Top eight risks in healthcare industry in SA, says ContinuitySA
Healthcare companies and facilities in South Africa carry many risks similar to those faced by their global peers, as well as those faced by local organisations in other sectors. Combined, these risks create a distinctive risk profile for companies in this sector, says Lynette Smit, a Business Continuity advisor at ContinuitySA.
"Healthcare companies need to pay special attention to business continuity as their businesses deal directly with human life," Smit explains. "However, ContinuitySA's experience in both the public and private healthcare sectors shows that certain risks are particularly acute in South Africa - and that many of them are overlooked. This may be because many of them are not directly related to the company's core business, but could have a huge potential impact on it."
ContinuitySA believes the following eight risks particularly affect the South African healthcare sector, and should be factored into organisations' business continuity planning schedules.
Outdated buildings and infrastructure. This risk is particularly high in the public sector as many buildings are leased, and landlords do not undertake proper maintenance. In addition, many public health facilities are in old buildings in which wiring can be faulty, or in which sprinkler systems are not installed due to heritage regulations. Working in such conditions can negatively affect staff morale and pose a threat to the safety of both staff and patients.
Over-reliance on third-party suppliers. For budget reasons, a lot of specialised equipment is leased and is often outdated. This in turn places the organisation at the mercy of suppliers and service organisations: because maintenance engineers, or replacement equipment in the event of a breakdown, are scarce, important medical tests or procedures can be delayed. Another supply chain vulnerability is the industry's heavy reliance on drivers and couriers for the transport of specimens to medical facilities - union activity can thus impact heavily.
In addition, the public health sector is bedevilled by slow procurement processes.
Power interruption. Power outages are set to increase in frequency and severity for the foreseeable future, a definite risk for organisations dealing with life-and-death issues. Too many healthcare organisations have generators with limited diesel supply, and with uncertain maintenance and testing schedules. "A crisis or power outage is the wrong time to find out your alternative power source is inoperative or can only sustain you for a short period of time," Smit notes.
Poor IT infrastructure and disaster recovery. All businesses are dependent on IT, but none more than medical laboratories or research facilities. Another problem is that business-critical and client-sensitive data is frequently stored on unsecured laptops.
Despite their high reliance on IT, healthcare companies often do not have adequate IT disaster recovery plans in place, and testing is not performed regularly to ensure both data and systems can be restored within specified time limits.
Another critical IT dependency for healthcare is bandwidth, particularly when it comes to remote facilities.
Inadequate security of critical paper documentation. The flip-side of the healthcare sector's IT risks is the fact that its continued high dependence on paper documentation, such as highly confidential patient records, also creates vulnerability. Storage of documentation in digital formats is considered to be leading practice. ContinuitySA recommends the implementation of an electronic document management system to ensure compliance with the Protection of Personal Information Act, or the building of a fit-for-purpose document storage facility with adequate redundancy.
Skills shortages. Specialist human resources are a feature of the healthcare industry, but they are in short supply. An organisation can find itself reliant on certain individuals who cannot easily be replaced. Exacerbating factors include high attrition rates in the sector owing to low morale, and lengthy recruitment processes.
Crime. While all South African businesses face high risk from criminal activity, healthcare companies have a higher risk because goods/samples/specimens are often stolen from research and/or storage facilities because they form critical evidence in impending court cases.
The loss of years of research findings, or the theft of patient information during a robbery, also constitutes a risk as the findings are often irreplaceable and patient information can be highly sensitive in nature.
Inadequate buffer stocks. Industry standards stipulate that healthcare facilities must carry at least 30 days' worth of buffer stocks. Complicating factors for healthcare providers to adhere to these regulations include the limited shelf life of some products, and a lack of funds to build and manage stockpiles.