Hal Weiss, information services systems engineer at Baptist Memorial Health Care Corp. in Memphis, said he"s having trouble getting upper management to approve money for disaster recovery upgrades because of budgetary constraints.

"We"re dependent on Medicaid, Medicare insurance for how much they"re going to reimburse us for procedures," Weiss said. "[Also] I can"t pick the applications that the organization purchases, because they"re dictated by the clinicians. So sometimes an application is purchased that doesn"t lend itself to a [disaster recovery] strategy. It can only be one machine running at one time for a specific task."

Yet another issue Weiss faces is that he has two storage-area networks (SAN) from two separate vendors, requiring him to have two distinct disaster recovery schemes because the vendors" network switches won"t talk to each other.

Todd said one way his organization has reduced its disaster recovery costs is by classifying its data so that everything need not be replicated off-site. Only information from "critical" business systems is replicated. Todd said he allows his legal department to determine what data is critical and what isn"t, which alleviates political battles with business units that want everything protected.

An issue each of the panelists identified was the need for a deletion policy.

Weiss said his hospital must save everything because it"s regulated by federal, state and local governments, making it nearly impossible to determine what can be deleted.