Logo

Business Continuity Plan Template for Medical Device Companies

Business Continuity Plan Template for Medical Device Companies

What is a Business Continuity Plan for Medical Device Companies?

A business continuity plan for medical device companies is a strategy to ensure the continued production of medical devices, maintenance of quality assurance, and reliability of supply chains in the event of unforeseen circumstances. It outlines steps and procedures to be taken to minimize disruption and ensure the safety of both customers and employees during a crisis.

What's included in this Business Continuity Plan for Medical Device Companies template?

  • 3 focus areas
  • 6 objectives

Each focus area has its own objectives, projects, and KPIs to ensure that the strategy is comprehensive and effective.

Who is the Business Continuity Plan for Medical Device Companies template for?

This template is designed for medical device companies and healthcare technology businesses to develop their own business continuity plans. It allows them to outline their objectives and actions in order to ensure the continuity of their operations in times of crisis.

1. Define clear examples of your focus areas

A focus area is a general area of improvement or strategy within a business continuity plan. They can range from quality control and resource planning to cybersecurity and emergency management. It is important to define clear objectives and actions within each focus area before tackling them.

2. Think about the objectives that could fall under that focus area

Objectives are goals or targets that are set to achieve the desired outcome of a focus area. They should be measurable and achievable, and should be supported by actionable projects. Examples of some objectives for the focus area of Optimize Quality Control could be: Increase Quality Assurance, and Establish Quality Standards.

3. Set measurable targets (KPIs) to tackle the objective

A key performance indicator (KPI) is a metric used to measure the progress of an objective. It should be specific, measurable, achievable, relevant and time-bound, and should be monitored regularly to ensure successful completion of the objective. An example of a KPI for the focus area of Optimize Quality Control could be: Reduce defective products from 5% to 2%.

4. Implement related projects to achieve the KPIs

Projects (or actions) are initiatives taken to fulfill objectives. They should be specific in nature and be able to be completed within a given timeline. Projects should be designed to actively measure progress toward the goal. An example of a project related to Optimize Quality Control could be: Implement stricter inspections.

5. Utilize Cascade Strategy Execution Platform to see faster results from your strategy

Cascade Strategy Execution Platform allows businesses to plan, track, and execute their strategies. It provides teams with the tools they need to monitor progress, highlight areas of improvement, and ensure successful completion of their business continuity plans.

  • Complete Modular Solution
  • Seamless User Experience
  • MES Investment and ROI
  • MES Migration
  • Critical Manufacturing Framework
  • Easy Deployment
  • MES for Industry 4.0
  • The IoT Data Platform for Manufacturers
  • Augmented Reality
  • fabLIVE Factory Digital Twin
  • Factory Automation
  • Material Logistics
  • Advanced Planning and Scheduling
  • Connect IoT
  • Enterprise Integration
  • Semiconductor

Manage advanced scenarios with the edge capabilities for innovation and efficiency

  • Electronics

Upgrade process capability and manage capacity and quality, while driving down the cost

  • Medical Devices

Shift focus from managing compliance and risk to agility and product quality

  • Industrial Equipment Manufacturing

Accelerate digital transformation across complex discrete industries

  • Making Industry 4.0 a Reality
  • White Papers
  • Case Studies
  • Gartner Magic Quadrant for MES 2023
  • Peer Lessons Learned for MES Implementation
  • Webinars on-demand

medical device business continuity plan

Automated Validation

  • Press Releases
  • Media Articles
  • Trade Shows

Critical Manufacturing receives the highest number of reviews and willingness to recommend score in the latest Gartner® Peer Insights™ “Voice of the Customer” report

Critical Manufacturing receives the highest number of reviews and willingness to recommend score in the latest Gartner® Peer Insights™ “Voice of the Customer” report

  • Our Customers
  • Success Stories
  • Customer Training Program
  • Find a Partner
  • Become a Partner
  • Partner Training Program
  • Business Intelligence
  • Customer Portal

Diagnostic and imaging

MES for Business Continuity in the Medical Device Industry

March 12, 2021.

Posted by: Rebekah Cauthen

We talked in March 2020 about getting your MES selection going . The Pandemic was in the early stages of development, and industries were unsure of the extent and overall effect to business disruption. The post recommended a logical, systematic method of initiating and executing a MES selection process.

A later post in April 2020 discussed on how to use Partners for business continuity ; again, assuming that disruption was a temporary, but an important issue to address. Partners can extend your reach; provide needed expertise and guidance, as well as oversight, project management and project execution.

Well here we are, after a year of pandemic. How have you fared? There are numerous studies, most recently McKinsey’s , that states the acceleration and adoption of digital technologies has been speeded by ‘several years’ as a result of the pandemic; that instead of stopping innovation, it’s facilitated, nudged, and brought digital transformation to the forefront as a means to not only sustain, but thrive in these trying times. Specifically for manufacturing, accelerators such as using advanced technologies in operations and automation, McKinsey found that 37% of organizations deployed solutions, and 50% believe that those changes will stick. So the changes are real and sustainable in at least half of the use cases.

medical device business continuity plan

Digital transformation can represent a lot of different technologies, but normally includes AR (Augmented Reality); VR (Virtual Reality); Digital Thread/Digital Twin (simulated replicas of your plant or process); AI/ML (Artificial Intelligence & Machine Learning) and ‘edge’ technologies like IoT (Internet of Things). Collectively, they enrich the manufacturing environment to allow you to make better, faster and more informed decisions using the ‘real time’ or ‘live’ data that’s generated from your process. These technologies improve not only manufacturing itself, but the people and systems that are interconnected and depend on the results and outputs of the process. It’s a continuous improvement/quality initiative that’s become pervasive thanks to the technology advances and innovative applications of technology itself, as well as the increasing number of suppliers that’s made the technology commercially feasible.

What about MES?

Although a decades-old solution for manufacturing oversight and productivity, Manufacturing Execution System equally plays a distinctive and primary role in digital transformation. A ‘modern MES’ entails the very technologies that digital transformation/Industry 4.0 brings to industry, packaged up in a form that makes it simple to buy, deploy and use. It covers the entire value chain within a product’s lifecycle, from raw materials through finished goods through logistics, to ensure organizational responsiveness to market changes occur in a formalized, documented, regimented manner, utilizing the newest technologies, systems and infrastructure.

As the medical device industry grows despite the pandemic ( current research shows a 7% market growth) the need for an MES for process oversight and guidance becomes an even stronger argument. Given that US President Biden just re-invoked the Defense Production Act , the need to address medical devices in short supply is now a national priority in the US, one of the largest markets in the world with 40% of the global medical device market in 2017 . MES will again play a leading role in implementing the business continuity needed for organizations to quickly respond to demand and scale operations.

MES solutions have played a foundational role for over 20 years in managing quality, production and workforce productivity for medical device manufacturers.  Ultradent Products ’ use case is an example of using an MES cross-enterprise within a complex network of products, manufacturing styles and an extended supply chain. There are strict compliance requirements with paper-based capture of process data. Essentially, the MES is crucial to upholding the success of the manufacturing process and the value chain of Ultradent.

Another medical device company, Elekta Limited , uses Critical Manufacturing MES as a key component of their global manufacturing center of excellence for medical devices. This entails strict enforcement of manufacturing Quality Standards along with competitive, qualitative and cost effective processes for production. The implementation of Critical Manufacturing MES is helping to both enhance quality and ensure that products are manufactured at the ‘right cost’ for customers, increasing integration between processes and providing complete real-time visibility and intelligence across multiple manufacturing lines. 

MES as a foundation for Business Continuity

Relying on an MES as the foundation of a good manufacturing process ensures business continuity, as the key infrastructure is set for process and product control to meet customer demand and instill a culture of customer responsiveness. All of the underlying processes that are deemed to contribute to the correct performance of the organization are captured, documented, and ‘institutionalized’ within the application.

For medical device companies, we wrote about four main care-abouts that MES contributes to, or is the foundation for:

  • Accelerating New Product Introduction
  • Assuring Quality
  • Establishing Traceability and Regulatory Reporting
  • Boosting Efficiency and Profitability

Collectively, this underscores the need for production oversight and control; stringent quality management; compliance to regulations; and maintaining a profitable bottom line.

MES is at the core of productivity for maintaining business continuity. The boost to manufacturing practices from digital transformation initiatives are widespread, but generally include digitizing paper-based processes; achieving flexible, responsive operations to answer changing market conditions or customer requests; and adopting automation in key and definable ways to increase productivity and quality through standardized practices and repeatable production.

Automation is one area where the increase has been dramatic. Boosted by the pandemic, manufacturers are accelerating their automation investments. The World Economic Forum reported in October 2020 that 43% of businesses surveyed are set to reduce their workforce due to technology integration while 34% plan to expand their workforce for the same reason. By 2025, the time spent on current tasks at work by humans and machines will be equal. Although ‘automation’ in normal context refers to robotics, it can also include process equipment, machine vision, and other functions normally performed by people. MES can provide the necessary infrastructure to keep these digitized investments in line with current manufacturing practices, reinforcing GMP and providing guidance and education to the workforce, who may be employed in new areas, processes or tasks.

Overall, the role MES plays in business continuity is increasing, rather than decreasing, in importance. It provides the foundation for technology integration into an enterprise; generates reports, analytics and insight into productivity and performance; and is a platform for adding workforce enhancements associated with Industry 4.0, such as AR/VR, Digital Twin and Business Intelligence.

For medical device manufacturers, this business continuity extends into reinforcing and enforcing GMP; traceability/genealogy; workforce instructions and oversight; quality management and supporting validation. It’s the one overarching solution that not only builds the information infrastructure of a regulated manufacturing process, but provides a means to extend, enrich and collaborate with multiple sites, partners and customers.

Rebekah Cauthen

Rebekah Cauthen

Rebekah Cauthen has over 9 years experience in manufacturing IT, having worked with various manufacturing technology companies in both the United States and Europe. In 2019 Rebekah joined Critical Manufacturing as the Sales Manager DACH. Rebekah’s passion is supporting medical device manufacturers in their transition to manufacturing excellence and intelligence through state-of-the-art technology.

Related articles

medical device business continuity plan

Pretending to be Agile – Implementation of MES in a regulated environment

In regulated industries such as medical device manufacturing and pharma, where adherence to strict standards is paramount, embracing the agile flexibility presents its own set of challenges.

medical device business continuity plan

Manufacturing’s Role in MedTech Becoming a Valued Healthcare Partner

How can a MedTech manufacturer secure its position as a valued partner in the fast-changing healthcare industry? It all comes down to being reliable on many fronts.

medical device business continuity plan

How MedTech companies can excel in inflationary periods?

MedTech companies are struggling like most industries due to inflationary trends, however, the problem is further amplified for companies with a predominantly commoditized product portfolio.

You must be logged in to post a comment.

medical device business continuity plan

  • Request a Quote for Services
  • Request a Quote for Plastics
  • Request a Quote for Medical

Risk Management for Medical Device Manufacturers

Table of Contents

Medical device manufacturers have a mission. Their goal is to deliver quality products that improve health outcomes for patients. Healthcare providers need to feel confident about using these products, which calls for high quality standards when designing and manufacturing medical devices.

Medical device manufacturers can achieve this high level of quality by designing and implementing a thorough risk management process.

The ISO 14971 framework is a great starting point for creating a risk management process. This voluntary standard outlines the best practices to adopt to mitigate risks when designing and distributing medical devices.

Types of Risks Faced by Medical Device Manufacturers

Science-Worker

Regulatory Risks

From properly labeling a medical product to choosing materials cleared by the U.S. Food and Drug Administration (FDA), medical device manufacturers have to comply with strict guidelines at every step of the way.

Regulatory frameworks can also determine how a manufacturer should market their product, how they should disclose potential risks, and how healthcare providers should use these products.

Regulatory risks include facing fines and penalties if a manufacturer fails to meet the standards set by the FDA, European Union, or the International Organization for Standardization (ISO). Medical device manufacturers can even lose access to a market if they fail to comply.

Managing regulatory risks is challenging because the regulatory environment keeps changing. For instance, the Canadian market is currently replacing the Canadian Medical Devices Conformity Assessment System with the Medical Device Single Audit Program .

Product Liability Risks and Safety Risks

A medical device that doesn’t work as intended can cause harm to a patient. Medical device manufacturers can become liable for additional medical costs, loss of quality of life, or even death.

Risk management goes beyond product quality. It encompasses the way the manufacturer markets the product since making inaccurate claims about how a product works can result in harm to a patient.

Packaging is another important aspect of risk management. The right packaging should protect the integrity and quality of the medical device.

The first barrier against product liability risks is to develop a comprehensive process that ensures product quality. This process can include studies and testing before releasing a new product and monitoring patient outcomes once the product is on the market.

Medical device manufacturers should aim for continuous improvement. With new materials and manufacturing techniques available, it’s possible to keep improving product designs to reduce risks.

ISO 14971 is a comprehensive risk mitigation framework that can help assess product liability risks at different stages.

Business Continuity Risks

Business continuity can refer to a number of threats that could interrupt key business processes.

Cyber-attacks are a common example. With cyber-attacks up 42% in 2022 compared to 2021, your risk assessment team can’t overlook this threat.

With IT products being such an important tool for many business processes, a network or power outage can also be a business continuity risk.

Terrorist attacks, fires, floods, pandemics, and other natural disasters can also result in disruption. The risk management process can be challenging for organizations that outsource product assembly or production abroad.

Business continuity risks can impact your organization directly or indirectly. For instance, a pandemic or natural disaster can disrupt your supply chain.

Identifying and Assessing Risks

Now that you have a better understanding of the risks medical device manufacturers typically face, it’s time to evaluate the unique risks your organization faces.

Methods for Identifying Risks

You can implement different risk assessment strategies to identify your unique risks. We have collected six varying approaches, such as:

  • Learn from your past mistakes. If you encountered an issue with a product or experienced business continuity challenges, approach the incident as a risk you need to mitigate.
  • Listen to legal and compliance experts. These experts can use the ISO 14971 framework and other tools to assess your risks.
  • Consider getting help from an outside consultant. Someone with extensive experience and knowledge of your industry can help spot regulatory risks or product liability risks you had overlooked.
  • Conduct a thorough IT risk analysis. Look at risks such as data breaches, network outages, cyber-attacks, and more.
  • Keep up with the latest industry trends. Look at the risk affecting your competitors and partners. These trends can help you predict the risks you will face in the near future.
  • Listen to employees and stakeholders. The people who design and manufacture your products might be aware of flaws, and the healthcare professionals or patients who use your products can also help with risk management.

Assessing the Likelihood and Impact of Risks

Medical device manufacturers need to adapt their risk management strategy to each individual risk based on two factors:

  • The likelihood of a risk. How likely is the event to happen? For product liability risks, the percentage of patients affected by an issue can be a helpful risk assessment tool.
  • The potential impact of the risk. A risk can result in a loss of revenue, a loss of reputation, or a fine from the FDA. Assess the extent of this impact on the organization.

While medical device manufacturers shouldn’t overlook any existing risks, looking at the likelihood and potential impact of risk will help prioritize risk mitigation. It can also support the decision to allocate resources to the risk mitigation plan.

Mitigating Risks

After completing a thorough risk assessment, medical device manufacturers can create a risk management plan with strategies that will prevent or reduce the impact of known risks.

Risk Prevention and Control Measures

Risk prevention strategies include quality control, improving the design of a product to prevent failure, or replacing problematic materials.

Medical device manufacturers can also develop a compliance process to follow ISO and FDA guidelines, or offer training to healthcare providers to help improve patient outcomes with a device.

Control measures are another way to prevent risks. Examples include restricting access to sensitive data or replacing a high-risk supplier with a reliable partner.

Risk Acceptance and Transfer

Medical device manufacturers can take steps to reduce risks, but risks will always exist to some degree. Organizations need to determine the level of risks they are comfortable with.

Risk transfer is another core component of a successful risk management strategy. A common way to transfer risks is to purchase insurance coverage. For instance, an insurance policy can protect medical device manufacturers from product liability claims or cyber-attacks.

Your insurance company can become a valuable partner for helping you understand and assess risks. Your insurer can help uncover risks you hadn’t considered or recommend a tailored policy based on the likelihood of different events.

You can also transfer risk by having healthcare providers and patients can also sign waivers to indicate they understand the potential risks of using a medical device. A waiver can, for instance, eliminate liability risks in case the healthcare provider or patient doesn’t use the medical device as intended.

Best Practices for Risk Management

Successful medical device manufacturers have turned risk management into a well-documented process.

Developing and Implementing a Risk Management Plan

After assessing risks and identifying relevant strategies, you should develop a written plan. This plan will act as a framework you can refer to when a new risk arises. It ensures a consistent response to risks across your organization and will improve your response time since you’ll have a go-to solution when a risk threatens your organization.

Plus, your written plan shows that you are taking an active role in preventing risks. It can help in the context of an audit by the FDA or a lawsuit for negligence.

Regularly Reviewing and Updating the Risk Management Process

Risk management is an ongoing project. Risks aren’t set in stone and can change over time.

Ideally, you should have a multidisciplinary team that is in charge of reviewing and updating your plan regularly. You might want to update your plan when you release a new product or when regulatory frameworks change.

Involving All Stakeholders in the Risk Management Process

Risk management shouldn’t be an isolated process. You’ll get a much better understanding of the risks your organization faces by involving several stakeholders.

Product designers, marketing employees, suppliers, and executives can help you identify risks across several processes. Your IT team also has a crucial role to play in identifying risks linked to protecting intellectual property and sensitive data.

You should also involve healthcare providers and patients. Studies and interviews can help improve your product and reduce product liability risks.

Take the Next Step in Your Risk Management Journey

Mask-Factory-Team

The ISO 14971 framework is a great place to start for medical device manufacturers looking for a set of risk management best practices developed by industry experts. Working with the right partners can also help reduce risks. If you’re in need of a trustworthy medical product assembly and packaging vendor, MDI could be a great match. Contact our team today to tell us about your project and request a quote.

Cares Council Volunteer Support Form

Cares council grant application.

  • Pharmaceutical Engineering Magazine
  • Online Exclusives
  • Special Reports
  • Facilities & Equipment
  • Information Systems
  • Product Development
  • Production Systems
  • Quality Systems
  • Regulatory Compliance
  • Research + Development
  • Supply Chain Management
  • White Papers
  • iSpeak Blog
  • Editorial Calendar
  • Article of the Year
  • Submit an Article
  • Editorial Team

Business Continuity Planning to Prevent Drug Shortages

Key activities for strategic business continuity planning for preventing drug shortages

As noted in the ISPE Drug Shortages Prevention Plan, 1 business continuity planning is a powerful, methodology, essential for enabling an uninterrupted supply of critical medicines for patients in challenging manufacturing circumstances. This “30,000-foot view” article shares an executive summary of principles and best practices of business continuity planning to ensure continued pharmaceutical supply.

  • 1 International Society for Pharmaceutical Engineering. “ISPE Drug Shortages Prevention Plan: A Holistic View for Root Cause to Prevention.” October 2014. https://ispe.org/DrugShortagesPreventionPlan

While powerful, business continuity planning is not always leveraged optimally for preventing drug shortages because it can be difficult to initiate and maintain, particularly when future supply challenges may be unknown or unpredictable, and because it can require a significant investment of money, personnel, training, and other resources. However, over the lifespan of any company, unexpected challenges will inevitably surface. The COVID-19 pandemic is the most illustrative example of our times regarding how significant business continuity planning may be to ensuring uninterrupted supply of critical medicines, as the entire pharmaceutical industry has been challenged by both unprecedented demand and supply constraints globally.

It is understandable how immediate operations necessary to maintain routine supply to the market may be prioritized over proactive measures, which may never be needed or needed in the way that was originally anticipated. Yet it remains essential that pharmaceutical industry leaders pursue strategic approaches for business continuity planning because drug shortages may devastatingly impact patients and their families, as shown in the recent ISPE Drug Shortages Webinar, which described one pediatric cancer patient’s challenges from multiple drug shortages. 2

In recent years, large-scale events have motivated governments, health authorities, and patients to focus on the reasons behind supply disruptions. While many root causes are being explored, some markets are prioritizing business continuity planning for the prevention of drug shortages and making these plans a requirement in certain cases. 3 , 4  Any procedures established to meet these new requirements should be developed with sufficient flexibility to accommodate appropriate evolution of business continuity planning because the risks of today may not be the risks of tomorrow.

Approaches to Business Continuity Planning

The guidance presented in this article is intended to assist pharmaceutical leaders in striking the right balance between critical patient needs and the business investment for drug shortage prevention measures. In general, the concepts described herein apply to all types of pharmaceutical products, including active pharmaceutical ingredients (APIs), finished drugs, biologics, vaccines, medical devices, and combination products.

There are a number of excellent resources for business continuity planning. Notably, the ICH Guideline for Quality Risk Management Q9 5 serves as an important resource document for existing practices, standards, and guidelines within the pharmaceutical industry. As such, ICH Q9 concepts and terminology will be used throughout this overview.

At the outset of pursuing robust business continuity planning for preventing drug shortages, it is important to recognize this is not a one-time event. Rather, the four primary activities in business continuity planning—establishing product priority, evaluating risk to supply, developing mitigation options and agility strategy, and implementing response plans—will need to be revisited and adjusted as the product portfolio and business dynamics change over time (Figure 1). Therefore, companies should develop programs to support an ongoing refresh of their business continuity plans.

  • 2 International Society for Pharmaceutical Engineering. “Resolving and Avoiding Drug Shortages and the Health Crises They Create” (webinar). 1 September 2020. https://ispe.org/webinars/video/resolving-avoiding-drug-shortages-health-crises-they-create-webinar>
  • 3 Garnier, Y. “The French System for Preventing and Managing Shortages.” BlueReg Pharma Consulting. 28 May 2020. https://blue-reg.com/the-french-system-for-preventing-and-managing-shortages
  • 4 Covington & Burling LLP. “CARES Act Reforms Aim to Prevent Shortages of Critical Medical Products.” 5 April 2020. https://www.cov.com/-/media/files/corporate/publications/2020/04/cares-act-reforms-aim-to-prevent-shortages-of-critical-medical-products.pdf
  • 5 International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use. “ICH Harmonised Tripartite Guideline: Quality Risk Management Q9, Current Step 4 Version.” November 2005. https://database.ich.org/sites/default/files/Q9%20Guideline.pdf

Key activities for strategic business continuity planning for preventing drug shortages

Generally, the four stages of business continuity planning will proceed in the order shown in Figure 1; however, as patient needs develop or business or regulatory landscapes change, it may be appropriate to make targeted adjustments within any one of the four stages to ensure the best outcomes.

In each of the four stages, a strong partnership between functional areas within a company will be required for success. The functional areas typically involved in these activities are as follows:

  • Customer relations
  • External business partnerships
  • Manufacturing
  • Medical affairs
  • Procurement
  • Regulatory affairs
  • Sales and marketing
  • Supply chain
  • Technical/manufacturing operations

Because many issues and decisions related to business continuity planning will be best addressed after input is considered from multiple functional areas, it is equally important to formally designate a business continuity planning team leader who will have the authority to exercise decisions on behalf of all. Figure 2 illustrates the key stages and decision points for business planning discussed in this article.

Key stages and decision points for business continuity planning to mitigate and prevent drug shortages.

Establishing Product Priority

A foundational activity for business continuity planning is determining the priority of products. Not all products merit the same level of business continuity planning because the impact of supply disruptions is not equal for all products. Considering product priority becomes even more important when the resources required to develop business continuity plans may be constrained. The relative priority of each product will be more reliable if it has been determined by evaluating products individually, as well as across the portfolio of products for which the company is the marketing authorization holder (MAH). This is because there may be important connections between products, often business related, which can influence the priority of an individual product.

Three perspectives primarily drive prioritization of products: therapeutic importance, regulatory requirements, and business significance. Because of the numerous perspectives that must be considered within these three areas when establishing the product priority, the evaluation of priority is best completed as a cross-functional activity and experts in the business areas listed previously should be consulted.

Therapeutic Importance

The medical significance of a product for patients is the most significant consideration when determining that product’s overall priority. There are several ways to differentiate the therapeutic importance of a product (Figure 3). Applying one therapeutic assessment globally is usually not sufficient because a product may have different therapeutic value across various markets. Additionally, within or across markets, each dosage form and strength within a product family may not always have the same medical priority. Sometimes, a specific dosage form and strength is developed to provide convenience to the health provider or patient and, as a result, its unavailability may not be as impactful as shortages of other dosage forms and strengths.

Examples of characteristics to consider when establishing therapeutic importance

Regulatory Requirements

Health authorities (also known as national competent authorities) and health organizations, such as the World Health Organization (WHO), can influence product priority significantly through their definitions of what products may be critical, essential, or life-saving for patients in certain markets. They may also designate medically significant products through a set of criteria or through a list of products. For example, the WHO has long maintained an Essential Medicines List. 6 Additionally, governments may establish incentives to prioritize products manufactured in a certain market. Typically, health authorities have higher expectations for risk management and business continuity planning for products deemed to be more significant in their market(s).

Currently, there is no harmonized definition across markets regarding what products are significant to the patients. 7 , 8 As a result, it is imperative that pharmaceutical companies have insight into the definitions or lists applicable for the markets where their products are sold, and which products may be assigned to a national stockpile. Notably, the priority may be dynamic in a market. For example, in a large-scale event, a product that is valuable for emergency use could rapidly become essential and in high demand.

In addition to considering all regulations and governmental expectations when assessing the priority of a product in each market, it is important for companies to maintain constructive interactions with health authorities. 9  This will ensure that a company is able to develop a strategic approach to meet requirements across all markets and be poised to engage with the health authorities prior to or at the outset of any significant supply disruption or emergency. Early communication on drug supply challenges, preferably before supply disruptions occur, will maximize the assistance the health authorities may be able to provide to mitigate or prevent a drug shortage.

Business Significance

Business significance of a product should be assessed both from the perspective of the overall revenue position for the company as well as the market share of the product. If a product is essential for a company’s revenues, there may be no financial tolerance to have product supply unavailable for even a day. On the other end of the spectrum, a product might be sold in very low volume and manufactured only once or twice per year. Beyond failure-to-supply costs, which may be written into supply agreements, a supply gap for a low-volume product may have minimal patient impact or business significance. However, even an absence of a small-volume product can create significant challenges for patients who may rely on it, which could then generate business challenge for a company if the health care provider or patient reaction to the absence of product generates unfavorable publicity and impacts the overall reputation of the company.

A market share analysis is an important activity to complete when determining business significance. It should include an analysis of how much market share the company holds for the product, as well as how interconnected the competing suppliers may be to the manufacturing nodes. Generally, if the market for a specific product is divided across at least three manufacturers, 10 a supply disruption from one manufacturer may not make a significant difference to the overall market. However, if the market share is divided unevenly and the manufacturer experiencing the supply disruption contributes significantly to the overall industry-wide inventory, the disruption may drive an industry-wide shortage and competitors may have insufficient capacity to increase manufacturing to address the supply gap. Additionally, a product may be a higher priority if any risks to supply would likely impact multiple suppliers (e.g., all companies use the same raw material supplier), and very quickly create an industry-wide gap.

Lastly, connections between products, either within the portfolio of one company (i.e., one MAH holder) or connections with a partner company, may need to be considered when establishing the business significance for each product. One product may be interdependent with other products due to marketing, regulatory quality, or manufacturing supply requirements or strategies. Depending on the nature of the connection, a product that may otherwise be of lower priority may become more significant because interruption in its supply may impact other products the company markets or the company’s partnerships with other companies.

Setting Business Continuity Planning Target Levels

As noted earlier, the appropriate level of business continuity planning will vary by product. For the purposes of establishing a target level of business continuity planning, all of the perspectives described previously will contribute to the final priority categorization. Low-priority products do not typically merit rigorous business continuity planning activities, but the activities may be completed on a discretionary basis based on the company’s goals or preferences. For products that have priority from any of the three perspectives of therapeutic importance, regulatory requirements, or business significance, companies will need to apply an appropriate level of rigor to the business continuity planning activities, based on the perspectives driving the priority (Figure 4).

  • 6 World Health Organization. “WHO Model Lists of Essential Medicines.” 2020. https://www.who.int/medicines/publications/essentialmedicines/en
  • 7 ISPE Drug Shortages Initiative Core Team. “ISPE Offers Platforms to Progress Continuity of Supply of ‘Essential’ Medicines.” 11 September 2020. https://ispe.org/pharmaceutical-engineering/ispeak/ispe-offers-platforms-progress-continuity-supply-essential
  • 8 Persaud, N., M. Jiang, R. Shaikh, et al. “Comparison of Essential Medicines Lists in 137 Countries.” Bulletin of the World Health Organization 97 (2019):394––404C. doi:10.2471/BLT.18.222448
  • 9 Tomeo, D., K. Hirshfield, and D. L. Hustead. “Engage with Health Authorities to Mitigate & Prevent Drug Shortages.” Pharmaceutical Engineering 40, no. 4 (2020): 36–41. https://ispe.org/pharmaceutical-engineering/july-august-2020/engage-health-authorities-mitigate-prevent-drug
  • 10 World Health Organization. “Medicines Shortages.” WHO Drug Information 20, no. 2 (2016): 180–185. https://www.who.int/medicines/publications/druginformation/WHO_DI_30-2_Medicines.pdf?ua=1

Product priority guides target level of business continuity planning

Assessing Risk to Supply

Once the product priority is established for a product, the company can assess the risks to supply with a better gauge for the potential level of impact of any identified risks. The key learnings from establishing product priority should be considered during the risk assessment process.

Table 1 shows typical areas to consider during a risk assessment for the purposes of preventing shortages. The areas listed are not exhaustive and may not be applicable to every product or company. Each company will need to determine what may best be included in their assessment and should address any company-specific issues or perspectives. Risk assessment activities may not need to be as comprehensive for low-priority products, particularly when any correlating supply disruption may have minimal patient impact.

The assessment of areas of potential risk should address the fundamental questions posed in ICH Q9: 5

  • What might go wrong?
  • What is the probability it will go wrong?
  • What are the consequences?

An informal survey of ISPE membership has indicated that companies use a wide range of off-the-shelf and custom-designed risk assessment procedures, tools, and technology. ICH Q9 Annex I provides an overview of common tools for identifying what might go wrong and what is the probability it will go wrong. Table 2 1 , 5 , 9 – 17 lists other valuable guidance resources available to assist with the assessment of risk in pharmaceutical manufacturing.

*At the time of publication of this article, a new guidance from the FDA regarding risk management plans to mitigate potential for drug shortages was anticipated, but not yet available.

Risk assessments generally evaluate risks to (a) the product, (b) business systems, and (c) operations, and assessments of these three areas may be completed either individually or as a combination activity. When business continuity planning is done for only one area (products, business systems, or operations), the preventive measures may fall woefully short because product supply, business systems, and operations can all be disrupted simultaneously, such as in large-scale events (e.g., hurricanes, earthquakes, pandemics).

Beyond evaluating manufacturing reliability and quality maturity, business continuity planning to avoid drug shortages may benefit from integration with any governance, risk management, and compliance (GRC) or enterprise risk management (ERM) activities already in place for the company. For example, regarding risk to operations, the transformative nature of the COVID-19 pandemic may increase the importance of completing financial viability assessments of business partners, with consideration paid to not only primary business partners but also secondary and tertiary business partners. If a company does not have a formal GRC or ERM program, industry experts and software are available provide guidance suited to the needs of the organization. 18 , 19 , 20

Mitigation Options

The outcome of assessing risk to supply should be a road map of the key risks for the products, business systems, and operations to drive the selection of an appropriate business continuity approach.

A robust response plan should include both traditional mitigation options, such as redundancy of operations or increased inventory for safety stock, and agility strategy. Agility, as defined herein, is applied in the absence of an immediate back-up facility or inventory stockpile and should enable quick operational reactions to ensure resiliency for continued supply. It requires advanced, forward thinking and preparation to be successful. A well-designed agility strategy can be equally successful as redundancy; however, because agility strategy is by nature infrequently practiced, if it all, there may be some unexpected variation in the outcomes when activated. An appropriate blend of redundancy and agility will typically provide the best resiliency for continued supply. Figure 5 provides insight into the key considerations when selecting the best target on the business continuity planning options spectrum.

  • 17 a b International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use. “ICH Harmonised Tripartite Guideline: Pharmaceutical Quality System Q10, Current Step 4 Version.” 4 June 2008. https://database.ich.org/sites/default/files/Q10%20Guideline.pdf
  • 11 US Food and Drug Administration. “Drug Shortages: Root Causes and Potential Solutions.” Updated 21 February 2020. https://www.fda.gov/media/131130/download
  • 12 European Medicines Agency. “Guidance on Detection and Notification of Shortages of Medicinal Products for Marketing Authorisation Holders (MAHs) in the Union (EEA).” July 2019. https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/guidance-detection-notification-shortages-medicinal-products-marketing-authorisation-holders-mahs_en.pdf
  • 13 International Organization for Standardization. “ISO 14971:2019 Medical Devices—Application of Risk Management To Medical Devices.” December 2019. https://www.iso.org/standard/72704.html
  • 14 World Health Organization. “Technical Consultation on Preventing and Managing Global Stock Outs of Medicines.” 8–9 December 2015. https://www.who.int/medicines/areas/access/Medicines_Shortages.pdf?ua=1
  • 15 International Society for Pharmaceutical Engineering. “ISPE Drug Shortage Assessment and Prevention Tool.” 2015. https://ispe.org/sites/default/files/initiatives/drug-shortages/drug-shortage-assessment-tool-watermarked-307240.pdf
  • 16 Parenteral Drug Association. Risk-Based Approach for Prevention and Management of Drug Shortages. PDA Technical Report no. 68. Bethesda, MD: Parenteral Drug Association, 2014.
  • 18 Consultancy.org. “Global Risk Consulting Market Nears $70 Billion, Top 30 Consultancy Firms.” 13 December 2018. https://www.consultancy.org/news/101/global-risk-consulting-market-nears-70-billion-top-30-consultancy-firms
  • 19 Gartner Peer Insights. “Integrated Risk Management (IRM) Solutions.” Accessed 26 December 2020. https://www.gartner.com/reviews/market/integrated-risk-management
  • 20 G2. “Best GRC Platforms.” 12 August 2020. https://www.g2.com/categories/grc-platforms

Business continuity planning options spectrum

Securing backup facilities or materials for pharmaceutical production or stockpiling inventory are longstanding redundancy options to ensure product supply. Although redundancy is well defined and generates expected results, it is costly due to necessary operational overhead. Unexpected complexity may also develop when a company maintains additional facilities, sources of supply, or inventory. Additionally, an adequate number of trained staff and practice runs for back-up operations are necessary to ensure a successful and timely transition to the redundant option, when needed. In some cases, limitations on the number of suppliers or raw material sources mean that redundant facilities or sources of supply are very difficult or impossible to achieve.

Given the implementation challenges or significant investment required to achieve redundancy or stockpiling, they are not always the best options for the manufacturing of every product or every step of manufacture of an individual product. For example, redundancy or stockpiling may not be appropriate for products that are deemed low priority for business continuity planning or products that involve few supply chain risks. Quite often, the decision for the best approach will require input from the various business areas listed earlier (customer relations, external business partnerships, legal, manufacturing, and so on). Because options analysis can quickly become complex, tools such as a decision-matrix method (e.g., Pugh matrix) 21 , 22 may help to guide selection of the best business continuity planning approach.

An important financial perspective to consider for business continuity plan decisions is that, as a general rule, it is better to decrease the level of bound capital along the supply chain from raw materials to API to bulk to the finished goods level because this may decrease the financial impact of the business continuity plan. Increasing inventory of raw materials, API, etc., at the earlier nodes of the supply chain will typically ensure lower, more efficient levels of finished product inventory. It is usually most cost-effective to have a second source for raw materials, excipients, and APIs and only stockpile the finished goods to the level required to meet the marketed forecast. Idle capacity cost should also be considered in the overall investment calculation during the establishment of a contingency plan.

Once redundancy and stockpiling decisions are made, operational agility will need to be developed to offset remaining risk for holistic business continuity planning. Agility requires a company to establish practices and processes to ensure they can address issues when they have occurred. Excelling in agility will allow a manufacturer to quickly pivot operations to maintain supply, such as increasing production or using alternative operations or materials to maintain product supply. Six Sigma 23 methodology may be helpful in evaluating and establishing appropriate agility approaches.

Key areas for agility strategy are supply chain, quality, strategic processes, business relationships, technology, regulatory, and metrics. The following are examples of how agility may be achieved in these areas.

  • Advance thinking about potentially appropriate alternate suppliers (e.g., for raw materials, API, or finished product) can give a company a head start when faced with how to rapidly work with an alternate supplier that is not registered. Robust due diligence activities and well-maintained vendor qualification programs and supplier arrangements are recommended, as they may provide invaluable insights about timely and viable options amid an unexpected supply interruption.
  • Companies that can quickly and completely understand the interconnectedness of a product and operations with other products and end markets have superior strategic options to redirect inventory to address market-specific supply disruptions.
  • Diversification of suppliers may ensure continuous supply. There are signs that a shifting manufacturing footprint may be on the horizon, particularly due to the impact of COVID-19 on the pharma industry. 24 , 25
  • Quality failures are the root cause for a significant number of drug shortages; 11 , 26  therefore, it is particularly important to ensure a robust pharmaceutical quality system (PQS) 17  across the life cycle of a product.
  • A mature PQS—particularly in the areas of change management, monitoring, nonconformance investigations, corrective and preventive actions, complaint handling, and knowledge management—should identify early any issues that may impact continuous pharmaceutical supply, and this allows companies to implement appropriate and timely corrective actions to either mitigate or prevent a drug shortage.
  • Lessons learned from regulatory inspections should provide opportunities for continual quality improvement.
  • When developing manufacturing operations, it may be advantageous to group products with similar excipients to facilitate quick manufacturing switch outs. Having the ability to quickly ramp up one set of products and ramp down others could help companies mitigate a potential shortage situation.
  • Challenging the system or operational practices periodically, based on lessons learned or other company experiences, can proactively identify new risks.
  • Developing strong relationships with suppliers and contract manufacturing organizations (CMOs) to understand issues early is invaluable in ensuring the best outcomes for potential or actual supply disruptions.
  • Having the ability to quickly start manufacture of a product at a CMO through contracts, foundational qualification work, and training (often referred to as a warm start 26 ) is an agile version of redundancy.
  • Companies may want to establish relationships with competitors, so they may partner during significant supply disruptions to temporarily provide patients with an alternate source of supply.
  • It can be challenging to use new technologies (e.g., continuous manufacturing) or an alternate type of existing technology (as described in scale-up and post-approval changes [SUPAC] guidance 27 , 28 , 29 , 30 , 31 for existing products. However, completing foundational development work for new or alternate technology before shortage event occurs may give a company a shorter runway for restart and may help the company adjust to increased demand.
  • A well-planned regulatory strategy for registration dossiers may be a powerful way to mitigate or prevent drug shortages. As an example, ICH Q12 (Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management) 32  describes post-approval change management protocols (PACMPs) for registrations that may potentially alleviate post-approval change requirements. With the appropriate level of process and product understanding, PACMPs may be instrumental in ensuring continuous supply. Therefore, investing in upfront development and regulatory work for agility purposes can be foundational to success.
  • Well-developed practices and procedures for engaging health authorities in advance of supply disruptions may help companies mitigate or prevent drug shortages because with early enough insight into an event that may disrupt drug supply, regulators may be able to provide pivotal assistance to help the company address the issue.
  • Metrics to assess agility may or may not be needed and should be established as appropriate on a case--by-case basis. That said, traditional metrics are very valuable and will often help companies know when agility strategy may need to be employed. Traditional metrics closely linked to drug shortage identification and prevention are quality measures and demand forecasting. See the ISPE Drug Shortage Prevention Plan 1 for a more in-depth discussion of important metrics.
  • Companies may want to establish a target timeline for transitioning to alternate supply options defined in business continuity plans. This may help companies better understand the overall impact of such transitions and whether predefined mitigation will be sufficient to address a supply disruption event.

Implementing, Monitoring, and Refreshing Response Plans

After the mitigation options and agility strategy are determined, the business continuity plan should be summarized and communicated across the company. Communication tools should include risk control documentation. Additionally, there may be a need to prioritize the implementation of the business continuity plans if multiple plans are established simultaneously.

The completion of the business continuity plan and communication of it are certainly noteworthy milestones to celebrate, but they are not the last steps. As noted earlier, circumstances for product supply may change over time, and these changes may impact the outcome of any of the business continuity activities described in the plans. As a result, planning is not a one-time project. However, companies with larger portfolios of products or limited staff may find it unsustainable to routinely reevaluate product priority, supply risks, and the resulting product response plan for each product. Therefore, it is essential to establish a process for a periodic review of changes in circumstances that may impact the risk outlook for supply of one or more products and merit a change to the established response plan. Though this process may vary by company, it is important to develop an event-based trigger to prompt interim reviews. Some key triggers are presented in Figure 6.

  • 21 American Society of Quality. “Quality Resources: Decision Matrix.” Accessed 26 December 2020. https://asq.org/quality-resources/decision-matrix
  • 22 Bouza-Rodríguez, J. B., A. Comesaña-Campos, and A. Menéndez-Díaz. “A Graphical Method to Assist Quality Decisions Throughout the Product Development Process.” Quality Engineering 26, no. 4 (2014): 467–478. https://asq.org/quality-resources/articles/a-graphical-method-to-assist-quality-decisions-throughout-the-product-development-process?id=8a0f57c336cb484b9784d9b948e4f412
  • 23 Shanley, A. “Reinventing Lean Six Sigma for the Pharmaceutical Industry.” Pharmaceutical Technology 41, no. 10 (2017). https://www.pharmtech.com/view/reinventing-lean-six-sigma-pharmaceutical-industry
  • 24 PwC. “Beyond China: US Manufacturers Are Sizing Up New and Cost-Efficient Global Footprints.” July 2020. https://www.pwc.com/us/en/library/fit-for-growth/assets/ffg-industrial-supply-chain-footprint.pdf
  • 25 Steinberg, G. “COVID-19: How to Forge a Supply Chain that Withstands Severe Shocks.” Ernst & Young Global Limited. 27 November 2020. https://www.ey.com/en_us/consulting/how-to-forge-a-supply-chain-that-withstands-severe-shocks
  • 26 a b Pew Charitable Trusts and the International Society for Pharmaceutical Engineering. “Drug Shortages An Exploration of the Relationship between U.S. Market Forces and Sterile Injectable Pharmaceutical Products: Interviews with 10 Pharmaceutical Companies.” January 2017. https://www.pewtrusts.org/-/media/assets/2017/01/drug_shortages.pdf
  • 27 U.S. Food and Drug Administration. “Guidance for Industry: Immediate Release Solid Oral Dosage Forms; Scale-Up and Postapproval Changes: Chemistry, Manufacturing, and Controls, In Vitro Dissolution Testing, and In Vivo Bioequivalence Documentation.” November 1995. https://www.fda.gov/media/70949/download
  • 28 U.S. Food and Drug Administration. “Guidance Document: SUPAC-IR: Questions and Answers about SUPAC-IR Guidance.” February 1997. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/supac-ir-questions-and-answers-about-supac-ir-guidance
  • 29 U.S. Food and Drug Administration. “Guidance for Industry: Nonsterile Semisolid Dosage Forms; Scale-Up and Postapproval Changes: Chemistry, Manufacturing, and Controls; In Vitro Release Testing and In Vivo Bioequivalence Documentation.” May 1997. https://www.fda.gov/media/71141/download
  • 30 U.S. Food and Drug Administration. “Guidance for Industry: SUPAC-MR: Modified Release Solid Oral Dosage Forms; Scale-Up and Postapproval Changes: Chemistry, Manufacturing, and Controls; In Vitro Dissolution Testing and In Vivo Bioequivalence Documentation.” September 1997. https://www.fda.gov/media/70956/download
  • 31 U.S. Food and Drug Administration. “SUPAC: Manufacturing Equipment Addendum: Guidance for Industry.” December 2014. https://www.fda.gov/media/85681/download
  • 32 International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use. “ICH Harmonised Tripartite Guideline: Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management Q12: Final Version.” 20 November 2019. https://database.ich.org/sites/default/files/Q12_Guideline_Step4_2019_1119.pdf

Examples of triggers for reevaluating the business continuity plan.

Because changes in circumstances may occur in many areas of the business, convening a multifunctional business continuity task force for periodic reviews of potential changes may provide the best opportunity to identify where modifications to a response plan may be warranted. The functional areas listed earlier in the article should be considered when assigning team members to a business continuity task force.

It is important to select key metrics such as demand forecast, supply metrics, capacity, and inspection results that can provide early warnings of potential issues, and develop a plan for how the business continuity task force will monitor these metrics. Additionally, insight into key changes for each area will be needed. Processes should be established in each of the functional areas for how to escalate changes that may have significance to the business continuity plans and are therefore important for the task force to review. The processes should leverage existing systems, such as the quality change control process, for maximum efficiency and effectiveness.

After the periodic analysis is complete, a plan for refreshing impacted response plans should be developed. Additionally, the status of implementation of all business continuity plans and related updates should be monitored by the business continuity task force.

Lastly, and very importantly, any use of established business continuity plans to address an unexpected supply disruption will present an opportunity for evaluating how well the plans worked and if any adjustments should be made. In the absence of actual events, the business continuity plans may also be challenged with announced or unannounced practice runs. The business continuity task force should lead efforts to execute or challenge the business continuity plans and to evaluate the resulting lessons learned.

Health Authority Communications

Health authority interactions and communications are an identified component in the quality risk management process in ICH Q9 and may occur at any point during the different stages of business continuity planning or execution. With respect to ensuring continuity of drug supply, it is important to recognize that regulations are in place to ensure the safety, efficacy, and quality of pharmaceutical products. However, it may be riskier for patients to go without a drug, due to supply disruptions, than to use a drug that does not meet all regulatory provisions. Sometimes, the issue driving the supply disruption will have little or no bearing on the safety, efficacy, or quality of the product, or the issue may be addressed in an innovative way that is not covered by the registered application. Therefore, it is important that MAHs consider all options to achieve responsible regulatory compliance that keeps the benefit/risk profile of the patient at the forefront, and interact candidly with health authorities to determine the most appropriate path forward during challenging circumstances.

This article summarizes key stages and decision points for successful business continuity planning to mitigate and prevent drug shortages, and the foundational concepts described are aligned with ICH Q9 guideline, Quality Risk Management. 5 The approach was developed from across company experiences and has benefited from preliminary learnings from the COVID-19 pandemic. It will be reviewed and updated, if required, based on further learnings emerging from industry interactions and regulatory feedback.

Each drug shortage event presents unique challenges and opportunities for improvement, and the events related to COVID-19 are no exception. One of the many outcomes of the COVID-19 pandemic has been that companies have needed to rely on business continuity planning to be more flexible and sharpen their focus on ways to ensure continuous supply of critical medicines. When we overcome these difficult times, it will be important to understand which business continuity measures worked well during this enormous, global event and which did not. There will also be an important opportunity to identify which manufacturing or business practices developed during the pandemic may be appropriate to implement routinely for greater effectiveness in the supply chain overall. Exciting new directions and enduring solutions for preventing and mitigating drug shortages may be achieved, and this constant evolution in the business continuity planning space should always be embraced.

The ISPE Drug Shortages Team is a team of multidisciplinary experts who seek to assist ISPE membership, industry, and regulatory collaborations to reduce drug shortages globally through technology, quality, and manufacturing innovation and regulatory compliance. This team is actively monitoring developments related to drug shortages and is available to respond to any associated questions. We welcome input on best practices to support the continuity of supply and decision-making regarding actual or potential drug shortages.

Larger versions of the figures in this article are available here: Business Continuity Planning to Prevent Drug Shortages figures

Acknowledgment

The ISPE Drug Shortage Initiative Team collectively developed the content for this article and special recognition is extended to the following contributors:

James Canterbury, Principal, Ernst & Young LLP, Iselin, NJ

Dawn Culp, BS, Hikma Pharmaceuticals USA, Inc., Berkeley Heights, NJ

Nasir Egal, PhD, Sanofi, Washington, DC

Erin R. Fox, PharmD, University of Utah Health, Salt Lake City, UT

Jean Francois Duliere, Pharmaceutical Senior Expert and Consultant, Paris, France

Emma Harrington, Moderna, Norwood, MA,

Drishya Nair, MS, Ernst & Young US LLP, Iselin, NJ

Terrance Ocheltree, PhD, RPh, Corium, Inc., Libertyville, IL

Christopher J. Potter, CMC Pharmaceutical Consultant, Marlborough, UK

Thomas Zimmer, PhD, ISPE Vice President, European Operations , Harxheim, GER

  • 'Share on Twitter'

About the Author

medical device business continuity plan

Related Articles

Figure 1: Pharma 4.0™ Operating Model.

Innovation is an integral part of corporate strategy. Initiatives to facilitate innovation are continually developed and pursued. The 2022 ISPE Pharma 4.0™ Emerging Leader (EL) Hackathon was designed based on innovator needs and provided a hands-on blueprint manufacturing exercise. Over a period of two days and facilitated by 40 subject matter experts, coaches, and jury members, 50...

Delivering Curative Therapies: Autologous vs. Allogeneic Supply Chains

Advanced therapy medicinal products (ATMPs) are one of the most promising developments in the pharmaceutical and biotech industries in recent decades. Although there is a great promise to treat and even cure many diseases with these products, there are also unique challenges, especially with their supply chains.

Digital Data: Your Roadmap to Supply Chain Efficiency

The global supply network that underpins life science manufacturing is vast and highly complex. Maintaining a reliable inflow of critical materials depends on more than your relationship with a particular supplier—it also depends on that supplier’s supply chain, with further dependencies and variabilities all along the value chain. With contract manufacturers also in the mix, the complexity...

  • Skip to main content
  • Skip to FDA Search
  • Skip to in this section menu
  • Skip to footer links

U.S. flag

The .gov means it’s official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you're on a federal government site.

The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

U.S. Food and Drug Administration

  •   Search
  •   Menu
  • Medical Devices
  • Medical Device Safety
  • Emergency Situations (Medical Devices)

Emergency Preparedness and Medical Devices: Supply Chain Recommendations for Health Care Providers, Device Manufacturers, and Distributors

During natural disasters and other emergency situations, medical devices may be exposed to fluctuating power, contaminants, or unusual levels of heat or humidity. There also may be disruptions in the delivery of devices or critical components and impacts on the device supply chain.

The FDA encourages medical device stakeholders to engage in preparation activities to minimize potential disruptions to patient care. Effective preparations can help ensure that critical supplies continue to be delivered in a timely and efficient manner.

For health care providers and systems, manufacturers, and distributors, here are some best practices to consider while preparing for natural disasters and other emergencies:

General Recommendations:

  • Engage with supply chain partners and other entities who may be able to supply resources and assistance during an emergency; create Memoranda of Understanding (MOUs) or Memoranda of Agreement (MOA) to formalize expectations for sharing resources and assistance during an emergency
  • Assess risk by identifying the potential impact of emergencies like hurricanes, wildfires, or pandemics on your supply chain, business operations, and facilities
  • Consider stockpiling additional materials to ensure you have sufficient inventory to maintain operations during any potential disruption
  • Identify alternative mechanisms for ordering, receiving, and tracking supplies as normal methods may be unavailable during and after a disaster

Recommendations for Health Care Providers:

  • Identify multiple delivery locations for essential supplies and ensure sufficient planning for how to route supplies to point of care locations.
  • Develop a contingency communication plan with key distributors to ensure ongoing communications regarding potential shortages or delivery challenges in case primary methods of communication are unavailable.
  • Create a secondary list of distributors for critical supplies in the event primary distributors are unable to meet demand.
  • Be prepared to implement conservation measures, as well as workflow modifications, to reduce excess consumption of devices without compromising quality of care.

Recommendations for Medical Device Manufacturers:

  • Identify manufacturing sites susceptible to disruptions caused by severe weather and forecast demand for products produced in those locations to ensure sufficient production capacity in the event of a disaster
  • Plan for the continuity of business operations by ensuring additional production capacity is available and identifying alternate sources of materials and delivery methods
  • Review risk management plans and identify critical suppliers that could be impacted by severe weather
  • Identify sterilization facilities that are susceptible to hurricane and/or severe weather disruptions and plan accordingly

Recommendations for Distributors:

  • Identify regions susceptible to disruptions caused by severe weather and pre-position additional inventory in warehouses and customer facilities, where appropriate.
  • Develop a plan for effectively communicating with customers about the availability of products, including product shortages, viable alternatives and/or substitutions, allocation limits, and order confirmations in the event normal ordering processes are unavailable.
  • Collaborate with state and local authorities on opportunities to ensure uninterrupted supply of medical devices in the event of disruptions from extreme weather events, including an effective channel for communicating with emergency management personnel.

If you have feedback or questions related to the medical device supply chain, please contact the Resilient Supply Chain Program for Medical Devices by emailing [email protected] .

If you have questions about emergency preparedness and medical devices, contact the All Hazards Readiness Response & Cybersecurity Program by emailing [email protected] .

Additional Resources

  • Disposal of Contaminated Devices
  • Reopening Dialysis Clinics after Restoration of Power and Water
  • Medical Devices Requiring Refrigeration
  • Medical Devices that Have Been Exposed to Heat and Humidity
  • Tips for Mammography Facilities Following Natural Disasters or Severe Weather Conditions
  • FDA Offers Tips about Medical Devices and Hurricane Disasters
  • Resilient Supply Chain Program for Medical Devices

easton redding 9

  • Understanding Business Continuity vs BDR: A Guide
  • Business Continuity

Protect Patient Care and Privacy with Healthcare Business Continuity Planning

  • February 24, 2023

Dale Shulmistra

Dale Shulmistra

healthcare-business-continuity-planning

Maintaining continuity is vital for every business, but perhaps no other industry faces the same level of urgency as healthcare. Without a solid healthcare business continuity plan in place, healthcare organizations could become paralyzed by a crisis at any time. This poses a risk not only to the organization’s bottom line but also to the privacy and safety of patients and staff.

Healthcare facilities, including hospitals, clinics, and labs, play a critical role in public health, which puts them in an especially precarious position when it comes to continuity. If a hospital’s IT network fails, it can endanger the facility’s reputation and financial standing, not to mention patient health. Read on to learn what risks today’s healthcare organizations face and how an established system of business continuity can better prepare them for any emergency scenario on the horizon.

The Importance of Healthcare Business Continuity

While the principles of business continuity are generally the same regardless of industry, healthcare business continuity stands apart in several ways. When a healthcare facility experiences data loss or other disasters, the downtime affects more than just the “business.” It also affects:

  • Patients:  If a facility experiences an emergency and hasn’t planned properly, patient care might be disrupted or delayed, which can have serious long-term effects.
  • Patient data:  Cyberattacks and data breaches can expose sensitive health and identifying information to unauthorized parties, creating the risk of identity theft.
  • Legal liabilities: If a loss in care puts patients’ health at risk, the facility may face accusations of negligence.
  • Regulatory liabilities: Facilities that are found to be noncompliant with federal laws like the Health Insurance Portability and Accountability Act (HIPAA) can be hit with huge fines—on top of all the other losses caused by the disruption.

The importance of healthcare business continuity planning cannot be overstated. Every facility—whether it’s a small town doctor’s office or a  sprawling regional hospital system —must have a comprehensive plan for disaster prevention and recovery.

Possible Continuity Disruptions for Healthcare Organizations

Healthcare facilities face a wide range of risks that can interrupt operations, take critical systems offline, and limit the ability to care for patients. When developing a business continuity strategy, it’s important to consider all potential disruptions, including:

  • Natural disasters such as earthquakes, hurricanes, and fires
  • Power and water outages
  • Widespread staff illnesses
  • Supply chain disruptions
  • Cyberattacks, including data loss from malware and ransomware

While a single organization is unlikely to experience multiple emergencies on a regular basis, evaluating each type of threat and how it would affect your facility is an essential step. Knowing the risks you face empowers you to adequately prepare, which, in turn, shortens recovery times and significantly reduces financial losses.

The Threat of Ransomware in Healthcare

While hospitals and other healthcare providers face a variety of threats, ransomware has become particularly ominous. In recent years, the Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Federal Bureau of Investigation (FBI) and the Department of Health and Human Services (DHHS), has issued dire warnings and advisories about the risk of ransomware attacks against the healthcare industry. Let’s dig into the details of how ransomware affects healthcare business continuity.

Frequency and Severity

Healthcare organizations are under regular siege by cyberattackers, and the situation has grown progressively worse over time. Data breaches on the whole have been on an upward trajectory for several years, particularly in cases involving large quantities of patient information. The number of healthcare data breaches involving 500 or more patient records steadily increased from 2009 to 2021 .

While data breaches occur due to a variety of errors and attacks, ransomware is the most concerning cause, and more healthcare organizations are experiencing ransomware attacks than ever before. A 2022 report from Sophos revealed that 66% of surveyed healthcare organizations  surveyed experienced a ransomware attack in 2021, compared to 34% in 2020.

Ransomware is not only becoming more frequent but also more serious. These worrying statistics  from a recent study published by the Journal of the American Medical Association further demonstrate the gravity of the ransomware threat against healthcare organizations:

  • The annual number of ransomware attacks on US healthcare organizations doubled from 2016 to 2021.
  • In that five-year period, 374 ransomware attacks on US healthcare organizations exposed the personal health information (PHI) of approximately 42 million patients.
  • Nearly half of the ransomware attacks in the healthcare industry disrupted the delivery of care.
  • Among organizations that experienced an attack, 41.7% suffered electronic system downtime and 10.2% had to cancel scheduled care.

These statistics underscore the importance of healthcare business continuity planning, which integrates prevention and recovery strategies that can reduce the likelihood that a ransomware attack will occur and minimize the damage if it does.

Consequences

Reports of ransomware incidents often focus on the immediate effects like system outages, but the consequences are much more complex than an initial assessment of the situation might suggest. Additional details from the Sophos survey paint a clear picture of how a ransomware attack might impact a healthcare facility:

  • Healthcare organizations are far more likely to pay ransom demands to restore their encrypted data, yet they recover far less data. In 2021, healthcare organizations recovered 65% of their data, on average, after paying the ransom.
  • Recovery times for ransomware attacks against healthcare are painfully lengthy, with one in four organizations needing up to a month to recover.
  • Among surveyed healthcare organizations, 94% stated that the attack caused business or revenue losses, with an average remediation cost of $1.85 million.

Despite these potentially devastating outcomes, healthcare organizations have not adequately invested in measures like cyber insurance, particularly in comparison to other industries. This lack of preparation puts life-saving facilities in incredibly vulnerable positions.

The CommonSpirit Attack

While statistics are a useful means of understanding the ransomware threat, a real-life example helps put everything in context. The attack against CommonSpirit Health perfectly captures the danger posed by ransomware.

In early October 2022, CommonSpirit, the second-largest nonprofit hospital chain in the United States, identified a ransomware attack against its systems. Though the organization says it acted quickly to prevent extensive damage, the effects speak for themselves:

  • Many of CommonSpirit’s hospitals had to cancel appointments and take patient portals and electronic health records offline.
  • Annual financial records revealed that the cost of the outage was approximately $150 million.
  • The attack exposed the personal health and personal identifying information of more than 600,000 patients .

Following the disclosure that patient information was exposed, CommonSpirit has faced multiple class-action lawsuits on behalf of plaintiffs who argue that the organization didn’t take adequate steps to protect sensitive data. One lawsuit is seeking more than $5 million in damages, while another is requesting complimentary credit monitoring services, actual damages, compensatory damages, statutory damages, and statutory penalties. If the court rules against CommonSpirit, these suits could cost the organization millions, in addition to the recovery and revenue losses they experienced during the initial attack. The ransomware attack on CommonSpirit is a prime example of how such incidents can cause not only an immediate disruption but also a long-term impact on patient trust.

Why Ransomware Targets Healthcare Facilities

With such a variety of businesses available to target, why do ransomware gangs continue to focus on hospitals and healthcare? One reason is that many organizations implement woefully inadequate cybersecurity measures despite the imminent threat of a cyberattack . The most common vulnerabilities include:

  • Lack of system patching: Organizations often have lax protocols for updating applications and operating systems.
  • Not enough cybersecurity training: Healthcare workers, including physicians, often fall prey to malicious emails containing malware or links to infected sites, and they don’t receive enough training in recognizing the signs of a phishing scam.
  • Weak passwords : Lax password-management policies at healthcare facilities make it easy for hackers to break into otherwise secure applications.
  • Unprotected devices : Today’s advanced medical devices are increasingly connected to the Internet, but they often aren’t protected with the same cybersecurity measures as traditional hardware.
  • Outdated data backup systems : Healthcare groups have been slow to upgrade to more advanced data backup solutions that could help them minimize the risk of data loss after an attack like ransomware.

Hackers are well aware of cybersecurity weaknesses in the healthcare industry, and they’re happy to exploit them for personal financial gain. They also know that patient data is voluminous and highly sensitive, which increases the likelihood that healthcare facilities will pay the ransom. Maintaining business continuity in healthcare will remain a challenge until these vulnerabilities are resolved across the industry.

How Healthcare Business Continuity Literally Saves Lives

The CommonSpirit ransomware attack provided a clear illustration of how a disruption can be detrimental to patients: records were completely lost, and patients were effectively forgotten by their providers.

Consider also the attack on the Health Service Executive (HSE), the national healthcare system in Ireland. A ransomware attack rendered many of the healthcare facilities within the system unable to provide patient care, leading to canceled appointments for services like cancer treatments. A similar, smaller-scale incident occurred at Tallahassee Memorial HealthCare, one of the largest hospitals in the south. Tallahassee Memorial had to cancel appointments and divert ambulances to other hospitals due to a cyberattack in February 2023. While canceled appointments may seem like a nuisance, for many patients, they can mean a delay in critical care and worse long-term outcomes.

The effects also go beyond appointment cancelations. Imagine the effects of lost data, such as patient records, in intensive care units. A disruption in medication delivery or confusion about a patient’s existing conditions can create life-threatening situations. Make no mistake: a break in healthcare continuity is a break in patient care, and facilities have an obligation to create an effective continuity strategy.

The Sky-High Costs of Downtime in Healthcare

An operational disruption can be expensive for any business. For smaller companies, a single hour can easily cost more than $10,000. But for large healthcare organizations, those downtime costs can balloon into millions of dollars per hour.

Running a healthcare facility is naturally expensive. Under normal circumstances, those costs are offset by the healthcare costs passed onto patients and their insurance providers. Unfortunately, when a disaster causes 19,000 appointments to be canceled, for example, that’s a huge loss in revenue—especially when salaried health professionals are still being paid despite the disruption. Patient care aside, these sky-high costs are another reason why healthcare organizations are under more pressure to maintain continuity.

The Risk of Regulatory Noncompliance

Federal regulations are especially strict for healthcare organizations, and rightly so. A failure in healthcare business continuity planning can not only put patients at risk of bodily harm but also their most sensitive data to cybercriminals. To help prevent these risks, the U.S. government developed regulations like HIPAA. The law sets specific rules for how healthcare organizations handle sensitive data, including:

  • Transmission and processing
  • Protections against theft and instruction
  • Back-up methods

Under the law’s Security Rule , a healthcare organization must deploy technology and protocols that enable it to quickly restore data after a disruptive event so that it can continue operating in “emergency mode.” A failure to comply with HIPAA comes with steep costs, with each violation carrying a fine of up to $50,000 . As such, every healthcare organization should have a  HIPAA compliant disaster recovery plan.

Key Steps to Healthcare Business Continuity

When developing continuity plans, healthcare organizations must keep some essential steps in mind. Identifying risks, evaluating impacts, and implementing better backup solutions creates a foundation for better continuity.

Identify Risks and Impacts

The first step to setting any business continuity objective at a healthcare organization is creating a comprehensive disaster recovery plan (DRP), which should include two core components: risk assessment and business impact analysis.

Healthcare organizations must assess all the risks that pose a threat to operations, including data breaches, ransomware attacks, and hardware failures. It’s important to evaluate each organization individually as location, size, and structure can play a significant role in determining whether a threat exists and how severe it might be.

Following a risk assessment, every hospital facility should conduct a business impact analysis to determine how each type of event would hurt operations. Important questions to ask include:

  • How long would recovery take?
  • What costs would accrue?
  • What services might be disrupted?

An impact analysis reveals just how bad things could get, thus helping an organization understand which solutions are needed to mitigate and recover from such events.

Establish Stronger Data Protection

Data threats like ransomware aren’t going away anytime soon, especially while healthcare organizations continue to leave themselves exposed to targeted attacks. However, high-quality backup solutions significantly reduce the risk of data loss and downtime, even after a large-scale ransomware attack. Large facilities can make use of  data backups with ransomware detection and massive storage capacities. Small practices and community clinics, on the other hand, can benefit from more affordable options with smaller capacities but equivalent security features.

Backup frequency and storage type are also important considerations. With the ability to schedule backups as often as every five minutes and recover a virtualized backup in seconds, healthcare firms can maintain continuity through nearly any data disruption. Hybrid backups , which store data both on-site and in the cloud, make it more likely that organizations can recover data even after an aggressive attack. This kind of protection is needed throughout the healthcare industry to ensure operational continuity, no matter what form of data disaster strikes next.

The Essentials of IT Disaster Recovery for Healthcare

All components of a healthcare organization’s IT infrastructure must be adequately protected against downtime threats. Similarly, when any of those systems are disrupted, the organization must have a solution in place that enables a rapid recovery. Essential components for disaster recovery in healthcare include:

  • Network security and redundancy
  • Data backup solutions
  • Antimalware systems
  • Redundant telecommunications lines
  • Backup power generators

However, recovery alone is not enough. Prevention is also crucial to business continuity. Among the most important preventative measures are:

  • Cybersecurity training for personnel
  • Disaster recovery testing and drills
  • Network penetration tests
  • Test recoveries of data backups

Failure to employ any one of these strategies could leave healthcare organizations unprepared to cope with potential crises and disasters.

Where to Turn for Better Healthcare Business Continuity

Healthcare business continuity is a matter of financial stability, organizational longevity, and patient safety, but it often feels like an overwhelming and burdensome process. Healthcare organizations that don’t yet have a business continuity or disaster recovery plan in place can begin with a template that they can tailor to align with the needs of their individual facilities.

If your healthcare organization needs some extra help preparing for possible disasters, make use of the resources available through Invenio IT. To see firsthand how a business continuity solution can protect your healthcare organization against ransomware and other data threats, request a free demo  of today’s advanced technology. For guidance on how to develop a stronger healthcare business continuity plan, reach out to Invenio IT’s team of disaster recovery experts.

New call-to-action

Related Articles

statistics-on-data-loss

Data Loss Statistics that Prove Every Business Needs a Backup Solution

  • February 22, 2024

Business Continuity Plan Objectives

9 Business Continuity Plan Objectives Every Business Should Use

  • February 14, 2024

medical device business continuity plan

Permanent Remote Workforce? 14 Questions to Consider ASAP

  • February 8, 2024

Zero Trust

Zero Trust 101: What You Need to Know

  • January 31, 2024

everything you need to know about cyber insurance

How Cyber Insurance Protects SMBs and Improves Their Resilience

  • January 29, 2024

salesforce outage

What Businesses Can Learn from the Latest Salesforce Outage

  • January 18, 2024

© 2023 InvenioIT. All rights reserved.

medical device business continuity plan

Quality Solutions Now Quality Solutions Now

Business continuity planning: vital to the life sciences industries.

Business continuity planning: vital to the life sciences industries

Business continuity planning (BCP) is essential for the success of any enterprise, but it’s particularly crucial for companies in the life sciences industries, where criticality and compliance with FDA regulations may be impacted by a host of factors ranging from cybercrime to natural disasters to disruptions in the supply chain.

BCP: A Four Part Process

BCP is the development of a plan for a business to resume its most essential functions following a disruption. The Ready program , a national initiative that works in tandem with FEMA to help families and businesses prepare for and recover from disaster, breaks BCP down into a four-part process:

  • What financial and operational impact could ensue as a result of disruption to individual business processes or functions?
  • At what point following disruption to process or function would the organization experience the potential impact?
  • This data is then used to prioritize the functions and processes whose disruption could result in the greatest negative impact.
  • Recovery Strategies : Determine the resources needed for recovery and conduct a gap analysis to identify the discrepancies between the necessary resources and the organization’s current capabilities. Restoration of regular business function can require internal resources or those obtained from third parties; resources can range from personnel and office space to power sources and technology. This step includes exploring various recovery strategies and selecting the ones most appropriate to your organization.
  • Plan Development : Develop plans to implement selected recovery strategies; this step includes assembling a recovery team, documenting the organization’s BCP, writing out protocols for relocation and manual workarounds, and gaining approval from management.
  • Testing & Exercises : Establish testing and maintenance procedures for all recovery strategies in the BCP; develop and facilitate training to ensure all employees understand and can support execution of the plan. Test the recovery strategies and update the BCP as needed based on the results of testing.

Risk Assessment & Risk Management

Risk assessment is one step in an overall system of risk management that FEMA, in its Continuity Guidance Circular I , outlines as a five-phase cycle aimed at identifying and mitigating the impact of disruptive events. It closely parallels the process for business continuity planning:

  • Strategic Goals, Objectives, and Constraints : Determining how resources should be allocated among leadership, staff, facilities, and communications for the organization’s BCP to be met, who should be involved in the decision making process (stakeholders, those affected by the decisions), and what factors will impact decisions around continuity planning (finances, degree of risk, severity of impact, etc.).
  • Risk Assessment: Identify the risk, its likelihood of occurrence, and the potential impact if it does occur. This is achieved by creating an inventory of the business’ essential functions, identifying hazards (natural and man-made) that could compromise the business’ ability to carry out these functions, developing continuity hazard scenarios that take into account the risk to the four main components of continuity (leadership, staff, facilities, and communication), and determining the countermeasures already in place to mitigate risk.
  • Evaluating Alternatives to Address Risk : Develop alternate strategies to mitigate risk for those scenarios where existing countermeasures are found to be insufficient. Reevaluate the risk in each scenario based on implementation of the alternative strategy to determine the degree to which risk is further reduced.
  • Selecting Appropriate Alternatives : Choose the most suitable alternative strategies based on their potential for risk reduction, as well as the factors identified in phase one. Get buy-in from stakeholders and ensure the chosen strategies are understood by the company.
  • Implementation & Analysis of Results : Establish metrics to assess the efficacy of the chosen strategies; implement the strategies and evaluate their performance based on these metrics.   

Risk profiles in the life sciences industries

For most companies, a risk profile will run a typical gamut of risks:

  • Market risk stemming from fluctuating economic conditions or investment values.
  • Operational risk arising from a breakdown of internal processes or systems, or human error.
  • Business recovery risk based on the organization’s vulnerability to loss following disruption of its daily operations.
  • Catastrophic loss resulting from a highly impactful—and often unpredictable—event.

While these are broad categories and not exclusive to the life sciences industries, there are industry-specific risks that need to be considered in the development of any BCP for pharmaceutical, biologics, combination product, and medical device manufacturers.

FDA regulations and approvals, as well as potential changes in the healthcare industry and in healthcare laws are sure to be listed in the risk profile of any organization in the life sciences. But an increasingly significant area of concern is the integrity of supply chains, not only in resilience to disruption but in compliance with necessary standards.

A recent report cited by Continuity Central notes that life sciences ranks in the top three industries impacted by supply chain events, sharing the spotlight with automotive and high tech. It’s no surprise then that the U.S. Economic Development Administration (EDA), in its Industry Cluster Briefing Series on Biotechnology, Pharmaceutical, and Life Sciences Cluster , advocates the development of a supply chain risk management system that plots out the entire chain to identify interdependencies and potential areas of risk so that organizations can engage with suppliers to integrate their BCP at every point of the supply chain.

Final Thoughts

Given the life science industry’s reliance on supply chains—often specialized to the point of a series of single source relationships—and its obligation to meet FDA requirements in a continuously evolving technological and regulatory landscape, development of a robust BCP and implementation of a thorough risk management system is critical to organizational resilience and success.

The health industry is a heavily regulated industry full of unexpected challenges. Let our industry experts guide you through your next mission-critical project.

QSN designed and implemented a complete quality system for my medical device business. Their service was professional and efficient, both from a cost and time perspective. While I had always suspected that QSN had provided me with a first rate quality system, the proof came when the FDA announced a complete audit of my business on very short notice. QSN gave me full support for the audit itself on a very tight time schedule and my business passed the audit with no observations. I could not be happier with their service and wholeheartedly recommend them. Medical Device Manufacturer President and CEO

IMAGES

  1. Free Business Continuity Plan Templates

    medical device business continuity plan

  2. Business Continuity Plan Template

    medical device business continuity plan

  3. How to Write a Business Continuity Plan?

    medical device business continuity plan

  4. FREE 12+ Sample Business Continuity Plan Templates in PDF

    medical device business continuity plan

  5. PPT

    medical device business continuity plan

  6. Healthcare Business Continuity Planning Capabilities Ppt Elements

    medical device business continuity plan

VIDEO

  1. BUSINESS CONTINUITY PLAN

  2. Business Continuity Plan (PhIS) 2024

  3. 2023 03 16 Medical Device Finance and Business Development

  4. Electricians Useful Multipurpose Testing Device Part -2

  5. 🏥 The Struggle of Starting a Medical Device Business 🛠️ Don't Underestimate the Challenge!

  6. Medical Devices Webinar

COMMENTS

  1. CREATING A BUSINESS CONTINUITY PLAN - NACHC

    Business continuity planning is the process of identifying critical business functions of an organization, developing solutions to maintain those functions during a disruption, testing those solutions, and updating and revising solutions on a continuous cycle.

  2. Business Continuity Plan Template for Medical Device Companies

    Business Continuity Plan Template for Medical Device Companies 1. Define clear examples of your focus areas. A focus area is a general area of improvement or strategy within a... 2. Think about the objectives that could fall under that focus area. Objectives are goals or targets that are set to... ...

  3. MES for Business Continuity in the Medical Device Industry

    Boosting Efficiency and Profitability. Collectively, this underscores the need for production oversight and control; stringent quality management; compliance to regulations; and maintaining a profitable bottom line. MES is at the core of productivity for maintaining business continuity.

  4. Risk Management for Medical Device Manufacturers - MDI

    February 22, 2023 Table of Contents Types of Risks Faced by Medical Device Manufacturers Regulatory Risks Product Liability Risks and Safety Risks Business Continuity Risks Identifying and Assessing Risks Methods for Identifying Risks Assessing the Likelihood and Impact of Risks Mitigating Risks Risk Prevention and Control Measures

  5. Business Continuity Planning to Prevent Drug Shortages - ISPE

    Generally, the four stages of business continuity planning will proceed in the order shown in Figure 1; however, as patient needs develop or business or regulatory landscapes change, it may be appropriate to make targeted adjustments within any one of the four stages to ensure the best outcomes.

  6. Emergency Preparedness and Medical Devices: Supply Chain ...

    The FDA encourages medical device stakeholders to engage in preparation activities to minimize potential disruptions to patient care. ... Plan for the continuity of business operations by ensuring ...

  7. The urgent need for business continuity planning in healthcare.

    In recent years, the Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Federal Bureau of Investigation (FBI) and the Department of Health and Human Services (DHHS), has issued dire warnings and advisories about the risk of ransomware attacks against the healthcare industry.

  8. Business continuity planning: vital to the life sciences ...

    While these are broad categories and not exclusive to the life sciences industries, there are industry-specific risks that need to be considered in the development of any BCP for pharmaceutical, biologics, combination product, and medical device manufacturers.