Business Continuity: NHS Workshop Appendix 1.1

Transcription

1 1 Business Continuity: NHS Workshop Appendix 1.1

2 2 Housekeeping Fire safety Breaks and refreshments Toilets Mobiles and pagers

3 3 Introduction Respect each others contributions What is said in the room stays in the room

4 Course Objectives To develop an understanding of Business Continuity To understand how to use the toolkit To understand how to develop a business continuity plan for your organisation 4

5 5 Ice Breaker Tell the group: Name Role and department you work in What role they have in business continuity Favourite sweet you had when you were growing up!

6 6 What is a Business Continuity? ISO22313 Is the capability of the organisation to continue delivery of products or services at acceptable predefined levels following a disruptive incident.

7 7 What is a Business Continuity Management? ISO22301/22313 It is the process of achieving business continuity and is about preparing an organisation to deal with disruptive incidents that might otherwise prevent it from achieving its objectives.

8 Elements of Business Continuity Management Business impact analysis & risk assessment Exercising & Testing Operational planning & control Business Continuity Strategy 8 Establish & implement BC procedures ISO22313

9 9 Plan Do Check Act Cycle The ISO & uses a Plan-Do-Check-Act Cycle in planning, establishing, implementing, operating, monitoring, reviewing, maintaining and continually improving the effectiveness of an organisations Business Continuity Management System

10 Business Continuity Management Cycle 10 ISO22313

11 11 Activity 1 In your groups discuss what the legal and/or regulatory responsibilities for Business Continuity are for your organisation and the wider NHS

12 Activity 1 - Summary Civil Contingencies Act 2004 & Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 The NHS Operating Framework BS NHS parts 1 & 2 NHS England Business Continuity Framework 2013 Health & Safety at Work Act 1974 NHS Standard Contract 12

13 13 Activity 1 Apart from the legal side common sense prevails for the: Public we serve The staff we employ Our partners we work with And those who commission our organisation

14 Interested Parties Public The Organisation NHS England Patients/Clients Top Management Dept of Health Community Providers Acute Providers Mental Health Providers PFI Partners Those who establish policies and objectives for BCMS Management Those who set up and management business continuity Those who maintain business continuity procedures Owners of business continuity procedures PHE CSU s LA/Dir PH CCG PTS Ambulance Providers A&E Ambulance Services Foundation Trusts Incident Response Personnel Those with authority to invoke Appropriate spokespeople Response Teams Community Groups Private Sector LRF s NHS LA Other Staff Contractors Dependants of Staff 14 Adapted for the NHS fiso22313

15 Elements of Business Continuity Management Business impact analysis & risk assessment Exercising & Testing Operational planning & control Business Continuity Strategy 15 Establish & implement BC procedures ISO22313

16 Understanding the Organisation Suppliers & Partner Organisations Understanding the Organisation Purpose of Organisation Internal Context External Context Products & Services Products & Services Products & Services Patients & Clients Activity Activity Activity Activity Activity Activity Supporting activity Dependencies and supporting activities Assets and resources Assets and resources 16 Adapted for the NHS from ISO22313

17 17 Business Impact Analysis Template First 24 hours hours Upto one week Upto two weeks

18 18 Business Impact Analysis Template Activities which must be continued Activities which could be scaled down if necessary Activities which could be suspended if necessary

19 19 Activity 2 In your groups: Identify your organisations/departments key activity/service What are the prioritised activity and resources required to deliver these? Are there any apparent risks to these prioritised activities? How will you maintain these prioritised activities in the event of a disruptive incident?

20 Elements of Business Continuity Management Business impact analysis & risk assessment Exercising & Testing Operational planning & control Business Continuity Strategy 20 Establish & implement BC procedures ISO22313

21 21 Activity 3 In your groups discuss: Does your organisation have a business continuity policy? What do you think a business continuity policy should contain and why?

22 22 Activity 3 Summary This is a senior management responsibility that: Is appropriate to the organisation Provides a framework for setting business continuity objectives To continual improvement of the business continuity management system

23 23 Activity 4 What are your organisation key activities? What are the prioritised activity and resources required to deliver these? What are the key risks to these prioritised activities? How will you maintain these prioritised activities in the event of an incident?

24 24 Activity 4 Feedback

25 Elements of Business Continuity Management Business impact analysis & risk assessment Exercising & Testing Operational planning & control Business Continuity Strategy 25 Establish & implement BC procedures ISO22313

26 Continuity Requirements People Premises Technology Information Suppliers and Partners 26

27 Continuity Requirements People Premises Technology Information Suppliers and Partners What number of staff do you require to carry out prioritised activities? What is the minimum staffing level you could cope with? What skills/level of expertise are required to undertake these activities? What locations do your prioritised activities operate from? What alternative premises do you have? What machinery, equipment and other facilities are essential? Is the service dependant on electrical medical equipment? What IT is essential to carry out your prioritised activities? What systems and means of communication are required to carry out your prioritised activities What Information is essential to carry out your prioritised activities? How is this information stored? Who are your priority suppliers? Are key services contracted out? Do both you and your suppliers/ partners have mutual aid arrangements in please 27

28 28 Terms RTO Recovery Time Objective MALO Minimum Acceptable Level of Operations

29 Mitigating Impacts through effective BC sudden disruption 29 ISO22313

30 Mitigating Impacts through effective BC gradual disruption 30 ISO22313

31 Incident Timeline What mechanism could be used to ensure that during and following as incident the matter is escalated to the appropriate level in the organisation? 31

32 32 Risk Assessment Activity 5 List as many examples as you can of measures which could be considered in the context of flooding due to failure of internal plumbing systems to: Reduce the likelihood of a disruption Shorten any period of disruption Limit the impact of a disruption

33 Example Royal Marsden 2008 More than 100 firefighters in 25 fire engines were deployed on the blaze Between patients were helped onto the streets whilst the hospital was filled with thick smoke. The fire could be seen across the London skyline. 33

34 34 Example BT Flood & Fire March tens of thousands of customers in parts of North and West London may be experiencing a loss of broadband and/or telephone service [...] as this is a complex incident we cannot accurately predict when all services will be restored. We will issue further updates as the situation changes. Any customers needing to make calls to the emergency services who have a problem using their phones are advised to do so by using their mobile phone, or alternatively by using a friend or neighbour's working phone

35 Example Chase Farm Hospital 2010 Loss of water supply due to burst water main in Enfield. Bowsers (water tanks) are still on site to ensure the main patient areas continue to receive water [...] Bottled water is available for staff and patients. The A&E department is open to all walk-in patients however all other emergencies are being transferred to Barnet Hospital. Once the water has resumed A&E services will return to normal. 35

36 36 BC Strategy Options Stakeholders People Suppliers Premises Information Technology

37 37 BC Strategy Options Discussion Team work: What strategies might be needed for maintaining core skills and knowledge? What elements should your premises strategy consider to reduce the impact of the unavailability of one or more worksites? What technology strategies for BC could your organisation adopt in the event of a disruption to the main area of your building following a fire, with an recovery time objective of 3 months?

38 38 BC Response Plans Organisations may have numerous plans. These may include: Strategic organisational response plans Department response plans Building or site response plans Technical response plans for IT or clinical systems

39 39 BC Response Plan Content Document Control Purpose & Scope Document owner & maintainer Roles and responsibilities Plan activation Contact details Incident management structure and plan

40 40 BC Response Plan Content The plan should: Set out the prioritised activities to be recovered, the timescales in which they are to be recovered and the recovery levels needed; The resources available at different points in time to deliver the prioritised activities; The process for mobilising the necessary resources The details actions and tasks needed to ensure the continuity and recovery of prioritised activities.

41 Elements of Business Continuity Management Business impact analysis & risk assessment Exercising & Testing Operational planning & control Business Continuity Strategy 41 Establish & implement BC procedures ISO22313

42 42 Exercising, Maintaining & Reviewing Exercises are there to test plans Ensures that plans are fit for purpose Identify gaps and learning actions Continuous updating of core information i.e. contact lists

43 43 Exercising, Maintaining & Reviewing Plans should be updated when: The organisation is restructured prioritised activity is delivered differently Change to the external environment e.g. statutory change, NHS England requirement Following lessons identified from an incident or exercise Changes to key staff or partners

44 Embedding your BCP Plans should be updated when: The organisation is restructured prioritised activity is delivered differently Change to the external environment e.g. statutory change, NHS England requirement Following lessons identified from an incident or exercise Changes to key staff or partners BC Policy and Strategy should be produced 44

45 45 Record Keeping Discussion When responding you need to keep records, but why is record keeping so important?

46 46 Record Keeping Discussion Documents decisions made Why is record keeping so important? Details of casualties or near misses that occur Legal follow up