Location: US, TN, Memphis
Company: Methodist Le Bonheur
The Director of Business Continuity is responsible for building, leading, and maturing Methodist Le Bonheur Healthcare’s enterprise business continuity management (BCM) program as a core capability of the Security and Emergency Management function. This leader will establish the governance, operating model, standards, tools, methods, and executive reporting required to ensure MLH can sustain or rapidly restore critical clinical, operational, financial, digital, and administrative services during and after disruptive events. This role provides enterprise leadership across acute care, ambulatory operations, clinical and ancillary services, revenue cycle, supply chain, digital health, information technology, facilities, compliance, and third-party partners. The director will distinguish and integrate related resilience disciplines: business continuity management focuses on sustaining essential operations and clinical services; crisis management provides executive command, decision-making, escalation, and communications during high-impact events; and disaster recovery restores technology infrastructure, applications, data, and access in alignment with business-defined priorities. This role is accountable for ensuring those capabilities operate as an integrated resilience system without conflating ownership or scope. This role models appropriate behavior as exemplified in MLH’s mission, vision, and values.
Job role:
Program governance and strategy
- Establish a system-wide BCM governance structure that includes executive sponsorship, cross-functional steering committee oversight, operational workgroups, and clear integration with emergency management, IT disaster recovery, cyber resilience, enterprise risk management, compliance, and clinical operations.
- Develop and maintain a RACI/RASCI model that clarifies responsibilities across business continuity, emergency management, crisis management, disaster recovery, incident response, facilities, clinical operations, and third-party resilience.
- Establish annual and multi-year BCM objectives aligned to MLH strategic priorities, patient safety, regulatory readiness, operational risk, cyber resilience, and enterprise transformation.
Business impact analysis and risk assessment
- Lead the development, deployment, and annual refresh of MLH’s standardized business impact analysis (BIA) methodology across clinical, operational, administrative, digital, financial, and support functions.
- Ensure the BIA is process-first and business-led, focusing on critical clinical and operational processes rather than starting with applications or technology platforms.
- Coordinate with IT disaster recovery and application owners to align business-defined recovery expectations with RTOs, RPOs, application dependencies, data recovery expectations, and restoration sequencing.
Business continuity planning
- Develop and maintain enterprise BCM standards, templates, playbooks, planning tools, and documentation requirements for departments, service lines, facilities, shared services, and corporate functions.
- Oversee the creation, review, approval, and maintenance of business continuity plans for critical functions across acute care, ambulatory, clinical support, administrative, revenue cycle, IT-enabled operations, and supply chain areas.
- Develop phased continuity strategies for extended disruptions, including short-duration downtime, multi-day technology outages, cyber incidents, utility disruptions, supply shortages, facility loss, public health emergencies, and regional disasters.
Crisis management and operational resilience
- Partner with Security and Emergency Management leadership to ensure BCM is integrated with MLH’s crisis management, emergency operations, Hospital Incident Command System, executive escalation, and incident response structures.
- Support crisis activation, executive decision-making, situational awareness, operational prioritization, and continuity/recovery coordination during actual or potential disruptive events.
- Coordinate post-incident recovery planning and after-action processes to capture lessons learned, assign corrective actions, and strengthen future readiness.
Disaster recovery coordination
- Maintain a clear distinction between BCM and IT disaster recovery while ensuring strong integration between business priorities and technology recovery.
- Facilitate operational validation of IT disaster recovery plans to ensure recovered systems and restored data actually enable critical clinical and business processes.
- Support extended IT downtime preparedness for EHR, clinical systems, imaging, laboratory, pharmacy, revenue cycle, telehealth, identity/access, network, communications, and other critical technology dependencies.
Testing and exercises
- Design and lead an enterprise BCM exercise strategy that includes tabletop exercises, functional exercises, department-level downtime drills, vendor-participation exercises, cyber/technology disruption scenarios, and enterprise-wide resilience simulations.
- Ensure exercises test realistic clinical and operational scenarios, including extended EHR downtime, cyber incidents, communications outages, supply shortages, facility loss, utility outages, patient surges, regional disasters, and third-party failures.
- Ensure BCM exercise outcomes are reported to the appropriate governance bodies and used to improve plans, training, resource allocation, controls, and executive readiness.
Vendor and third-party resilience
- Establish and maintain a third-party resilience framework for vendors and partners that support critical clinical, operational, technology, supply chain, revenue cycle, digital health, and administrative functions.
- Ensure critical vendor contracts and service relationships address continuity expectations, incident notification, recovery commitments, testing participation, service-level requirements, data recovery, transition support, and exit considerations.
- Coordinate vendor participation in exercises where third-party services materially affect patient care, operational continuity, revenue cycle, technology availability, or supply continuity.
Regulatory compliance
- Ensure the BCM program supports MLH’s readiness for Joint Commission Emergency Management standards, CMS Emergency Preparedness requirements, HIPAA contingency expectations, state and local requirements, and applicable healthcare accreditation and regulatory obligations.
- Maintain documentation that demonstrates alignment with emergency planning, continuity of operations, communication planning, policies/procedures, training, testing, after-action review, and corrective action expectations.
- Align BCM program design with recognized frameworks and leading practices, including ISO 22301, BCI Good Practice Guidelines, DRII Professional Practices, ASIS business continuity guidance, FEMA/NIMS, and healthcare emergency management practices.
Executive communications
- Develop executive-ready dashboards, briefings, board-level narratives, risk summaries, maturity updates, and decision materials that clearly communicate MLH’s continuity posture.
- Provide regular updates to the BCM steering committee, Security and Emergency Management leadership, IT leadership, clinical and operational executives, and other governance forums.
- Partner with Communications, Legal, Compliance, Privacy, Emergency Management, and executive leadership to support internal and external crisis communication needs.
Metrics, reporting, and continuous improvement
- Define and maintain BCM performance metrics, maturity indicators, risk indicators, and executive scorecards.
- Track core measures, including BIA completion, continuity plan completion, plan validation, exercise participation, corrective action closure, critical vendor review completion, training completion, downtime readiness, RTO/RPO alignment, and plan review timeliness.
- Benchmark BCM maturity against healthcare and enterprise resilience practices and recommend improvements to strengthen MLH’s operational resilience.