Part 4 - Iowa Medicaid Enterprise

RFP MED-12-001 | Technical ProposalIowa Medicaid Enterprise System Service Procurement | MMIS and Core MMIS OperationsWhile floodwaters did affect the community, the water levels posed no significant threat to the Noridianfacilities. However, the BCP was activated due to the fact that the city of Fargo was placed in a lockdownmode during the flood, directly impacting employee availability. As part of that plan, our BusinessImpact Analysis (BIA) and Business Unit Plans were used to move staff to alternate locations to continueperforming work. Because of good planning and appropriate execution of our BCP, our customersexperienced no service interruptions. In April and May of 2009, during the H1N1 potential pandemic,Noridian executed its existing Pandemic Plan, which is part of the overall BCP. The Pandemic Plan wasactivated as the World Health Organization (WHO) raised the overall Pandemic Level around the world.Our response was measured, and addressed the overall health and safety of our employees.Team Noridian's corporate experience proves that our approach and methodology for business continuityplanning are sound and that we have the knowledge and experience to provide the Department with areliable plan for disaster recovery and business continuity.Team Noridian has an established business continuity planning methodology that addresses the people,processes, and technology considerations of business continuity and recovery. Team Noridian combinesbusiness impact analysis, business process management, and systems engineering in developing itsbusiness continuity plans. A key component of the BCP is the business impact analysis (BIA). The BIAsurvey is conducted annually to identify and prioritize critical business functions and applications,realizing that certain business processes are more critical to the operation than others. Business impactanalysis includes both impact analysis and risk analysis. This analysis is performed for each of the corebusiness processes in the operation.Impact analysis is used to identify the criticality of operations and key resources required to maintain theminimum acceptable levels of output for each core business process. Resources include people, facilities,and technical components of the Team Noridian solution. The goal of impact analysis is to identify apriority order of business processes so that in the case of a crisis, attention and resources are beingfocused on the most critical processes first and foremost. Team Noridian will use our experience and willconsult with the Department when evaluating and prioritizing business functions to ensure the IME'spriorities and interests are integrated into the planning process.During risk analysis, Team Noridian evaluates multiple risk categories, including natural hazards,technical hazards, and human-caused hazards. Figure 8-59 lists some possible risks to business continuity.During the risk analysis, Team Noridian evaluates each individual business process and it's dependencyon technology and systems to identify potential system failures, while determining if there is a possiblemanual workaround in the event of a system failure.Natural Hazards Technological Hazards Human-Caused Hazards• Flood• Fire• Earthquake• Hurricane• Tornado• Severe weather• Public health emergencies,e.g., Pandemic Flu• Material spill• Airplane crash• Power outage• IT failure• Supply-chain failure• Communication outage• Loss of data integrity• Physical loss of data in a disaster• Errors introduced into the system• Corruption of data or systems• Terrorism• Labor strike• Sabotage• Regulatory action• Civil disobedience• Unauthorized disclosures• Theft• Fraud• Interception of data during transmission• Compromised system security as a result of system access by anunauthorized person• Unauthorized access of protected data and information by someone otherthan the owner of the protected data and information• Unauthorized access of protected data and information by employees• Unauthorized requests for protected data and information• Unauthorized access through hardcopy files or reports• Unauthorized transfer of protected data and information through third partiesFigure 8-59. Risk Examples to Business Continuity. Team Noridian's Business Continuity Plan accountsfor many possible risks, including natural disasters.8 | 96