The Basics

This subsection requires that the organization implement a disaster recovery system.  It requires testing of that system at least biannually, and evidence that the organization takes action on opportunities for improvement identified in such testing.

This is a standard that can be met in a myriad of ways, given the diversity in technological approaches to disaster recovery.  The most commonly seen system, of course, involves periodic back-ups with the tapes being taken offsite to a storage facility that is secure from fire and catastrophic weather.  It also could involve the maintenance of a "mirror" system that, on a real-time basis, keeps all data in two or more geographically separate places.  Employees in the IT department should be familiar with their particular organization's approach to this important issue.

Management Tips

Documentation of disaster recovery planning can be massive, running into the thousands of pages in large, complex organizations.  While this can be important, it is not of particular utility in the context of URAC, either from the employee training perspective or from the reviewer's perspective.  Make sure your documentation also has a high-level summary description of the methodology used.  It is also important to assure that this documentation is comprehensive as to all systems -- in other words, make sure you have a way of recovering all your important data.

Documentation of the testing requires two components -- evidence of the test and evidence that the organization takes the results of the test seriously by taking action in response to problems identified in that testing.  Meeting minutes, quality improvement plans, corrective action plans, all should be considered as a supplement to mere documentation that the organization has tested its disaster recovery system.

URAC Accreditation Tips

The documentation at the AccreditNet phase should include a summary of the disaster recovery plan and a summary of the most recent test of that plan.  The onsite review will delve more deeply into how the organization implements that plan, lessons learned in the most recent test, and what the organization has done in response to those lessons.

While the implementation of the plan is a primary element of this primary standard, the testing of that plan and implementation of system improvements in response to the test are secondary elements.

URAC Accreditation Tips