Check out this recent Compliance Perspectives podcast where Jill Cusack, AVP, Privacy Officer of American Fidelity; Tom Leatherbee, Manager, Recovery Division, Hagerty Consulting; and Fey LLC’s own, Laura Clark Fey speak with Adam Turtletaub, Chief Engagement & Strategy Officer at the Society of Corporate Compliance and Ethics on the importance of the compliance team in disaster preparedness, response, and recovery. If you would like to see the full presentation on this topic, please join Jill, Tom, and Laura on Tuesday, October 3rd, 2023, at 9:45 A.M, at the 22nd Annual Compliance & Ethics Institute in Chicago, Illinois, or via live broadcast!

Listen to or download the podcast recording (MP3, 15 minutes). A full transcript follows.

Podcast transcript

Speakers: Adam Turtletaub, Chief Engagement & Strategy Officer, Society of Corporate Compliance and Ethics (host); Jill Cusack, AVP, Privacy Officer, American Fidelity; Laura Clark Fey, Principal, Fey LLC; and Tom Leatherbee, Manager, Recovery Division, Hagerty Consulting.

Adam Turtletaub: Welcome to the Compliance Perspectives podcast. I'm Adam Turtletaub from the Society of Corporate Compliance and Ethics and Health Care Compliance Association. Joining us today from Oklahoma City and Kansas City are Laura Clark Fey, Principal at Fey LLC, Tom Leatherbee, Manager, Recovery Division, Hagerty Consulting, and Jill Cusack, AVP Privacy Officer at American Fidelity. And they're going to be talking today about Disasters Anew, the role of compliance team in disaster preparedness, response, and recovery, a topic they'll be addressing at the 2023 Compliance and Ethics Institute. First, Laura, Tom, Jill, let me thank you for being here. Jill, why don't we start with you? I think when most people think of disaster planning in the corporate context, they tend to think of things like employee call trees, off-site backup of data. Where does compliance fit into the equation?

Jill Cusack: You know, call trees, data backup, those are great, and they're absolutely critical whenever anything bad happens. However, world events have shown us that when something bad happens, it doesn't usually just happen for a day or two. We've seen the COVID pandemic taking business to a whole different level over the last couple of years, but also we've seen ransomware events that are taking companies offline for three, four weeks at a time, hurricane scenarios that are taking companies out for a week or more. At this point, we have to keep in mind that business obligations are ongoing, even if our actual business is closed or affected.

Adam Turtletaub: And we've definitely seen that as sort of a sort of normal way of life in abnormal times, and that businesses can in fact operate that way, but it doesn't mean there aren't challenges there. Laura, what are some of the key compliance risk areas when disaster strikes and companies seek to recover?

Laura Clark Fey: There are a broad range of compliance risk areas when a disaster strikes and a broad range of obligations as well. And so when a disaster strikes, entities need to be thinking about any broadly applicable federal regulations that require certain actions like OSHA, employee safety obligations, and employee-related obligations, like obligations to pay your employees and for healthcare plan coverage and retirement plans. You also need to be thinking about tax filing deadlines like financial and other financial reporting obligations. In addition to that, there are industry-specific regulations that govern how entities are required to respond to disasters and require the implementation of policies and procedures for responding to those disasters, like those under HIPAA.

And those obligations can include not only the implementation of a written plan, but also things like breach notification and other reporting obligations. There are state laws. There are standards and certifications, like under ISO or SOC 2 or PCI DSS. There are also internal policies and procedures that need to be taken into account, and contracts that may be in play, contracts with your customers, contracts with your service providers, contracts with insurance providers. And so it's a broad variety of obligations that can come into play and need to be taken into account. And the risk areas span everything from employment-related obligations, safety obligations, notification obligations, record-keeping obligations, obligations for communications, and also taking into account the evolving cyber risks that come into play during a broad variety of disasters as cyber criminals seek to take advantage of the disaster. And that can greatly escalate the risk for entities.

Tom Leatherbee: And also, Adam, if you look at entities like a large hospital system or perhaps a large nonprofit, perhaps a university, there could be federal grant requirements at play. These entities could have federal grant reporting or compliance obligations that don't stop merely because a disaster was in place. In addition, both corporate entities as well as other types of entities may be seeking federal grants as part of their recovery from a disaster and changing the compliance infrastructure to be able to comply with the needs of those federal grants is absolutely essential and isn't something that these entities are going to want to do on the fly. So proper planning for that sort of a different compliance environment is critical before the disaster strikes.

Laura Clark Fey: Tom raises a really important point. And in connection with that, thinking about information that you will need to record to try to get to that funding, such as videos and photographs of the site damage. Those are all factors that need to be taken into account.

Adam Turtletaub: Well, given all those factors, the obligations, reporting requirements, the risks, who should the compliance team look to work with in ensuring that compliance is considered as part of the plan?

Jill Cusack: Unfortunately, that's not a one-size-fits-all answer. And that's going to depend upon organizational size, sophistication, whether you're a public entity, a private entity, and as Tom said, whether you do intend to pursue some sort of federal relief after an incident occurs. Most entities will have somebody who is a dedicated disaster person, even if they aren't called that. And just like we talked about earlier, the entities that just have a phone tree or a data recovery system at this point are going to at least have somebody who's in charge of those things. So if you're in a compliance seat and you really don't understand who in your organization you need to be talking with, I would start with those people and see who they've already coordinated with.

If you're looking to add some kind of sophistication to your organization, you can look out to external help. My partners here today both represent different kinds of entities that help companies and public entities get organized on these things. But there are also a lot of just free resources you can find. Ready.gov is a great resource to go and look and see what sorts of risks and hazards the government has identified that you may want to start preparing for.

Adam Turtletaub: It seems as if the list of those keeps growing. Laura, let me go back to you for a second. There are going to be some people who are likely to say something along the lines of when there's life and death decisions to be made, crises, no one should worry about compliance. This is about survival. No one's really going to care. What do you say back to them?

Laura Clark Fey: My response to that is it really, honestly, this may be a surprising response, but from my perspective, it depends on the disaster. If nuclear warheads are headed to all 50 states and the end of the world as we know it may be coming or is likely to be coming, that's one thing. But for most types of disasters that entities are going to confront, the disaster eventually is over and business must go on. And in order for businesses to survive disasters that are not world-ending or existential in terms of level of risk, it's really, really important to have a good plan in place to think about all of the risks that are most likely going, you know, that are most possible for your organization and to have a really strong plan that takes into account the business as a whole, not just IT and cybersecurity, not just legal, not just compliance, but takes into account HR, takes into account your communications department, takes into account business operations, takes into account the importance of having middle-level managers even fully aware of what the plan is, so that as employees reach out to them, naturally, they've got responses in place.

And that businesses are taking into account potential risk if they're not properly implementing their disaster recovery plan and business continuity plan. And that includes everything from business-related operations and communications to both employees and customers and also service providers, but then also takes into account regulatory obligations and regulatory risks, because if you are not complying with your regulatory obligations and also your contractual obligations, then further down the line, you may be confronted by regulatory investigations and litigation at a class action level that could ultimately be business-ending, although the disaster otherwise would not have been. And so I just think it's incredibly important for entities to think about this and to think broadly in terms of not only the potential disasters, but also what risks could arise from the disaster that, for example, cybercriminals might take advantage of. And we know cybercriminals will take advantage of everything they can.

Adam Turtletaub: Now, as you were giving that answer, you talked a lot about being able to sort of measure where we are and meet these requirements, which goes back to the reporting discussion earlier. Tom, what data does the compliance team need to track and have on hand to be an integral part of the disaster planning process?

Tom Leatherbee: Well, I think we should step back a little bit and look back at the COVID pandemic, because we had a lot of lessons that have come out of the COVID pandemic. And a lot of those initial lessons were put in place, and we were actually able to test them when the Omicron surge happened. So we have a couple of takeaways there, and they go from the big picture down to the small picture. And the first was that in trying to determine what needs to be tracked, what sort of data needs to be collected, what the continuity process and the planning process even looks like, the team responsible for that has to be aware of politics.

And that could be organizational politics or it could be national politics. And even the very basics of having access to that sort of data, having a role in the planning process, having a role in the post-disaster operational process, all relies on being aware of the politics at hand. You know, before getting into these exact details, the team also has to be aware of impacts. There are short-term and long-term impacts on the organization in terms of core business functions, in terms of growth goals, in terms of budget. And it's really important to understand that this data that can be collected has to be broad enough to cover all of those areas, but also needs to be not disruptive.

The business still has to function, the organization still has to function, and the data has to be used in such a way to make recommendations that don't do disaster recovery for the sake of disaster recovery. That's too often a problem in the industry, and that allow the business to recover in a way that continues to allow the business to meet its operational and strategic goals. In terms of specific tracking, there's operational data that needs to be tracked, regulatory data. We've talked about tracking data that could be used for future federal assistance that could be turned over to a state emergency management office to help calculate preliminary data or preliminary damage assessment for perhaps a disaster declaration.

But the needs are very specific to the organization. The important takeaway here is they can't be too focused on simple business continuity. We have to look toward mitigation. We can't be putting the business entity back at risk in an effort to simply restore operations too efficiently. The business has to make investment in a long-term resilience strategy and not just in disaster planning.

Adam Turtletaub: Well, Laura, Tom, Jill, thank you so much for sharing your insights with us today on this very important and a bit chilling topic. I really look forward to hearing more at the 2023 Compliance and Ethics Institute. I want to thank all of you for taking the time to listen. I'm Adam Turtletaub from SCCE and HCCA. I hope you're able to expand your compliance perspective.