By Karen Blum

What do a landline phone, a fax machine and thermometers have in common? They’re all tools you may need to dust off and use if your pharmacy or hospital faces a cyberattack and must operate under downtime procedures for an extended period.

Typical downtime procedures are designed for short durations, but a cyberattack can take down anything on a server for weeks, said Doug DeJong, MBA, RPh, FASHP, the director of pharmacy advisory services for Premier, during a presentation at the ASHP 2023 Midyear Clinical Meeting & Exhibition, in Anaheim, Calif. Alongside increases in healthcare breaches, the average downtime period has lengthened from 18 days in 2020 to 22 days in 2021, he said, citing statistics from the Department of Health and Human Services. One recent example of how hackers can cause prolonged downtime is the February cyberattack on UnitedHealth Group’s technology arm, Change Healthcare, which left pharmacies across the United States unable to fill some prescriptions. Although pharmacy systems resumed processing claims by late March, the attack caused lingering difficulties.

When planning for extended downtime, Mr. DeJong said, pharmacies should focus on two primary areas: participating in organization-wide efforts to ensure essential patient care services, and leading the review for pharmacy-specific systems and ensuring front-line staff are prepared.

Start by taking an inventory of all relevant policies and procedures, recommended Jennifer Halsey, PharmD, MHA, BCPS, the director of ambulatory pharmacy and an assistant professor of pharmacy practice at the University of Illinois-Chicago. Make sure your downtime operations policies and procedures are up-to-date, and note which staff have the most experience working during planned downtime.

The next step, Dr. Halsey said, is to assemble your pharmacy team, including leaders and front-line workers, to update downtime procedures. Pay attention to organizational policies regarding issues such as the use of personal cellphones to access patient information. “Each organization has to perform a risk assessment to determine how they would handle the access and transmission of patient information during downtime,” she said. “Basic HIPAA rules would still apply.”

Create a list of tasks and services that must be accomplished even during downtime versus those you will be unable to do. Also consider workflows that intersect with other departments such as nursing or physicians. Plan out scenarios: How will a pharmacist order lab tests for vancomycin monitoring? How will you know whether automated dispensing cabinets (ADCs) need filling?

Downtime planning can be broken down into several categories, Dr. Halsey said, including:

img-button

Communication. How will you communicate within your department or between departments, and with external stakeholders such as retail pharmacies? Not every department has a landline phone, and if you use one, people trying to reach you may get a busy signal. Personal cellphones can facilitate communication if your institution will allow it, but getting a signal could be challenging if the pharmacy is in the basement. Determine how you will be notified when patients are admitted or discharged from the hospital, how to communicate with care teams, and where to keep paper charts centrally to write orders.

img-button

Regulatory considerations. Know whether your state regulatory body must be notified or makes any special dispensations during downtime. Develop processes for temperature monitoring and reporting; Dr. Halsey’s department bought mercury thermometers to use as backup if digital devices became inoperable. Also consider how to handle mandatory reporting for prescription drug monitoring programs and vaccine administrations.

img-button

Technology. Meet with your internal informatics team and other stakeholders to determine your downtime capabilities. What’s in your electronic health record downtime reports? How will you record transactions from ADCs that have limited memory capacity, even in override mode?

img-button

Resources. Ensure that paper copies of policies and procedures are available. Determine how you will access drug information and compounding references. What downtime forms will you need for patient profiles, or to record progress notes and document compounding? What about billing? Consider having a downtime computer in your department or creating QR codes to access documents using cellphones.

img-button

Workflows. Map out your processes for receiving new medication orders. This task may involve twice as many steps during downtime, Dr. Halsey said. Conduct simulations to make sure the pharmacy is prepared.

Consider breaking down the prep work into monthly “bite-sized” exercises that roll out sequentially, Mr. DeJong advised. One month, create manual profiles for existing patients. The next months, establish processes for daily restocking, IV preparation, etc. Once your downtime procedures have been outlined, review them periodically for updates. With adequate preparation, he said, “you will reduce the chance that everybody has a deer-in-the-headlights look if it ever has to be done in real time.”


The sources reported no relevant financial disclosures.

This article is from the April 2024 print issue.