NHS Leeds West Clinical Commissioning Group Business Continuity Plan (BCP)

Transcription

1 NHS Leeds West Clinical Commissioning Group Business Continuity Plan (BCP) Plan ID: BCP 1 Directorate: Plan Owner (Chief Officer): BCM Contact: 1 (Senior Manager) Controlled Hard Copy Issue List Document Version and Status: Date Completed: Date Revised : Author: NHS Leeds West CCG Philomena Corrigan Susan Robins Elizabeth Micklethwaite Business Manager v.03 draft August 2013 August 2014 Elizabeth Micklethwaite, Business Manager, Suites 2-4, Ground Floor, WIRA House, West Park Ring Road, Leeds LS16 9BT 1. Document Control 1

2 0.1. Management Review. Name Role Signature Date Philomena Corrigan Gordon Sinclair Chief Officer Clinical Chair 0.2. Change Authorisation Name Role Signature Date Nigel Street Leeds City Council Emergency Planning Officer 27 August 2013 Philomena Corrigan Gordon Sinclair Chief Officer Clinical Chair 0.3. Change History. Version Date Author Location and Description of Change V2 30/7/14 Sue Robins Update to Individuals names and titles Use of this template 2

3 Business Continuity Planning It is essential that managers and key staff have access to and are familiar with the contents of this plan. Controlled copies of this plan should be issued to managers and key staff and retained off-site in case an emergency or disruption occurs outside normal working hours. Managers and key staff issued with a controlled copy of the Business Continuity Plan are listed in Appendix A to ensure that when updates to the electronic version are made, controlled hard copies are produced and re-issued to ensure that managers and key staff always have the latest version to hand. The structure, content and detail of the Business Continuity Plan will depend on the nature of the service, the level of risk and the environment in which it operates. In general, the content of a Business Continuity Plan should contain the following: - (sections 1.1 to 1.8) 1.1 Purpose & Scope The purpose and scope of the Business Continuity Plan should be briefly and clearly defined so it can be understood by those who will put the plan into effect i.e. whether the plan covers multiple service areas or individual services as identified in the Business Impact Analysis. The purpose and scope should include a brief description of the service(s) to be recovered and the associated recovery timescales Purpose: Scope This plan identifies the approaches adopted by the NHS Leeds West CCG to ensure that they are resilient. This approach will allow the CCG to maintain and/or recover critical functions in the event of a service disruption, reducing adverse impacts so far as is practicable. NHS Leeds West CCG is a commissioning organisation and a category two responder organisation. The adverse or negative impacts of any service disruptions in the short term are likely to be minimal. The organisation must however be in a position to respond to the wider consequences of any disruptions including the support and co-ordination of any commissioned services also affected. Additionally, Leeds West CCG is required to ensure that the providers and services they commission are appropriately resilient, maintaining independent business continuity plans where appropriate whilst maintaining the ability to respond to any emergency which may affect the population. The aim would be to ensure that the CCG is fully operational between 24 hours to one week from the emergency or disruption occurring Aim The aim of this plan is to define a framework for use bynhs Leeds West CCG staff in the event of a potential or actual service disruption in order to maintain and/or restore critical functions of the organisation. 3

4 1.2 Invocation Procedure & Triggers The process by which a Business Continuity Plan is invoked, including clear triggers to justify activation, need to be documented and allow for the Business Continuity Plan to be invoked in the shortest possible time following the occurrence of a disruption. The description of the process should be brief and should quickly enable confirmation of the nature and extent of the disruption, control and containment of the situation and support timely communication with those required to provide a response and other key stakeholders. The Business Continuity Plan should include contact details of those responsible for invoking the plan and form a structured checklist of actions and tasks in order of occurrence Invocation Triggers: The Business Impact Analysis previously completed identified the following risks or threats that if realised would be trigger points for the invocation of the Business Continuity Plan: - they add value to a service area response one or more service areas have implemented business continuity arrangements a service disruption is affecting the whole organisation and a corporate response is required Invocation Procedure (part 1) Manager responsible for invoking the Business Continuity Plan. Agreed list of deputies responsible for invoking the Business Continuity Plan. Deputy 1 Deputy 2 Deputy 3 Philomena Corrigan In the event that the manager responsible for invoking the Business Continuity Plan (above) is not available, the responsibility passes through to the agreed list of deputies (below). Those listed need to share the responsibility equally, and need to communicate to ascertain who is available and confirm that the requisite trigger points have been reached to justify invocation of the plan. Gordon Sinclair Mobile Susan Robins Simon Stockill

5 Deputy 4 Visseh Pejhan-Sykes Invocation Procedure (part 2) Describe the procedure to be adopted by the manager or deputy invoking the Business Continuity Plan The manager or deputy responsible for invocation will require access to the Business Continuity Plan and the Key Contact List (Appendix A). The manager or deputy will take the following actions: Establish the impact of the disruptive incident on the service and initiate the recording of entries and assignment of actions into the Incident Log (Appendix B). Continually assess the impact of the on-going incident on the service. Convene the Management Team and decide upon an appropriate meeting venue (if required). Contact key contacts including CCG core responders (Facilities Management, HR and IT Services) as required advising them of the disruptive incident and requesting their support. Update the Plan Owner (Chief Officer) and other managers and key staff as appropriate if the disruption is likely to have an impact on service delivery. Take control of the incident and decide and initiate the functions and workload to be prioritised and recovered first. Direct the response or recovery process, who goes where and when. Oversee the response or recovery effort through until the service is recovered. Monitor the situation and provide regular status reports to the Plan Owner (Chief Officer). In the event of a major cross-cutting disruption, initiate escalation of the incident via the Plan Owner (Chief Officer) to the Clinical Chair. Any other actions as required specific to the service. 5

6 Management Team The Management Team will be set-up in the event of any incident which threatens to affect, or is already affecting the ability of Leeds West CCG to deliver its operational functions. The Management Team will be chaired by the Director of Commissioning invoking the Business Continuity Plan. Support Teams In the event of a significant incident, support teams may be established and managed by the Management Team. These will provide specialist aspects of support and will report directly to the Incident Team as required. Incidents Out of Hours Out of hours, the responsibility sits with the Director on-call. 6

7 Example Invocation Structure The invocation structure identifies the manager or deputy responsible for invoking the BCP initiating the response and recovery arrangements during a disruptive incident. The manager or deputy is responsible for convening and chairing the Team. The Team communicates with the core responders (Facilities Management, HR and IT Services) and contact any key partners or contractor organisations that need to be notified of the disruption. The manager or deputy is responsible for ensuring that the Plan Owner (Chief Officer) is kept informed and receives regular status reports. The Plan Owner (Chief Officer) is responsible for escalation of the disruption and its impact to the Director. Depending on the impact of the disruption, the Incident Management Team could manage both the initial response and business continuity requirements. The example invocation structure provides a structure where the Incident Team is supplemented by a Support Team. Director Susan Robins Plan Owner (Chief Officer) Philomena Corrigan/Gordon Sinclair Core Responders (Facilities Management, HR, IT) Manager responsible for invoking the BCP Visseh Pejhan-Sykes, Simon Stockill, Diane Hampshire Stakeholders Other Leeds CCGs NHS England Local Area Team Incident Team To be agreed depending on incident Support Team To be agreed depending on incident 7

8 1.3 Operational Requirements NHS Leeds West CCG has used the Business Impact Analysis template from Leeds City Council and has incorporated the recommendations and findings into the Business Continuity Plan. This information is used to populate the following tables (1.3.1 to 1.3.5) which can be used to plot your services operational requirements in the event of: Loss of Staff; Loss of Buildings/Accommodation/Utilities; Loss of IT Technology/Hardware/Telephony; Communication to key partners Operational requirements in the event of an emergency or disruptive incident should consider:- The maximum tolerable period of disruption for NHS Leeds West CCG (recovery timescales); The cost of implementing alternative operational requirements; The consequences of inaction. When determining emergency operational requirements, wherever practicable, managers should consider and protect the interests of key stakeholders. Managers should take account of any potential impacts for staff who may have general or specific access requirements in particular, consider those characteristics protected by the Equality Act The Director leading the Management Team will liaise with (depending on the incident) with the appropriate service ie. facilities management for an incident relating to the building, HR for staff issues and IT Helpdesk for loss of IT technology Loss of Staff An emergency or disruption could cause a temporary loss of staff, including those with specialist skills or knowledge. The Management team will consider the number of staff require to maintain key functions for Leeds West CCG. General Information: In the event that Leeds West CCG experience a disruption, or reduced level of service due to a staff shortage as a result of severe weather, pandemic outbreak or industrial action, the following business continuity arrangements should be considered and invoked: - 8

9 Severe Weather: The following only applies when the Chief Officer has declared invocation of the Severe Weather Policy (managers should refer to the Website for the current and detailed version of Special Leave: Guidance for Managers). The following applies to all staff. Where staff are released early because of severe weather conditions, they will be asked to make up the time or take some work home and make up the hours at some later date. Staff, because of severe weather conditions, who arrive late, but within a reasonable time-span, and who remain at work until the end of the working day will be asked to make up the hours by using flexi-time. Staff who do not attend work due to severe weather will be expected to use annual leave or flex-time to cover the absence. Absences caused by the urgent need to care for children, elderly or other close relatives whose schools, day centres or other establishments have been closed because of severe weather will be considered under Special Leave Policy. If staff are to be absent or late, they must make every effort to telephone their line manager/supervisor to report the circumstances. During severe weather conditions managers and supervisors should forward severe weather warnings/notifications to all staff members including regular updates. Staff should consider their best way of travelling to and from work in such circumstances. Pandemic Outbreak The Executive Director for Nursing is responsible for invoking the NHS Leeds West CCG NHS England Area Team Pandemic Influenza Plan. The aim of the plan is to provide a framework and guidance to enable the CCG to respond effectively to an outbreak of pandemic influenza. Industrial Action In the event of industrial action, applications for Exemption Notices for key functions considered critical can be made to the Trade Unions. An Exemption Notice is a request from the employer requesting the Trade Unions to exempt one or more of their members from taking industrial action in order to provide or maintain a function considered critical. Managers and supervisors should meet (convene the Management Team) at regular intervals throughout each day of industrial action to form a view on staff availability, prioritising work and to react to any issues that might arise. During industrial action, work can be prioritised and reallocated to non-striking staff. This should offer no contractual problems. Care will however be required to avoid endangering the goodwill of non-striking staff by asking them to perform additional duties. Key to maintaining functions is planning prior to industrial action taking place. Announcements by Trade Unions of the intention to ballot their membership for strike action are well publicised (a ballot usually takes 2 to 4 weeks). The opportunity which this timescale offers should be used to initiate early preparatory planning. Once the membership has voted in favour of industrial action, then they have a mandate for strike action and need only provide 7 days notice of industrial action taking place. 9

10 Emergency Contact to all staff In the event that Leeds West CCG experience a disruption, as a result of severe weather, pandemic outbreak, loss of building or utilities all staff will be alerted by SMS text message. This will be actioned by an Executive Manager who log into their NHS mail account to access the required staff information Emergency telephone contact list. Just to note in the event or a major incident all mobile phone networks will be disengaged by the Police so an on-line based notification will be required Loss of Buildings/Accommodation/Utilities An emergency or disruption could cause a partial or complete loss of buildings and accommodation. The information captured during completion of the Business Impact Analysis has identified the current buildings and accommodation used. Consideration now needs to be given to identifying alternative buildings and accommodation options to ensure that the functions can be decanted and maintained in the event of an emergency or disruption. Options might include; making use of existing accommodation in other locations.i.e. training/meeting rooms; moving staff performing less urgent duties to accommodate staff performing a higher priority function; remote working (including working from home or from other CCG buildings; reciprocal arrangements with other services; or if a large site is lost, Facilities Management should be informed to source alternative premises. General Information: Loss of buildings and accommodation either in whole or in part will require managers and supervisors to complete an assessment of the impact on the business and decide a course of action. It may be possible to safely contain the incident to an area of the building, allowing parts of the building to remain open and accessible. Or it may be that the building has to be evacuated and closed. Facilities Management If the incident or disruption occurs in normal working hours, contact Russell Thomas If the incident or disruption occurs outside of normal working hours, the on-all manager should be contacted. Loss of Buildings/Accommodation/Utilities - If this building has to be evacuated or is unable to be accessed for any reason Leeds West staff will be asked to meet at Weetwood Hall Hotel, Otley Road, Leeds LS16 5PS

11 1.3.3 Loss of IT Technology/Hardware/Telephony Staff are heavily dependent on IT technology to deliver their roles. The information captured during completion of the Business Impact Analysis has identified the technology that is required to support the service. The following table has been used to identify and record the immediate, urgent and routine timescales for recovery of IT technology including specific applications and telephony: - ICT Applications, Hardware/Software/Telecoms Within 4 hours Urgent 1 day Routine Computer Network Telephones General Information: In the event of an ITT outage, access to or input of electronically stored data/records may not be possible. For short term outages this may be an inconvenience; however more prolonged outages will have a greater impact on the service. All data/records located on the Clinical Support Unit IT Services infrastructure is backed-up at the end of each working day minimising the potential for such data/records to be lost. It is the responsibility of staff during an IT outage to maintain a level of service continuity whilst IT Services resolve the issue and recover the system/applications. This may require implementation of manual workarounds to log incoming calls and enquiries which can be dealt with later once the outage has been resolved. Standard Desktop and Applications on the IT Infrastructure For faults relating to Leeds West CCG IT applications/software and associated hardware including printers, scanners and fax s, contact the IT Services Helpdesk to report the fault or via IT online at leedsccg.helpdesk@nhs.net. The Helpdesk will log the fault and issue a Helpdesk Call Reference Number to be noted in case a follow-up call is required. For IT applications considered by IT Services to be high priority, the incident resolution timescale is within 4 hours, medium priority applications within 8 hours and low priority applications within 16 hours. In the event of a major IT outage i.e. data corruption, multiple disk failure, server fire etc. these timescales would not be achievable and applications/software would take much longer to recover. For printer service/maintenance faults should be reported to reception who will notify Danwood and arrange for an engineer to attend. 11

12 Landline and Mobile Telephony Contact the IT helpdesk on For loss of landline telephony, mobile phones can be used where provided. For lost or stolen mobile telephones it is essential to block the SIM card as unauthorised usage will continue to be charged to the account Communication to Key Stakeholders. General Information In the event of an incident the Management Team would contact all key stakeholder informing them of the incident and advising of timescale to resume business as usual. 1.4 Sources of Essential Information The Business Continuity Plan should define and signpost sources of information considered essential to the service and how such information can be accessed. Consideration should be given to backing-up vital information off-site e.g. hard copies/disk etc. (not all will be applicable). All of Leeds West CCGs essential information in stored and backed up at the end of each working day by the IT department at the Clinical Support Unit. 1.5 Responsible Persons The Business Continuity Plan should identify nominated person/s who will assume responsibility for arranging human welfare issues following an emergency or disruption (not all will be applicable and several may be covered by the same person). The Management Team will be responsible for any issues that arise following an incident. 12

13 1.6 Forms and Appendices Copies of all forms and appendices required as part of an emergency response or recovery should be stored electronically with or attached to this template. Appendices might include; maps and directions, drawings, site and office seating plans for alternative facilities and storage areas. Appendices might also include detailed procedures for manual workarounds, system recovery plans and ICT configuration management plans. Key appendices considered essential include: Appendix A : Key Contact List Appendix B : Incident Log Appendix C : Emergency Response Checklist Appendix D : Appendix E : Appendix F : These appendices are included below; 13

14 Appendix A: Key Contact List A comprehensive and up to date contact list is crucial for responding to and managing an emergency or disruption and to ensure the overall effectiveness of your Business Continuity Plan and contingency arrangements. The contacts list should contain the contact details for the Incident Management Team along with other contacts which would play a key role in responding to an emergency or disruptive incident. Include contact details for those who need to be informed of a disruption, such as partners, clients and customers (home telephone numbers when included in the Key Contacts List should not be subject to general or uncontrolled distribution, a mobile telephone number should be used whenever available). Key Contact List Name Role/responsibility Office telephone Mobile Number Address Incident Management Team: Philomena Corrigan Chief Officer phil.corrigan@nhs.net Gordon Sinclair Clinical Chair gordon.sinclair@nhs.net Susan Robins Director of Commissioning susanrobins@nhs.net Visseh Pejhan-Sykes Chief Finance Officer visseh.pejhan-sykes@nhs.net Diane Hampshire Executive Director for Nursing diane.hampshire@nhs.net and Quality Simon Stockill Medical Director simon.stockill@nhs.net Carolyn Walker Communications and carolyn.walker@nhs.net Engagement Manager Elizabeth Micklethwaite Business Manager elizabeth.micklethwaite@nhs.net 14

15 Name/Organisation Role/responsibility Office telephone Mobile Number Address Other Key Contacts Emergency Services Emergency response Local Police Emergency NHS Medical advice Environment Agency Reporting environmental emergencies and incidents Transco/Gas Emergency contact i.e. leaks etc. Northern Power Grid Emergency contact i.e. power outage etc. Yorkshire Water Emergency contact i.e. burst pipes etc. LCC General Switchboard Reporting emergencies Fire Protection Contractor NG Bailey Appliance problems IT Helpdesk IT failure including telecoms Russell Thomas WIRA Building Manager

16 Appendix B: Incident Log The Incident Log is used to record key information, especially in respect of decisions made during any emergency or disruption. Besides decisions taken, details of casualties and damage assessments may also be recorded. It is important that a record is maintained from start through to finish. (additional Incident Log sheets/pages should be prepared where hard copies are to be used) Incident Log Page # of # Date Time Information / Decisions / Actions Owner Recorded by 16

17 Appendix C: Emergency Response Checklist An Emergency Response Checklist is a useful tool to use during the heat of a disruption or emergency to tick off initiation of, or completion of key tasks (in the heat of a disruption it might be easy to overlook essential tasks). An Emergency Response Checklist is provided below and can be adapted to suit the needs of the incident causing the disruption by including additional actions specific to the business. Emergency Response Checklist Action Initiated by (name/date/time) Completed by (name/date/time) Liaise with Emergency Services Identify any damage Identify the service/s disrupted Convene your Management Team Initiate Incident Log Decide on course of action Communicate decisions to staff and stakeholders Provide public information to maintain reputation and business Arrange a Debrief Review Business Continuity Plan 17

18 1.7 Sign-Off of the Business Continuity Plan Template The Plan Owner (Chief Officer) and Senior Manager should sign-off the completed template to confirm that the contents of the Business Continuity Plan are appropriate to meet the needs of the service. Sign-Off of the Business Continuity Plan Plan Owner (Chief Officer) Enter signature/date Director of Commissioning Enter signature/date 1.8 Date of Next Review/Test/Exercise. The purpose of review and exercise is to ensure that the services business continuity arrangements competence and capability remains effective, fit for purpose and up to date. All business changes (internal or external) that impact the service need to be reviewed and tested in relation to business continuity arrangements. The service is responsible for reviewing and approving all changes and ensuring that the content of the Business Continuity Plan is revised to reflect such changes. It is recommended to undertake a complete review and exercise of the Business Continuity Plan at least annually or when there is significant change in premises, personnel, process, market, technology or organisational structure and when an exercise or incident highlights deficiencies. Date of Next Management Review/Test/Exercise Date due August 2015 Person responsible for arranging the review/exercise Elizabeth Micklethwaite 18