Reference No: BUSINESS CONTINUITY POLICY UHB 050 Version No: 4 Previous Trust / LHB Ref No: N/A Documents to read alongside this Policy N/A Classification of document: Area for Circulation: Author: Executive Lead: Group Consulted Via/ Committee: Ratified by: Corporate UHB Wide Interim Civil Contingencies and Emergency Planning Manager Director of Planning Health Systems Management Board Version Number Date Published: Date of Review Reviewer Name Completed Action Approved By 2 Strategic Planning Committee 3 May 2012 4 March 2014 5 March 2015 Date Approved October 2010 New Review Date October 2013 October 2013 March 2015 March 2018 Disclaimer When using this document please ensure that the version you are using is the most up to date either by checking on the UHB database for any new versions. If the review date has passed please contact the author. OUT OF DATE POLICY DOCUMENTS MUST NOT BE RELIED ON Business Continuity Policy Page 1 of 7 Ref: UHB 050
Contents Page No. 1 INTRODUCTION... 3 2 POLICY STATEMENT... 3 3 AIM... 3 4 OBJECTIVES... 3 5 SCOPE... 4 6 ROLES AND RESPONSIBILITIES... 4 7 RESOURCES... 6 8 TRAINING AND IMPLEMENTATION... 6 9 REVIEW, MONITORING AND AUDIT ARRANGEMENTS... 6 10 RETENTION OR ARCHIVING... 7 11 EQUALITY... 7 12 REFERENCES... 7 Business Continuity Policy Page 2 of 7 Ref: UHB 050
1 INTRODUCTION National Health Service organisations have a duty under the Civil Contingencies Act 2004 to ensure that they have effective business continuity plans in place. Business continuity is the strategic and tactical capability of Cardiff and Vale University Health Board to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level. This Policy sets out the requirements of Clinical Boards and Directorates within the UHB to meet these duties. Thus ensuring compliance with the legislation and robust business resilience. 2 POLICY STATEMENT The Cardiff and Vale University Health Board will promote a culture of business continuity management that will instil confidence in its stakeholders (staff, patients and customers) in its ability to effectively deal with and recover from disruptive challenges. 3 AIM The UHB will have in place a series of business continuity or contingency plans that will: Set out agreed procedures to respond to business interruption incidents that could result in adversely affecting the productivity/normal operating of the UHB; Mitigate the impact of a disruptive challenge to the business of the Health Board; Provide guidance on the recommended methods to rapidly recover the situation back to normal operation. The requirement to develop business continuity plans will arise from the business impact assessments (i.e. the identification of risks to the business through the risk management process) undertaken at a range of levels from National (both UK and Welsh Assembly Governments) through Local Resilience Forum Community Risk Registers to University Health Board level. 4 OBJECTIVES This policy provides a clear commitment to business continuity planning and effective planning will enable the UHB to: Continue to provide critical services to the community; Provide better use of personnel and resources during times when both may be limited; Reduce the period of disruption to the organisation; Improve the resilience of the organisations infrastructure to reduce/mitigate the likelihood of disruption; Reduce the operational and financial impact of any disruption; Business Continuity Policy Page 3 of 7 Ref: UHB 050
5 SCOPE This Policy incorporates all activities of the UHB and its employees. Where the disruption of those activities impact on the wider community the UHB will engage with the community/its representatives and/or relevant partner agencies. 6 ROLES AND RESPONSIBILITIES The University Health Board (UHB) has in existence structures and committees, which set the strategic aims and direction of the organisation and monitor progress. The UHB is responsible for reviewing the effectiveness of Internal Controls financial, organisational and clinical. The Board is required to produce statements of assurance which demonstrate that it is doing its reasonable best to ensure that the UHB meets its objectives and protects patient, staff, the public and stakeholders against risks to its business in line with the requirements of the Civil Contingencies Act 2004. Health Systems Management Board (HSMB) The role of HSMB is to provide the Board with assurances that appropriate arrangements for effective internal control and for the identification and management of risks to the UHB s business. This is achieved through the approval of plans and the monitoring of progress reports. HSMB works closely with both the Audit Committee, and the Patient Safety and Quality Committee in carrying out this role in order to provide assurance to the Board that the UHB has effective systems of internal control. Chief Executive The Chief Executive has overall responsibility for: the management structures and systems necessary to implement corporate governance, controls assurance standards including business continuity management; meeting all statutory requirements to manage risks to normal business operations; adhering to guidance issued by the Welsh Assembly Government in respect of resilience and business continuity management; ensuring that the University Health Board receives an annual report on the effectiveness of organisational systems; the business continuity policy and procedure are subject to regular reviews in line with the UHB s policy document, and that measures for implementing the policy are established, maintained and monitored; funding for action required as a result of the business impact analysis is provided; there are competent people who have the knowledge and training to carry out appropriate business impact assessments. Business Continuity Policy Page 4 of 7 Ref: UHB 050
To assist the Chief Executive with these responsibilities and provide support in relation to the infrastructure and corporate responsibilities, a Clinical Board Lead is appointed for key areas and the Director of Planning is the Executive lead for Civil Contingencies. Director of Planning The Director of Planning, nominated by the Chief Executive, is the lead Director for the co-ordination of business continuity management within the UHB and will: Ensure systems are in place to audit compliance with legislation and address any deficits identified; Ensure that legislative requirements are complied with; Ensure that effective systems are in place to support the effective coordination of business continuity management throughout the Health Board including any corporate risks identified; Clinical Board Directors Clinical Board Directors are instrumental in achieving the requirements of this policy, and are accountable to the Chief Executive for ensuring implementation of the business continuity policy within their area of responsibility; Directors must identify managers/clinicians who will co-ordinate business impact assessments and the resulting business continuity/contingency plans. Directors will also ensure that: the business continuity policy and procedure are implemented; all managers are competent to discharge their business continuity management responsibilities; business impact assessments and business continuity/contingency plans are completed and recorded on Clinical Board/Directorate risk register as appropriate; any business impact assessments that have a potential corporate impact are communicated to the Director of Planning; the need for additional funding or other resources within the directorate as a result of undertaking business impact assessments is identified; reports to the UHB in order to confirm that all business risks identified have suitable and sufficient plans that have been fully and effectively tested and are reviewed regularly; post incident debriefs are undertaken as/when required and plans are revised as required; Line Managers Line managers, which include any individual involved in the managerial process ranging from a directorate manager to an operationally based supervisor, are instrumental in achieving the requirements of the business continuity policy. Line managers will, within their areas of responsibility, ensure that: Business Continuity Policy Page 5 of 7 Ref: UHB 050
all staff have knowledge of and understand the business continuity policy and supporting business continuity/contingency plans; business impact assessments are undertaken, business continuity/contingency plans are developed, implemented and reviewed and that a ward/department risk register is maintained; the need for additional funding or other resources is, as a result of undertaking business impact assessments, identified; 7 RESOURCES In order to ensure consistency across the organisation, business impact assessments (risk assessments of the impact on normal business) will be undertaken in accordance with the University Health Board s approach to risk management and risk assessments. Resources in terms of time will be required to educate staff on both the requirements of this policy and the development of documents across the UHB. 8 TRAINING AND IMPLEMENTATION Business continuity plans are only successful when they have been communicated to staff, tested and rehearsed. It is the responsibility of the manager who owns the plan to ensure that all staff who may use it are trained. Managers will be trained by the Civil Contingencies Team to provide them with the knowledge that they require to discharge this responsibility. Corporate plans, the development of which will be coordinated by the Civil Contingencies Team, will be subjected to regular testing and exercising and staff subsequently trained as required. 9 REVIEW, MONITORING AND AUDIT ARRANGEMENTS This Strategic policy and Corporate business continuity/contingency plans will be reviewed annually. The review of Clinical Board/Directorate/Department plans will be for local determination but as a minimum will be reviewed every three years or as/when incident debriefs indicate or when legislation/guidance or the organisation changes. Compliance with this policy will be monitored by: the development of business continuity/contingency plans where the risk to normal business operations have been identified; through the post incident debrief of the response and recovery to untoward business impacting incidents; The Welsh Government Health Emergency Planning require an annual audit against healthcare Standard 4. The Civil Contingencies Manager will collate the response. Business Continuity Policy Page 6 of 7 Ref: UHB 050
10 RETENTION OR ARCHIVING In cases of Police investigations/public enquiries and other legal processes it is often necessary to demonstrate that the policy in place at the time of the incident. The Director of Governance must therefore ensure that copies of policies and procedures are archived and stored in line with the University Health Board Records Management Policy and are made available for reference purposes should the situation arise. 11 EQUALITY An Equality Impact Assessment has been undertaken to assess the relevance of this policy to equality and the potential impact on different groups, specifically in relation to the General Duty of the Race Relations (Amendment) Act 2000 and the Disability Discrimination Act 2005 and including other equality legislation. The assessment identified that the Policy presented a low risk to the UHB. In the event of a Major Incident there may be some differential impact, but these do not have disproportionate or inequitable outcomes and can be reasonably justified. Business Continuity Policy Page 7 of 7 Ref: UHB 050