EPRR: BCP - Checklist

Transcription

1 NHS England Business Continuity Management Toolkit EPRR: BCP - Checklist Appendix 3.2 1

2 [Intentionally Blank]

3 INTRODUCTION The purpose of this document is to assist those who are developing a business continuity plan for their organisation a number of key areas in which they need to include. This checklist is produced in the spirit of ISO & but focusses on the priorities in which the NHS England EPRR core standards are set around. It is also recognised that there is not a single one template that can fit the NHS, hence no template has been produced. Organisations are to cross check their plans so that as a minimum the points in this document are included in their Business Continuity Plans. GUIDANCE Further guidance on the wider subject Business Continuity can be sort from: NHS standard contracts 2013/4 the NHS England Planning Framework 2013 the NHS England Emergency Preparedness Framework 2013 ISO Societal Security - Business Continuity Management Systems Requirements ISO Societal Security - Business Continuity Management Systems Guidance PAS Framework for Health Services Resilience BUSINESS CONTINUITY RESPONSE PLANS Throughout the NHS there has been a requirement for a number of years that Business Continuity Plans are produced, and exercised. The BS25999 (NHS):2009 guidance was the foundation of this. This has now been replaced using the spirit of PAS 2015, ISO and ISO The following checklist is not designed to be fully compliant with the above standards but is something in which individual organisations should aspire to work towards. It is also appropriate that not every point on the checklist will be in every plan, but should appear in the larger organisational plans. All NHS organisations and providers of NHS funded care must develop, maintain and continually improve their business continuity management systems. Prior to completing a Business Continuity Plan (BCRP), the organisation/department needs to undertake a business impact analysis (BIA) and document this separately. This then prioritises the plans the organisation, service or activity is required to develop. The BIA is required to be referred to in the introduction of each BCRP. 3

4 Plan Content Descriptor 1. The link between the business continuity response plan and the risk register or business impact analysis 2. The plan must identify all of the prioritised activities from the BIA. BIA 3. The plan must list the maximum period of tolerable disruption for all the critical activities 4. Organisations must document the internal and external stakeholders that could be affected by the disruptive incident especially surrounding service delivery BIA BIA Communication 5. The plan contains the relevant contact details of key stakeholders Communication 6. The way in which the BCRP will be distributed including electronic storage on NRE or extranet. NHS protective marking scheme to be considered in production of the plan 7. The plan describes how the organisation will respond to a significant incident, in line with the formal organisation communications strategy 8. The plan describes what the 24 hour arrangements are for alerting managers and other key staff, and what systems are in place to keep these details correct 9. The plan must document how they undertake the receiving and cascading warnings and other communications before, during and after a disruption or significant event. Including and resilient communication systems used 10. The plan will confirm the mechanism the organisation will use to inform the relevant partners including, but not limited to, other NHS care providers, CCGs, and NHS England. Communication 11. The plan will document the distribution list of the plan 12. Document the insurance arrangements in place and how they may apply to incidents 13. The BCRP sets out how the incident costs will be tracked. The use of unique cost centres will assist. 14. Audit Trail to record changes and updates as policy, staff, and service/activity changes/develops 15. Organisations must refer to which prioritised activities that have been placed on the corporate risk register and how these risks have been addressed. 16. The document will correlate to the NHS England Model Competencies for Members of NHS England Emergency 0n-Call Rotas. 17. The document will demonstrate how the necessary knowledge and skills will be achieved and maintained of incident commanders 18. The plan documents how the organisation will maintain their incidents logs, and minutes of meetings during and after the meeting. 19. The plan will describe how the post incident report will be produced including how they will hold a debrief to identify lessons. 20. The plan will describe how the skills and knowledge of staff at an operational level will be achieved and maintained, i.e. the department receptionist, security 21. The plan will identify who the author is, who is responsible for the maintenance and updating of the plan, and the expiry of the document Finance Finance 22. The sign off of the BCRP at the strategic level of the organisation

5 Descriptor 23. Within the plan it must document when the plan will be used, exercised and tested. 24. Within the plan it will document dependant stakeholders and how the organisation will exercise and test the plan with these services or organisations 25. A scalable plan setting out the command and control arrangements will be managed and by whom 26. All plans should consider the impact of Severe weather (including snow, heat wave, prolonged periods of cold weather and flooding) 27. Business Continuity Plans must ensure that the following sections are: The responsibilities of key staff and departments The responsibilities of the appropriate Accountable Emergency officer or Executive Director Where the incident will be managed from (incident coordination centre) 28. Details of the activity surge plan to ensure that critical services are maintained in periods of peak activity 29. The plan contains information on alternative locations where the service/activity could be delivered from in case of denial of access 30. The plan described how the independent healthcare sector may be used in a disruptive incident to assist in service delivery 31. The plan describes how mutual aid from other NHS providers can be requested if a disruptive incident occurs 32. The plan describes how supplies and replacement equipment will be managed and maintained throughout the disruptive incident 33. The plan must detail how it is activated, what escalation system they have in place, and who assumes responsibility at each stage 34. The plan will describe if there is any provision for staff to be accommodated overnight if the incident dictates and how this is activated (i.e. pre-agreed arrangement with local hotels) 35. The plan will include appropriate action cards and aide memoirs for use by key team members 36. The plans must set out the alerting mechanisms for external and self-declared incidents, including trigger points and escalation procedures 37. The BCRP will document the recovery time objectives and other timescales identified in the BIA 38. The plan describes the recovery and restoration principles and how they will be managed and by whom 39. The plan will describe or demonstrate how lessons identified from incident will affect future plans 5