Connecticut Business & Industry Association Presentation Avian Influenza and Business Continuity Planning

Transcription

1 Connecticut Business & Industry Association Presentation Avian Influenza and Business Continuity Planning W. Richard Smith, Jr. August 2006

2 Preface This presentation is intended to facilitate a discussion of the issues presented and does not constitute legal advice. Any questions regarding specific legal issues or facility operations should be reviewed with a lawyer engaged by you for that purpose. 2

3 Discussion Topics Recognized Business Risks Pandemic Planning Assumptions Planning Impacts/Expectations/Obligations Legal Liability Standards Planning Strategies Continuity Planning Reviews 3

4 Why Plan? Recognized Business Risks Health Emergencies: (pandemic/epidemic disease) perceived risks and actual events, reactions of government and individuals Northeast Blackout 2003 (Technology Events) Hurricane Katrina (Natural Events) International Terrorism Events September 11, 2001, Madrid 2004, London Subway 2005 Domestic Terrorism Events Foreign/domestic groups that consider violence a tool 4

5 Pandemic Event Factors No one can tell you when a pandemic will occur or if the next pandemic event will be avian influenza What can be said is that pandemic events have occurred throughout history, and three pandemic events have occurred in the last 100 years What has changed, is our increased global connectedness and our ability to project potential effects based upon various pandemic disease assumptions 5

6 U.S. Pandemic Flu Model (Los Alamos National Laboratory, 2006)( 6

7 Potential Public Health Emergency Parameters Avian Influenza Assumptions Operative outbreak period 6 to 8 week waves Successive waves of infection Workforce impact up to 40% absenteeism at peak Peak effects two week period Staff absences and resource limitations for 3 to 6 months 7

8 Potential Impacts of Health Emergencies Employee illness temporary and permanent losses Loss of healthy employees caring for others Supply chain interruptions Interruption of customer operations (sales) Utility interruptions due to their employee losses Loss of access to your facility (loss of bldg. operations) Government emergency orders affecting person to person contact: closure of schools, businesses and social gatherings Transportation restrictions Human factors regarding uncertainty and fear 8

9 CT Health Emergency Authorities Business plans must consider impacts of emergency orders Isolation and quarantine orders for individuals or geographic areas (broad impact to operations) Authority to take land, buildings, vehicles, drugs, other supplies (critical infrastructure, locations, suppliers) You will comply: Criminal sanctions for violation of order or obstruction, resistance or hindering those enforcing orders Petition relief from Probate Court; appeal to Superior Court Also local health authority isolation/quarantine orders Communicating with agencies now means better plan design 9

10 Why Plan? : Meeting Planning Expectations Industry Standards/Government Requirements Dept. of Homeland Security Recommendations to Businesses and Citizens National Fire Protection Association 1600 voluntary national preparedness std. 9/11 Commission Recommendation Intelligence Reform and Terrorism Prevention Act 2004: Congressional recommendation 10

11 9/11 Commission Recommendation: We endorse the American National Standards Institute s recommended standard for private preparedness. We were encouraged by Secretary Tom Ridge s praise of the standard, and urge the Department of Homeland Security to promote its adoption. We also encourage the insurance and credit rating industries to look closely at a company s compliance with the ANSI standard in assessing its insurability and creditworthiness. We believe that compliance with the standard should define the standard of care owed by a company to its employees and the public for legal purposes. Private sector preparedness is not a luxury; it is a cost of doing business in the post 9/11 world. It is ignored at a tremendous potential cost in lives, money, and national security. (Emphasis added) 11

12 Congressional Endorsement of Planning Intelligence Reform and Terrorism Prevention Act of 2004, Section 7305(b): It is the sense of Congress that the Secretary of Homeland Security should promote, where appropriate, the adoption of voluntary national preparedness standards such as the private sector preparedness standard developed by the American National Standards Institute and based on National Fire Protection Association 1600 Standard on Disaster/Emergency Management and Business Continuity Programs. 12

13 Industry Standards NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs Plans shall comply w/applicable laws and industry codes of practice (NFPA 1600, Section 5.2.1) Industry Code Example: American Chemistry Council Responsible Care Standard Consider how standards may be defined: 9/11 Commission IRTP Act NFPA Legal Compliance Industry Code 13

14 Examples: Specific Government Planning Requirements Financial Institutions Planning Mandates U.S. Treasury Standards Bioterrorism Act 2002 (SDWA Sec Vulnerability Assessments) CAA 112(r) hazard ID, release prevention, minimize consequences EPCRA, OPA OSHA General Duty standard 14

15 Legal Liability Landscape Tort Liability Elements: Injury to persons or property Does business owe a duty of care to injured party? In Re September 11 Litigation: duty to protect against terrorist acts exists Did business fail to take reasonable steps to fulfill duty: (negligence standard of case) what is reasonableness standard today? Consider 9/11 Commission and Congressional recommendations for NFPA 1600 consider wealth of available government guidance Liability for injury to shareholders (economic injury) Loss of revenue inability to continue operations Loss of stock value/reputation if unaddressed foreseeable risk 15

16 Evolving Liability Theory : Negligent Failure to Plan Duty to employees, shareholders, vendors, customers Based on new foreseeability of events Pandemic influenza impacts Natural Disasters Terror attacks or other intentional injuries Requires adequate internal controls to manage risk Minimize direct and indirect damage to the business What constitutes good faith corporate decisionmaking today? 16

17 Existing Environmental Planning Obligations and BCP Implications Permit and Regulatory requirements are not suspended Noncompliance defense issue how well did you plan? Alternate facility permitting may be needed Training and operations Ensure backup personnel have proper training to comply with standards, handle waste, perform inspections, maintain records, etc. Other non compliance risks Injuries, property damage/contamination, lost business 17

18 Minimize Failure to Plan Exposures Liability Exposures Post event agency enforcement of existing regulatory requirements Third party action for damages Defensive Strategies Perform BCP review process Include review of existing regulatory/permit obligations Audit, monitor, test and document BCP efforts 18

19 Failure to Plan: Other Considerations Liability Defense Consideration In part, you will be defending against 20/20 hindsight arguments of what advance planning you should have done given available guidance from government and industry sources Confidentiality Note: Potential Sensitivity of preliminary evaluation information (consult your legal counsel) Regulatory review may disclose noncompliance exposures Consider notice requirements and amnesty programs Decisions to adopt or not adopt measures may be sensitive Documentation of process important operationally & legally 19

20 Making Your Case: Legal Perspectives Primary considerations: protect people and ensure continuity and recovery of business operations Looking through lawyer s glasses: Proactive measures reduce liability risks Mitigation reduces potential scope and degree of adverse impacts and liability Documentation evidence of reasonable and appropriate efforts Regular review/improvement: address changing standards and facilities, plan effectiveness, apply drill experiences 20

21 Planning Models and Strategies Carlos Barria / Reuters

22 Emergency Management Program Elements Confirm operational requirements of law and industry codes of practices Perform hazard identification, risk assessment and impact analysis Design mitigation strategy eliminate risks or mitigate unavoidable hazard effects Confirm resource management capabilities Prepare written plan of your strategy, response, mitigation, recovery and continuity objectives 22

23 Planning Elements: Potential Hazards and Impacts Consider natural, accidental and intentional hazards Analyze potential impacts to: Health and safety of personnel Continuity of operations Property, facilities and infrastructure Delivery of services Environmental quality Economic/financial condition Regulatory and contractual obligations Reputation and business confidence 23

24 Planning Elements: Impact Analysis Quantification of potential events Identify affected facilities, functions & services Detail protective measures Include impacts that are external (beyond front door) and secondary (communications, power, transportation) Identify critical operations & personnel, and recovery priorities for continuity of operations Use economic/financial loss projections to flag critical operations, functions and needed planning efforts for mitigation plan 24

25 Planning Elements: Hazard Mitigation A pre event strategy based on hazards, risk, impact analysis and cost benefit analysis Interim/Long term measures to reduce risk Mitigation strategy considerations: Facility design/land use approach to avoid hazards Hazard elimination/reduction efforts Relocation/defending physical hazards Hazard warning/communications measures Redundancy / duplication of assets 25

26 Planning Elements: Resources Identification and Evaluation Inventory internal/external resources to conduct business Identify and overcome resource shortfalls Include personnel, equipment, facilities, training, funding, expert knowledge, materials and time schedule of needs Multi use of existing locations Personnel relocation Interconnectivity of equipment locations Response / reaction time requirements 26

27 Planning Elements: Communications Plans Provide a plan and equipment appropriate to advise employees, public officials and others of emergency information Regular communication both internal and at home, other offices, etc. to circulate information regarding changing operational circumstances, personnel assistance, and implementation of response, continuity and recovery plans Communications should be timely, accurate, and honest 27

28 Case Study: Toronto SARS 2003 (Source: The Public/Private Response to Sudden Disease Outbreak, IPHL/CDC Fndn., 2005) Key Health Factors of Toronto SARS Emergency Toronto SARS epidemic lasted for approximately 14 weeks (March June 2003) SARS was introduced by a traveler from SE Asia, where the epidemic had been spreading for 3 months The Toronto epidemic was almost brought under control after 7 weeks (Phase I). Another, asymptomatic person was actually a super spreader who visited a Toronto hospital triggered a second, 7 week round of infections There was no SARS vaccine or rapid diagnostic test available (Note: AI /SARS incubation periods and contagiousness differ) 28

29 Case Study: Toronto SARS 2003 Toronto SARS was brought under control through a combination of old fashioned public health control measures: Public information about personal hygiene Use of masks, gloves, gowns, and similar infectious disease control measures Strict Isolation of diagnosed SARS patients Quarantine measures for as many as 30,000 persons exposed to SARS Closures of facilities where SARS transmission was occurring International travel advisories issued by WHO and CDC Final Health Assessment for Ontario: 375 suspect or probable cases of SARS identified 44 deaths attributed to SARS 29

30 Case Study: Toronto SARS 2003 Economic Impacts 12,000 jobs lost Nine city wide conventions cancelled in summer 2003 Cost to Toronto economy in 2003 alone: > $ 1Billion Many economic indicators were still recovering in

31 Create Agency Communications Link (Source: The Public/Private Response to Sudden Disease Outbreak, IPHL/CDC Fndn., 2005) 31

32 Agency Communications cont. (Source: The Public/Private Response to Sudden Disease Outbreak, IPHL/CDC Fndn., 2005) 32

33 Continuity Planning Review What Now? ID reduced staff operations options Focus on what is viable business model Assume loss of infrastructure at some point(s) Develop and practice communications plan Create and begin employee education now Use workplace good health practices now Work with vendors on a plan Assume work at home from initial outbreak 33

34 Continuity Planning Review Facilities Inventory of available space Assessment of current uses and needs Vulnerability analysis for all sites Site Security evaluations Alternative locations analysis & selection Secure shutdown procedures Operations relocation procedures 34

35 Facility Considerations cont. Use of alternate locations Consider permit limits with increased production Consider facility permit constraints (operation transfers may exceed permit limits, small quantity generator status, non regulated safe harbors) Consider permit modifications Facility personnel issues Document cross training measures for site backups and potential personnel relocation requirements 35

36 Continuity Planning Review Business Relations and Contract Issues Review All Contracts Force Majeure delete or minimize in contracts with critical vendors Modify your contract commitments for business interruption events Leases negotiate rent abatement and termination standards (mitigation issue) Loss of infrastructure/utilities (electric, gas, communications) Loss of access to premises by government order or management shutdown (loss of their staff or support needs) 36

37 Business Relations and Contract Issues cont. Insurance evaluate available coverage for direct and indirect damages from various business interruption events Public Communications the process and the message to customers, vendors, media, and government (in addition to your employee communication plan) 37

38 Business Relations and Contract Issues cont. Supply chain vendor issues Exclusivity: avoid limitations on transitional or replacement suppliers and service vendors Limitation of liability carefully evaluate and minimize vendor use of limitations, dollar caps, specific exclusions (especially for contingency planning vendors ) Audit and test continuity plans of critical vendors Review your applicable contract obligations as vendor or supplier 38

39 Employee Issues and Strategies

40 BCP is about Employees, not Employment Business interruption events require workforce strategies to continue operations Your business must survive the event to partake in a recovery But focusing on keeping the doors open, rather than protecting employees can spell failure Don t win the battle and lose the war 40

41 Continuity Planning Review Employees Training Incident communications Travel health & safety issues Domestic location health & safety Staff duplication & relocation Contingent employees Hiring practices Payroll procedures 41

42 Planning Review Current Employees Participation in Emergency/Continuity program development Training program for employees Communications Pre incident plan development, education and training Incident facility and offsite (home/travel); status and operations Post incident instructions, counseling, evaluation of operations, plan review Travel issues Health and security precautions (health kits, training) Obtaining medical care / medical evacuation Handling foreign quarantine/isolation events (returning procedures) 42

43 Planning Review Current Employees cont. Domestic health and safety procedures Workplace standards Employee and facility safety measures Office health best practices measures (healthy/ill employees) Employee health reporting procedures and privacy issues Special needs employees Employee discretion policy vacation/personal time use, etc. Non essential personal standards Leave as a disease transmission strategy Work at home standards Eligibility and accountability Trigger events, notice and duration standards 43

44 Planning Review Other Employees Contingent employees Fast hire sources and procedures Contracts with agencies Contracts with staff providers Retirees as replacements (planning in advance) Critical staff backup ID critical positions Cross training Contingent outsourcing contractors Prospective employees Security screening issues Health screening issues 44

45 Reflections Adapt currently available standards and experiences of others to address your needs Maximize use of your existing plans and experiences, then test, revise and improve over time Don t wait for creation of Gold Standard program Do it now 45