Business Continuity Plan East & North Hertfordshire CCG

Transcription

1 Business Continuity Plan East & North Hertfordshire CCG Additional copies of this Plan can be found in the Incident Control Room located in the office next to the Boardroom, second floor, Charter House. The Plan is also available to staff on the intranet or at N:\E&NH CCG\Corporate\Governance\Emergency Planning 1

2 Document Control Plan Page Details of amendment Date Author Version V001 Updated following JW comments July 2013 VP V002 General update following Draft Business August 2013 VP Impact Assessments V003 Whole Document Review Updates to Plan, October 2013 JW Business Impact Assessments and Policy Statement in line with EPRR Core Standards V005 Updated following Exec Comments November VP 2013 FINAL Approved Governing Body Business Board November 2013 JMc Ownership and Approval Lead Director: Director of Commissioning and Accountable Emergency Officer Date: Emergency November 2013 Officer Version: FINAL Author: Director of Commissioning Review date: November 2014 Approved by: Governing Body Business Board Responsible Manager for Plan Review, Testing and Distribution Emergency Planning Manager 2

3 Contents Index 1. Background The Business Continuity Process 2. Introduction 3. Definition 4. Resources 5. Training and exercising 6. Accountability, roles and responsibilities 7. Plan activation 8. Business continuity management team (crisis and recovery team) 9. Continuing services in the event of a disruption 10. Failure of IT systems 11. Failure of telecommunications 12. Failure of utilities electricity / gas / water supplies 13. Loss of CCG buildings 14. Fuel shortages 15. Staff shortages 16. Communication 17. Document review arrangements Appendices Appendix 1: Appendix 2: Appendix 3: Appendix 4: Appendix 5: Business Continuity Management CCG Policy Statement Business Impact Assessments index Business Recovery Template Key Contacts List Business Impact Assessments 3

4 1. Background The Business Continuity Process 1.1 Policy statement It is the policy of East & North Hertfordshire Clinical Commissioning Group (CCG) to develop, implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy. It is the policy of the CCG to take all reasonable steps to ensure that in the event of a service interruption, the organisation will be able to respond appropriately and continue to deliver its essential functions and that we are able to respond to the needs of our local population. A service interruption is defined as: Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions. ( The CCGs Policy Statement is provided at Appendix Emergency planning - business continuity The Cabinet Office s Expectations and Indicators of Good Practice Set for Category 1 and 2 Responders describes seven expectations regarding the Civil Contingencies Act (2004), Regulations (2005) and guidance: 1. Duty to assess risk 2. Duty to maintain plans Emergency Plan 3. Duty to maintain plans Business Continuity 4. Duty to communicate with the public 5. Business Continuity Promotion 6. Information sharing 7. Cooperation Clinical Commissioning Groups are Category 2 Responders and as such will be required to co-operate with Category 1 Responders in the event of an emergency. They are also required to have Business Continuity Plans and Major Incident Plans. These requirements will be achieved in three stages: Stage 1 A Business Impact Assessment (the impacts of the loss of staff, communications, data systems, transport and buildings) Appendix 2 provides details of the Business Impact Assessments undertaken at Departmental level within the CCG. Some functions are hosted by or delivered through contracts with other organisations (e.g. PropCo Ltd, Central Eastern CSU). These assessments are also provided at Appendix 2. 4

5 Stage 2 - A Business Continuity Plan (the measures to be taken internally in the event of such a loss) The Business Continuity Plan will comprise the mitigating actions arising from the Impact Assessments, the key contacts that will instigate the relevant mitigating actions and the contact details of all staff that might have to undertake those actions - be it communicating with others or changing their way of working. Stage 3 A Major Incident Plan (the measures to be taken in support of Category 1 responders in the event of an Emergency ) This details the organisation s response to: an event or situation which threatens serious damage to human welfare; an event or situation which threatens serious damage to the environment; War, or terrorism, which threatens serious damage to the security of the UK. 1.3 The CCG is required to equip nominated staff with the Major Incident Plan, the Business Continuity Plan, an incident control centre, an emergency telephone line and a list of all relevant telephone and contacts. The plans have been built on experience and will be subject to a desktop test, as part of best practice, in order that they are further refined. The result of the desktop testing will be reported to the CCG Governing Body. 2. Introduction 2.1 The Civil Contingencies Act 2004 came into force in November 2005 and focuses on local arrangements for civil protection, establishing a statutory framework of roles and responsibilities for local responders (such as CCGs) as Category 2 Responders. It is a requirement of the Act that the CCGs have Business Continuity Plans in place to support the CCGs Major Incident Plan. 2.2 The purpose of the Business Continuity Plan is to outline the responsibility of the CCG and their staff in the event of a crisis in order to maintain as normal a service as practically possible. The over-riding aim is to ensure a prompt and efficient recovery of critical activities from any incident or physical disaster that may affect the CCGs ability to operate and deliver their commissioning service in support of the NHS economy. It must be recognised that any event not only impacts on staff, premises, technology and operations, but also on the CCGs brand, status, relationships and reputation and that all business continuity arrangements should ensure that the CCGs meet their legal, statutory and regulatory obligations to both their staff and dependent stakeholders. 2.3 The scope of this plan is to provide overarching organisational guidance of business continuity management and the invocation process within the CCGs, and an outline of responsibilities. 5

6 2.4 The following table indicates the links with other CCG and System Resilience Plans: Document Community Risk Register LRF Flood Plan LRF Pandemic Influenza Plan LRF Severe Weather Plan The CCG is a Level 2 responder for Emergency Preparedness Resilience and Response which will be led by the Hertfordshire and South Midlands Area Team. These plans will be owned by the Local Resilience Forum with input from the Local Health resilience Partnership. However, the CCG will have a role in planning for and responding to the relevant incident. This document to be read in conjunction with: The ISO Standard for Business Continuity (ISO 22301) British Standard NHS Business Continuity Management (BS25999) CCG Risk Register/Risk Management Dashboard System Escalation Plan CCG Major Incident Plan 3. Definition 3.1 Business Continuity Management is the process that helps manage the risks to the smooth running of the organisation in the delivery of its services, ensuring that essential business can continue in the event of a disruption and can be sustained in the event of an emergency. It is aimed at reducing or eliminating the risks of business interruption and it is necessary to have contingency plans in place to ensure normal business functions can be resumed as soon as possible. 6

7 3.2 A service interruption can be defined as Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions For the NHS, Business Continuity Management is defined as the management process that enables an NHS organisation: To identify those key services which, if interrupted for any reason, would have the greatest impact upon the community, the health economy and the organisation. To identify and reduce the risks and threats to the continuation of these key services. To develop plans which enable the organisation to recover and/or maintain core services in the shortest possible time. 3.3 There are many and varied possible causes of service disruption; these may range from the loss of infrastructure e.g. offices; buildings; IT systems; managing a power cut or extreme weather to arranging service provision during an emergency or epidemic. These events may not be mutually exclusive i.e. extreme weather can lead to loss of electricity or staff being unable to get to work. 4. Resources 4.1 The CCG recognises its obligations with regards to emergency planning, resilience, responding to major incidents and business continuity. Funds, as identified as being necessary, will be made available in the event of a major incident to ensure the CCG meets its obligations with respect to these. 5. Training and Exercising 5.1 The emergency and business continuity response arrangements within the plan will be ineffective if the staff expected to implement them at the time are unaware of them. Therefore all staff will be made aware of the plan at their corporate induction training and mandatory risk training, and will also be made aware of where the overarching and departmental plans can be located. If there are any significant changes to the plan, then this will be communicated to departmental leads to cascade to all staff. Business Continuity arrangements w i l l be exercised at least once a year in order to validate the effectiveness and highlight any gaps which can then be corrected. 6. Accountability, Roles and Responsibilities 6.1 Overall accountability for the smooth running of the organisation lies with the CCGs Accountable Officer. The Director of Commissioning is the lead Director for Business Continuity and will be responsible for providing positive assurance to the Governing Body on the CCGs plans. 7

8 6.2 Executive Directors are responsible for maintaining their individual services, and for alerting the need to activate Business Continuity Plans if such an event occurs within their directorate. 6.3 Designated Associate Directors and Assistant Directors must ensure that any changes of contact details of key staff noted in their plans are updated as required, that their Directorate plans are reviewed at least annually and that any new services that are developed are included in the plans. 6.4 The Head of Emergency Preparedness, Response and Business Continuity will provide specialist guidance during the invocation of any part of the Business Continuity Plans and will assist in coordinating any actions required. 6.5 The Communications Team will be responsible for informing the public of events where necessary, following agreement of the Accountable Officer or Director of Commissioning (designated deputy), and will also keep staff informed of developments as appropriate. 6.6 All CCG employed staff are responsible for co-operating with the implementation of the Business Continuity Plans as part of their normal duties and responsibilities. 8

9 7. Plan activation 7.1 A nominated post holder from each department will decide in discussion with the Heads of Department and the Director of Commissioning whether the plan or any part of it should be activated using the process in the following flow chart. Out of hours the decision will be made with the direction of the on call CCG director/manager PROCESS PLAN FOR ACTIVATION CRISIS OCCURS (MAJOR INCIDENT PLAN MAY ALREADY BE IN ACTION) CONSIDER IF CRISIS CAN BE CONTAINED WITHIN THE USUAL RESOURCES YES NO NO FURTHER ACTION AT THIS STAGE DISCUSS WITH DoC, AND AGREE THAT THE BUSINESS CONTINUITY PLAN SHOULD BE INVOKED SET UP CRISIS AND RECOVERY TEAM NOTIFY STAFF WITHIN DEPARTMENT AND ANY OTHER DEPARTMENT/SERVICES OR STAKEHOLDERS THAT MAY BE AFFECTED. PROGRESS AND ANY FURTHER DEVELOPMENTS TO BE ASSESSED DAILY (AS A MINIMUM, IT MAY NEED TO BE MORE FREQUENT) INITIATE DEPARTMENT PLAN 9

10 8. Business Continuity Management Team (Crisis and Recovery Team) 8.1 A team will be convened to oversee the process of ensuring essential services are maintained and that recovery plans are put into place, Membership may include the following: Director of Commissioning or nominated Deputy Associate Director where incident has occurred Lead for Emergency Preparedness, Response & Business Continuity Communications Manager Estates representation (as required) Any other personnel deemed necessary, i.e. representative of HR, specialist advice, CSU etc. 8.2 The team will meet initially on a daily basis and will keep notes of the meeting, actions taken, resources committed, and progress made using the template a t Appendix Incident Control Centre location and resources: Resources Filing Cabinet, located in the Office next to the Boardroom, Second Floor, Charter House, WGC. Includes additional paper copies of this Plan. 9. Continuing Services in the event of a Disruption 9.1 As part of the Business Impact Assessment process, a critical function analysis has been carried out to determine those parts of the service that are a priority to maintain or reinstate. The CCG is responsible for commissioning a wide range of patient services to the local population and the following will be restored and maintained as soon as is practically possible. Maintaining an emergency response and support to Category 1 responders; Incident investigation; Mobilisation of the workforce, and support f o r staff safety and welfare; Provision of IT (through contract with Central Eastern CSU); Maintaining communications with the general public and CCG staff; Essential Finance functions; Essential HR processes; Safeguarding adults and children; and Continuity of contract management responsibilities. 9.2 The critical function analysis also identifies those functions that are less critical and could be suspended. 10

11 Service Function Financial management including QIPP and financial recovery Planning services - preparing commissioning plans Commissioning services through pathway development and redesign Contract management acute contracts Contract management community and third sector Performance and data analysis Governance duties to ensure continuous compliance with statutory duties Partnership working to ensure joined up working to improve the health and wellbeing of patients Support and guidance to member practices Quality and safety Administration Length of time function can be suspended for 7 days 28 days 28 days 14 days 14 days 14 days 14 days 14 days 14 days 14 days 14 days If an incident occurs and this plan is activated, permission will be sought from the Accountable Officer, or CCG Chair, or in their absence via the Director of Commissioning (or nominated Deputy) to suspend the mainstream service functions detailed above and release the CCG staff who cover these functions to provide support to critical functions provided in other areas of the CCG. 9.3 Each department has identified its own critical functions that are required to maintain its service and have their own local departmental plans which a r e accessible in both paper copy and electronically. It is the responsibility of designated Associate/Assistant Directors to communicate the location of these plans to their staff. In the event of an emergency, or business interruption, the CCG will endeavour to maintain services as usual or as close to the usual standard as possible. However, where it is clear that this is not achievable, the Head of Service in conjunction with the Dire ctor of Commis s ionin g ( or on-call Director/Manager if out of hours) will decide which priority functions of the department must continue, depending on the nature of the business interruption. 11

12 9.4 There are some generic areas that could potentially affect all departments and these are described below: 10. Failure of IT systems 10.1 The CCG, like many organisations, rely upon IT systems for their day to day business. A disaster that prevents the organisation from accessing these systems whether caused by the failure of the systems themselves, or being due to an incident such as fire or flooding will potentially have a serious impact on the continuation of the CCGs functions While it is impossible to consider and document a recovery plan for every disaster that may occur the impact of the loss of IT systems to each department is covered in the individual departmental plans and it is expected that they can be adapted to cater for any specific incident. If there is a failure in the IT system or any stand-alone computer for important data for a prolonged period of time, staff will need to change to a paper back-up system where possible to capture the data so that this can be recorded on the system retrospectively The development of telecommunications that are reliant upon the IT network makes it likely that telephone failure will also result from any IT network failure The priority in which restoration is required will depend on the service area and is detailed in individual departmental plans If there is a loss of hardware or software through theft or damage then advice should be sought from the IT provider and the incident reported to the CCGs Risk team (via the Associate Director of Governance) The maintenance of the CCG IT systems is provided by the Central Eastern CSU under a Service Level Agreement (SLA). Under the terms of this SLA the CSU will invoke their Emergency Disaster and Recovery Plan to cope with any event causing prolonged interruption of service. 11. Failure of Telecommunications 11.1 The telephone lines are provided under contract with BT, and managed by Vodafone MTPASS SIM cards have been requested for the on-call phone and those of the Emergency Planning Officer and the on-call Directors and managers. This will provide resilience in terms of key staff needing to respond to potential incidents covered by this plan Each departmental plan identifies in more detail the actions required should the telephone systems be inactive. The priority in which restoration of phone lines are required will depend on the service area and if crucial will be 12

13 detailed in individual departmental plans. CCG contact in the first instance: IT Helpdesk on If electricity has failed then prior consideration needs to be given to the ability to recharge mobile phone batteries. 12. Failure of Utilities Electricity / Gas / Water Supplies 12.1 The CCG uses various utility suppliers (details provided in the Contacts List at Appendix 4). In the event of a failure that has an impact on the CCG to fully deliver its function, initial contact should be made the relevant supplier should be notified as follows: CCG contact in the first instance: Carillion on The fault should be reported and a request made as to whether they are able to give an indication of the length of time the supply will be unavailable If heating is lost an assessment should be made to the effect of the loss of the heating related to the time of year and the forecast temperature as to whether services can continue from the affected location For plumbing emergencies: CCG contact in the first instance: Carillion on In the event that the water supply fails the impact of the following must be assessed: Toilets Hand hygiene Drinking water 13

14 13. Loss of CCG Building 13.1 If premises are unable to be used then services may need to be suspended or relocated. Local departmental plans will detail who to contact and measures to be taken. The Lead for Emergency Preparedness, Response & Business Continuity will assist in finding alternative accommodation should CCG buildings be affected Alternative locations for staff will include HCT HQ at Howard Court, HPFT HQ at Waverley Road, St Albans and HVCCG HQ at Hemel Hempstead. Initiation of these arrangements will be agreed by the Director of Commissioning (or nominated Deputy) or by agreement with the on-call Director/Manager. 14. Fuel Shortages 14.1 In the event of a fuel shortage the ability to maintain services may be affected. If it has been necessary for the invocation of the National Fuel Plan then the Business Continuity Management Team will be convened to oversee the management of the situation within the CCG. It is unlikely there will be provision of fuel for staff to get to their work base and the responsibility for alternative travel arrangements is with the individual members of staff in discussion with their line manager. 15. Staff Shortages 15.1 The absence of staff will have a varying effect depending on their role. In some cases roles can be covered by other staff but others may be highly specialised and necessary arrangements will be detailed in departmental plans as to whether a service can continue particularly if the service depends on that person alone There may be a scenario when a number of staff are all incapacitated at the same time such as pandemic influenza. The departmental manager will be responsible for assessing the impact on the ability to continue to provide a service and what contingencies can be put in place, and whether some non- critical services can be cancelled as detailed in the individual departmental plans. 16. Communication 16.1 If an event occurs that is so severe that alternative arrangements for the provision of care commissioned by the CCGs need to be communicated to the local population, this will be carried out via the Communications Manager after discussion with the Director of Commissioning. 17. Document Review Arrangements 17.1 This document will be reviewed on an annual basis or when there are changes in the working systems of the organisations; or major changes to 14

15 the contact arrangements of staff or suppliers that affect the content. The date of the review will be recorded on the front of the document. It is the responsibility of the identified departmental leads to update local departmental plans on an ongoing basis and the Emergency Planning Manager to ensure the generic section of this document is kept updated. 15

16 Appendix 1: Business Continuity Management Policy Statement Business Continuity Management (BCM) is an important part of NHS East & North Hertfordshire CCGs risk management arrangements. The Civil Contingencies Act (CCA) identifies all CCGs as Category 2 Responders, and imposes a statutory requirement on each CCG to have robust BCM arrangements in place to manage disruptions to the delivery of services. It is the policy of NHS East & North Hertfordshire CCG to develop implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy. The aim of Business Continuity Management is to prepare for any disruption to the continuity of the business, whether directly - i.e. within the responsibility control or influence of the business, or indirectly - i.e. due to a major incident occurring to a partner, supplier, dependent or third party, or from a natural disaster. It is recognised that plans to recover from any disruption must consider the impacts not only to our staff, premises, technology and operations, but that NHS East & North Hertfordshire CCG must also plan to maintain its brand, status, relationships and reputation. Business Continuity arrangements should ensure that the CCG continues to meet i t s legal, statutory and regulatory obligations to its staff and to its dependent stakeholders. All NHS East & North Hertfordshire CCG departments are to continue to develop and implement BCM for their areas of business. In order for this to be achieved, members of each department have been nominated as Business Continuity Leads to represent their part of the business for Business Continuity Management. These individuals are responsible for reviewing and maintaining the departmental Business Continuity arrangements within the CCG. To ensure that the BCMS fully meets the changing needs of the business all Business Continuity Plans will be exercised, reviewed and audited annually. In accordance with the NHS E n g l a n d Guidance 2, NHS East & North Hertfordshire CCG BCMS will be in accordance with and aligned to the ISO Lesley Watts Accountable Officer Date 1 NM Government (2004) Civil Contingencies Act 2 NHS England (2013) Board Business Continuity Framework 3 ISO Societal Security - Business Continuity Management Systems Requirements

17 Appendix 2 The Business Impact Assessments The analysis is divided into the following sections: Section 1 Critical Functions of the Governing Body Members and Accountable Officer 1.1 Governing Body 1.2 Accountable Officer Section 2 Critical Functions of Directorates 2.1 Finance 2.2 Commissioning 2.3 Quality Section 3 Critical Functions provided by Eastern Central Clinical Support Unit 3.1 ICT 3.2 Medicines Management 3.3 Continuing Health Care

18 Business Impact Assessments East and North Hertfordshire Clinical Commissioning Group Version: Version 5 Ratified by: Date ratified: Job title of originator/author: Director of Commissioning Name of responsible committee/individual: Accountable Officer Date issued: October 2013 Review date: October 2014 Target audience: All CCG staff

19 The assessment is divided into the following sections: The Business Impact Assessments Section 1 Critical Functions of the Governing Body Members and Accountable Officer 1.1 Governing Body 1.2 Accountable Officer Section 2 Critical Functions of Directorates 2.1 Finance 2.2 Commissioning 2.3 Quality Section 3 Critical Functions provided by Eastern Central Clinical Support Unit 3.1 ICT 3.2 Medicines Management 3.3 Continuing Health Care Staff are located in the following building: Floor Two Charter House Parkway Welwyn Garden City Hertfordshire AL8 6JL

20 SECTION 1 Critical Functions of the CCG Governing Body Members To provide leadership (including clinical leadership) in their individual/specialist areas To undertake statutory roles and duties (SIRO, Caldicott Guardian, Safeguarding, Data Protection Officer) To attend meetings of the CCG Governing Body and the Committees of which they are members To ensure that the Governing Body meets its duties Section 1.1 East and North Hertfordshire CCG Governing Body Key Contacts: Tony Kostick Chair Lesley Watts Accountable Officer Alan Pond Finance Director (SIRO) John Webster Director of Commissioning (EPRR responsibilities) Sheilagh Reavey Director of Nursing and Quality (Caldicott Guardian) Alison Sansom Assistant Director of Continuing Health Care Stacey Golding Governance Lead for Pharmacy and Medicines Optimisation Minimum Levels of Service that need to be maintained a. Performance of statutory duties within set timescales / 3 days b. Availability of clinical leadership within 24 hours c. Ongoing governance of the organisation within 5 working days d. Scheduled meetings of the Governing Body and key committees to the prescribed frequency Contingency Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs

21 Threat Priority for restoring service Contingency measures required Loss of staff 3 a/b) Deputies for each statutory and clinical lead role. Secure external support where necessary. 4 c/d) Defer meeting dates. Endeavour to meet quorums at meetings. Chair s action subject to ratification. Loss of telephone communication 3 a-d) Use of instead (using contact list for all GB members and corporate staff). Loss of 3 a-d) Use of telephone and postal or dispatch systems (using telephone and address contact lists for all GB members). Loss of Internet 4 a-d) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft 3 a-d) Copies of key documents stored in.pdf Office format. Loss of access to stored documents (servers) 4 a-d) Copies of key documents stored on alternate servers, battle box and on intranet, emergency encrypted memory stick Actions required to restore service Formal appointment of successors if loss persists. Contact clinical support group. Contact clinical support group Contact clinical support group Contact clinical support group Contact clinical support group or Head of Governance for hardcopies and emergency encrypted memory stick Risk if priority unable to be met Impact on stability of clinical/statutory leadership. Impact upon ability to conduct business, progress work plans and maintain governance/assurance. Impact on ability to maintain stability of clinical/statutory leadership. Impact on ability to maintain clinical/statutory leadership. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Loss of individual 6 Hot desk working will apply N/A if at HQ N/A IT system Fuel Shortage 5 d) Use of telephone conferencing. N/A Impact on conduct of business on the work plans and maintenance of governance Loss of buildings: 6 c-d) Use of alternate NHS accommodation and VPN for home working. 6 c-d) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Marks House (HVCCG) HQ Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ Possible overload on alternate NHS accommodation.

22 Critical Functions of the Accountable Officer Section 1.2 East and North Hertfordshire CCG Accountable Officer (AO) To undertake the statutory roles and the duties of the post Key Contacts: Tony Kostick Chair Lesley Watts Accountable Officer Alan Pond Finance Director (SIRO) John Webster Director of Commissioning (EPRR responsibilities) Sheilagh Reavey Director of Nursing and Quality (Caldicott Guardian) Minimum Levels of Service that need to be maintained: b. Statutory roles (Health and Safety, Employment Rights, Occupiers Liability) c. Strategic Leadership d. Governance regarding decision making e. Outward facing role ( front of house ) f. Delivery of and progress against objectives Contingency: Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs

23 Threat Priority for restoring service Contingency measures required Loss of staff 2 a-e) Succession planning of deputies for each statutory and lead role of the AO. Loss of telephone communication Secure external support where necessary. 3 a-e) Use of instead (using contact list for all GB members and corporate staff). Loss of 3 a-e) Use of telephone and postal or despatch systems (using telephone and address contact lists for all GB members and corporate staff). Loss of Internet 4 a-e) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft 3 a-e) Copies of key documents stored in.pdf Office Loss of access to stored documents (servers) format. 4 a-e) copies of key documents stored on alternate servers and on intranet Loss of individual N/A IT systems Fuel Shortage 5 a-e) Use of Virtual Private Networking for staff with laptops. Use of video conferencing and telephone conferencing. Loss of buildings: 6 a-e) Use of alternate NHS accommodation and VPN for home working. 6 a-e) Use of alternate NHS accommodation and VPN for home working. Actions required to restore service Formal appointment of successor if loss persists. Contact service provider. N/A As appropriate to the threat Marks House (HVCCG) HQ Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ Risk if priority unable to be met Impact on workloads of other Governing Body Members and risk of objectives not being achieved. Impact on ability to manage the CCG and risk of objectives not being achieved. Impact on ability to manage the CCG and risk of objectives not being achieved. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Registered Mail will be used. Impact on ability to manage the CCG and risk of objectives not being achieved. Possible overload on alternate accommodation.

24 SECTION 2 Critical Functions of the Finance Directorate Section 2.1 Critical Functions of the Finance Director To provide the financial strategy for the organisation To ensure sound financial management across the organisation To provide financial governance across the organisation To undertake the statutory roles and duties including: Bribery Act, Public Contracts and Public Procurement Key Contacts: Alan Pond Finance Director (SIRO) Noreen Coles Assistant Finance Director Eddie James Assistant Director Financial Services Minimum Levels of Service that need to be maintained: a. Access to Invoicing and Payments system within 3 days (including contract payments & pay of CCG staff) b. Monitoring financial position within 3 days (within 1 day if within first week of month) c. Monitoring bank accounts within 3 days Contingency: Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs Threat Priority for restoring service Contingency measures required Loss of staff 3 a-c) Deputies for each statutory and lead role of the Finance Director.(FD) a-c) Secure external support where Loss of telephone communication Actions required to restore service Formal appointment of successor if loss persists. Risk if priority unable to be met Impact on workloads of FD and finance teams and risk of financial objectives not being achieved. necessary. 3 a-c) Use of instead Contact Clinical Support Group Impact on ability monitor financial position.

25 Loss of 3 a-c) Use of telephone and postal or despatch systems (using telephone and address contact lists internal and external). Contact Clinical Support Group Impact on ability to manage the CCG with risk of statutory requirements not being met and other financial objectives not being achieved. Loss of Internet 4 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft 3 a-c) Copies of key documents stored in.pdf Office Loss of access to stored documents (servers) format. 3 a-c) copies of key documents stored on alternate servers and on intranet. Contact Clinical Support Group Contact Clinical Support Group Contact Clinical Support Group Loss of individual 3 a) Contingent process for invoice payment Contact relevant service Impact on ability pay other IT systems (cheque system). provider. organisations with risk of service disruption. 4 b-c) Contingent process for financial and Contact relevant service Impact on ability to manage account monitoring. provider. finances with risk of not meeting statutory financial balance and other financial objectives. 4 a) Manual invoicing process. Contact relevant service Impact on cash flow. provider. Fuel Shortage 5 b-c) Use of Virtual Private Networking for staff with laptops. b-c) Use of telephone conferencing. Loss of buildings: 6 a-c) Use of alternate NHS accommodation and VPN for home working. 6 a-c) Use of alternate NHS accommodation and VPN for home working. N/A As appropriate to the threat Marks House (HVCCG) HQ Howards Court (HCT) HQ few places Waverley Rd (HPFT) HQ Impact on ability to manage finances with risk of not meeting statutory financial balance and other financial objectives. Possible overload on alternate NHS Accommodation.

26 SECTION 2 Critical Functions of the Commissioning Directorate Section 2.2 Critical Functions of the Commissioning Director Retain the organisational structure of the 6 localities Retain the organisational structure the 4 programme boards for specific work streams Responsive management support at practice level Maintain the CCG hotline that is pertinent to patient specific queries Key Contacts: John Webster - Director of Commissioning Nicky Poulain - Associate Director of Commissioning Minimum Levels of Service that need to be maintained a. Responsiveness to commissioned services for patient specific queries b. Approval mechanism to authorise payments by finance directorate c. Communicating progress to locality structures and to the CCG executive Contingency Threat Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of staff 3 a) Secure immediate cover. Formal appointment of Impact on workloads of other staff 5 b-c) Secure external support where successors if loss persists. and potential risk clinical gap. necessary. Additional burden on primary care

27 Loss of telephone communication 3 a-b) Use of instead Contact clinical support unit Impact on timeliness of advice and impact on governance and assurance systems. Loss of 3 a-c) Use of telephone and postal or despatch Impact on timeliness of advice and impact on governance and assurance systems. Loss of Internet 5 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft 4 a-c) Copies of key documents stored in.pdf Office Loss of access to stored documents (servers) format. 3 a-c) Copies of key documents stored on alternate servers and on intranet. Loss of individual N/A (hot desk) IT systems Fuel Shortage 5 a-c) Use of Virtual Private Networking for staff with laptops. Use of telephone conferencing. Loss of buildings: 6 a-c) Use of alternate NHS accommodation and VPN for home working. 6 a-c) Use of alternate NHS accommodation and VPN for home working. Hard copy of documents in ICC battle box N/A As appropriate to the threat Marks House (HVCCG) HQ Howards Court (HCT) HQ Waverley Rd (HPFT) HQ Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Impact on workload and timeliness of advice and impact on governance and assurance systems. Possible overload on alternate NHS Accommodation.

28 Section 2 - Critical Functions of the Nursing and Quality Directorate 2.3 Critical Functions of the Nursing and Quality Director To ensure statutory functions are adhered to relating to: Patient Advice Liaison Service, Complaints and Serious Incidents To ensure statutory functions are maintained for Safeguarding Adults and Children To ensure adherence to Corporate and Clinical Governance legislation To provide responsive management support and reporting including incident investigation Ensure providers implement appropriate actions, where necessary, as these affect quality and safety Ensure Continuing Health Care functions are performed including: procurement of care, new referrals and associated administration processes Key Contacts: Sheilagh Reavey - Director of Nursing and Quality James Gleed - Assistant Director of Nursing and Quality Alison Sansom - Assistant Director of Continuing Care Minimum Levels of Service that need to be maintained a. Onward notification of any highlighted patient safety investigation and continuing health care risks b. Ensure ability to respond to patient enquiries c. Ensure statutory governance arrangements are adhered to with upward reporting to Executive Contingency Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of staff 3 a-b) Secure immediate cover. Formal appointment of Impact on workloads of other staff successors if loss persists. with governance and clinical risks. 5 c) Secure external support where necessary Loss of telephone communication 4 a-c) Use of instead Contact service provider. Impact on timeliness in providing advice

29 Loss of 4 a-c) Use of telephone and postal or despatch systems Loss of Internet 4 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft 3 a-c) Copies of key documents stored in.pdf Office Loss of access to stored documents (servers) format. 3 a-c) copies of key documents stored on alternate servers and on intranet. Loss of individual N/A IT systems Fuel Shortage 5 a-c) Use of Virtual Private Networking for staff with laptops. Use of telephone conferencing. Loss of buildings: 6 a-c) Use of alternate NHS accommodation and VPN for home working and decant Incident Control Room to Bexhill Hospital. N/A As appropriate to the threat Marks House (HVCCG) HCT HQ Howards Court Waverley Road, St Albans (HPFT) Impact on timeliness of governance and clinical advice. Impact on governance and assurance systems. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Impact on timeliness of alerts and clinical advice. Impact on governance and assurance systems. Possible overload on alternate NHS Accommodation

30 Section 3 Critical Functions of Clinical Support Unit 3.1 / 3.2 Critical Functions of Eastern Central Clinical Support Unit ICT functionality (core information and communications technology, data processing incorporating resilience to include: , telecommunications, back & restore, antivirus, physical and logical controls) Pharmacy and Medicines Optimisation (oversight of prescribing financial management) Pharmacy and Medicines Optimisation discharge statutory functions of controlled drugs Key Contacts: Keith Fairbrother - Head of ICT Security Martin Wallace - Assistant Director of ICT Heather Gray - Director of Pharmacy and Medicines Optimisation Stacy Golding - Governance Lead for Pharmacy and Medicines Optimisation Minimum Levels of Service that need to be maintained: a) To continue critical or sensitive business operations (ICT) b) To facilitate effective co-ordination of recovery tasks (ICT) c) Ensure the provision of expert prescribing advice in a timely manner (Medicines Management) d) Ensure clinical support and personally for front line patient facing services in any public health emergency Contingency: Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs

31 Threat Priority for restoring service Contingency measures required Actions required to restore service Loss of staff 1 a-c) Secure immediate cover. Formal appointment of successors if loss persists. 4 d) Secure external support where necessary. Loss of telephone communication 1 a-d) Use of instead. Contact service provider. Risk if priority unable to be met Loss of 2 a-d) Use of telephone and postal or despatch systems. Loss of Internet 4 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft 3 a-c) Copies of key documents stored in.pdf Office Loss of access to stored documents (servers) Loss of individual IT systems Fuel Shortage format. 3 a-c) Copies of key documents stored on alternate servers and on intranet. N/A Use of Virtual Private Networking for staff with laptops. Use of telephone conferencing. N/A Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Loss of buildings: 6 a-c) Use of alternate NHS accommodation and VPN for home working. 6 a-c) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Marks House (HVCCG HQ) Howards Court (Few places HCT HQ) Waverley Road, St Albans, HPFT Possible overload on alternate NHS accommodation

32 Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of staff 3 After 24 hours prioritisation Secure replacement or agency Impact of uncontrolled of essential tasks with statutory deadlines. staff. Communication and Statutory SII reporting times not met. 4 After 2 days prioritisation Impact of provider quality being unof urgent tasks. reviewed and/or regulatory compliance not delivered. 5 1 week would impact on meetings. Impact of organisation governance and assurance being disrupted. Loss of telephone Use of instead (using Contact service provider. Impact of instant two-way flow of communication contacts list). communication interrupted. Loss of 3 After 24 hours prioritisation Impact of uncontrolled of essential tasks with statutory deadlines. communication, risks un-reported, quality un-reviewed and some 4 After 2 days prioritisation statutory deadlines not being of urgent tasks. achieved. Use of telephone and postal or despatch systems (using telephone and address contact lists for all staff). 3 4 After 24 hours prioritisation of essential tasks with statutory deadlines. After 2 days prioritisation of urgent tasks. Impact of some statutory deadlines not being achieved, uncontrolled communication (including media), unreported risks and un-reviewed quality. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be Loss of Internet 4 Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft 3 Copies of key documents stored in.pdf Office Loss of access to stored documents (servers) format. 3 copies of key documents stored on alternate servers and on intranet.

33 Loss of individual IT systems Use of telephone and paper systems (including paper versions of records). Contact service providers. STEIS 3 After 24 hours prioritisation of essential tasks with statutory deadlines. Impact of statutory deadlines regarding SI reporting and monitoring not being met. Statutory reporting not achievable. SAFEGUARD 4 After 2 days prioritisation of urgent tasks. Impact of unreported and unreviewed risks. Statutory reporting not achievable. After 2 days prioritisation of urgent Websites and 4 tasks. Impact of uncontrolled Extranet communication. Fuel Shortage Use of Virtual Private Networking for staff with laptops. N/A Loss of buildings: Use of telephone conferencing. Longer term impact of some statutory deadlines not being achieved, uncontrolled communication (including media), unreported risks and un-reviewed quality. 6 a-n) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Marks House (HVCCG HQ) 6 a-n) Use of alternate NHS accommodation Howards Court HCT HQ (few and VPN for home working. places) Possible overload on alternate NHS 5 a-n) Use of alternate NHS accommodation accommodation and VPN for home working. Waverley Rd, St Albans (HPFT)