Microsoft Word - CODAC Business Continuity Plan 2024.docx

BUSINESS CONTINUITY PLAN

Table of Contents

INTRODUCTION

3

PURPOSE OF A BUSINESS CONTINUITY PLAN (BCP)

3

FACILITY CLOSURE/COMPLETE LOSS OF ANY SITE

4

I NCIDENT A SSESSMENT

4 4 4 4

R ESIDENTIAL AND S UPPORTIVE L IVING S ITES

E XECUTIVE N OTIFICATION M ASS N OTIFICATION

EVACUATION AND RELOCATION

4

R ESIDENTIAL P ROGRAM E VACUATION

5

MAT SITE INOPERABILITY

5

C OMMUNICATION WITH M EMBERS AND S TAKEHOLDERS C ONTINUATION AND R E - ESTABLISHMENT OF S ERVICES

5 5 5 5

S ITE R E - OPENING T IMELINES T ELEHEALTH S ERVICES

UNEXPECTED LOSS OF PERSONNEL

5

UNEXPECTED LOSS OF FUNDING

6

UTILITY FAILURE

7

G AS L EAKS /G AS L INE B REAK

7 7 8 8 8 8

P OWER F AILURE

E MERGENCY G ENERATOR P ROCEDURE AT 380

W ATER M AIN B REAK

R ESIDENTIAL S ITES : FOR A P LUMBING E MERGENCY AFTER 5:00 P . M ./H OLIDAYS /W EEKENDS

T ELEPHONE F AILURE

A LERTING M EMBERS OF T ELEPHONE F AILURE M EMBERSHIP S TAFF P ROCEDURES

10 11 11 12 12 13

C ONTACTING THE I N -H OUSE P HARMACIES G ENOA E XTENSIONS L OSS OF P RIMARY C OMPUTER S YSTEM /R ECORDS /VPN OR I NTERNET LOSS N ETWORK S YSTEM AND D ISASTER R ECOVERY P LAN

P LANNED U PDATES /O UTAGES TO THE S YSTEM

Page 1 of 21

U NPLANNED O UTAGES INCLUDING BUT NOT LIMITED TO C YBERSECURITY T HREAT /R ANSOMWARE /V IRUSES 13 COMMUNICATION WITH FUNDERS/STAKEHOLDERS/PERSONNEL 15 O VERVIEW 15 SUPPLEMENT PUBLIC RELATIONS DEPARTMENT 16 D ESIGNATE S POKESPERSON 16 D ESIGNATE B ACK - UP TO S POKESPERSON 17 C RITERIA FOR S POKESPERSON ( S )/P EOPLE SPEAKING TO M EDIA 17 C OORDINATE WITH S POKESPERSONS FROM OTHER INVOLVED A GENCIES 17 PREPARING CODAC’S POSITION ON THE CRISIS 18 BUSINESS CONTINUITY TRAINING PLAN 18 EXECUTIVE LEADERSHIP IS COMPRISED OF: 19 KEY STAKEHOLDER CONTACT RESPONSIBILITIES 20 T ECHNOLOGY C ONTACTS 20 H EALTH P LANS /MCO S 20 K EY C LINICAL C ONTACT 20 O THER B USINESS C ONTACTS 20 M EDIA OR O FFICIAL CODAC C OMMUNITY C ONTACTS 20 D IAL M Y C ALLS 21 EMERGENCY TELEPHONE NUMBERS 21

Page 2 of 21

Introduction This plan documents CODAC’s process, recovery tasks, strategies, personnel, and other resources that may be utilized by Executive and other leadership, independently or in conjunction with other continuity plans, to address any short- or long-term business interruption. Examples include, but are not limited to, interruption due to planned or unplanned events, actions, situations, disaster, or other emergencies. As part of CODAC’s annual risk management assessment, this plan will be reviewed/updated at least annually. CODAC will review business continuity and disaster plan procedures and analysis. Purpose of a Business Continuity Plan (BCP) The BCP establishes procedures to recover business operations following a disruption. The plan supports the following objectives: Maximize Operational Effectiveness Post-Disruption:  Notification/activation phase : Detect and assess damage and activate the plan.  Recovery phase : Restore operations and reassign department personnel as needed.  Reconstitution phase : Restore capabilities to normal operations. Identify Essential Activities and Resources: Outline the activities, resources, and procedures required to maintain operations during short-term or prolonged interruptions. Assign Responsibilities and Provide Guidance: Designate personnel responsibilities and provide guidance for recovering individual department operations during interruptions. Coordinate with External Entities: Ensure coordination with state and local entities such as county health and human services, law enforcement, and vendors following an event. Ensure Compliance with Health Directives: Adjust emergency plans in accordance with directives from the Centers for Disease Control and Prevention (CDC) and the World Health Organization (WHO). Helpful Websites  World Health Organization (WHO) http://www.who.int/en  Centers for Disease Control and Prevention (CDC) http://www.cdc.gov  National Institute for Standards and Technology (NIST) 800-34 Contingency Planning Guide for Information Technology Systems http://www.nist.gov/  Federal Emergency Management Agency (FEMA) www.fema.gov  Arizona Department of Health Services (ADHS) www.azdhs.gov  National Oceanic and Atmospheric Administration (NOAA) National Weather Service www.weather.gov  Department of Homeland Security www.ready.gov

Page 3 of 21

Facility Closure/Complete Loss of Any Site If any of CODAC’s sites become nonoperational or unsafe, the goals/objectives of this plan are to provide direction to continue providing services despite the event, action, or decision. Initial steps will be: Incident Assessment a. Upon knowledge of the incident, personnel will assess the situation. In an emergency, personnel should intervene as needed (call 911, utility company, etc.). Contact a supervisor as soon as possible. b. The supervisor will inform appropriate leadership and executive leadership. c. Utilize PA system (where available), Dial-my-Calls, site radios, site email, Microsoft Teams Escalation chats, and notify onsite Safety and Security Specialist, if applicable. d. Outpatient Sites: The CODAC Director/Program Coordinator will inform their supervisor who will notify the appropriate leadership and Executive Leadership members. Residential and Supportive Living Sites For residential sites – Brief Intervention Programs (BIPs), Behavioral Health Residential Facility (BHRF), or other CODAC residential property (transitional/supported living Connie Hillman, ATL, PPW or Men’s House, etc.) – personnel should contact appropriate Leadership (Amy Muñoz at (520) 576-0880, or Daniel Barden at (520) 429-8435 or their designee(s)) who will assess the situation and notify relevant individuals. Executive Notification The President/CEO and other members of Executive Leadership and senior leadership will be informed as appropriate. They will activate the phone tree or emergency communication method as necessary Mass Notification Appropriate leadership personnel will determine whether to use CODAC’s mass notification systems (DialMyCalls, InformaCast emergency alerts, etc.) to inform staff and/or members of the situation. Messaging and updates will be sent as necessary. Stakeholder Communication: The President/CEO or designee will notify key stakeholders (e.g., CODAC’s Board of Directors, health plans) about the situation. Evacuation and Relocation 1. Site personnel will ensure the safe evacuation of all members and personnel, including medications (if applicable, and safe to do so). 2. Site personnel will relocate and provide necessary services from the nearest available CODAC site.

Page 4 of 21

Residential Program Evacuation If residential and supported living programs need evacuation, CODAC will determine if another residential program has the capacity to accept the residents. If not, the administration office will be the temporary relocation site, or alternative arrangements will be made. If the administrative site is inoperable, the back-up site is CODAC at Cobblestone Court. MAT Site Inoperability A formalized agreement has been made with La Frontera and COPE Community Services to provide methadone services to CODAC members. Communication with Members and Stakeholders Efforts will be made to contact members and stakeholders to inform them of any service changes or disruptions and future action plans. See below. Continuation and Re-establishment of Services All services will continue and will be re-established as soon as possible. Essential services (medications, evaluations, etc.) will be re-established within hours. Site Re-opening Timelines Timelines for re-opening a site will be situation specific; however, efforts will be made to resume services at the same or another permanent location as soon as possible. Telehealth Services If necessary, onsite services that can be offered virtually may be converted to telehealth services as appropriate. Unexpected Loss of Personnel If CODAC experiences an unexpected loss of personnel (i.e., Pandemic (refer to CODAC’s Pandemic Plan), death, tragedy, layoff, or other reduction in workforce), the following plan is in place: 1. Depending on the extent of the loss, site leadership is to work with senior leadership to determine how to ensure coverage. However, if the loss is extensive, steps 2-7 should be activated. 2. The CODAC site director/program coordinator will contact their supervisor who will contact Human Resources. Human Resources will alert the President/CEO (Dennis Regnier - cell phone (520) 300-0995, office (520) 202-1865) or his designee as soon as possible. As necessary, Executive Leadership and other senior leadership will be informed and will assist in determining the next steps. 3. President/CEO or designee will contact affected funders/stakeholders to alert them of the situation.

Page 5 of 21

4. The chief medical officer and all appropriate members of Executive Leadership and other senior leadership will be contacted (see specific key personnel list/call tree on this plan). 5. Appropriate leadership personnel will determine whether CODAC’s mass notification systems (Dial My Calls, InformaCast, etc.) should be utilized to inform appropriate staff and/or members of the situation via text. If determined that this would be helpful, messages alerting staff and/or members about the situation will be sent including updates as appropriate. Microsoft Teams Escalation chats, and other emergency communication processes can also be used, as applicable. 6. An assessment of the situation will be conducted, and an appropriate response will be initiated to ensure the ability to meet members' needs including: a. Personnel re-organization 7. All efforts will be made as soon as feasible to contact members, program participants, and other stakeholders to inform them of changes and future action plans. To the extent possible, all services will continue and will be re-established as soon as possible. Essential services will be resumed in a matter of hours. Unexpected Loss of Funding CODAC personnel regularly educate members, participants, and other stakeholders that services are provided contingent upon funding. The agency attempts to inform its members, participants, personnel and other stakeholders of policies, legislation and advocacy efforts that may impact them. This helps prevent negative perceptions about the organization’s integrity and commitment to the community if CODAC has no choice but to terminate services. If CODAC suffers a complete loss of funding for one or more of its programs, the following plan is in place: 1. The Executive Leadership member who is informed of the loss of funding will ensure that Executive Leadership is aware of the changes and Executive Leadership will convene immediately to determine the next steps. 2. Supervisors/site directors/program coordinators, applicable community partners and subcontractors, and all appropriate stakeholders will be contacted. 3. The CEO and the chief operating officer will spearhead appropriate media coverage to inform the general community of efforts to reinstate funding and advocate for alternative services to meet the needs of the people CODAC serves. 4. All efforts will be made as soon as is feasible to contact members, program participants, and other stakeholders to inform them of the changes and future action plans. 5. To the extent possible, all services will continue and will be re-established as soon as possible. 6. If CODAC is unable to continue providing services using other funding, comparable services will be identified elsewhere, and members/program participants will be referred to that other provider(s)/resource(s). b. Relocation/redirection of services c. Reduction of service hours, etc.

Page 6 of 21

Utility Failure Gas Leaks/Gas Line Break Smelling Gas If someone smells gas, do not attempt to turn off/on any equipment. It is possible that electrical contacts may cause a spark that in turn might ignite the gas. Evacuation Clear the immediate area or evacuate the building, as appropriate. Ensure that everyone present in the building has been evacuated. 1. Notification: Immediately notify the Fire Department (911) and Southwest Gas Company 746-1076 . Notify the CODAC security on-call number 202-1911 of the emergency. Clear the immediate area or evacuate the building, as appropriate. Ensure that everybody present in the building has been evacuated. 2. Notify the CODAC security on-call number 202-1911 of the emergency. 3. If the leak is inside, open doors and windows, if possible. Remain away from the area until appropriate authorities indicate that it is safe to return. Utilize PA system (where available), Dial-my-Calls, site radios to announce utility failure, send site email, notification to the sites’ Microsoft Teams Escalation chats, and notify onsite Safety and Security Specialist, if applicable. Ventilation If the leak is inside, open doors and windows, if possible, to ventilate the area. Safety Remain away from the area until the appropriate authorities indicate that it is safe to return. Power Failure 1. Contact Utility Provider: Call Tucson Electric Power at 623-7711. 2. Notify Security: Notify the CODAC security on-call number 202-1911 of the emergency. 3. Stay at Workstations: Everyone should remain at their workstation until power is restored, or until the senior staff person at the facility announces further action. 4. Emergency Lighting: In the event of a blackout, all CODAC facilities have emergency lighting to allow for safe egress, if necessary. 5. Program Operations: If program operations must cease, staff should ensure everybody safely exits the building. 6. Communication: Utilize PA system (where available), Dial-my-Calls, site radios to announce, send site email, notification to the sites’ Microsoft Teams Escalation chats, and notify onsite Safety and Security Specialist, if applicable.

Page 7 of 21

Emergency Generator Procedure at 380 1. Call Tucson Electric Power at 623-7711 to report the power outage/find out how long power will be out. Triage with supervisory staff if the power is expected to be out long enough to justify getting a generator. 2. Notify the CODAC security on-call number 202-1911 of the emergency. 3. Call Sunbelt Rentals at 624-6601. Request that a 110 single phase, 36kW generator be delivered to 380. It should take 10-15 minutes to bring the generator during the workday. It could take one to two hours for them to bring a generator after-hours. 4. Sunbelt Rentals will place the generator in the blocked off parking spot at the east end of the parking lot. They will turn on the generator. CODAC staff will need to switch the breaker box switch to “on” at the outside panel. The key to this room will be in the lock box. 5. After the power has been restored, flip the switch to “off” at the outside panel and call Sunbelt Rentals to pick up the generator. 6. Utilize PA system (where available), Dial-my-Calls, site radios to announce, “ CODE GREEN/BLUE/BLACK/YELLOW” three times, send site email, notification to the sites’ Microsoft Teams Escalation chats, and notify onsite Safety and Security Specialist, if applicable. Water Main Break 1. Do not attempt to turn off any equipment. The presence of water could cause electrocution. 2. Use your judgment and clear the immediate area or evacuate the building, as appropriate. 3. Call the Tucson Water Department (520) 791-4133. 4. Notify the CODAC security on-call number (520) 202-1911 of the emergency. 5. Utilize PA system (where available), Dial-my-Calls, site radios to announce, “ CODE GREEN/BLUE/BLACK/YELLOW” three times, send site email, notification to the sites’ Microsoft Teams Escalation chats, and notify onsite Safety and Security Specialist, if applicable . Residential Sites: for a Plumbing Emergency after 5:00 p.m./Holidays/Weekends Contact Plumb Plumbing directly at 629-0504 and notify the CODAC security on-call number 202-1911 of the emergency. Supervising staff or designee will ensure any person(s) with a physical disability is assisted during drill and actual emergency evacuations. Should a facility need to be closed because of any of the above situations please refer to facility closure procedures in this document. Telephone Failure CODAC’s telephone system – a CISCO Voice Over IP (VOIP) technology – is a computer system, and its recovery is included in the CODAC Information Systems Disaster Recovery Plan. Should telephone failure across CODAC occur: 1. Personnel should contact the helpdesk at (520) 202-1700 or at helpdesk@codac.org. In addition, if the failure occurs after normal business hours, personnel should contact the

Page 8 of 21

help-desk after-hours number at (520) 260-8614 and Chief Information Officer (Rafael Arechaga (520) 591-2954) who will then update the appropriate individuals as needed using: a. The Phone system Teams chat. b. Real time InformaCast (messages sent to Teams, cell phone, desk phone and email). c. ALL CODAC Email (not reliant on InformaCast and can contain more detailed information). 2. During business hours, if phones go down at one of the sites, CODAC will forward the calls to another site to ensure continuity of telecommunication with members and other agencies. 3. If all phones go down across the agency, IT will forward the key phone lines (identified below) to identified cell phones to limit disruption to CODAC’s main line and crisis lines. Phone numbers to be forwarded during business hours:  520-202-1950 (Safety Zone) should be transferred to 520-260-1023 (Linkage cell phone)  520-327-7273 (SACASA) should be transferred to 520-649-5762 (Advocate Cell). NOTE: Coordinate with Katlyn Monje or Liliana Horsley regarding which cell should be forwarded to bcs it might be different each time.  520-202-1792 and 520-202-1786 (380 direct lines) should be transferred to 520 240-8732 (OES Cell)  520-327-4505 (main CODAC line) should be transferred to 520-730-5523 (Kristy Burns Cell) with revised voicemail greeting. NOTE: Coordinate with membership as to whether we will do this or transfer to another phone (burner, etc.). Phone numbers to be transferred after business hours:  520-202-1950 (Safety Zone) and 520-327-7273 (SACASA) should be transferred to Linkage cell phone 520-202-1792.  520-202-1786 (380 direct lines) should be transferred to 520-240-8732 (OES Cell) 4. NOTE: During telephone system failure, faxes will not work/be received. If staff are expecting faxes during the failure, they will need to follow up with the sender to have the fax sent when phones are working or via another mechanism. 5. If the loss is determined to be long-term (more than 24 hours), the Executive Leadership team will ensure that the appropriate stakeholders are notified, including members, funders, etc. (via social media, Patient Portal, message to anyone with scheduled appts through EDI, email blast, etc.) Leadership personnel will ensure that any associated resources are appropriately allocated and/or re-deployed. In the event of total telephone failure across all sites, Supervisors should

Page 9 of 21

utilize their cell phones to contact the helpdesk after-hours number (520) 260-8614 and/or Rafael Arechaga (520) 591-2954. 6. CODAC personnel will contact stakeholders as needed (i.e., health plans, other funders, members, personnel, etc.). Communication with personnel and/or members via InformaCast is also available; Microsoft Teams Escalation chats can be used as needed; and other processes for emergency communication should be utilized as appropriate. Alerting Members of Telephone Failure o Notifying members with appointments that day/next day of telephone failure: NextGen EDI messaging can be sent to members with upcoming scheduled appointments.  The message can read: "CODAC is experiencing phone issues effecting inbound & outbound calls. We Apologize for any inconvenience. We will call to reschedule missed appts ASAP."  Note: EDI does not send messages to members with virtual/telehealth appointments. But, virtual/telehealth appointments should not be impacted by telephone failure anyway. o Mass communication can be sent to members who have given permission to send text or emails via Dial My Calls and Constant Contact email blast, respectively, if needed. A list of members and their contact information will need to be run from NextGen Crystal Reports. o A message can be sent to all members who are enrolled in CODAC’s Patient Portal. To send a message via the Patient Portal:  Select Patient Messaging > Build a Message > Message Type Other > Phone Lines Down o Create Facebook and Instagram posts on the CODAC and SACASA pages. o Create notification posts on CODAC.org  Notibar plugin at the top of all pages  Contact Us page in red o Create notification posts on SACASA.org  Homepage at Top  Contact Us page at top  Develop/print/post flier at Front Desk: The flier content can say "CODAC is experiencing phone issues. If you receive a busy signal when you call CODAC, it means that the phone lines are currently down. Please try back or email us at info@codac.org with any urgent needs. We sincerely apologize for this inconvenience while our phone carrier is working to resolve the issue.” A draft is available in Canva via the Communications team.

Page 10 of 21

Membership Staff Procedures  Utilize department cell phones to call members with upcoming appointments to collect copays.  Manage messages coming in through Patient Portal.  How to collect co-pays for virtual visits and phone appts  Utilize department cell phones for follow-up calls of people seen virtual and phone appointments.  Utilize department cell phones, email and Patient Portal for follow-up on member document requests.  Benefits appointments to be conducted via cell phones. For Staff who conduct scheduled appointments via telephone and/or need to contact members, pharmacy, collaterals, referrals, etc.:  The site will identify staff who have scheduled upcoming appointments via telephone. o If the staff member does not have a CODAC-issued cell phone, site cell phones can be utilized for this purpose. o Speedway: Has 5 cell phones - can use to call members. o Cobblestone:  Site leadership have cell phones.  IRT: DRCs all have their own phones. Will share with rest of site, per Nancy directive.  Need to deploy additional cell phones to Cobblestone. o 380 Leadership have cell phones o MAs at all sites: work with Site directors to use extra cite cell phones.  IT to deploy available/unused cell phones.  Purchase pay-as-you-go cell phones for sites as needed.  IT exploring availability of internet based phones. Contacting the In-House Pharmacies Genoa Extensions Genoa Pharmacies located at Cobblestone and Speedway can be contacted using the extensions listed below (if internal calls are still working).  Cobblestone: 1919  Speedway: 2093 CODAC utilizes Microsoft Teams and email which could be utilized to communicate should this be needed.  Connect with Lumen to determine problem, submit ticket, work to resolve problem.

Page 11 of 21

 Faxes: CODAC fax server works with a direct in-dial number that goes to Fax Server. Fax Server receives the fax, makes it into a digital copy, and whomever is managing the queue, distributes it to the correct people who need to receive it. If the phone lines are down, so are the fax phones. Loss of Primary Computer System/Records/VPN or Internet loss CODAC utilizes computer systems for many business duties. In addition to medical records, computer systems are utilized for scheduling, emails, intranet, internet, and other vital business related matters. In the event of computer system interruption, personnel should contact the helpdesk at (520) 202-1700 or at helpdesk@codac.org. In addition, if the failure occurs after normal business hours, staff should contact the helpdesk after-hours number at (520) 260-8614 and the chief information officer, Rafael Arechaga, at (520) 591-2954. Network System and Disaster Recovery Plan CODAC’s utilizes up-to-date server technology to ensure failure resistant performance and safeguards. CODAC houses its servers off-site (Involta), therefore, any disruption at a particular CODAC site would not affect CODAC’s primary computer systems/records and these records could be accessed from any other site. Involta has its own Disaster Recovery Plan (DRP) to assist in dealing with any disruption on their end and has assured CODAC that any disruption in service could be re-instated within a matter of hours. Their plan includes back-up generators, etc. to ensure safety/security of servers and functions. In addition, to ensure rapid recovery should a problem arise, CODAC’s information systems Disaster Recovery Plan includes, but is not limited, to the following:  Appropriate system planning  Back up equipment (storage units/computers/etc.)  Servers are located at an off-site data center (Involta).  Ensure proper temperature and humidity levels in Server/Network room. State-of-the art data backup and recovery equipment, software, and processes.  CODAC has an off-site backup of EHR database in case the data center is no longer accessible.  Competent well-trained IT personnel.  Procurement of systems from nationally renowned hardware manufacturers that include full warrantees and service contracts.  Maintaining current software license and support contracts.  Accessible vendors contact information for fast expert support.  Disaster recovery kits which include the written plan, vendor licenses information, vendor contact information, software keys, administrator passwords, etc.  Utilization of ticketing software for documenting system issues and solutions.  Annual review and internal audit of the DRP to ensure information is current, accurate and effective.  Various policies to ensure overall system security and integrity.

Page 12 of 21

 Business impact analysis  CODAC personnel receive ongoing cybersecurity training.

Dependent upon the gravity of the system issue, critical services will be restored anywhere between a few minutes but no later than 24 hours. All stakeholders will be alerted and given an estimate for recovery time as soon as possible. Levels of disruption are detailed below  Level 1 : minimal interruption of system that is resolved without any need for additional communication.  Level 2 : minor system outage; affecting one site or system with minimal disruption; communication and intervention limited to site and stakeholders affected.  Level 3 : more than one site or system affected with some disruption; communication limited to those affected.  Level 4 : Several sites or systems affected with major disruption in services; communication to all personnel affected; and consider various stakeholder communications.  Level 5 : complete disruption of systems and/or services; communication to all personnel and appropriate stakeholders. Planned Updates/Outages to the System From time to time, CODAC’s network needs updates or upgrades to occur. Planned updates/upgrades could affect various systems (telephone, EHR, email, etc.). During planned updates which will result in disruption of normal operations, the following will occur: 1. Chief information officer will coordinate a quick meeting with appropriate leadership to discuss expectations, outage updates, etc. 2. As appropriate, CODAC’s Business Continuity Communication Plan will be initiated. (Refer to communication plan). 3. Appropriate personnel and stakeholders will be given details related to the outage, including how long the outage will occur, what systems will be interrupted, when systems expect to be and are restored, and how to access vital information or contact appropriate personnel during the outage. Updates on any changes to these details will be communicated as soon as the information is known. Unplanned Outages including but not limited to Cybersecurity Threat/Ransomware/Viruses When an unplanned outage occurs, the following should be initiated: 1. The helpdesk should be alerted immediately, including when they occur after-hours. Unplanned outages may vary in scope and volume; however, all outages should be reported. 2. Helpdesk and the chief information officer will assess the situation and address any potential issues (viruses, equipment failure, etc.).

Page 13 of 21

3. As soon as possible, the chief information officer will inform the CEO who will assist in determining if any additional steps are needed. The chief financial officer should be notified of the outage to determine fiscal impacts of disruption(s). 4. If necessary, IT will alert appropriate personnel of the disruption(s) including further instructions as appropriate. Should the situation be critical – including potentially disrupting business operations in any manner such as ransomware or another serious cybersecurity threat – IT will notify the chief financial officer. Recoverability will be assessed. As appropriate, leadership and CEO will be alerted. If necessary, the chief financial officer or designee will immediately inform CODAC’s insurance representatives who will initiate cybersecurity protocols. Every effort will be made to ensure that total recovery is possible, and services are not interrupted or are restored as soon as possible. If CODAC’s Electronic Health Record (EHR) Nextgen is down for more than 24 hours, IT Staff and Leadership will monitor the status of the NextGen system continuously.  If the outage extends beyond 72 hours, IT Staff will notify Clinical Leadership and the clinical team immediately. Interim Documentation:  The clinical team will be instructed to document all patient services manually or using alternative electronic systems, if available.  Documentation should include all pertinent information necessary for accurate and complete medical records and billing. Service Documentation:  Clinical staff will maintain detailed records of all services provided, including patient information, services rendered, and any other relevant clinical notes.  These records should be kept in a secure location and organized in a manner that will facilitate easy entry into NextGen once the system is restored. Submission and Data Entry:  Once NextGen is operational, the clinical team will enter all manually documented services into the system.  IT Staff will provide support as needed to ensure data integrity and accuracy during the transition. If possible, appropriate personnel and stakeholders will be given details related to the outage, including how long the outage will occur, what systems will be interrupted, when systems expect to be and are restored and how to access vital information or contact appropriate personnel during the outage. Updates on any changes to these details will be communicated as soon as the information is known.

Page 14 of 21

For more detailed information, see CODAC’s Information Systems Disaster Recovery Plan. In the event of major calamity and loss of records, complete reconstruction is possible, and all efforts will be made to restore records. Communication with Funders/Stakeholders/Personnel In the event of a business disruption, CODAC personnel should follow the Business Continuity Plan steps regarding communication. Generally speaking, any incident should be reported to supervisory staff as soon as personnel is able to do so. Funders, stakeholders, personnel, and members served may also be alerted to the situation as needed. Should the situation necessitate health plan notification, the CEO or their designee will immediately contact health plan representatives or their designees to advise them of the specific business disruption and actions taken to date. All other stakeholders will be contacted as needed. Updates will be provided throughout the business disruption until it is resolved. Executive Leadership will contact any other appropriate stakeholders and activate the phone tree if necessary. In the event of an emergency or situation that requires activation of the phone tree, a list of Management personnel’s contact information (secondary contact numbers should be up to date in Paycom) In addition, CODAC has various methods to communicate with specific stakeholders including email, cell phones, Web sites and Microsoft Teams. Should systems go down, CODAC has access to mass notification systems that can be utilized to contact personnel or members as needed:  Dial My Calls can be used to send text messages to staff and/or members.  InformaCast can be used to send text messages, emails, Teams alerts and Cisco phone notifications to staff.  Constant Contact can be used to send email blasts to members.  CODAC Web sites and social media platforms can post notifications.  CODAC’s Patient Portal can send messages to members enrolled in the patient portal.  NextGen can send texts and/or emails to members. Additional tools include Microsoft Teams Escalation chats and other emergency communication processes. This array of communication avenues allow leadership to contact personnel or members in the event of a business disruption and give real time updates on the situation including any specific instructions on next steps, etc. Communication with members via this format needs additional approval and can only be done in conjunction with the CEO and Chief Operating Officer. Crisis Communication Plan Overview A crisis is any situation that threatens the integrity or reputation of CODAC and is usually brought on by adverse or negative media or public attention. Crisis situations can include any

Page 15 of 21

legal dispute, death, theft, accident, fire, flood, or manmade disaster that could be attributed to CODAC. It can also be a situation where, in the eyes of the media or the public, CODAC did not react to one of the above situations in the appropriate manner. This definition is not all encompassing but serves as an idea of situations for which the Crisis Communications Plan might be required. If a situation arises that may be a crisis, follow the protocols above regarding alerting leadership including the Executive Leadership team. The CODAC President/CEO and the CODAC chief operating officer will take the lead on determining appropriate communications to the public including the media and government officials such as the Offices of Emergency Management and Homeland Security. The Executive Leadership team will determine appropriate next steps regarding communication as outlined below: Supplement Public Relations Department Coordinate individuals to support/supplement the Communications team by identifying and mobilizing competent individuals to communicate to various publics as well as answer media calls/escort media. Thoughtful and prompt communication is essential. When appropriate and possible, impacted audiences will be notified as described above. Additionally, CODAC’s Web sites, patient portal, email marketing, and social media platforms may be utilized to aid in communications. Media will request a statement/information when they call. Prepare a statement and distribute it to all individuals answering the telephone. Statement example: “Facts are still being gathered, but there will be a press conference before 4:00 p.m. today. Can I have your name and number and we will call you back to let you know when the press conference will be held.” Keep a log of all phone calls received including date, name of caller, questions asked, telephone number, person responsible for response, and additional follow up needs. Designate Spokesperson Decide who the spokesperson is for this specific situation. The spokesperson will typically be the president/CEO, though this can vary depending on the situation or if the president/CEO is unavailable. Role of spokesperson: represent the agency, make official statements, and answer media questions throughout the crisis.

Page 16 of 21

Designate Back-up to Spokesperson The role of the back-up spokesperson is to fill the position if the primary spokesperson is unavailable.

Unless otherwise determined, the backup spokesperson is: Amy Munoz: Office: (520) 202-1759 x 1062, Mobile: (520) 576-0880 Designated Experts/Advisors to Spokesperson(s) Business Operations Advisor: Dennis Regnier Financial Advisor: Eric Westerlund Clinical Operations Advisor: Eddie Ornelas/Daniel Barden/Amy Munoz Medical Advisor: Dr. Steve Bupp/Dr. Sabreen Boone/Dr. Mark Grant Technical/IT Advisor: Rafael Arechaga Compliance/Risk Management Advisor: Amy Munoz/Estella Searcy

Public Relations Advisor: Kristine Welter Hall Housing and Placement Advisor: Amy Munoz EEOC/HR: Estella Searcy Other leadership from the area where crisis occurred may be asked to participate as needed. Criteria for Spokesperson(s)/People speaking to Media  Skilled in handling media.  Skilled in directing responses to another topic.  Skilled in identifying key points.  Able to speak without using jargon, which can be confusing or misinterpreted.  Respectful of the role of the reporter.  Knowledgeable about the organization and the crisis at hand.  Able to establish credibility with the media.  Able to project confidence to the audience.  Suitable regarding diction, appearance, and charisma.  Sincere, straightforward, and believable.  Accessible to the media and to internal communications personnel.  Able to remain calm under stressful situations. Coordinate with Spokespersons from other involved Agencies Spokespersons from other agencies/companies involved in the crisis will send media spokespersons to the event as well. It is important for CODAC to coordinate with these spokespersons. CODAC’s Chief Operating Officer will manage these relationships. Examples of other agencies that may send spokespersons include the Fire Department, Police Department, TMC Health and Neighborhood Associations. A list of known spokespersons will be available where possible.

Page 17 of 21

Preparing CODAC’s Position on the Crisis Remember, it is important to “tell it all, tell it fast, and tell the truth.” When a mistake has been made, admit it up front, and begin doing whatever is possible to re-establish credibility and confidence with internal and external audiences. Keep Executive Leadership in the face of the media; avoid letting a lawyer do all/most of the public speaking. This will build credibility. Never lie, deny, or hide involvement. Determining Position: To decide on a position from which to talk about the event/situation, step out of your role in the agency, and put yourself in the situation of whoever was involved in the crisis, or try to view the crisis from the eye of the public. (DO NOT IGNORE THE SITUATION.) Ways that you might choose to position the situation include:  Unauthorized procedures  Inadequate supervision  Inadequate quality control  Misuse of confidential information  Errors of judgment  Inadequate standard operating procedures Also consider the consequences of the event/situation for CODAC and all stakeholders:  Legal  Financial  Effects on consumer  Effects on operations  Effects on Public/Community relations (effects on perception of CODAC) Considering consequences helps address concerns stakeholders might have and determines the tone of statements made by the CODAC spokesperson. Please refer to CODAC’s Media Relations Plan for more information related to public relations during a business disruption. Business Continuity Training Plan CODAC personnel currently participate in monthly safety drills, including crisis response system drills at each site. Both Executive Leadership and Leadership Council will be trained on the Business Continuity Plan processes at the Leadership Council meeting on a yearly basis. The plan and analysis of tests will also be reviewed and updated as appropriate.  Human error  Clerical error

Page 18 of 21

Specific Key Personnel: Consists of Executive Leadership, Staff Management and other personnel deemed necessary depending on the crisis. Executive Leadership is comprised of: Dennis Regnier, President/CEO Steven J. Bupp, chief medical officer Sabeen Boone, chief physical health officer

Eric Westerlund, chief financial officer Amy Munoz, chief compliance officer

Kristine Welter Hall, chief operating officer Estella Searcy, chief human resources officer Eddie Ornelas, chief integrated health and wellness officer Daniel Barden, chief clinical officer Rafael Arechaga, chief information officer

Page 19 of 21

Key Stakeholder Contact Responsibilities

Technology Contacts Involta/other IT/IS contacts

Rafael Arechaga or designee Rafael Arechaga or designee

Assessment and Communication of Technological Disruption

Health Plans/MCOs Health Plan Leadership

Dennis Regnier or designee

ACC-AHCCCS Complete Care Health Plan Representatives Commercial Plans/Other Plans via portal Other key health plan contacts

Amy Munoz

Samantha Eckert/Paul Axinn Leadership/Site Directors

Key Clinical Contact Clinical Leadership contacts

Dan Barden, Eddie Ornelas, Amy Munoz or designee

Hospital/Crisis/AOC/after-hours Partners Amy Munoz or designee Substance Abuse/After-hours Partners Daniel Barden or designee SACASA/After-hours partners Katlyn Monje, Kristine Welter Hall Other Business Contacts Board of Directors Dennis Regnier or designee Insurance Reps Eric Westerlund/Amy Munoz/Estella Searcy Financial Reps Eric Westerlund or designee

Media or Official CODAC Community Contacts Website/Social Media Changes

Kristine Welter Hall

Other Media Kristine Welter Hall Officials or other stakeholders of interest Dennis Regnier/Kristine Welter Hall Members Kristine Welter Hall/Damien Bracamonte Other Stakeholders All Key Management Personnel

Page 20 of 21

DialMyCalls Human

Resource/personnel

Estella Searcy

communication IT Communication

Rafael Arechaga Kristine Welter Hall Senior Leadership

Media/Member Communication Emergency Procedure

EMERGENCY TELEPHONE NUMBERS Fire and Police Department 911 Southwest Gas Company

(520) 746-1076 (520) 791-4133 (520) 623-7711 (520) 318-6740

Tucson Water Department Tucson Electric Power American Red Cross

Page 21 of 21