Continuity of Operations: What Must Continue—and What Must Change
How healthcare leaders decide which services to sustain, expand, reduce, or suspend during a disruption
The Healthcare Executive Brief
What healthcare leaders need to know about security, safety, and organizational readiness
A hospital can have an approved emergency operations plan, complete its required exercises, maintain an incident command structure, and still be unprepared to sustain patient care during a prolonged disruption.
The problem is not always an inadequate response plan. It may be that leaders have never decided how the organization will operate when normal staffing, technology, utilities, facilities, supplies, communications, or vendor support are no longer available.
Continuity of operations is often addressed as an emergency management planning requirement. A list of essential functions is developed, department plans are collected, and downtime procedures are placed in binders or electronic files. But listing what is important is not the same as deciding what the organization will actually sustain when resources become limited.
During a serious disruption, everything may not be able to continue at its normal level. Some services must be protected. Some may need to expand. Others may need to be reduced, relocated, delivered differently, or temporarily suspended. People, supplies, space, technology, and leadership attention may need to move from one part of the organization to another.
Those decisions affect patient safety, workforce sustainability, clinical capacity, finances, community access, and the organization's eventual recovery.
Continuity is not the promise that everything will continue. It is the disciplined process of deciding what must continue, what must expand, what can be reduced, and how long those decisions can be sustained.
The central question for healthcare executives is:
How long can we continue delivering safe and essential care when the people, technology, utilities, facilities, supplies, communications, or vendors we depend on are unavailable or significantly degraded?
Compliance provides a foundation—but not the decisions
Healthcare emergency preparedness requirements create an important framework. The Centers for Medicare & Medicaid Services and accrediting organizations (AO) require participating providers and suppliers to plan for emergencies and coordinate with federal, state, tribal, regional, and local preparedness systems. AO Standards on emergency readiness addresses hazard vulnerability analysis, emergency operations planning, continuity, training, exercises, and program evaluation. CMS Emergency Preparedness Rule The Joint Commission—Emergency Readiness
Those expectations are necessary. But compliance should not be mistaken for operational resilience.
A plan can be complete without being realistic. An exercise can satisfy a requirement without placing meaningful pressure on the organization. A corrective action can be marked complete without demonstrating that the underlying vulnerability was reduced.
More importantly, regulations and standards cannot decide an organization's
operational priorities. They cannot determine which service line receives limited staffing, which department receives scarce supplies, when elective procedures should stop, or when an organization should expand one service by reducing another.
Those are leadership decisions.
If everything is essential, nothing has been prioritized
Most departments can make a legitimate case that their work is essential. Clinical services depend on pharmacy, laboratory, imaging, sterile processing, environmental services, food and nutrition, facilities, biomedical engineering, information technology, patient transport, security, supply chain, finance, and communications.
A function does not have to touch the patient directly to be essential to patient care.
But labeling every function essential does not resolve the problem. Multiple departments may depend on the same limited employees, generators, network capacity, supplies, transportation resources, physical space, and vendors. During normal operations, those competing needs may be manageable. During a prolonged disruption, they may not be.
Every department cannot automatically receive first-priority.
Continuity planning requires leaders to determine:
Which services must remain at or near normal capacity
Which services are likely to experience increased demand
Which can operate temporarily at a reduced level
Which can be relocated or delivered differently
Which can be delayed or suspended
What clinical, operational, financial, and community consequences each decision creates
The goal is not to declare some services unimportant. It is to determine how the organization will preserve its mission when normal operations are no longer possible.
And these should be listed as one of the first set of questions asked during a disruption.
Some services must expand while others contract
Disasters change demand.
A mass-casualty incident may require expanded emergency, surgical, imaging, laboratory, blood-bank, security, and family-assistance capabilities. A severe infectious disease event may place additional demands on critical care, respiratory care, infection prevention, environmental services, employee health, supply chain, and communications. A prolonged utility failure may require increased facilities, engineering, logistics, security, transportation, and vendor support even as clinical capacity is reduced.
Expansion requires resources. Those resources must come from somewhere.
The organization may need to postpone elective procedures, reduce nonurgent appointments, consolidate units, curtail routine administrative work, reassign employees, or temporarily suspend services that consume people, space, supplies, or technology needed elsewhere.
Scaling back a service does not mean it lacks value. It means leaders have determined that another need temporarily carries greater urgency.
That decision should be based on clinical need, projected demand, available resources, expected duration, regional healthcare capacity, community consequences, and the effects of delaying care—not which department makes the strongest argument in the command center.
The plan should identify possible operating strategies before the emergency, but it should not lock leaders into one predetermined answer. Conditions change. Continuity planning should create a disciplined way to make and revisit decisions as information improves.
Duration changes the answer
A workaround that can be sustained for four hours may become unsafe after four days.
Emergency plans often describe what the organization will do immediately after a disruption. Continuity planning must also consider what happens when the disruption continues.
Leaders should understand:
How quickly critical supplies are consumed
How long emergency fuel, water, oxygen, food, medication, and other resources will last
Whether vendors can replenish them during a regional or national event
How long employees can safely work before relief is required
How long manual processes can remain reliable
How deferred maintenance and delayed care accumulate
How long reduced services can continue before patients or the community experience unacceptable harm
The availability of a backup system is not the same as sustainability. A generator may start, but continued operation depends on fuel, maintenance, roads, drivers, vendors, and regional supply. A manual documentation process may work initially but become increasingly difficult as patient volume, fatigue, and unreconciled information accumulate.
Every continuity strategy should therefore include a time dimension:
At what level can this service operate safely, and for how long can that level be sustained?
The workforce is a finite continuity resource
Continuity plans often give significant attention to facilities, technology, supplies, and equipment. None of them operate without people.
A hospital may have electricity, water, supplies, available beds, and functioning technology but still lack the qualified workforce needed to operate safely.
Employee availability may be affected by damaged roads, fuel shortages, evacuation orders, school and childcare closures, family responsibilities, illness, community disruption, and concerns about personal safety. Employees who report may face extended shifts, limited relief, inadequate rest, and uncertainty about conditions at home.
Expanding one service may also require employees to be reassigned from another. That creates questions about competency, supervision, credentialing, workload, labor agreements, and the operational effects on the department losing those employees.
Leaders must consider minimum staffing, relief schedules, cross-training, alternate assignments, temporary personnel, physician availability, succession planning, transportation, lodging, food, dependent-care barriers, and behavioral health support.
Telling employees they are essential does not remove the personal and logistical barriers that may prevent them from reporting or remaining at work. The workforce must be planned for as deliberately as emergency power, medical supplies, and technology.
Hidden dependencies create hidden limits
Healthcare delivery is built on interconnected systems. The failure that disrupts patient care may not begin in the clinical department. It may begin with a utility, vendor, network connection, transportation route, support function, or staffing shortage that was not recognized as mission-critical.
A network outage may affect registration, documentation, medication administration, laboratory results, imaging, transfers, and discharge. A water interruption may affect clinical care, sanitation, food service, dialysis, HVAC, sterile processing, and fire protection. A supply-chain disruption may affect medication, oxygen, food, linens, blood products, personal protective equipment, and basic patient-care supplies.
The first failure is often only the beginning. The more important question may be: What fails next?
FEMA's National Response Framework emphasizes continuity planning and preparedness for cascading failures across businesses, supply chains, and infrastructure sectors. HHS's ASPR TRACIE also maintains healthcare-specific continuity and recovery resources to help organizations identify essential functions and dependencies. FEMA National Response Framework ASPR TRACIE Continuity Planning
Understanding those dependencies allows leaders to set more realistic operating levels. It can also reveal that the same limited resource is assumed by several supposedly independent continuity plans.
“We will use downtime procedures” is not enough
Many plans rely on manual procedures when technology becomes unavailable. That may be appropriate, but the existence of a downtime binder does not prove that the organization can sustain care without its normal systems.
Can employees locate and use the procedures? Are sufficient forms and supplies available? How will orders, medication administration, results, and patient movement be tracked? How will departments communicate? How will information created during downtime be reconciled? How long can the process remain safe as workload and fatigue increase?
A process tested for 30 minutes on one unit may fail when used for 24 hours across an entire hospital.
“We will use downtime procedures” is not a continuity strategy unless those procedures have been tested under realistic staffing, workload, communication, and duration assumptions.
Decisions require triggers and authority
Continuity decisions should not depend on locating the right executive and beginning the discussion after the disruption has already occurred.
The organization should identify the conditions that may trigger changes in operations.
Those triggers might include staffing levels, remaining supply quantities, patient volume, infrastructure capability, estimated outage duration, vendor performance, regional demand, or the availability of receiving facilities.
Leaders should also know who has authority to:
Reduce or suspend services
Cancel procedures or appointments
Consolidate units or relocate operations
Reassign employees and resources
Activate alternate vendors or sites
Divert, transfer, or evacuate patients
Commit emergency funds
Restore normal operations
Emergency management can facilitate planning, provide situational awareness, organize incident command, and help leaders understand risks and options. It cannot independently decide which clinical services receive priority or what level of disruption the organization will accept.
Shared responsibility should not mean unclear accountability.
Scaling back creates a recovery obligation
Reducing a service does not eliminate the work. It often delays it.
Canceled procedures must be rescheduled. Deferred appointments create backlogs. Discharged or transferred patients may require follow-up. Inventories must be restored. Employees need rest. Manual records must be reconciled. Damaged systems and infrastructure require repair. Financial and regulatory processes may need attention.
Some patients can safely wait. Others may deteriorate while services are limited.
Reductions may also affect communities with few alternatives or individuals who already face barriers to care.
Recovery planning should therefore begin when services are reduced—not after the emergency ends.
Leaders should understand how long a service can remain restricted, what conditions allow it to resume, what backlog will be created, what resources recovery will require, and whether normal operations should return all at once or in stages.
Operational continuity sustains the mission during disruption. Organizational resilience determines how effectively the organization adapts, recovers, and improves afterward.
What healthcare leaders should do next:
Categorize essential services by operating strategy. Determine which functions must be sustained, which may need to expand, which can be reduced, and which may be relocated, delivered differently, or temporarily suspended.
Add time to every assumption. Define how long each operating level can be supported before staffing, supplies, infrastructure, quality, or safety becomes unacceptable.
Map shared dependencies. Identify the people, technology, utilities, facilities, information, supplies, and vendors required by each service. Look for multiple departments relying on the same limited resource.
Establish decision triggers and authority. Decide what conditions will change operating levels, who can authorize those changes, and how decisions will be communicated to employees, physicians, patients, partners, and the community.
Exercise competing priorities. Test prolonged and cascading disruptions that force leaders to allocate limited resources, expand some services, reduce others, and adjust decisions as conditions change.
Plan for the consequences of reduced operations. Estimate delayed care, patient backlogs, depleted inventories, workforce recovery needs, financial effects, and the resources required to restore services.
Questions healthcare executives should ask:
Which services must remain at normal capacity, and which are likely to require expansion?
Which services can be safely reduced, relocated, delivered differently, or suspended?
What limited resources are shared among those services?
How long can each operating strategy be sustained safely?
What conditions will trigger a change in operating level, and who has authority to make that decision?
How will reduced services be restored and the resulting backlog managed?
This is an executive issue
Continuity of operations is frequently overlooked because it forces the organization to confront choices that are difficult, operationally complex, and sometimes unpopular.
An emergency operations plan can describe how the organization will respond. It cannot replace decisions about which services receive priority, where limited resources will go, what level of care can be sustained, or when normal operations must change.
Those are executive decisions.
A resilient healthcare organization is not one that promises everything will continue regardless of conditions. It is one that understands what must continue, recognizes what may need to expand, knows what can be reduced, and can sustain those choices long enough to protect patients, support the workforce, and preserve its mission.
Continuity is not about preserving business as usual. It is about preserving the organization's ability to deliver safe and essential care when business as usual is no longer possible.
Comments