COVID-19: Key Considerations in Moving Your BPO to Work-From-Home

Your BPO provider is closing its delivery center and wants to shift your team to a “work from home” (WFH) model. The good news is that work will continue, but security and performance may be affected. If your business continuity/disaster recovery (BC/DR) plan already handles this, then congratulations on your foresight! If not, you’ll have to work out a new plan on the fly. Here are a few things for lawyers to think about in making the shift:

What’s the Contractual Context? You’ll need to understand the rules that frame the discussion. Does a force majeure clause apply or are the common law doctrines of impossibility or frustration of purpose relevant? Both customer and provider may be affected and want relief. If so, you’ll want to read the contract carefully to confirm whether the condition inspiring the move actually allows for relief. There may be a difference between a shutdown that’s mandated by government order and one that’s prudent but not required. A claim of force majeure may also lock-in breakage and loss and a constructive conversation with your contract partner may produce a better outcome. See our alerts COVID-19: Contract Cancellation and the Doctrines of Impossibility and Frustration of Purpose and COVID-19: Excusing Performance of Commercial Contracts due to ‘Force Majeure.’ You should also consider whether available insurance coverages may respond to losses you suffer as a result of the shift. See our alerts at our COVID-19 Insurance Coverage Pandemic Resource Center.

What’s the Regulatory Context? Many industries have existing guidelines for business continuity and disaster recovery that should be consulted, as well as recent updates addressing coronavirus concerns. For example, on March 6, the FFIEC issued interagency guidance reminding financial institutions that their business continuity plans should address pandemics. The FFIEC Business Continuity Planning Booklet specifically addresses pandemic planning in Appendix D and is a helpful general reference in the absence of other applicable guidance. See our alert 15 COVID-19 Steps for Financial Institutions to Take Now. Our Energy and Environmental blog, The Nickel Report, is tracking developments in the energy and utility industries and others subject to environmental regulation. Privacy and security compliance issues will also need to be addressed. See our alert Coronavirus/COVID-19:  Key Privacy and Security Considerations for a summary of issues that may need attention. The new environment may also raise unexpected compliance issues. Consider who is (or should be) responsible for identifying those obligations and for paying any related costs. See, for example, our alert COVID-19:  How Do Employers Comply with DOL Posting Requirements for Remote Employees?) and our Hunton Employment & Labor Perspectives blog post Employers Must Consider Expense Reimbursement for Employees Working at Home Because of COVID-19.

Can You Lean on Your Existing BC/DR Plan? Many BC/DR plans address only facility- or city-level outages and don’t cover a global pandemic. However, many more limited plans do rely on a WFH solution, so the template may already exist and a quick amendment to extend it may be all that’s needed.

How Do We Build a New Plan? If your current BC/DR plan isn’t adequate, a new plan will require some quick, open-minded collaboration between customer and provider. The existing plan may be the best place to start, offering a wireframe for the new solution and reminding you of the range of operational and legal issues to be addressed. If the existing plan isn’t helpful, the legal teams will need to work with the operational teams to understand the nuts and bolts of the proposed solution and identify the legal issues to be addressed. The lawyers will want to understand: How will the migration to WFH happen and how long will it take? Who provides the at-home computers and related technology? How will it be imaged and secured? What applications and data will be implicated? How will provider staff access the necessary applications and communicate with you? How will that network be provisioned and secured? And, of course, who pays for it and how much?

How Do We Address Staff Health Concerns? While the provider has the main responsibility for worker protection, the customer also has an interest in avoiding illness on its team. Consider whether to adopt a policy requiring WFH staff to comply with “social distancing” and other guidance from public health agencies or other authoritative sources. For mission-critical personnel, consider whether a far more robust protection plan is prudent, addressing household protection measures or even providing for remote-facility isolation. You may also want to address the possibility of loss of staff to illness or other causes unique to the at-home environment and whether and how the provider reports those losses to you.

How Do We Handle Security? Physical and network security measures that are routine in hardened delivery centers just can’t be duplicated in a WFH model, where personal devices and public internet connections may be the only tools available, especially on short notice. The IT security teams may need to cobble together a “best available” solution, taking into account regulatory minimums or the need to obtain special relief. Consider whether it is possible to agree on a migration to more reliable and secure WFH infrastructure over time.

What About Service Levels? A valid claim of force majeure may limit a service provider’s obligation to meet contracted service levels. However, many agreements condition that relief on execution of any applicable BC/DR plans and many BC/DR plans provide for limited or “reasonable efforts” service levels during the recovery period. In the absence of applicable agreements, an emergency shift to a WFH model will fairly require some consideration of appropriate modifications to service level commitments.

How Do We Manage the WFH Period? Continuous, open communication will be critical to a successful migration. Existing contract governance tools may be enough, but consider whether special structures and communication protocols (with redundancies to account for possible loss of staff) make sense.

When and How Does the WFH Period End? In the rush to shift to the new model, don’t forget to keep an eye on the end game—a re-transition to normal operations. To keep the parties focused, consider whether the WFH plan ought to have a sunset date—either time-based or triggered by reference to external factors or government announcements—subject to optional extensions to address continuing disruptions and assure continuity of service. The governance model ought to require regular consultation on evolving prospects for a return to normal and the plan should contemplate a process for an orderly re-transition. At some point, continuing in a jury-rigged WFH solution may just not be tolerable and the parties may want to address termination options. Note that some agreements provide for a “no-fault” termination option if recovery doesn’t occur within a specified period.

Dealing with Uncertainty. The urgency to shift to WFH may not allow time to work out solutions to every element of the plan and its risks. Even so, the parties ought to be able to agree on an orderly way to address those uncertainties. Consider documenting what can be addressed right away and then setting a reasonable timeframe during which the parties will work in good faith to arrive at a commercially reasonable solution for the rest, perhaps within a range of outcomes that can be anticipated. If possible, address what happens if the parties aren’t able to agree at the end of that process. Consider, too, how the parties should be obligated to behave in response to continuing developments. For example, should customers and/or providers be required to seek “essential business” status under applicable shutdown orders?