The Supplier Who Is Also the Recovery Site
A regional healthcare provider outsources its electronic patient record hosting to a single supplier. The contract requires the supplier to maintain a recovery site 200 km away and to achieve a 4-hour recovery time objective. During a routine review, the provider's continuity lead discovers that the supplier's recovery site draws connectivity from the same regional exchange as the primary data centre, and that the supplier's own upstream provider for that exchange is a company the healthcare provider also uses for its ambulance dispatch system. The supplier considers this compliant because the sites are geographically separated. The provider's regulator has asked for assurance that single points of failure have been identified and mitigated. The contract has 14 months to run and no termination-for-convenience clause.
1. Evaluate the supplier's claim of compliance and identify the concentration risk the provider has failed to see.
Read the worked answer
The supplier is compliant with the letter of the contract (geographic separation) and in breach of its intent (survivability of the service). Geographic distance is a proxy for independence, not a guarantee of it. Two sites 200 km apart that share a connectivity exchange fail together.
The more serious finding is the second-order concentration: the exchange's upstream provider is also the ambulance dispatch supplier. That creates a correlated failure in which the provider loses both its patient record hosting and its dispatch capability from one upstream event. Neither the hosting contract nor the dispatch contract, read alone, would surface this - it only appears when the dependency graph is drawn across both.
This is exactly the assurance the regulator is asking for, and the provider cannot give it on current evidence. The failure is not the supplier's; it is the provider's, for accepting a geographic-separation test as proof of independence and for never mapping shared upstream dependencies across its supplier estate.
The continuity lead should document the finding formally, because a known unmitigated single point of failure that the regulator has specifically enquired about carries a different liability profile than one nobody had noticed.
2. Given 14 months remaining and no termination-for-convenience clause, set out the realistic mitigation options and their trade-offs.
Read the worked answer
There is no option that removes the risk within the contract term. The realistic set is about reducing and evidencing it while positioning for renewal.
Options:
- Contractual variation (preferred). Negotiate an addendum requiring the supplier to demonstrate route diversity - not site distance - for the recovery site, and to disclose upstream providers. The supplier has an incentive to agree because renewal is 14 months away and the regulator's interest is now visible. Trade-off: may carry a price increase; takes time.
- Interim compensating controls. Arrange a secondary connectivity path or a documented manual fallback for patient record access, sized to the realistic outage duration. Trade-off: cost and operational burden for a low-probability event; but it converts an unquantified exposure into a bounded one.
- Dispatch-side separation. Open a parallel conversation with the dispatch supplier about its dependency on the same upstream. This may be cheaper and faster than anything on the hosting side, and it addresses the correlated-failure scenario directly.
- Prepare for exit at renewal. Begin requirements and market sounding now so that the 14-month runway is used, not discovered. Trade-off: effort with no guarantee of switching.
Do not represent the risk as mitigated to the regulator. Present it as identified, with a dated remediation plan and named owners. An honest 'identified and being treated' is defensible; a false 'mitigated' is not.