Part 4 - Iowa Medicaid Enterprise

RFP MED-12-001 | Technical ProposalIowa Medicaid Enterprise System Service Procurement | MMIS and Core MMIS OperationsThe completion of the risk analysis generates a risk assessment report which becomes a part of the BCP.The impact and risk analysis is conducted at least annually, but is also triggered when there are significantchanges to the system, regulatory changes, and other events that affect the BPC plan. Along with eachrisk that is identified, appropriate safeguards associated with each risk are ascertained.After the impact and risk analysis are performed, Team Noridian begins the planning process for the BCP.The planning methodology is based on industry-accepted guidance in the form of the Computer SecurityAct, OMB guidance, NIST publications, Federal Continuity Directives, FEMA guidance, and HomelandSecurity Presidential Directives. Our real-world experience to be able to execute the methodology comesfrom decades in the health care industry working in complex claims processing environments wheresafeguarding sensitive information and assuring access to services is critical. The BCP planning process iscyclical, and is comprised of the following phases:• Develop plan• Test process and procedures• Train on the process and procedures• Execute plan• Evaluate planThe planning process addresses preventive measures for risks and threats to mitigate potential serviceinterruptions. It is not enough to have plans of preventative measures, however. As part of the BCP, acontingency plan is created for each critical business unit. Examples of content in business unitcontingency plans include:• Management calling tree that is updated quarterly and provided to the Department for approval• Inventory of the critical business unit processes for continued production at the minimal acceptableoutput levels• Key personnel required for running essential functions, and organizational and reporting relationshipsto be implemented during continuation of operations of essential functions• Resource requirements including facilities, personnel, contact information, and vital records• Physical building locations for primary functions and backup locations for the business unit• Key vendors that are part of essential functions• Manual procedures for system down time• Backup and redundancy requirements for the business unit (includes major computer equipment andsoftware, operating systems used, system software, and backup file locations)Also within the contingency plan are the triggers for activation of the contingency plan. This allows for asystematic and documented approach to what events will warrant the activation of the contingency plan.When a contingency plan is activated, a calling tree is used to notify and activate the business resumptionteam to begin work to restore operations to an acceptable level. The business resumption team is made upof key resources such as management and senior staff that have extensive business knowledge. The teamis also large enough to handle the unavailability of some members who may be directly impacted by thetriggering event. It is the responsibility of the business resumption team to begin the execution of thecontingency plan.In the event of an emergency due to disaster, component failure, or security or privacy breach, systems inthe primary data center may be rendered unavailable for normal processing. In one of these events, it maybe necessary to exercise BCP or backup system procedures for some time. Each of our disaster recoveryand backup environments follow the same strict security and privacy processes and controls as theprimary systems. Access to these systems uses the same technology and provides the same protections asduring normal operations. Therefore, we are able to maintain access to necessary electronic protectedhealth information (ePHI) in the event of an emergency, and are further able to enforce the same level of8 | 97