BUSINESS CONTINUITY MANAGEMENT POLICY

Transcription

1 BUSINESS CONTINUITY MANAGEMENT POLICY A GUIDE TO BUSINESS CONTINUITY AND SERVICE RECOVERY PLANNING Version 1.1 Ratified by BHR CCGs Governing Bodies Date ratified September 2013 Name of Director Lead Marie Price Name of author Lisa Wood Date issued October 2013 Review date October 2014 Target audience BHR CCGs Staff Version 1.1 Page 1 of 7

2 Contents Page 1. Introduction 3 2. Purpose 3 3. Causes of Service Interruption 3 4. Business Continuity and Recovery Planning 4 5. Process 5 Version 1.1 Page 2 of 7

3 1.0 Introduction 1.1 The NHS needs to be able to plan for and respond to a wide range of incidents and emergencies that could affect health or patient care. Under the Civil Contingencies Act (2004) NHS organisations must show that they can deal with such incidents while maintaining services to patients. This work is referred to as emergency preparedness resilience and response (EPRR). Emergency response organisations are classified by two types, Category One, primary responders and Category Two, supporting agencies. 1.2 While NHS England (NHSE), as a Category One responder, bears the majority of responsibilities in preparing and responding to incidents and emergencies, the CCG, as a Category Two responder, has a duty to participate in preparations and provide a cooperative and supportive role to NHSE should an incident occur. As a Category Two responder there are also a number of core standards that CCGs must meet and a business continuity management policy and business continuity plan are included. Specific obligations under EPRR are assigned to each category. Each CCG s Chief Operating Officer has been appointed as Accountable Emergency Officer (AEO) for EPRR and is responsible for ensuring that the CCG s roles and responsibilities around EPRR are adhered to. 1.3 As Category 2 responders under the Civil Contingencies Act 2004, Clinical Commissioning Groups (CCGs) are required to have a business continuity plan in place to manage the effects of any incident that might disrupt its normal business. It has always been a sensible precaution to have contingency plans in place to manage interruptions to normal business functions. These range from (for example) managing a power cut to arranging service provision during a major incident or epidemic. The BHR CCGs business continuity management strategy is based on our legal requirements, internal and external issues that could affect service delivery and the needs and expectation of interested parties. 1.4 Business Continuity plans may be required to support NHS England London s Major Incident Plan. National Risk Management requirements (Standards for Better Health, NHS Litigation Authority) necessitate that business recovery and service continuity plans are in place. 1.5 It is the policy of NHS Barking and Dagenham, NHS Havering and NHS Redbridge Clinical Commissioning Groups (BHR CCGs) to take all reasonable steps to ensure that in the event of a service interruption, the organisation will be able to respond appropriately. A service interruption is defined as: Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions. 1.4 An appropriate response would aim to maintain critical activities and restore normal services as soon as possible in the circumstances prevailing at the time. Version 1.1 Page 3 of 7

4 2.0 Purpose 2.1 This Policy sets out the general principles and process for the creation and revision of the Business Continuity plans. This document aims to ensure that all Business Continuity processes carried out by the CCGs are done so in an agreed manner. 3.0 Causes of Service Interruption 3.1 There are many and varied possible causes of service disruption. As a general guide, service continuity planning should be carried out to minimise the effects of a number of potentially disruptive events: Major accident or incident, national disaster, epidemic, terrorist attack Fire, flood, extreme weather conditions Loss of utilities, including IT and telephone systems Major disruption to staffing; epidemic, transport disruption, industrial action, inability to recruit; mass resignations (e.g. lottery syndicate). 3.2 It should be borne in mind that these events may not be mutually exclusive, e.g. extreme weather leads to loss of electricity, disruption to transport, staff unable to get to work. 4.0 Business Continuity & Service Recovery Planning 4.1 Business Continuity: Core Business Functions Identifying core business functions of the BHR CCGs that must be supported in any emergency situation. Core business planning is the responsibility of each Directorate or function within a Directorate (if necessary). 4.2 Service Recovery: Planning for the restoration and support of utilities and services without which the core business functions would not be able to continue. Examples of these are: Gas, Water, Electricity Fire alarms, Security system IT system, Telephone / Communications Post services Estate services Support planning is the responsibility of the Director responsible for each function in liaison with NHS Property Services. 4.3 Premises Recovery Loss of individual premises (or parts of) may cause a significant disruption to the functioning of the BHR CCGs. Therefore, individual premises recovery plans need to be prepared for all premises operated (owned or leased) by the BHR CCGs. Version 1.1 Page 4 of 7

5 This will be the responsibility of NHS Property Services, with co-operation from the landlords and of staff based in those facilities. These recovery plans will be incorporated into the BHR CCGs Business Continuity Plan. 4.4 IT Services Loss of IT Services will again cause a significant level of disruption to the functioning of the BHR CCGs services. The Director who has responsibility for the management of the SLA with the provider of IT services needs to ensure the IT recovery plans of the service provider are incorporated into the BHR CCGs Business Continuity Plans. As of 1 April 2013, North East London Foundation Trust (NELFT) provides management of our IT service which also covers the telephone system within each of our CCGs locations. 4.5 Staffing The BHR CCGs will identify minimum staff levels for each key function to ensure that in the event of major disruption to staffing (such as illness, transport disruption, industrial action, severe weather) we can continue to maintain critical activities. 4.6 Surge Management North East London Commissioning Support Unit (NEL CSU) provides this service on behalf of the BHR CCGs. NEL CSU have their own plan and systems in place for surge management and processes for escalation. Details of this will be included in the BHR CCGs Business Continuity Plan. 4.7 Contractor Services Loss of Contractor Services in respect of NHS England s obligation to provide Primary Care Services e.g. response to unplanned loss of a Primary Care Contractor or Contractor Service is the responsibility of NHS England. 4.8 External Events The BHR CCGs involvement in external events may have some Business Continuity implications, and these must be considered For example, a major terrorist strike in Central London may result in a mass evacuation to the outlying boroughs/counties. The BHR CCGs may find itself having to provide staff to Local Authority reception centres etc whilst having to maintain its own service provision. 5.0 Process 5.1 A phased approach to producing the Business Continuity and Service Recovery Plan has been adopted. Version 1.1 Page 5 of 7

6 5.2 Phase 1 Identification of Functions and Category of each one The BHR CCGs Joint Management Team have reviewed all functions and agreed which category each function is classed as from the following; Category A Activities which must be continued Category B Activities which can be scaled down Category C Activities which can be suspended if necessary The above has formed an interim Business Continuity Plan which has been issued to all Directors The next stage is for each team to identify specifically what is required for each function to be able to continue to operate. This will form the Directorate plan and become part of the organisation Business Continuity Plan A risk assessment of business continuity incidents occurring which may affect the ability of the CCGs to continue to function will be undertaken and included within the Plan. 5.3 Phase 2 Completion of Function Business Continuity Plans A template will be issued to all Directors to identify what is required for each function to be able to continue to operate. It is the responsibility of the Directors to ensure that copies of the template are completed by all relevant leads for each function Completed templates should be returned to the Business Continuity Lead by the date requested, for incorporation into the full plan Review and updating of templates is to be carried out at least annually, or where there is a significant change of circumstances. 5.4 Phase 3 Information gathering Once key contacts, documents and relevant information for each team are identified within the templates an exercise will be undertaken to gather, update and save the information in one place A list of identified critical Information Assets will be included in each Plan with specific detail around business continuity plans for each asset. A separate process will be undertaken by the Senior Information Risk Owner (SIRO) and the Information Governance lead to identify and record each team s Information Assets as part of the Information Governance Toolkit requirements. The SIRO is responsible for ensuring the organisational information risk is properly identified and managed and that appropriate assurance mechanisms exist. The SIRO is supported by Information Asset Owners (IAOs) and Information Asset Administrators (IAAs). The IAOs provide assurance that information risk is managed effectively for the information assets that they own and understanding Version 1.1 Page 6 of 7

7 and addressing risks to those assets. The IAAs are delegated the responsibility for day to day management of information risk of an asset on behalf of the IAOs and provide administrative support as is required to ensure compliance. 5.5 The Plan Once sign off by the Chief Officer and Directors at the BHR CCGs Joint Management Team meeting, this policy and the Business Continuity Plan will be taken to each CCG Governing Body, or to a committee with delegated authority, for formal approval Following this, the Plan will be issued in electronic format and hard copy to each team, along with all accompanying documentation. In addition each Directorate will be issued with an encrypted USB for emergency planning purposes where the Plan and relevant documentation will also need to be saved. Each Directorate will be responsible for updating this as and when necessary and ensure a full review of the critical information on a quarterly basis Each Director will sign to confirm ownership of the plan and agreement that they will make their staff aware that they are responsible for cooperating with the implementation of this policy and relevant plans as part of their normal duties and responsibilities A hard copy of the full organisation Plan will be kept at each of the 3 BHR CCGs sites The BCM policy and business continuity plans will be published on the CCGs website and staff intranet A formal desktop review of the plans will be carried out annually and regular exercises, including a communications exercise every 6 months, undertaken to test the robustness of the plans, which may result in this policy or the plans being updated. Service-specific procedures and controls will be subject to regular reviews by the Information Asset Owners Following reviews of the plans if necessary training will be undertaken by the Directors to ensure that they are fully equipped to carry out their responsibilities around business continuity Should the Plan be invoked any lessons learnt will be reviewed and where necessary the plan will be updated by the Business Continuity Lead NHS England has published core standards for Emergency Preparedness, Resilience and Response (EPRR) and those standards specific to Business Continuity Management will be used to ensure the BHR CCGs Business Continuity Plan is fit for purpose. If requested by NHS England we will submit evidence of our conformity to these standards. Version 1.1 Page 7 of 7