By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Business Continuity Plan (BCP)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A business continuity plan (BCP) is an organization’s written playbook for keeping its most important work going when something major goes wrong, such as a cyberattack, power failure, flood, or vendor outage, and for getting back to normal afterward.
The HIMSS Dictionary describes a BCP as documented, prearranged instructions and procedures explaining how an organization will maintain its mission and essential business functions both during a serious disruption and after it.
In a hospital, the “business” is patient care. A BCP answers practical questions: How will clinicians see medication lists if the EHR is down? How will lab results reach the units? Who decides when to divert ambulances? How will patients be registered, and how will paper records be entered later?
Continuity planning involves several related plans:
| Plan | Focus | Healthcare Example |
|---|---|---|
| Business Continuity Plan | Sustaining essential functions during and after a disruption | Downtime procedures for medication administration, orders, and results |
| Disaster Recovery Plan | Restoring IT systems and data | Failing the EHR over to a secondary data center |
| Incident Response Plan | Detecting, containing, and investigating a security incident | Isolating infected systems during a ransomware attack |
| Emergency Operations Plan | Coordinating the organization’s response to emergencies | Activating hospital incident command during a regional disaster |
| Crisis Communications Plan | Keeping staff, patients, and the public informed | Overhead pages, texts, and press statements during an outage |
⚠️ Exam Alert: The BCP keeps the organization operating. The disaster recovery plan brings technology back. The incident response plan handles the security event itself. The recovery time objective (RTO) is how quickly a system must be restored; the recovery point objective (RPO) is how much data loss, measured in time, is acceptable. A business impact analysis is the step that determines which functions and systems are most critical.
🌐 Why It Matters: Real-World Healthcare IT Context
Hospitals are deeply dependent on technology, and disruptions are no longer rare. A 2022 study in JAMA Health Forum by Hannah Neprash and colleagues counted 374 ransomware attacks on U.S. health care delivery organizations from 2016 through 2021, and found that almost half disrupted care delivery, most often through electronic system downtime. In 2024, the cyberattack on Change Healthcare showed that a disruption at a single vendor can interrupt claims, pharmacy, and other operations for organizations across the country.
Regulations require planning. The HIPAA Security Rule’s contingency plan standard requires covered entities and business associates to have policies and procedures for responding to emergencies that damage systems containing electronic protected health information. It includes a data backup plan, a disaster recovery plan, and an emergency mode operation plan, along with testing and an analysis of which applications and data are most critical. CMS’s emergency preparedness requirements for participating providers add expectations for all-hazards planning, policies, communication, and regular training and exercises.
NIST’s Contingency Planning Guide for Federal Information Systems, SP 800-34, is a widely used framework. It describes a business impact analysis that identifies critical processes, the maximum tolerable downtime for each, and the recovery objectives that guide technical design.
Common continuity gaps:
- Downtime procedures written years ago and never tested
- Paper forms that no one can find during an outage
- Read-only downtime computers that are not updated or not located on every unit
- No plan for recovering data entered on paper after systems return
- Dependence on a single vendor or data center with no alternative
- Plans that assume a few hours of downtime when ransomware recovery can take weeks
Characteristics of strong continuity programs:
- A business impact analysis tied to clinical priorities
- Unit-level downtime kits with forms, instructions, and contact lists
- Regularly updated downtime reports for medications, allergies, and active orders
- Scheduled downtime drills that include clinical staff
- Clear recovery procedures, including back-entry of paper documentation
- Third-party risk planning for critical vendors
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses keep patients safe during downtime, which makes them essential to continuity planning and testing.
At the Bedside
When the EHR goes down, nurses switch to paper medication administration records, paper flowsheets, and printed downtime reports. The most important questions are immediate: What medications are due? What allergies does this patient have? What are the active orders? Downtime reports printed from read-only computers answer those questions only if they were refreshed recently and nurses know where to find them.
Barcode scanning, smart pump integration, and electronic alerts may all be unavailable. Nurses compensate with independent double checks, careful patient identification, and closer communication with pharmacy.
In Clinical Workflow
Downtime changes how teams communicate. Orders may be written on paper, lab results may be phoned or delivered by runners, and imaging may be read on standalone workstations. Clear roles, such as a unit downtime coordinator, help keep information organized.
Recovery is its own workflow. After systems return, paper documentation must be entered or scanned, and the order of entry matters. Medications given during downtime need to be documented accurately to prevent duplicate doses, and results received on paper need to be reconciled with the electronic record.
In EHR Implementation (Go-Live Perspective)
Go-Live includes its own planned downtime. Cutover from the legacy system to the new one often involves a period when neither system is fully available, so units rely on downtime procedures, preloaded information, and extra support. During an Epic Go-Live, teams also configure downtime reports and read-only access in the new system and train staff to use them.
At-the-elbow support analysts help in both directions: guiding nurses through cutover procedures and, after Go-Live, making sure units know where downtime computers and forms are located for the new system. The first unplanned downtime after Go-Live is a real test of whether that preparation worked.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Business continuity is a core infrastructure and leadership topic:
| CAHIMS Domain | How BCPs Appear |
|---|---|
| Healthcare & Technology Environments | HIPAA contingency planning; CMS emergency preparedness; ransomware threat landscape |
| Clinical Informatics | Downtime procedures; paper workflows; back-entry and reconciliation after recovery |
| Healthcare Information & Systems Management | Backups, redundancy, failover, RTO and RPO, read-only downtime systems |
| Management & Leadership | Business impact analysis, drills and exercises, vendor risk, incident command |
Key Terms to Know Alongside BCP
- Disaster Recovery Plan (DRP) — procedures for restoring IT systems and data after a disruption
- Business Impact Analysis (BIA) — an assessment that identifies critical functions and the impact of losing them
- Recovery Time Objective (RTO) — the maximum acceptable time to restore a system or function
- Recovery Point Objective (RPO) — the maximum acceptable amount of data loss, measured in time
- Emergency Mode Operation — HIPAA’s required plan for protecting electronic PHI while operating in an emergency
- Downtime Procedures — the documented processes clinicians follow when clinical systems are unavailable
HIMSS Organizational Position
HIMSS treats continuity and resilience as part of cybersecurity and patient safety. Its Healthcare Cybersecurity Community shares practices for downtime planning and recovery, and HIMSS engages on resilience policy through its public policy work. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final
- eCFR — 45 CFR 164.308, HIPAA Administrative Safeguards (Contingency Plan) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- CMS — Emergency Preparedness Rule https://www.cms.gov/medicare/health-safety-standards/quality-safety-oversight-emergency-preparedness
- ASPR TRACIE — Healthcare Emergency Preparedness Information Gateway https://asprtracie.hhs.gov/
- ONC — SAFER Guides https://healthit.gov/clinical-quality-and-safety/safer-guides/
- Neprash et al. (2022), JAMA Health Forum — Trends in Ransomware Attacks on US Health Care Delivery Organizations https://pubmed.ncbi.nlm.nih.gov/36580326/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply