Indian Health Service

• Division of Information Security, National Programs, Albuquerque, NM
• 39 pages
• Sensitive
• For Official Use Only
• June 2009

2.1

Purpose

The National Patient Information Reporting System (NPIRS) Emergency Management Plan (EMP) establishes procedures to recover NPIRS after a disruption. The following objectives have been established for this plan:

• Maximize the effectiveness of contingency operations through an established plan that consists of the following phases:
− Notification/Activation phase to detect and assess damage and to activate the plan
− Recovery phase to restore temporary NPIRS operations and recover damage done to the original system
− Reconstitution phase to restore NPIRS system processing capabilities to normal operations
• Identify the activities, resources, and procedures needed to carry out NPIRS processing requirements during prolonged interruptions to normal operations.
• Assign responsibilities to designated OIT/NPIRS personnel and provide guidance for recovering NPIRS during prolonged periods of interruption to normal operations.
• Ensure coordination with other OIT/NPIRS staff who will participate in the contingency planning strategies; ensure coordination with external points of contact and vendors who will participate in the contingency planning strategies.

2.2

Applicability

The NPIRS EMP applies to the functions, operations, and resources necessary to restore and resume NPIRS operations as it is installed at:

5300 Homestead Rd., Albuquerque, New Mexico.

The NPIRS EMP applies to OIT/NPIRS and all other persons associated with the NPIRS, as identified under Section 3.3, “Responsibilities.”

2.3

Scope

This EMP identifies what the OIT Albuquerque must do to continue its essential functions in times of crisis. Emergency planning requires the consideration of a wide range of possible situations that could disrupt normal operations or require response to an unusual situation. These possibilities include, but are not limited to:

• A national emergency such as a war involving the United States Armed Forces, an attack on the U.S., or any threat to the continuity of the Federal Government.
• Natural and technological disasters such as radiological incidents or emergencies, hazardous materials (HAZMAT) incidents, and environmental disasters.
• Events declared by the President of the Unites States to be major disasters, or emergencies under Public Law (P.L.) 93-288, the “Robert T. Stafford Disaster Relief and Emergency Assistance Act,” as amended.
• Civil disorders, terrorism, or other violent acts.
• Any situation that substantially disrupts normal operations of the OIT Albuquerque Office.

…

2.5

Emergency Operations Centers (EOC)

An EOC is the location designated by this Plan where operations will continue in the event of an emergency. The alternate site will be used to continue Public Data recovery and processing throughout the period of disruption, until the return to normal operations.

OIT will use the alternate site’s IT resources to recover the Public Data during an emergency situation that prevents access to the original facility.
The designated systems at the alternate site can be configured to restore the Public Data and make it available to IHS staff by Virtual Private Network (VPN).

2.6

Assumptions

Based on these principles, the following assumptions were used when developing the NPIRS EMP:
• NPIRS is inoperable at the OIT/NPIRS computer center and cannot be recovered within 72 hours.
• Key NPIRS personnel have been identified and trained in their emergency response and recovery roles; they are available to activate the Emergency Management Plan for NPIRS.
• Computer center equipment, including components supporting the NPIRS, are connected to an uninterruptible power supply (UPS) that provides 45-60 minutes of electricity during a power failure.
• Current backups of NPIRS application software and data are intact and available at the offsite storage facility.
• Equipment, connections, and capabilities required to operate NPIRS are available for delivery at the OIT/NPIRS original site in Albuquerque, New Mexico.
• Equipment, connections, and capabilities required to operate NPIRS are available at the alternate site in Albuquerque, New Mexico.
• Service agreements are maintained with NPIRS hardware, software, and communications providers to support the emergency system recovery.
• If applicable, related contingency plans are in process to include the Integration Engine and adequate communication links for receiving export data, as well as general communications.

The NPIRS EMP does not apply to the following situations:
• Overall recovery and continuity of business operations. This plan is an Annex to the Office of Information Technology Business Resumption Plan (BRP) and Emergency Management Plan (EMP), which includes the Continuity of Operations Plan (COOP).
• Emergency evacuation of personnel. Refer to the Building Emergency Management Plan for the Occupant Evacuation Plan (OEP).

…

3.0

Concept of Operations

3.1

System Description and Architecture
The National Patient Information Reporting System (NPIRS) stores information related to Native American patient and health care facilities. This national data repository is commonly known as the National Data Warehouse (NDW).
The NDW is the central data repository for all Indian Health systems. It provides the data for various data marts that, in turn, support IHS statutory, regulatory, and administrative obligations, including user population counts, workload reporting, epidemiological non-standard reporting, accreditation, and Government Performance and Results Act (GPRA) performance measurements to meet the mission and business requirements of the Indian Health Service.
The NDW functional areas fall into four major categories:
(1) Operation Systems (AIX)
(2) Database Software (DB2)
(3) Data Movement (FTP connections and export process programming)
(4) Web Site Reporting

3.2

Line of Succession

The Office of Information Technology (OIT) sets forth an order of succession in coordination with the order set forth by the Department, to ensure that decision-making authority for the OIT Emergency Management Plan is uninterrupted.
1. The Chief Information Officer (CIO) is responsible for ensuring the safety of personnel and the execution of procedures documented within this Emergency Management Plan.
2. If the CIO is unable to function as the overall authority or chooses to delegate this responsibility to a successor, the Deputy Chief Information Officer (DCIO) shall function as that authority.
The line of succession continues, as follows:
3. Division of Program Management and Budget (DPMB) Director
4. Division of Information Technology Operations (DITO) Director

…

Share this: