BUSINESS CONTINUITY PLAN

Transcription

1 BUSINESS CONTINUITY PLAN Additional copies of this Plan can be found in the Incident Control Room located in the office next to the Boardroom, second floor, Charter House. Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 1 of 50

2 DOCUMENT CONTROL SHEET Document Owner: Director of Operations Document Author(s): EPRR Lead Version: 5.3 FINAL Directorate: Operations Approved By: Governing Body Date of Approval: 15 January 2015 Date of Review: 15 January 2016 Change History: Version Date Reviewer(s) Revision Description 1.0 July 2013 Valarie Penn Updated following JW comments 2.0 August 2013 Valarie Penn General update following Draft Business Impact Assessments 3.0 October 2013 John Webster Whole Document Review Updates to Plan, Business Impact Assessments and Policy Statement in line with EPRR Core Standards 4.0 November 2013 Valarie Penn Updated following Exec Comments 4.1 January 2015 Oskan Edwardson Annual Update for approval 5.0 January 2015 Jas Dosanjh Formatting 5.1 April 2015 Jas Dosanjh Sharn Elton Appendix 3 updated. Critical Functions of the Operations Director added to Appendix 4 section June 2015 Anne Ephgrave Critical Functions of HR added to Appendix 4 section July 2015 Phil Turnock Addition of section Objectives for the Recover of Services and updated Appendix 4 Section Critical Functions of HBL ICT Shared Service Implementation Plan: Development and Consultation Dissemination EPRR Consultant Executive Team Staff can access this policy via the intranet and will be notified of new/revised versions via the staff briefing. This policy will be included in CCG Publication Scheme in compliance with the Freedom of Information Act Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 2 of 50

3 Training The emergency and business continuity response arrangements within the plan will be ineffective if the staff expected to implement them at the time are unaware of them. Therefore all staff will be made aware of the plan at their corporate induction training and mandatory risk training, and will also be made aware of where the overarching and departmental plans can be located. If there are any significant changes to the plan, then this will be communicated to departmental leads to cascade to all staff. Business Continuity arrangements w i l l be exercised at least once a year in order to validate the effectiveness and highlight any gaps which can then be corrected. Monitoring and Review This document will be reviewed on an annual basis or when there are changes in the working systems of the organisation; or major changes to the contact arrangements of staff or suppliers that affect the content. The date of the review will be recorded on the front of the document. It is the responsibility of the identified departmental leads to update local departmental plans on an ongoing basis and the Emergency Planning Manager to ensure the generic section of this document is kept update Equality and Diversity Associated CCG Documents January Equality Impact Assessment (Appendix 5) January Privacy Impact Assessment (Appendix 6) The following documents must be read in conjunction with this policy: Major Incident Plan System Escalation Plan Major Incident Action Cards CCG Risk Register/Risk Management Dashboard References The ISO Standard for Business Continuity (ISO 22301) British Standard NHS Business Continuity Management (BS25999) Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 3 of 50

4 Contents Section No. Section Name Page No. 1.0 Introduction Scope Purpose Definitions Role and Responsibilities Plan Activation Business Continuity Management Team (Crisis and Recovery Team) Continuing Services in the Event of a Disruption Failure of IT Systems Failure of Telecommunications Failure of Utilities Electricity / Gas / Water Supplies Loss of CCG Buildings Fuel Shortages Staff Shortages Communications 13 Appendix 1 Business Continuity Management CCG Policy Statement 14 Appendix 2 Business Recovery Template 16 Appendix 3 Key Contacts List 17 Appendix 4 Business Impact Assessments 18 Appendix 5 Equality Impact Assessment 49 Appendix 6 Privacy Impact Assessment 50 Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 4 of 50

5 1.0 Introduction The Civil Contingencies Act 2004 came into force in November 2005 and focuses on local arrangements for civil protection, establishing a statutory framework of roles and responsibilities for local responders (such as CCGs) as Category 2 Responders. It is a requirement of the Act that the CCGs have Business Continuity Plans in place to support the CCG s Major Incident Plan. 1.1 Policy statement It is the policy of East & North Hertfordshire Clinical Commissioning Group (CCG) to develop, implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy. It is the policy of the CCG to take all reasonable steps to ensure that in the event of a service interruption, the organisation will be able to respond appropriately and continue to deliver its essential functions and that we are able to respond to the needs of our local population. A service interruption is defined as: Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions. ( The CCGs Policy Statement is provided at Appendix Resources The CCG recognises its obligations with regards to emergency planning, resilience, responding to major incidents and business continuity. Funds, as identified as being necessary, will be made available in the event of a major incident to ensure the CCG meets its obligations with respect to these. 1.3 Emergency Planning - Business Continuity The Cabinet Office s Expectations and Indicators of Good Practice Set for Category 1 and 2 Responders describes seven expectations regarding the Civil Contingencies Act (2004), Regulations (2005) and guidance: 1. Duty to assess risk 2. Duty to maintain plans Emergency Plan 3. Duty to maintain plans Business Continuity 4. Duty to communicate with the public 5. Business Continuity Promotion 6. Information sharing 7. Cooperation Clinical Commissioning Groups are Category 2 Responders and as such will be required to co-operate with Category 1 Responders in the event of an emergency. They are also required to have Business Continuity Plans and Major Incident Plans. These requirements will be achieved in three stages: Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 5 of 50

6 Stage 1 A Business Impact Assessment: The impacts of the loss of staff, communications, data systems, transport and buildings. Appendix 4 provides details of the Business Impact Assessments undertaken at Departmental level within the CCG. Some functions are hosted by or delivered through contracts with other organisation s (e.g. PropCo Ltd). These assessments are also provided. Stage 2 - A Business Continuity Plan: The measures to be taken internally in the event of such a loss. The Business Continuity Plan will comprise the mitigating actions arising from the Impact Assessments, the key contacts that will instigate the relevant mitigating actions and the contact details of all staff that might have to undertake those actions - be it communicating with others or changing their way of working. Stage 3 A Major Incident Plan: The measures to be taken in support of Category 1 responders in the event of an Emergency. This details the organisation s response to: an event or situation which threatens serious damage to human welfare; an event or situation which threatens serious damage to the environment; War, or terrorism, which threatens serious damage to the security of the UK. The CCG is required to equip nominated staff with the Major Incident Plan, the Business Continuity Plan, an incident control centre, an emergency telephone line and a list of all relevant telephone and contacts. The plans have been built on experience and will be subject to a desktop test, as part of best practice, in order that they are further refined. The result of the desktop testing will be reported to the CCG Governing Body. 2.0 Scope The scope of this plan is to provide overarching organisational guidance of business continuity management and the invocation process within the CCG, and an outline of responsibilities. The following table indicates the links with other CCG and System Resilience Plans: Document Community Risk Register LRF Flood Plan LRF Pandemic Influenza Plan LRF Severe Weather Plan The CCG is a Level 2 responder for Emergency Preparedness Resilience and Response which will be led by the NHS England Midlands and East (Central Midlands) Area Team. These plans will be owned by the Local Resilience Forum with input from the Local Health resilience Partnership. However, the CCG will have a role in planning for and responding to the relevant incident. Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 6 of 50

7 3.0 Purpose The purpose of the Business Continuity Plan is to outline the responsibility of the CCG and their staff in the event of a crisis in order to maintain as normal a service as practically possible. The over-riding aim is to ensure a prompt and efficient recovery of critical activities from any incident or physical disaster that may affect the CCG s ability to operate and deliver their commissioning service in support of the NHS economy. It must be recognised that any event not only impacts on staff, premises, technology and operations, but also on the CCG s brand, status, relationships and reputation and that all business continuity arrangements should ensure that the CCGs meet their legal, statutory and regulatory obligations to both their staff and dependent stakeholders. 4.0 Definitions 4.1 Business Continuity Management is the process that helps manage the risks to the smooth running of the organisation in the delivery of its services, ensuring that essential business can continue in the event of a disruption and can be sustained in the event of an emergency. It is aimed at reducing or eliminating the risks of business interruption and it is necessary to have contingency plans in place to ensure normal business functions can be resumed as soon as possible. 4.2 A Service Interruption can be defined as Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions For the NHS, Business Continuity Management is defined as the management process that enables an NHS organisation: To identify those key services which, if interrupted for any reason, would have the greatest impact upon the community, the health economy and the organisation. To identify and reduce the risks and threats to the continuation of these key services. To develop plans which enable the organisation to recover and/or maintain core services in the shortest possible time. There are many and varied possible causes of service disruption; these may range from the loss of infrastructure e.g. offices; buildings; IT systems; managing a power cut or extreme weather to arranging service provision during an emergency or epidemic. These events may not be mutually exclusive i.e. extreme weather can lead to loss of electricity or staff being unable to get to work. 5.0 Roles and Responsibilities Overall accountability for the smooth running of the organisation lies with the CCG s Accountable Officer. The Director of Operations is the lead Director for Business Continuity and will be responsible for providing positive assurance to the Governing Body on the CCG s plans. 5.1 Executive Directors are responsible for maintaining their individual services, and for alerting the need to activate Business Continuity Plans if such an event occurs within their directorate. Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 7 of 50

8 5.2 Designated Associate Directors and Assistant Directors must ensure that any changes of contact details of key staff noted in their plans are updated as required, that their Directorate plans are reviewed at least annually and that any new services that are developed are included in the plans. 5.3 The Head of Emergency Preparedness, Response and Business Continuity will provide specialist guidance during the invocation of any part of the Business Continuity Plans and will assist in coordinating any actions required. 5.4 The Communications Team will be responsible for informing the public of events where necessary, following agreement of the Accountable Officer or Director of Operations (designated deputy), and will also keep staff informed of developments as appropriate. 5.5 All CCG employed staff are responsible for co-operating with the implementation of the Business Continuity Plans as part of their normal duties and responsibilities. 6.0 Plan activation A nominated post holder from each department will decide in discussion with the Heads of Department and the Director of Operations whether the plan or any part of it should be activated using the process in the following flow chart. Out of hours the decision will be made with the direction of the on call CCG director/manager Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 8 of 50

9 6.1 Business Continuity Management Team (Crisis and Recovery Team) A team will be convened to oversee the process of ensuring essential services are maintained and that recovery plans are put into place, Membership may include the following: Director of Operations or nominated Deputy Associate Director where incident has occurred Lead for Emergency Preparedness, Response & Business Continuity Communications Manager Estates representation (as required) Any other personnel deemed necessary, i.e. representative of HR, specialist advice, etc. The team will meet initially on a daily basis and will keep notes of the meeting, actions taken, resources committed, and progress made using the template a t Appendix 3. Incident Control Centre location and resources: located in the Office next to the Boardroom, Second Floor, Charter House, WGC. Includes additional paper copies of this Plan. 6.2 Continuing Services in the event of a Disruption As part of the Business Impact Assessment process, a critical function analysis has been carried out to determine those parts of the service that are a priority to maintain or reinstate. The CCG is responsible for commissioning a wide range of patient services to the local population and the following will be restored and maintained as soon as is practically possible. Maintaining an emergency response and support to Category 1 responders; Incident investigation; Mobilisation of the workforce, and support for staff safety and welfare; Provision of IT (through a shared service (called Herts Beds and Luton ICT Shared Service) with ENHCCG as the host for this service); Maintaining communications with the general public and CCG staff; Essential Finance functions; including the making and receiving of payments; Essential HR processes; Safeguarding adults and children; and Continuity of contract management responsibilities System leadership role. The critical function analysis also identifies those functions that are less critical and could be suspended. Service Function Financial management Planning services - preparing commissioning plans Commissioning services through pathway development and redesign Contract management acute contracts Length of time function can be suspended for 7 days 28 days 28 days 14 days Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 9 of 50

10 Contract management community and third sector Performance and data analysis Governance duties to ensure continuous compliance with statutory duties Partnership working to ensure joined up working to improve the health and wellbeing of patients Support and guidance to member practices Quality and safety Administration 14 days 14 days 14 days 14 days 14 days 14 days 14 days If an incident occurs and this plan is activated, permission will be sought from the Accountable Officer, or in their absence the Director of Operations (or nominated Deputy) to suspend the mainstream service functions detailed above and release the CCG staff who cover these functions to provide support to critical functions provided in other areas of the CCG. Each department has identified its own critical functions that are required to maintain its service and have their own local departmental plans which a r e accessible in both paper copy and electronically. It is the responsibility of designated Associate/Assistant Directors to communicate the location of these plans to their staff. In the event of an emergency, or business interruption, the CCG will endeavor to maintain services as usual or as close to the usual standard as possible. However, where it is clear that this is not achievable, the Head of Service in conjunction with the Director of Operations ( or on-call Director/Manager if out of hours) will decide which priority functions of the department must continue, depending on the nature of the business interruption. There are some generic areas that could potentially affect all departments and these are described below: 6.3 Failure of IT systems The CCG, like many organisations, rely upon IT systems for their day to day business. A disaster that prevents the organisation from accessing these systems whether caused by the failure of the systems themselves, or being due to an incident such as fire or flooding will potentially have a serious impact on the continuation of the CCG s functions. While it is impossible to consider and document a recovery plan for every disaster that may occur the impact of the loss of IT systems to each department is covered in the individual departmental plans and it is expected that they can be adapted to cater for any specific incident. If there is a failure in the IT system or any standalone computer for important data for a prolonged period of time, staff will need to change to a paper back-up system where possible to capture the data so that this can be recorded on the system retrospectively. The development of telecommunications that are reliant upon the IT network makes it likely that telephone failure will also result from any IT network failure. The priority in which restoration is required will depend on the service area and is detailed in individual Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 10 of 50

11 departmental plans. If there is a loss of hardware or software through theft or damage then advice should be sought from the IT provider and the incident reported to the CCG s Risk team (via the Associate Director of Governance). The maintenance of the CCG IT systems is provided by the Herts Beds and Luton ICT Shared Service (HBL ICT) under a Service Level Agreement (SLA). Under the terms of this SLA HBL ICT will invoke their Emergency Disaster and Recovery Plan to cope with any event causing prolonged interruption of service Objectives for the Recover of Services Recovery of Services: The recovery of Services in a Disaster Recovery or Business Continuity scenario is defined by two Objectives: Recovery Time Objective: The Recovery Time Objective (RTO) is defined as the time period after a disaster at which business functions need to be restored. Recovery Point Objective: The Recovery Point Objective (RPO) is the maximum period of time based data loss (relative to the disaster) which cannot be recovered. The standard RPO & RTO within the agreed partnership service agreements is: RPO 1 day from date of failure RTO = 24 hours from the time of failure Restore: Restoration of services will be managed through the agreement ICT Major Incident processes which will include full engagement of the CCG executive. Whereby the standard RPO or RTO cannot be achieved, this will be brokered with the CCG Executive during the respective phases of the Major Incident process. 6.4 Failure of Telecommunications The telephone lines are provided under contract with BT, and the system is under a maintenance contract with Vodafone. MTPASS SIM cards have been requested for the on-call phone and those of the Emergency Planning Officer and the on-call Directors and managers. This will provide resilience in terms of key staff needing to respond to potential incidents covered by this plan. Each departmental plan identifies in more detail the actions required should the telephone systems be inactive. The priority in which restoration of phone lines are required will depend on the service area and if crucial will be detailed in individual departmental plans. CCG contact in the first instance: HBLICT Service Desk on * Note this number is only activated if the Phone System is down at Charter House Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 11 of 50

12 If electricity has failed then prior consideration needs to be given to the ability to recharge mobile phone batteries. 6.5 Failure of Utilities Electricity / Gas / Water Supplies Resolution is via NHS Property Services The fault should be reported and a request made as to whether they are able to give an indication of the length of time the supply will be unavailable. If heating is lost an assessment should be made to the effect of the loss of the heating related to the time of year and the forecast temperature as to whether services can continue from the affected location. For plumbing emergencies: contact NHS Property Services CCG contact in the first instance: NHS Property Services In the event that the water supply fails the impact of the following must be assessed: Toilets Hand hygiene Drinking water 6.6 Loss of CCG Building If premises are unable to be used then services may need to be suspended or relocated. Local departmental plans will detail who to contact and measures to be taken. The Lead for Emergency Preparedness, Response & Business Continuity will assist in finding alternative accommodation should CCG buildings be affected. Alternative locations for staff will include HCT HQ at Howard Court, HPFT HQ at Waverley Road, St Albans and HVCCG HQ at Hemel Hempstead. Initiation of these arrangements will be agreed by the Director of Operations (or nominated Deputy) or by agreement with the on-call Director/Manager. 6.7 Fuel Shortages In the event of a fuel shortage the ability to maintain services may be affected. If it has been necessary for the invocation of the National Fuel Plan then the Business Continuity Management Team will be convened to oversee the management of the situation within the CCG It is unlikely there will be provision of fuel for staff to get to their work base and the responsibility for alternative travel arrangements is with the individual members of staff in discussion with their line manager. 6.8 Staff Shortages The absence of staff will have a varying effect depending on their role. In some cases roles can be covered by other staff but others may be highly specialised and necessary arrangements will be detailed in departmental plans as to whether a service can continue particularly if the service depends on that person alone. Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 12 of 50

13 There may be a scenario when a number of staff are all incapacitated at the same time such as pandemic influenza. The departmental manager will be responsible for assessing the impact on the ability to continue to provide a service and what contingencies can be put in place, and whether some non- critical services can be cancelled as detailed in the individual departmental plans. 6.9 Communication If an event occurs that is so severe that alternative arrangements for the provision of care commissioned by the CCGs need to be communicated to the local population, this will be carried out via the Communications Manager after discussion with the Director of Operations. Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 13 of 50

14 Appendix 1 Business Continuity Management Policy Statement Business Continuity Management (BCM) is an important part of NHS East & North Hertfordshire CCG s risk management arrangements. The Civil Contingencies Act (CCA) identifies all CCGs as Category 2 Responders, and imposes a statutory requirement on each CCG to have robust BCM arrangements in place to manage disruptions to the delivery of services. It is the policy of NHS East & North Hertfordshire CCG to develop implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy. The aim of Business Continuity Management is to prepare for any disruption to the continuity of the business, whether directly - i.e. within the responsibility control or influence of the business, or indirectly - i.e. due to a major incident occurring to a partner, supplier, dependent or third party, or from a natural disaster. It is recognised that plans to recover from any disruption must consider the impacts not only to our staff, premises, technology and operations, but that NHS East & North Hertfordshire CCG must also plan to maintain its brand, status, relationships and reputation. Business Continuity arrangements should ensure that the CCG continues to meet i t s legal, statutory and regulatory obligations to its staff and to its dependent stakeholders. All NHS East & North Hertfordshire CCG departments are to continue to develop and implement BCM for their areas of business. In order for this to be achieved, members of each department have been nominated as Business Continuity Leads to represent their part of the business for Business Continuity Management. These individuals are responsible for reviewing and maintaining the departmental Business Continuity arrangements within the CCG. To ensure that the BCMS fully meets the changing needs of the business all Business Continuity Plans will be exercised, reviewed and audited annually. In accordance with the NHS E n g l a n d Guidance 2, NHS East & North Hertfordshire CCG BCMS will be in accordance with and aligned to the ISO Lesley Watts Accountable Officer Date 1 NM Government (2004) Civil Contingencies Act 2 NHS England (2013) Board Business Continuity Framework 3 ISO Societal Security - Business Continuity Management Systems Requirements Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 14 of 50

15 Appendix 2 Business Recovery Template Reason for Invoking Plan: Date: Time: Brief Summary of Situation: Department/s Affected: Other Organisations Involved / Alerted: Date: Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 15 of 50

16 Actions Required (including Resources) By Whom Immediate: Within 8 Working Hours: Within 1 Working Day: Within 3 Days: Within 1 Week: Situation to be reviewed every..hrs /.days Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.3) East and North Hertfordshire Clinical Commissioning Group Page 16 of 50

17 Appendix 3 Key CCG Contacts On Call Member Role Work Mobile Work Number 1 CHRIS BADGER Assistant Director of Health Integration, ENHCCG & HCC Chris.Badger@hertfordhsire.gov.uk DENISE BOARDMAN Interim Director of Commissioning, ENHCCG Denise.Boardman@enhertsccg.nhs.uk JACQUI BUNCE Associate Director of Strategy, ENHCCG Jacqui.Bunce@enhertsccg.nhs.uk JO BURLINGHAM Assistant Director Operations, ENHCCG Jo.Burlingham@enhertsccg.nhs.uk NOREEN COLES Assistant Director of Finance, ENHCCG Noreen.Coles@enhertsccg.nhs.uk HELEN EDMONDSON AD of Locality Commissioning, ENHCCG Helen.Edmondson@enhertsccg.nhs.uk SHARN ELTON Director of Operations, ENHCCG Sharn.Elton@enhertsccg.nhs.uk SARAH FEAL Company Secretary, ENHCCG Sarah.Feal@enhertsccg.nhs.uk BEVERLEY FLOWERS Director of Strategic Partnerships, ENHCCG Beverley.Flowers@enhertsccg.nhs.uk JAMES GLEED Associate Director Commissioning Primary Care ENHCCG James.Gleed@enhertsccg.nhs.uk NEIL HALES Assistant Director of Contracting Neil.Hales@enhertsccg.nhs.uk EDWARD JAMES AD Financial Services, ENHCCG Edward.James@enhertsccg.nhs.uk ALAN POND Chief Finance Officer, ENHCCG Alan.Pond@enhertsccg.nhs.uk SHEILAGH REAVEY Director of Nursing & Quality, ENHCCG Sheilagh.Reavey@enhertsccg.nhs.uk CATH SLATER Assistant Director of Quality and Patient Safety, ENHCCG Cath.Slater@enhertsccg.nhs.uk PAULINE WALTON Assistant Director & Head of Pharmacy & Medicines Optimisation Pauline.Walton@enhertsccg.nhs.uk LESLEY WATTS Accountable Officer, ENHCCG Lesley.Watts@enhertsccg.nhs.uk COMMS NUALA MILBOURN Assistant Director of Communications, ENHCCG Nuala.Milbourn@enhertsccg.nhs.uk HR ANNE EPHGRAVE Head of Human Resources, ENHCCG Anne.Ephgrave@enhertsccg.nhs.uk ICT PHIL TURNOCK ICT Shared Service Director, HBL ICT, ENHCCG Phil.Turnock@hblict.nhs.uk Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.0) East and North Hertfordshire Clinical Commissioning Group Page 17 of 50

18 Appendix 4 Business Impact Assessments East and North Hertfordshire Clinical Commissioning Group Version: Ratified by: Governing Body Date ratified: January 2015 Job title of originator/author: Director of Operations Name of responsible committee/individual: Accountable Officer Date issued: January 2015 Review date: January 2016 Target audience: All CCG staff Business Continuity Plan Jan 2015 to Jan 2016 (FINAL v.5.0) East and North Hertfordshire Clinical Commissioning Group Page 18 of 50

19 The Business Impact Assessments Section 1: Critical Functions of the Governing Body Members 1.1 Governing Body 1.2 Accountable Officer Section 2: Critical Functions of Directorates 2.1 Finance [including ICT] HBL ICT Shared Service 2.2 Commissioning 2.3 Nursing and Quality Human Resources 2.4 Strategic Planning Continuing Healthcare Medicines Management 2.5 Operations East and North Hertfordshire Clinical Commissioning Group Page 19 of 50

20 SECTION 1 Critical Functions of the CCG Governing Body Members To provide leadership (including clinical leadership) in their individual/specialist areas To undertake statutory roles and duties (SIRO, Caldicott Guardian, Safeguarding, Data Protection Officer) To attend meetings of the CCG Governing Body and the Committees of which they are members To ensure that the Governing Body meets its duties Section 1.1 East and North Hertfordshire CCG Governing Body Key Contacts: Hari Pathmanathan - Chair Lesley Watts - Accountable Officer Alan Pond - Finance Director (SIRO) Sharn Elton - Director of Operations (EPRR responsibilities) Denise Boardman - Interim Director of Commissioning Sheilagh Reavey - Director of Nursing and Quality (Caldicott Guardian) Beverley Flowers - Director of Strategic Partnerships Minimum Levels of Service that need to be maintained a. Performance of statutory duties within set timescales / 3 days b. Availability of clinical leadership within 24 hours c. Ongoing governance of the organisation within 5 working days d. Scheduled meetings of the Governing Body and key committees to the prescribed frequency Contingency Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 20 of 50

21 Threat Priority for restoring service Contingency measures required Loss of staff 3 a/b) Deputies for each statutory and clinical lead role. Secure external support where necessary. 4 c/d) Defer meeting dates. Endeavour to meet quorums at meetings. Chair s action subject to ratification. Loss of telephone communica tion 3 a-d) Use of instead (using contact list for all GB members and corporate staff). Use mobile phones provisioned by the CCG Loss of 3 a-d) Use of telephone and postal or despatch systems (using telephone and address contact lists for all GB members). Actions required to restore service Formal appointment of successors if loss persists. Contact ICT Service Desk Contact ICT Service Desk Risk if priority unable to be met Impact on stability of clinical/statutory leadership. Impact upon ability to conduct business, progress work plans and maintain governance / assurance. Impact on ability to maintain stability of clinical/statutory leadership. Impact on ability to maintain clinical/statutory leadership. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Loss of Internet Loss of Microsoft Office Loss of access to stored documents (servers) 4 a-d) Other research methods. Copies of key documents stored in Microsoft Office format. 3 a-d) Copies of key documents stored in.pdf format. 4 a-d) Copies of key documents stored on alternate servers, battle box and on intranet, emergency encrypted memory stick Contact ICT Service Desk Contact ICT Service Desk Contact ICT helpdesk or Head of Governance for hardcopies and emergency encrypted memory stick Loss of 6 Hot desk working will apply N/A if at HQ N/A individual IT Fuel system Shortage 5 d) Use of telephone conferencing NB: could use unified Communications (Lync) N/A Impact on conduct of business on the work plans and maintenance of governance Loss of buildings: 6 c-d) Use of alternate NHS accommodation and VPN for home working. 6 c-d) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Hemel One (HVCCG) HQ Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ Possible overload on alternate NHS accommodation. East and North Hertfordshire Clinical Commissioning Group Page 21 of 50

22 Section 1.2 East and North Hertfordshire CCG Accountable Officer (AO) To undertake the statutory roles and the duties of the post Key Contacts: Hari Pathmanathan - Chair Lesley Watts - Accountable Officer Alan Pond - Finance Director (SIRO) Sharn Elton - Director of Operations (EPRR responsibilities) Denise Boardman - Interim Director of Commissioning Sheilagh Reavey - Director of Nursing and Quality (Caldicott Guardian) Beverley Flowers - Director of Strategic Partnerships Minimum Levels of Service that need to be maintained: a. Statutory roles (Health and Safety, Employment Rights, Occupiers Liability) b. Strategic Leadership c. Governance regarding decision making d. Outward facing role ( front of house ) e. Delivery of and progress against objectives Contingency: Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 22 of 50

23 Threat Priority for restoring service Contingency measures required Loss of staff 2 a-e) Succession planning of deputies for each statutory and lead role of the AO. Secure external support where necessary. Loss of 3 a-e) Use of instead (using telephone contact list for all GB members and communication corporate staff). Actions required to restore service Formal appointment of successor if loss persists. Contact HBLICT Service Desk during core hours* Outside core hours on-call ICT Duty Manager Further Escalation to the HBL ICT Director Risk if priority unable to be met Impact on workloads of other Governing Body Members and risk of objectives not being achieved. Impact on ability to manage the CCG and risk of objectives not being achieved. Loss of 3 a-e) Use of telephone and postal or systems (using telephone and address contact lists for all GB members and corporate staff). Loss of Internet 4 a-e) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft Office Loss of access to stored documents Loss of (servers) individual 3 a-e) Copies of key documents stored in.pdf format. Stored and managed on a tablet device 4 a-e) copies of key documents stored on alternate servers and on intranet IT Fuel systems Shortage 5 a-e) Use of Virtual Private Networking for staff with laptops. Use of video conferencing and telephone conferencing. Loss of a-e) Use of alternate NHS accommodation buildings: 6 and VPN for home working. N/A 6 a-e) Use of alternate NHS accommodation and VPN for home working. Service Desk is available 365 days a year Contact HBLICT Weekends Service and Desk Bank during Holidays core hours* Outside core hours ICT on-call Duty Manager Further Escalation to the HBL ICT Director Service Contact Desk HBLICT is available Service Desk 365 days during a year core hours* Monday Friday Weekends and Bank Holidays Outside Contact core HBLICT hours Service ICT Director Desk during on-call core - TBC hours* Service Desk is available 365 days a year Outside Contact core HBLICT Monday hours Service ICT Friday Director Desk during on-call core - TBC hours* Weekends and Bank Holidays Service Desk is available 365 days a year Outside core Monday hours ICT Friday Director on-call - TBC Weekends and Bank Holidays Service N/A Desk is available 365 days a year Weekends and Bank Holidays As appropriate to the threat Hemel One (HVCCG) HQ Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ Impact on ability to manage the CCG and risk of objectives not being achieved. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Registered Mail will be used. Impact on ability to manage the CCG and risk of objectives not being achieved. Possible overload on alternate accommodation. East and North Hertfordshire Clinical Commissioning Group Page 23 of 50

24 SECTION 2 Critical Functions of the Directorates Section 2.1 Critical Functions of the Finance Director To develop the financial strategy for the organisation To ensure sound financial management across the organisation To provide financial governance across the organisation To undertake the statutory roles and duties including: Bribery Act, Public Contracts and Public Procurement To oversee the ICT service Key Contacts: Alan Pond - Chief Finance Officer (and SIRO) Noreen Coles - Deputy Chief Finance Officer Eddie James - Assistant Director Financial Services Neil Hales - Assistant Director of Contracts Minimum Levels of Service that need to be maintained: a. Access to Invoicing and Payments system within 3 days (including contract payments & pay of CCG staff) b. Monitoring financial position within 3 days (within 1 day if within first week of month) c. Monitoring bank accounts within 3 days Contingency: Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 24 of 50

25 Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of staff 3 a-c) Deputies for each statutory and lead role of the Finance Director.(FD) a-c) Secure external support where necessary. Loss of telephone communication Formal appointment of successor if loss persists. 3 a-c) Use of instead Contact HBLICT Service Desk during core hours* Impact on workloads of FD and finance teams and risk of financial objectives not being achieved. Impact on ability monitor financial position. Loss of 3 a-c) Use of telephone and postal or systems (using telephone and address contact lists internal and external). Outside core hours ICT on-call Duty Manager Further Escalation to the HBL ICT Director Service Desk is available 365 days a year Contact HBLICT Weekends Service and Desk Bank during Holidays core hours* Outside core hours ICT on-call Duty Manager Further Escalation to the HBL ICT Director Impact on ability to manage the CCG with risk of statutory requirements not being met and other financial objectives not being achieved. Loss of Internet 4 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Service Desk is available 365 days a year Contact HBLICT Weekends Service and Desk Bank during Holidays core hours* Outside core hours ICT on-call Duty Manager Further Escalation to the HBL ICT Director Loss of Microsoft Office 3 a-c) Copies of key documents stored in.pdf format. Service Desk is available 365 days a year Contact HBL Weekends ICT Service and Desk Bank Holidays East and North Hertfordshire Clinical Commissioning Group Page 25 of 50

26 Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of access to stored documents (servers) 3 a-c) copies of key documents stored on alternate servers and on intranet. Contact HBLICT Service Desk during core hours* Outside core hours ICT on-call Duty Manager- Further Escalation to the HBL ICT Director Loss of individual 3 a) Contingent process for invoice payment IT systems (cheque system). 4 4 b-c) Contingent process for financial and account monitoring. a) Manual invoicing process. Fuel Shortage 5 b-c) Use of Virtual Private Networking for staff with laptops. b-c) Use of conferencing. Service Desk is available 365 days a year Weekends and Bank Holidays Contact relevant service provider Contact relevant service provider Contact relevant service provider N/A Impact on ability pay other organisations with risk of service disruption. Impact on ability to manage finances with risk of not meeting statutory financial balance and other financial objectives. Impact on cash flow. Impact on ability to manage finances with risk of not meeting statutory financial balance and other financial objectives. Loss of buildings: 6 a-c) Use of alternate NHS accommodation and VPN for home working. 6 a-c) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Hemel One (HVCCG) HQ Howards Court (HCT) HQ few places Waverley Rd (HPFT) HQ Possible overload on alternate NHS Accommodation. East and North Hertfordshire Clinical Commissioning Group Page 26 of 50

27 Section Critical Functions of HBL ICT Shared Service ICT functionality (core information and communications technology, data processing incorporating resilience to include: , telecommunications, back & restore, antivirus, physical and logical controls) Pharmacy and Medicines Optimisation (oversight of prescribing financial management) Pharmacy and Medicines Optimisation discharge statutory functions of controlled drugs Key Contacts: Phil Turnock - Director of HBL ICT Shared Service Simon Carey - Associate Director of Service Development and Assurance Keith Fairbrother - Head of Infrastructure Minimum Levels of Service that need to be maintained: a) To continue critical or sensitive business operations (ICT) b) To facilitate effective co-ordination of recovery tasks (ICT) Contingency: Priority for the Restoration of Services 8. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 9. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 10. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 11. Important: Within 3 days Will affect services without causing danger to patients 12. Necessary: Within 7 days Minor disruption to services 13. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 14. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 27 of 50

28 Threat Loss of Primary Data Centre Waverley Road Priority for restoring service Contingency measures required 1 a-b) Fail-over of critical services to Secondary Data Centre a-b) Invoke BC & DR via Major Incident Process Actions required to restore service Invoke Major Incident Process Invoke Disaster Recovery Plan Risk if priority unable to be met Loss of some critical ICT Services at CCG sites Loss Secondary Data Centre Charter House 1 a-b) Fail-over of critical services to Primary Data Centre a-b) Invoke BC & DR via Major Incident Process Invoke Major Incident Process Invoke Disaster Recovery Plan Loss of ICT Services at CCG sites Loss of Core Network (WAN) 1 a-b) Assessment of network configuration to determine any available components, route traffic across resilient network links. Invoke Major Incident Process Invoke Disaster Recovery Plan Loss of some critical ICT Services at CCG sites a-b) route traffic across N3 where possible a-b) Invoke BC & DR via Major Incident Process Loss of N3 1 a-b) Re configure core switch and reroute traffic through WAN is feasible. a-b) Invoke BC & DR via Major Incident Process Loss of SAN 1 a-b) fail over to secondary SAN a-b) re-provision storage to any spare redundant storage disks Invoke Major Incident Process Invoke Disaster Recovery Plan Invoke Major Incident Process Invoke Disaster Recovery Plan Loss on NHS mail for sending secure PID Loss of ICT Services at CCG sites Loss of Compute Services a-b) Invoke BC & DR via Major Incident Process 1 a-b) fail over to secondary/spare compute servers, including commissioning additional virtual servers. a-b) Invoke BC & DR via Major Incident Process Invoke Major Incident Process Invoke Disaster Recovery Plan Loss of ICT Services at CCG sites Loss ITSM Toolset 2 a-b) revert to manual processes & suspension of Invoke Major Incident Process Reduction service response SLA recording Loss of staff 1 a-c) Secure immediate cover. Invoke Formal Disaster appointment Recovery of Plan Unable to provide support to partnership a-b) Invoke BC & DR via Major Incident Process successors if loss persists. clients 4 d) Secure external support where necessary. East and North Hertfordshire Clinical Commissioning Group Page 28 of 50

29 Threat Loss of telephone communication Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met 1 a-d) Use of instead. Invoke Major Incident Process Reduced support services Loss of 2 a-d) Use of telephone and postal or dispatch systems. Loss of Internet 4 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Invoke Major Incident Process Invoke Major Incident Plan Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Potential reduced support services Loss of Microsoft Office Loss of access to stored documents (servers) Loss of individual IT systems 4 3 a-c) Copies of key documents stored in.pdf format. a-c) Copies of key documents stored on alternate servers and on intranet. Minimal disruption Invoke Service Major Desk Incident is available Process 365 days a Potential reduced support services year 3 Recover from disk Weekends and Bank Invoke Major Incident Process Holidays Potential reduced support services Fuel Shortage Use of Virtual Private Networking for staff with laptops. Use of telephone conferencing. N/A Potential reduced support services Loss of buildings: 6 6 a-c) Use of alternate NHS accommodation and VPN for home working. a-c) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Hemel One (HVCCG HQ) Howards Court (Few places HCT HQ) Waverley Road, St Albans, HPFT Possible overload on alternate NHS accommodation Potential reduced support services Loss of staff 3 After 24 hours prioritisation Secure replacement or agency Impact of uncontrolled of essential tasks with statutory deadlines. staff. Communication and Statutory SII reporting times not met. 4 After 2 days prioritisation Impact of provider quality being unof urgent tasks. reviewed and/or regulatory compliance not delivered. East and North Hertfordshire Clinical Commissioning Group Page 29 of 50