Health care companies and facilities in South Africa carry many risks similar to those faced by their global peers, as well as those faced by local organisations in other sectors. Combined, these risks create a distinctive risk profile for companies in this sector, says, Lynette Smit, a Business Continuity advisor at ContinuitySA.

"Health care companies need to pay special attention to business continuity as their businesses deal directly with human life," Smit explains.
"However, ContinuitySA's experience in both the public and private health care sectors shows that certain risks are particularly acute in South Africa—and that many of them are overlooked. This may be because many of them are not directly related to the company's core business, but could have a huge potential impact on it."

ContinuitySA believes that the following 8 risks particularly affect the South African health care sector, and should be factored into organisations' business continuity planning schedules.

Outdated buildings and infrastructure. This risk is particularly high in the public sector as many buildings are leased, and landlords do not undertake proper maintenance. In addition, many public health facilities are in old buildings in which wiring can be faulty, or in which sprinkler systems are not installed due to heritage regulations. Working in such conditions can negatively affect staff morale and pose a threat to the safety of both staff and patients.

Over-reliance on third-party suppliers. For budget reasons, a lot of specialised equipment is leased and is often outdated. This in turn places the organisation at the mercy of suppliers and service organisations: because maintenance engineers, or replacement equipment in the event of a breakdown, are scarce, important medical tests or procedures can be delayed. Another supply chain vulnerability is the industry's heavy reliance on drivers and couriers for the transport of specimens to medical facilities—union activity can thus impact heavily.

In addition, the public health sector is bedevilled by slow procurement processes.

Power interruption. Power outages are set to increase in frequency and severity for the foreseeable future, a definite risk for organisations dealing with life-and-death issues. Too many healthcare organisations have generators with limited diesel supply, and with uncertain maintenance and testing schedules. "A crisis or power outage is the wrong time to find out your alternative power source is inoperative or can only sustain you for a short period of time," Smit notes.

Poor IT infrastructure and disaster recovery. All businesses are dependent on IT, but none more than medical laboratories or research facilities. Another problem is that business critical and client-sensitive data is frequently stored on unsecured laptops.

Despite their high reliance on IT, health care companies often do not have adequate IT disaster recovery plans in place, and testing is not performed regularly to ensure both data and systems can be restored within specified time limits.

Another critical IT dependency for health care is bandwidth, particularly when it comes to remote facilities.

Inadequate security of critical paper documentation. The flipside of the health care sector's IT risks is the fact that its continued high dependence on paper documentation such as highly confidential patient records, also creates vulnerability. Storage of documentation in digital formats is considered to be leading practice. ContinuitySA recommends the implementation of an electronic document management system to ensure compliance with the Protection of Personal Information Act, or the building of a fit-for-purpose document storage facility with adequate redundancy.

Skills shortages. Specialist human resources are a feature of the health care industry but they are in short supply. An organisation can find itself reliant on certain individuals who cannot easily be replaced. Exacerbating factors include high attrition rates in the sector owing to low morale, and lengthy recruitment processes.

Crime. While all South African businesses face high risk from criminal activity, health care companies have a higher risk because goods/samples/specimens are often stolen from research and / or storage facilities because they form critical evidence impending court cases.

The loss of years of research findings, or the theft of patient information during a robbery also constitutes a risk as the findings are often irreplaceable and patient information can be highly sensitive in nature.

Inadequate buffer stocks. Industry standards stipulate that health care facilities must carry at least 30 days' worth of buffer stocks. Complicating factors for health care providers to adhere to these regulations include the limited shelf life of some products, and a lack of funds to build and manage stockpiles.