BUSINESS CONTINUITY MANAGEMENT POLICY

Transcription

1 BUSINESS CONTINUITY MANAGEMENT POLICY Version No: 1 Issue Status: awaiting Trust Board approval Date of Ratification: 11th April 2012 Ratified by: Risk Management Committee Policy Author(s): Stuart Coalwood Asst Director of External Compliance & Quality Assurance Policy Owner: Camilla Wiley, Director of Nursing Review Frequency: 2 yearly Last Review: May 2012 Next Review: May 2014 POLICY AWARENESS People who need to know this policy in detail People who need to have a broad understanding of this policy People who need to know this policy exists All on call staff All staff All staff CHANGE CONTROL DETAILS Date: Dd/mm/yy Version Description Reason for changes May 2012 V01 New Policy New Policy Location: RNOH Intranet 1

2 Contents Page Policy statement 4 Scope 4 Rationale and strategic context 4 Definitions 5 Roles and responsibilities 5 Governance 6 Training, awareness and exercising 6 Audit and review 7 Links to other policies and plans 7 2

3 1 Policy statement 1.1 The mission of the Royal National Orthopaedic Hospital NHS Trust is to be the Specialist Orthopaedic Hospital of choice by providing outstanding patient care, research and education. 1.2 It is the Policy of The Royal National Orthopaedic Hospital NHS Trust to ensure, so far as is reasonably practicable, that the essential services which contribute to the achievement of that mission are protected against potential threats, by the implementation of an effective programme of Business Continuity Management (BCM) which is aligned with British Standard (NHS) and which meets the aims of the Royal National Orthopaedic Hospital NHS Trust Integrated Equality Scheme. 2 Scope 2.1 This Policy applies to all The Royal National Orthopaedic Hospital NHS Trust Directorates and all The Royal National Orthopaedic Hospital NHS Trust provider services. 2.2 A The Royal National Orthopaedic Hospital NHS Trust Managers responsible for contracting, commissioning or purchasing goods or services from external providers are responsible for ensuring that contracts and/or service level agreements with providers of goods and/or services include arrangements to ensure that essential services are maintained. 2.3 NHS, private and third sector organisations which provide services to NHS patients or equipment and goods which will be used in the treatment of NHS patients on behalf of The Royal National Orthopaedic Hospital NHS Trust must have their own business continuity arrangements which meet their legal and contractual obligations. 3 Rationale and strategic context 3.1 This Policy and the supporting strategy and plans are required to assist in providing the Board with reasonable assurance that the Trust is meeting its BCM obligations. 3.2 BCM is a legal requirement for Primary Care Trusts, Acute Trusts and Acute Foundation Trusts, as Category 1 responders under the Civil Contingencies Act 2004 (CCA) and the Civil Contingencies Act 2004 (Contingency Planning) Regulations The Health and Social Care Act 2008 (Regulated Activities) Regulations 2009 (Regulations 9(2) and 24) came into force on April 1st 2010, and provide the statutory basis for the Care Quality Commission s Essential Standards of Quality and Safety, 4B, 6D and 10E, which require healthcare providers to put in place arrangements for the management of emergencies and the development and maintenance of contingency plans to maintain services. 3

4 3.4 The Operating Framework for the NHS in England (as amended) paragraphs sets out the Department of Health s expectations regarding emergency preparedness and business continuity. 3.5 The Business Continuity Institute sets out Good Practice Guidelines (GPGs) which are recognised as the industry standard under BS The Department of Health Interim Strategic National Guidance 2008 recommends that all NHS organisations aspire to comply with the requirements of this standard. 3.6 The annual Acute Services Contract between North Central London Cluster and (April 1st 2010) requires the Royal National Orthopaedic Hospital NHS Trust to have plans in place for responding to major incidents, and have plans in place to ensure business and service continuity. 4 Definitions 4.1 BCM can be defined as: an holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. 4.2 Essential services will be identified through a process of Business Impact Analysis. For the purposes of this Policy, essential services are defined as: Services which are necessary for the preservation of life or for the purpose of ensuring the health, safety and welfare of patients and/or staff. 4.3 All other terms in this policy and in any documents associated with the Royal National Orthopaedic Hospital NHS Trust BCM programme are as set out in the Business Continuity Institute Glossary. 5 Roles and responsibilities 5.1 Chief Executive and Board: The Chief Executive and the Board are accountable to the public and the Secretary of State for Health for ensuring that the Trust consistently follows the principles of good corporate governance and internal control They will ensure that a BCM framework is in place to ensure that, in the event of a loss or major disruption to core functions, the public continue to receive the best quality and range of services it is reasonably practicable to deliver, and that essential services are maintained. 5.2 Lead Director: The lead director has delegated responsibility from the Board to ensure that the requirements of this policy are met, and that the Board are provided with reasonable assurance or are kept informed of any significant concerns. 4

5 5.3 Emergency Planning Officer (EPO): The EPO is responsible for the development and implementation of the BCM programme, advising on compliance with the Civil Contingencies Act and ensuring that Emergency Planning and ICT resilience are co-ordinated in conjunction with the BCM policy. The EPO will also: Provide specialist advice and guidance in respect of BCM issues including the co-ordination, development, implementation and review of business continuity policies, plans and procedures Interpret the requirements of the Civil Contingencies Act 2004 (CCA) and associated guidance, and BS25999, to support service areas and to ensure that these requirements are met Conduct risk assessments based on current and future threats identified through environmental scanning and intelligence gathering Embed a Business Continuity culture through communication and the provision of awareness sessions, training and exercises to staff, according to their roles and needs Liaise with other NHS organisations and external agencies as required Audit compliance with business continuity plans, facilitating tests and providing recommendations and other management feedback as appropriate Department Managers and Team Leaders: Departmental Managers and Team Leaders are responsible for implementing and supporting the BCM policy, developing and maintaining their own Business Continuity Plans, ensuring sufficient training is given and participating in exercises where appropriate, and will liaise with the Emergency Planning Officer They are required to maintain all relevant operational business continuity plans as they are developed, ensuring that any significant service changes or risks are reflected in plans, and understand all the requirements and responsibilities as detailed in the plans All staff: Staff will make themselves aware of their department s Business Continuity Plans, and will participate in training and exercises as required. 6 Governance 6.1 BCM arrangements will be monitored through the Emergency Planning Steering Group. Reports on BCM will be submitted to the Trust Board at least annually by the Steering Group Chair. 5

6 7 Training, awareness and exercising 7.1 Staff with a role in BCM will be trained according to their level of need, following a Training Needs Analysis (TNA). 7.2 The EPO will ensure that BCM is incorporated into corporate induction, risk management, health and safety and emergency planning training, and develop and implement a programme of exercises. 7.3 Significant changes and updates to BCM requirements or processes will be notified through the Emergency Planning Committee and usual corporate routes. 8 Audit and review 8.1 The EPO will collate a central register of Business Continuity Plans and will ensure that compliance is audited. 9 Links to other policies and plans 9.1 This document should be read in conjunction with: Estates Strategy ICT strategy Emergency Management Plan/Major Incident Policy Risk Management Policy Fire Safety Policy Health & Safety Policy Incident Reporting Policy 6