Core 4.0

C-RM 2-1: Business Continuity Plan

Submited by: Tom Goddard

The Basics

Your organization must implement a business continuity plan ("BCP") for its program operations. The BCP must:

  • Clearly identify the systems and processes that are essential to your organization;
  • Outline the effect that the disruption of these systems and processes would have on your organization;
  • Describe your organization's strategy for dealing with such disruptions in various circumstances, such as various lengths of time of outage.

Management Tips

URAC sees this as a sequential process:

  • In order to prepare a BCP, you need first to figure out what business operations need to be continuous.
  • Once you've done that, you need to envision what would happen if something happened to each of these operations.
  • Only then are you ready to say what you'll do to respond to an outage.

In the midst of your BCP document, we recommend that you build a spreadsheet or grid that outlines all of these possible outage scenarios and your responses. Reviewers like grids for this standard.

Accreditation Tips

Desktop Review
Provide the BCP and any other documents that would be useful in conveying to the reviewer that you've thought through and planned for the full array of outage scenarios.
Validation Review
The URAC reviewer will talk about your BCP with senior leadership and staff involved with its implementation.
Document review
Be prepared to show the reviewer any documentation that shows activity related to the BCP since you submitted documents to URAC for desktop review. Such documents might include committee meeting minutes or testing results.

  • Core 4.0 / 12.31.2018

    C-RM 3-1: Information Systems Risk Assessment and Reduction

    URAC assumes that your organization has a comprehensive risk management program, and in this standard, requires that your information systems are a component of that system. Specifically, the IT component must address explicitly data storage, gathering, and transfer.Your organization must conduct risk assessment in these three areas, and that assessment must periodically include "an entity with th...

  • Core 4.0 / 12.26.2018

    C-RM 2-3: Business Continuity Plan Testing

    Your organization must test its business continuity plan ("BCP") no less frequently than every two years. Notably, the BCP test can be a tabletop exercise, which URAC defines as:test of a Business Continuity Plan (BCP) that includes documentation of the following aspects of the test:A tabletop exercise simulates an incident in an informal, stress-free environment.The participants who are usually t...

  • Core 4.0 / 12.26.2018

    C-RM 2-2: Pharmacy Emergency Management Plan

    Applicable only to organizations seeking accreditation in one of URAC's pharmacy modules, this standard requires that your business continuity plan describe an emergency management system that addresses how the organization will distribute medications in the event of an emergency. The description must address the organization's facilities, its services, and its products in some detail. As was the...