SOUTH WEST COMMISSIONING SUPPORT UNIT CORPORATE BUSINESS CONTINUITY AND SERVICE RECOVERY PLAN IN THE EVENT OF AN INCIDENT SEE DIAGRAM IN APPENDIX A1 ON PAGE 18 Version: 4.0 Ratified by: TBC Executive Leadership Team Date Ratified: TBC November 2013 Name of Originator/Author: Corporate Business Manager Name of Responsible Committee/Individual: Director of Finance / Commercial Director Date issued: 28 th November 2013 Review date: November 2014 Target audience: NHS South West CSU staff, customers and major suppliers
CORPORATE BUSINESS CONTINUITY AND SERVICE RECOVERY PLAN CONTENTS PAGE VERSION CONTROL i EQUALITY IMPACT ASSESSMENT iii 1 INTRODUCTION 1 2 SCOPE 2 3 LEGAL REQUIREMENTS 3 4 PLANNING ASSUMPTIONS 4 5 SERVICE DISRUPTION THREATS 4 6 CORE SERVICE FUNCTIONS 5 7 ESCALATION TRIGGER POINTS 6 8 ACTIVATION AND NOTIFICATION CASCADE 7 9 COMMAND AND CONTROL 8 10 MAINTAINING RECORDS 10 11 MEDICAL RECORDS 10 12 INFORMATION GATHERING AND SHARING 10 13 COMMUNICATIONS 10 14 HEALTH AND SAFETY 13 15 DEBRIEFS 13 16 PLAN REVIEW AND VALIDATION 14 17 TRAINING AND EXERCISE 15 18 REFERENCE MATERIAL 15 19 KEY CONTACTS 16 Appendices A1 Assessment Guidance Diagram 18 A2 Escalation Diagram of levels at which plan operates 19 A3 Full List of Personal and Emergency Contact Information 20 A4 Priority Order Checklist and Likely Communication Required 21 B Action Cards 22 C NHS South West CSU - Recovery Priorities of Service Functions 27 D NHS South West CSU - Alternative Facilities / Relocation 33
CORPORATE BUSINESS CONTINUITY AND SERVICE RECOVERY PLAN Document Status: Issued Version: 4.0 DOCUMENT CHANGE HISTORY Version Date Comments 1.0 15 March 2013 1 st Draft 1.1 26 April 2013 Amended after review 2.0 1 July 2013 Update after corporate governance meeting 3.0 19 July 2013 Update incorporating lessons learned from desktop scenario test exercise 4.0 15 November 2013 Updated for CCG and NHS England comments following exercise BOREAS Sponsoring Director: Author(s): Document Reference: Director of Finance / Commercial Director Corporate Business Manager SWCSU_BCP_v4
CORPORATE BUSINESS CONTINUITY AND SERVICE RECOVERY PLAN CONFIRMATION OF EQUALITY IMPACT ASSESSMENT FOR NHS SOUTH WEST CSU DOCUMENTS / POLICIES / STRATEGIES AND SERVICE REVIEWS Main aim of the document: Policy for Business Continuity and Service Recovery Outcome of the Equality Impact Assessment Process: The impact assessment showed that this policy had a neutral effect on each of the equality strands. Actions taken and planned as a result of the equality impact assessment, with details of action plan with timescales/review dates as applicable: No action needed. Groups/individuals consulted with as part of the impact assessment: Risk Management and Business Continuity sub-group Executive Leadership Team iii
1 INTRODUCTION Aim CORPORATE BUSINESS CONTINUITY AND SERVICE RECOVERY PLAN 1.1 The aim of the Corporate Business Continuity and Service Recovery Plan is to provide an overarching framework that outlines the strategic management of the CSUs response to a disruptive challenge that may impact, or is impacting on service delivery to its customers. 1.2 It is part of an effective Business Continuity Management System (BCMS) and provides the framework for resilience enabling an effective response that safeguards activities that have been identified as priority and must continue during the incident 1.3 This plan supports NHS England s (formerly NHS Commissioning Board (NHS CB)) approved Business Continuity Strategy for the CSU and links to the more detailed individual directorate Business Continuity Plans (BCP) for the specific actions affecting those areas, eg the IT directorate BCP 1.4 The plan aims to mitigate the impact of a business disruption event on the operation and reputation of the CSU by giving a framework for: Responding to a disruptive incident (incident management) Maintaining delivery of prioritised activities/services during an incident (business continuity) Returning to business as usual (resumption and recovery) Objectives 1.5 Key objectives of the plan are to: understand the critical functions and activities of the CSU analyse and respond to the risks to the CSU provide a detailed prioritisation and timetabled response to an emergency situation to restore services to customers in line with their Maximum Tolerable Disruption Period (MTDP)s for those services identify the key roles, responsibilities and contacts to respond to an emergency help protect the reputation of NHS South West CSU and related services, and to maintain public confidence
2 SCOPE 2.1 The scope of this plan is to provide a corporate view of how NHS South West CSU will operate in the event of a major incident or emergency that causes disruption to normal services across its various main geographical bases at Wynford House (Yeovil), Mallard Court (Bridgwater), South Plaza (Bristol), Castlewood (Clevedon), Corum Park (Warmley, South Gloucestershire). 2.2 The plan will seek to minimise disruption to business services and where applicable, ensure the timely resumption of those services. 2.3 Given that it is impractical to provide a defined list of appropriate actions in response to any possible scenario, the plan is designed with focus primarily on those services that are vital and require reinstatement in planned and prioritised phases. It is recognised that the prioritisation of these functions will be dictated by the nature of the emergency situation that has arisen. 2.4 This plan links together the other plans within NHS South West CSU and the plans of other organisations including those of its customers, the Clinical Commissioning Groups (CCGs) and the NHS England Area team. Under the Emergency Preparedness Resilience and Response (EPRR) the CSU is a Category 2 responder and will provide in-hours support from its non-critical activities. The CSU will work closely with the CCG s, who will provide out of hours support and the NHS England area team who have lead responsibility for EPRR. 2.5 The SWCS response in the event of an EPRR Major incident will be dictated and lead by the requirements of the NHS England area team and so will not be specifically addressed in this BCP. NHS England are working with the organisations in the area to ensure that copies of their detailed plans for EPRR are available in a number of locations so they can be accessed quickly in an emergency. For example, if the South Plaza building in Bristol is accessible, the NHS England area team will establish an incident coordination centre and work closely with the CCGs and SWCS and have access to: EPRR Plans Major Incident Plan Pandemic Flu Plan Heatwave Plan Severe Weather Plan Fuel Shortage Plan Mass Casualty Response Plan Winter Plan 2
2.6 This Corporate Business Continuity Plan will focus on directing staff and resources along with the more detailed directorate business continuity plans to ensure that both internal and external facing SWCS services are restored and there is a prompt return to business as usual. 3 LEGAL REQUIREMENT 3.1 This plan brings together the different strands of resilience planning within the NHS to support NHS South West CSU s efforts to become more resilient. It does this through: ensuring compliance with the relevant legislation, particularly the Civil Contingencies Act 2004 (CCA 2004) adopting a unified and cohesive approach to resilience and business continuity which is aligned to ISO 22301, the British Standard for business continuity requirements (http://www.iso.org/iso/catalogue_detail?csnumber=50038) (the previous standard was BS 25999); ISO 223013 which provides guidance, and PAS 2015 the framework for Health Services Resilience (http://shop.bsigroup.com/en/productdetail/?pid=000000000030201 297) 3.2 The Managing Director of NHS South West CSU has overall responsibility for ensuring that the organisation has a Business Continuity Plan in place. Operational responsibility for this plan lies with the Commercial Director who is assisted in the discharge of this responsibility by the Corporate Business Manager. 3.3 The CSU is closely aligned to its CCG customers and works with them to deliver services to the standards they require, and reassure NHS England that an effective BCMS is in place. The CSU defines any disruption to normal business as a potential Business Continuity Incident which may invoke this Business Continuity Plan, and this is reflected in directorate level Business Continuity Plans. Each directorate is working with its customers to develop early warning systems for their critical services and aligning them to their Service Level Agreements. CSU customers are involved in defining the level and type of service disruption which would trigger an alert to service users so that customers are alerted at the earliest opportunity through normal channels. 3.4 In the event an expert estimates that a more serious service disruption, as defined by customers, is likely to last longer than 4 hours this will trigger this BCP and the Director on call will be alerted to decide the most appropriate course of action. 3
4 PLANNING ASSUMPTIONS 4.1 This Plan has been developed using the following assumptions that: a comprehensive Business Impact Assessment (BIA) has been conducted by all directorates to identify; o critical core functions o key staff o resources o information systems o telecommunications o equipment o premises directorate level Business Continuity and Recovery Plans have been developed to identify recovery prioritisation of key functions that the level of detail in this Plan is based on the premise that sufficient and knowledgeable people will be available to execute the Plan and support business recovery operations all critical hard copy documentation has been imaged scanned or is available from an alternative source it is designed to address a most likely worst-case scenario 5 SERVICE DISRUPTION THREATS 5.1 Service interruption may be defined as: Any disruptive challenge that threatens personnel, buildings or the service provision of an organisation and which requires special measures to be taken to restore normal operating functions. 5.2 Essentially there are seven key threats to the CSU; damage/denial of access to premises (Full / Partial) shortage of staff loss or damage to other resources loss/damage to IT or data failure of utility services loss of communications failures by suppliers 5.3 Managers should also take notice of indicators of risk identified through other internal mechanisms, such as: adverse incident reporting security reports fire reports health and safety reports accident reports 4
6 CORE SERVICE FUNCTIONS 6.1 Through the Business Impact Assessment (BIA) process and development of directorate level business continuity and service recovery plans the functions that make up and support core services have been identified and prioritised against the Maximum Tolerable Period of Disruption (MTPD) in which time they must be re-established or recovered. 6.2 The MTPD has identified that there are no critical functions that need to be restored within 1 hour except communications. IT systems, email and internet access are part of that wider communications network and IT will aim to recover these as quickly as possible. Patient safety and any critical activities for the CSU customers are essential functions that need to be restored within 1 day and then there are a whole range of other important functions to be restored within 3 days set out in the appendix. 6.3 In addition to the MTPD, and in order to make immediate priorities and actions clear to the leadership during an incident, the CSU has adopted a simple priority system of labelling actions 1, 2, and 3 to reflect the order in which most important functions for each directorate need to be recovered 6.4 Copies of the Business Impact Assessments and Business Continuity Plans for each directorate are stored in hard copy form in the directorate and stored on the shared drive, in the sub folder Business Continuity. Each director and senior manager expected to be involved in an incident has a BCP pack which includes a list of key contact numbers 6.5 Each directorate Business Continuity Champion is responsible for maintaining these documents and notifying the Corporate Business Manager of any changes to ensure that the Corporate and directorate BCP s and the directors BCP packs are kept in a state of readiness at all times. 5
7 ESCALATION AND TRIGGER POINTS (ACTIVATION OF THE PLAN) 7.1 This Plan will be activated in response to an incident causing significant disruption to normal service delivery/business, particularly the delivery of key/critical activities, causing or resulting in Failure to delivery core activities and/or services A negative impact on financial matters or reputation Failure to comply with legislation 7.2 Whilst this Plan covers incidents affecting CSU operations, the CSU leadership will identify whether the incident is more serious. In that event the Director on Call will contact and escalate it to the NHS England Business Continuity Team, the NHS England (EPRR) Area Team and its CCG customers. Co-ordination and control may then come through the direction of others, but many of the principles and elements of this plan should still apply and allow the CSU leadership to direct CSU staff. 7.2 Examples of circumstances triggering activation of this plan include: loss of access to building / facility / a workplace for more than the determined timeframe (Maximum Tolerable Period of Disruption (MTPD)). This includes loss of the actual physical facility itself, as well as loss of access to the area surrounding the building, facility or workplace loss of amenities that support the building, facility or worksite, including power, water and gas, for longer than the determined MTPD loss of inputs and outputs from supply chain partners and contractors loss of IT access or services for longer than the determined MTPD including communications failures o Loss of access to NHS Mail and files o Loss of landline telephone unavailability or loss of key staff due to: o Pandemic disease or localised rapid disease transition o o o o severe weather condition transport disruption industrial action including fuel strikes slow burn incidents (eg slow recruitment, resignation of staff) Major civil disturbance 6
8 ACTIVATION AND NOTIFICATION CASCADE 8.1 The plan will be activated following assessment and confirmation by the Director on Call of a disruption to a number of core services. Activation of the plan and notification cascade will be in line with the assessment guidance and escalation diagram in Appendix A and A1 respectively. Role Managing Director Director of Strategy and Service Transformation Commercial Director Office Out of Hours Mobile 01935 384 009 n/a n/a 0117 900 2545 n/a n/a 0117 900 2429 n/a n/a 8.2 An underlying principle for the declaration of a business continuity incident is that it must be open for a wide range of sources to report an incident. This is to prevent a potential incident being overlooked and not acted upon appropriately. For example, any member of staff discovering or being alerted to a potential incident should report it upwards to their line manager and/or director to report it to the director on call. 8.3 Upon activation, the Emergency Response Team and / or the Executive Leadership Team will need to take a number of actions these may include: setting up a meeting with key service leads alerting key members of staff agreeing with key staff the activities needed and implement a recovery plan advising other staff of when and where to report notifying key contacts (staff, patients, stakeholders, suppliers) establishing immediate business needs maintaining a log of all decisions / events / actions taken considering working arrangements for staff considering alternate work locations establishing a Communications Plan both internal and externally 8.4 Specific Action Cards for the Emergency Response Team and the Executive Leadership Team can be found at Appendix B, to provide guidance and support on the actions and considerations that are specific to a business continuity disruptive event. These should be read in conjunction with the full suite of action cards contained in the individual directorate business continuity plans held in the operations room. 7
8.5 The plan will normally involve three broad phases Emergency Response - During the first few hours following an incident there will be an emergency response which is a location specific tactical response to the immediate situation and this will normally be handled by the Emergency Response Team Crises Management -During the first few days following the incident the senior management will provide crises management by considering strategic issues and implications and giving a strategic response Service recovery - from day one until the full recovery of the organisation using directorate level prioritised BCPs 9 COMMAND AND CONTROL 9.1 The core ingredient of any workable plan is a robust and comprehensive command, control and communication protocol, allowing for a response that is both action oriented and strategic. The response will be coordinated by the Emergency Response Team. They will manage the incident and lead the recovery of all resources, facilities and core services, in the following areas: Business Continuity Plan (BCP) Implementation, determining overall priorities and order of recovery priorities information to the Executive Leadership Team providing situation reports to other key stakeholders as relevant liaising with external partners and key stakeholders if required over suspension or reduction of services (e.g. local authority, CCGs,) reviewing operational plans and re-organising work priorities staff / Patient Welfare keeping staff informed providing timely communication both internally and externally health & safety security salvage stand down and plan review 9.2 It is expected that the Emergency Response Team will meet on a daily basis, increasing or decreasing frequency as required. 9.3 Membership of the Emergency Response Team is given in section 19 below, but may be joined by additional managers from various other areas depending on the emergency for example; Information Management Service NHS Property Services Emergency Planning specialists 8
9.4 The Emergency Response Team will report to the Executive Leadership Team. The Executive Leadership Team consists of: Managing Director All Directors Others as relevant to the incident 9.5 The Executive Leadership Team will provide the strategic overview and support to the Emergency Response Team. Priorities 9.6 The core services functions, including the recovery priorities are identified at Appendix C and include the maximum tolerable period of disruption (MTPD) in which time these services must be re-established or recovered; and the recovery priority. Alternate Facility / Relocation and Reciprocal Arrangements 9.7 Following the declaration of a business interruption, key services within directorate business continuity and service recovery plans may use alternate facility / relocation arrangements and reciprocal agreements with other areas within the CSU or with key service partners. Examples of these arrangements and agreements are detailed in Appendix D. Basis of Recovery 9.8 The basis of the recovery for this plan will vary depending on the nature of the incident and whether or not a part of the facility at the affected site/sites is/are useable and readily accessible, or whether a full off-site recovery is required. Flu Pandemic Special Considerations 9.9 This plan has been prepared in anticipation of a generic interruption event. Its suitability to deal with a specific event needs to be periodically reviewed in light of the particular risk circumstances faced. 9.10 A major difference between a pandemic business continuity procedure as detailed here and other significant business interruption incidents addressed by the Plan is the potential impact on people, including key staff. For example, it is anticipated that a flu pandemic could last 18 months, comprising 3 phases, each of 6 8 weeks duration with up to 40% of staff being adversely impacted. 9.11 It is important therefore that the NHS South West CSU has sufficient depth in its personnel succession plan to enable critical operations to be undertaken by staff other than those primarily designated with critical incident management responsibilities. 9
10 MAINTAINING RECORDS 10.1 Clear recording of decisions taken will help avoid confusion and ensure consistency at a time of significant disruption. It is also important for the CSU to have an audit trail of its command and control judgments. 10.2 As a minimum, these will include: the nature of the decision the reason for the decision the date and time of the decision who has taken the decision / authority designation the extent of consultation and advice from external stakeholders who has been notified of decisions made any review date set for revocation of the decision(s) where relevant 10.3 The Emergency Response Team and the Executive Leadership Team will need the support of a designated log keeper 11 MEDICAL RECORDS 11.1 A key priority for the Emergency Response Team will be to ensure that medical records systems and processes continue to function as normal as possible during any disruption to normal services in order to ensure patient safety, quality of care, the development of a care audit trail and the fulfilment of legal obligations. 12 INFORMATION GATHERING AND SHARING 12.1 During the response to any interruption to normal business, NHS South West CSU will be required to provide situation reports to a number of stakeholders both internally and externally. The CSU will set out a timetable for the drafting of situation reports to ensure common strands of information are gathered at set times to produce an accurate picture. 13 COMMUNICATIONS 13.1 The challenges facing the communications team will be slightly different to those faced during a major incident. Media attention will not necessarily be focussed in the same way as in a major incident. The CSU would not expect to see the same numbers of journalists on site as in a major incident, but local and regional media may have an interest and may be present on site in the early stages and would need handling. 10
Communications Objectives 13.2 The CSU s communications team objectives can by summarised as follows, to: provide clear, concise information about the situation complement other messages being issued by other agencies give the public the best possible advice and information, as required, in conjunction with any community health messages keep staff up-to-date on a rapidly changing situation Key Audiences 13.3 There will be various groups / organisations that will need to be kept updated. Although these groups will need sound communication briefings, some of these will be done through existing operational channels and not via the media route. The main function of the Communications Team will be to provide general briefings/updates for the media, general public and staff. 13.4 The key audience groups that are recognised as needing briefing are: NHS Groups management and staff across all CSU sites CCGs/NHS England /healthcare / emergency staff (at the local authority, police, ambulance services, etc.). Through existing operational channels, although links will be made direct with their communication teams as required, to share information/briefings. NHS 111 (through existing operational channels) Non NHS Groups Partner Agencies Media General Public Patients (including relatives of patients) / Patient Forums MPs, Councillors, etc Voluntary Organisations 13.5 The key messages that the Communications Team will be focusing on will be: the local situation and where the CSU fits in explanation of what is happening in clear language reassurance that the CSU is dealing with the situation sharing of information about services and the affect 11
13.6 This will present the team with key challenges, identified as: in the early stages, how to give advice and information ensuring consistency and accuracy at all times ensuring messages are timely ensuring messages are the same across the local health community and tie in with national guidance and information ensuring the measures in place can still operate if the Communications Lead is not available Role of the Communications Team 13.7 The management of communications will include: handling media enquiries compiling, authorising and issuing press statements and updates, and arranging press briefings and/or interviews with nominated staff providing internal daily communications and updates to all staff and to the public via the media ensuring there is a nominated CSU person available to clear all communications and to be available for interviews if required. The local media will have a key role in supplying the population with information. The CSU will develop further specific contacts with the local media and CCGs, to ensure they understand and appreciate the CSU s role and the help they can give during such an event setting up a media centre in a nominated area or off-site, as appropriate, and ensuring all appropriate facilities are in place and operational to deal with media inquiries and to support the Communications Team ensuring Main Reception at the various CSU locations and particularly Wynford House and South Plaza have the required information to direct any media enquiries to the media centre ensuring that during an incident that individuals are supported by at least one or two other CSU staff when dealing with the media and that no member of staff is left to deal with them in isolation. liaising with health partners, Local Authority and NHS 111 if required working in partnership with the CCGs and other agencies ensuring similar updates are given to staff before the media updates, using the internal communications methods ensuring that specific pages are available on the CSU s website and that they are clearly signposted and the information is up-todate, comprehensive and accurate. The web pages will be updated daily following the media update creating and maintaining similar pages on the staff intranet site 12
14 HEALTH AND SAFETY 14.1 The circumstances of an interruption to services do not reduce the need for the highest level of commitment to health and safety requirements. As well as the general duties under the Health and Safety at Work Act there are regulations, which are relevant to major incident planning which require the CSU to: assess risks to their employees while at work, and any risks to others which arise from the course of their undertaking identify the measures that need to be taken to control those risks have adequate written arrangements for planning, organising, control, monitoring, and review of those measures 14.2 The regulations specifically address procedures for dealing with serious and imminent danger and contact with external services, particularly medical care and rescue work. The CSU must be aware of the relevant health and safety legislation and that the Health and Safety Executive have wide powers to investigate accidents. 15 BRIEFS AND DEBRIEFS 15.1 Delivering an effective response can depend on the quality of the briefing that responders receive. Those required to respond should receive a detailed brief from a suitable individual within their chain of command. The briefing should contain. Details of the incident; Which structures of Command and Control are in place; Specific relevance to the role; Specific duties they are expected to undertake; Acknowledgement of Action Cards and awareness of their role 15.2 The incident manager and/or director will ensure that there is an effective debrief to properly appraise all aspects of the incident response and capture good practice and requirements for improvement. Debrief must be conducted in an open and honest manner. Debrief will usually be conducted as described below: Hot Debrief - Immediately after the incident those staff involved will be given the opportunity to feedback while it is fresh in their minds. Those in attendance should provide information on areas of the response that went well, to be recorded as best practice. They should also provide information on areas that did not go well, to be identified as lessons to be learnt and to generate actions to improve the BCP and Business Continuity management systems 13
Cold debrief -Within 14 days of the incident those involved in the response will produce a brief account of their involvement in the incident from their incident logs. An overall view of the response will be recorded by the Incident Manager (this can be delegated) and the information collated into one report. The report should include the precise times and chronology of events and should be referred to when implementing lessons identified 15.3 The Resilience Team will make arrangements for staff to be debriefed and may require others involved to debrief their involvement in the incident. The debriefing process may take the form of a proforma or structured debriefing sessions as appropriate to the incident. The resilience team will then prepare a report on the incident, to include issues identified by the debriefing process, together with an action plan to address the issues raised to ensure that lessons are learned. 15.4 Managers will ensure that all staff involved in any incident have opportunities for rest and recuperation; as well as personal discussions as part of the Cold debrief and where appropriate identify avenues for any additional support that may be needed. 16 PLAN REVIEW AND VALIDATION Plan Review 16.1 The Plan will be revised as detailed by the Civil Contingencies Act 2004 guidance when: a new risk assessment indicates the plan is out of date or a new risk identified lessons learnt from experience or exercise indicates the plan is out of date a restructure (organisation or changes to other responders) or other changes to the organisation e.g. technical indicates the plan is out of date changes in key personnel occur 16.2 Minor amendments such as contact details will be dealt with immediately and will not require approval, but a full plan review will be held as a minimum of every 2 years 16.3 Each Department Director should ensure that all organisational changes within their area of responsibility are notified promptly, to their Directorate business continuity lead, who collectively for the SWCS, led by the corporate business manager form the Resilience Team, who are responsible for arranging Business Continuity Plan reviews. 14
17 TRAINING AND EXERCISING 17.1 Training may be carried out for SWCS staff or be co-ordinated with the NHS England area team and the CCGs as required and has the following objectives: to identify key roles to conduct training needs analysis to ensure competency to establish required training programmes to ensure and maintain competency to establish on-going needs assessments 17.2 Exercising may be carried out with SWCS staff or be co-ordinated with the CCGs with the NHS England area team and has the following objectives: to practice a combined response by all relevant services and directorates to confirm the procedures are suitable and cater for current requirements to validate plans to establish a quality control system by testing individual competence 18 REFERENCE MATERIALS NHS Resilience 18.1 Department of Health guidance on NHS Resilience Planning for NHS Facilities in order to ensure continuous operational delivery of healthcare services when faced with a range of disruptive challenges. https://www.gov.uk/government/publications/resilience-planning-for-nhs-facilities NHS Commissioning 18.2 Commissioning resilience is fundamental to ensure that all organisations are able to achieve robust arrangements for dealing with incidents. In December 2007, DH produced a guidance document called Principles and Rules for Cooperation and Commissioning (Gateway reference number: 9244). It is recommended that commissioners consider this document to provide clear statement of principles and rules for cooperation and competition when commissioning or providing services. https://www.gov.uk/government/publications/principles-and-rules-for-cooperation-and-competition Cabinet Office 18.3 Guidance on Business Continuity https://www.gov.uk/resilience-in-society-infrastructure-communities-and-businesses 15
19 KEY CONTACTS (Normal Office Hours only) DIRECTORS Managing Director 01935 384 009 Commercial Director 0117 900 2429 Director of Strategy and Service Transformation 0117 900 2545 Director of Business Intelligence and Informatics 0117 900 2552 DIRECTORATE LEADS Business Solutions and Innovation Advisor 01278 727404 Deputy Director of Contract Commissioning 0117 900 2498 IT Service Development Manager 0117 984 1663 Head of Information Governance 0117 900 2410 Senior Business Partner 01275 546 815 Head of Commission for Quality 0117 900 2386 Associate Director of Procurement 0117 900 2298 Programme Director of Strategic Communications (press line) 0117 900 2549 Corporate Business Manager 0117 984 1611 EMERGENCY RESPONSE TEAM COMPOSITION (5-7 staff) + Admin Leadership by 3 or more directors (if available): Managing Director Commercial Director Director of Business Intelligence and Informatics Operational support by senior staff for example: Deputy Director of Contract Commissioning IT Service Development Manager Head of Commission for Quality Corporate Business Manager Admin support eg loggist, secretarial and communications 16
DIRECTOR ON CALL The Director on call will normally be the Managing Director In their absence it successively falls to o the Director of Strategy and Service Transformation. o the Commercial Director o any one of the Directors (or an experienced senior manager) The director on call will normally activate and stand down this plan. It is essential that all staff and agencies who were alerted are informed of the stand down INCIDENT MANAGER (normally the Director on call) The incident Manager will take charge of the incident, and normally this role will be carried out by the Director on call. In the event that the incident involves NHS England business continuity lead or a Major incident then NHS England specially trained staff will take on the role of incident manager and liaise with the Director on call CONTROL TEAM (normally the Emergency Response Team) The Control Team will work under the direction of the incident manager and will normally be the Emergency Response Team. In the event that the incident involves NHS England business continuity lead or a Major incident then NHS England specially trained staff may form a control team that relays their requirements to the Director on call and to the Emergency Response Team. SERVICE HEADS Directors are responsible for the BCP for their directorates and together with their Service Heads will assess the impact of any business continuity event on their directorate / service. Directors will ensure that their BCP dovetail with BCPs from other directorates and Service Heads will work to restore the services they are responsible for as quickly as possible. EMERGENCY RESPONSE TEAM The Director on call will lead and direct the Emergency Response Team, whose membership will vary depending on the incident. The Team will put this plan into effect, by establishing command and control (see sections 8 and 9 above) and follow the relevant action cards for their role in the appendix below 17
ASSESSMENT GUIDANCE DIAGRAM Appendix A1 Determine: 1. What has occurred? 2. What operations / services have been affected? 3. When did it occur? 4. Whose area of responsibility 5. Where did it occur? 6. Can the affected location be accessed? 7. What was cause? Incident Impact: 1. Moderate damage to facilities or impact on operations / services 2. Major damage to facilities or impact on operations / services 3. Future operations / services severely impacted INCIDENT OCCURS Incident Occurs Determine what has occurred Initial notification to Emergency Response Team Determine the incident impact If Major incident report to NHS England Area Team Inform NHS England Business Continuity Team and determine if their assistance is required Impact Assessment: Loss of facility >2 days Loss of I >24 hrs Loss of key staff Loss of contractor or supplier Loss of utilities >24hrs Determine: 1. Current workloads 2. Current staffing levels 3. Immediate work priorities 4. Staff / Resources required to support immediate work priorities 5. Staff / Resources required to support response Determine: 1. Whether specific service continuity teams are to be activated 2. Locations(s) / Resources to be utilised 3. Staff required to support immediate, short and long term work priorities 4. Resources required to support immediate, short and long term work priorities Does the Incident affect Operations / Services? Service Heads to determine impact on their activities Emergency Response Team to determine actions required and activate directorate BCPs Notify staff, patients, stakeholders, CCGs, hospitals, as appropriate Commence selected recovery task options Monitor the Situation NO Brief Executive Team on situation Continue with normal operations and monitor situation Notify staff, patients, stakeholders, CCGs, hospitals, as appropriate When able recommence normal operations 18 Conduct Debrief
Appendix A2 ESCALATION DIAGRAM OF LEVELS AT WHICH PLAN OPERATES Escalation and de-escalation throughout the various levels may not happen in sequence, and is driven by the nature, size and requirements of the incident. The following levels of escalation have been defined by NHS England BC Team ALERT ACTIVITY ACTION INCIDENT LEVELS 0 A business continuity incident that can be responded to and managed by individual BC Leads within their respective business as usual capabilities 1 A business continuity incident that requires the response of the BC Team 2 A business continuity incident that requires the response of the BC Team (VSM lead) with the support of the Incident Manager Alert Dynamic Risk Assessment Declaration of Incident Level 3 A business continuity incident that requires full invocation National Support Centre s BCP and coordinated by the National Support Centre BC Team under the command and control of an Incident Manager and Incident Director (VSM lead). Management of the incident may be escalated to the Executive Team and The Board EG Level 0 = Staff member sickness Level 1 = Loss of non-prioritised activity team workspace Level 2 = Prioritised activity affected, i.e. loss of Customer Contact Centre (IT/Premises) Level 3 = NHS England denied use of Quarry House / Maple Street (eg fire) 19
Appendix A3 EMERGENCY CONTACT INFORMATION Full contact details for staff and others can be found in the directors BC contact list and in the individual directorate level business continuity plans Single contact point for : SOUTH WEST CSU Communications team SWCS Comms team (all issues including press) 0117 900 2549 Communication with NHS England Area Team Manager/director on call BNSSG 0303 033 8833./ Somerset 0303 033 35000 Communicating with CCGs out-of-ours The CCGs operate a single out-of-hours contact number. The CCG Director on Call can be contacted 24 hours a day on: BNSSG 0303 033 9911./ Somerset 0303 033 9944 NHS Property Services South Plaza Main reception 07818 573097 4 th floor reception 0117 976 600 Area Estates Operations Maintenance Manager 0117 984 1506 20
Appendix A4 PRIORITY ORDER CHECKLIST AND LIKELY COMMUNICATION REQUIRED Priority 1 Communications / clear command and control leadership / Emergency Response Health and Safety / Patient Safety focus on outcomes to be delivered / timescale Establish and staff incident / operations room Completeness of situation report information / update report checklists Clear roles established - record of individuals/organisations contacted Wider communications IT website / NHS Mail email use comms checklists Priority 2 Establish Executive Team for strategic response and address customers priorities Action to address and recover Patient Facing services PALS, Choose and Book, Serious Incident, Surge team, CHC,IFR Utilities, sanitation/toilets, basic essential services IT response to enable access to normal email and system files Staff able to work remotely in different bases or from home Priority 3 Activate Individual directorate Business Continuity Plans incorporating their BIA Aim to recover vital assets, equipment, resources, information Establish interim systems for intermediate / longer term working Update system for progress against Critical, Essential and Important priorities HR support LIKELY COMMUNICATION REQUIRED Incident is taking place Action being taken Impact on the service Request for support / resources / information / specific actions to be taken 21
Appendix B ACTION CARDS Action Card 01 Initial point of contact alert record Action Card 02 Director on call Action Card 03 Emergency Response Team Action Card 04 Executive Team Checklist Action Card 05 Operations Directors and Senior Managers Action Card 06 Incident Room Manager Action Card 07 Administrative Support Action Card 08 Communications Manager Action Card 09 Loggist Action Card 10 Resource Manager 22
ACTION CARD 01 INITIAL POINT OF CONTACT ALERT CALL RECORD This card is used to document the first notification of a warning message or an alert to ensure that the alert is carefully recorded and inserted into the Incident Log book. All log book records must be timed, dated, signed and made in ink 1 Completed by 2 Date call received 3 Time call received 4 Name of caller and their contact details Name Title: Tel: 5 Organisation of caller Tel 6 Recorders Contact details Email If there is any doubt about the authenticity of the call the alert must be verified by calling a recognised number for the alerting body 7 Brief Summary of the business continuity / emergency notification 8 Other Organisations Involved 23
(METHANE template for Major Incidents included here should be printed and included as the first page in the log -book) TIME CALL RECEIVED:... RECEIVED FROM:... NAME OF CALLER:... TELEPHONE NUMBER:... Heading Type of Information M Major Incident Major incident declared E Exact Location Location of the emergency, as precise as possible T Type of Incident Nature of the incident, for example, major fire, building collapse H Hazards Actual or potential hazards at the scene, any concerns about contamination, toxic smoke. Any evacuation, if so, where to A Access Rendezvous point and any restrictions on access to the scene N Number of Casualties Number of fatalities; numbers injured E Emergency Services Which emergency services are present and potential future needs? Who is in command? 24
ACTION CARD 02 DIRECTOR ON CALL Role The role of the Director on call is to co-ordinate South West Commissioning Support s (SWCS) tactical response to a Business Continuity Incident. Responsibilities The SWCS Director On-call will discharge their role by: 1. Assessing the Business Continuity Incident and determining the level of response required by SWCS. 2. Declaring an SWCS major incident /activating the BCP if the situation dictates. 3. Keeping the Managing Director informed and up to date. 4. Communicating with external customers and stakeholders. 5. Using the provided resources, establishing and co-ordinating the SWCS response through the Incident Room, if required. 6. Ensuring that contemporaneous records are kept and subsequent response actions and decisions are accurately recorded and circulated. 7. As the SWCS lead, Chair the Emergency Response Team, agree local strategy and prioritise and allocate tasks. A Business Continuity Incident is defined as any disruption to normal business for longer than 4 hours Normal business practice is to ensure that any significant disruption (as defined by SWCS customers) is notified to customers and those affected as soon as possible so that they can cascade information within their organisation. The Director on call should also follow the action card for the Emergency Response Team 25
ACTION CARD 03 EMERGENCY RESPONSE TEAM Role The role of the Emergency Response Team under the direction of the Director on call will be to manage the incident and lead the recovery of all resources, facilities and core services. Responsibilities ensure the CSU s business continuity and service recovery plans, including the NHS England area team major incident plan (if required) are triggered, without duplication of effort or responsibility and those respective responsibilities are clearly understood activate and resource the Major Incident Room (if required) ensure that appropriately qualified individuals are appointed to take on any liaison role required; that they understand their responsibilities and are adequately resourced in order to undertake their duties direct the efforts of service liaison officers; providing timely information to these representatives using approved templates in order to contribute to any conference calls and liaison meetings assess the impact on the CSU ensure that mechanisms for reporting the resilience of services are in place throughout the CSU and common report templates are provided to aid swift collation of information consider the communication requirements for members of staff, partner agencies and patients. Ensure that staff are aware that the Major Incident Room has been established and its role/responsibilities during the recovery period consider the HR / resource implications; whether with CCG colleagues, additional commissioning is required or efforts are required to recruit, train and equip additional temporary staff, contractors or volunteers. apply policies, procedures and initiatives in response including advice from the Executive Leadership Team respond to requests for action and information from partner agencies, to ensure a pro-active role within any wider regional/national response 26
Response Actions for Considerations: Open a log of events and record actions and decisions Determine and record what has occurred, where, when and the scale of the event. Depending on the incident, alert the NHS England area team so they can activate their Major Incident Plan (if required) and activate the Corporate Business Continuity Plan (if required) Alert senior member of Emergency Response Team so they can alert other members and those immediately affected by the incident and establish Incident Room (if required) Alert senior member of Executive Leadership Team to consider the strategic response (if required) so they can alert others Alert communications team to alert them to the situation so they can prepare standard briefs and send out messages across the CSU and coordinate across the NHS patch Alert customers, other health care partners (e.g. Ambulance Service, Acute Trusts, NHS England and neighbouring CCGs) and local authority, as appropriate, keeping the communications team briefed Determine the incident impact and activate the SWCS corporate BCP. Involve NHS England Business Continuity Team if required Instigate daily meetings and involve communications team and others as required Does the incident affects operations /services? Request further information if required to do an initial impact assessment. Brief Executive Leadership Team Service heads to determine the impact on their activities and liaise with directorate business continuity leads Review CSU s plans and re-organise work priorities in line with Business Continuity and Service Recovery Plans and Business Impact Analysis. Focus resources on critical priority 1,2 and 3 services in all directorate level plans and determine actions required Emergency Response Team to determine actions required, to activate directorate BCPs and to consider staffing requirements in conjunction with other problems Initiated by Date/Time 27
Response Actions for Considerations: Notify staff, patients, stakeholders CCGs hospitals as appropriate. Keep Communications Team updated and provide timely communication both internal and externally. Respond to internal and external requests for information As more accurate and detailed information becomes available, Identify and quantify any damage to the organisation, including staff, premises, equipment, data, records, etc including reputational impact / damage Identify which critical functions have been disrupted Commence selected recovery task options. Determine and mobilise essential response and recovery staff Task Managers to review their existing workloads / Business Impact Analysis figures to update their corresponding resource requirement and necessary priority recovery timeframe objectives Monitor the situation Convene those responsible for recovering identified critical functions, and decide upon the actions to be taken, and in what timeframes. Notify staff, patients stakeholders etc working closely with the Communications Team and provide information as required to: Executive Leadership Team Staff Patients Suppliers Initiated by Date/Time 28
Daily actions during the recovery process: Convene those responsible for recovery to understand progress made, obstacles encountered, and decide continuing recovery process Provide information to Executive Leadership Team and ensure that their efforts are co-ordinated with the Emergency Response Team and any Recovery Working Group that has been established Work closely with the Communications Team and provide information if required to: Staff Patients Key health stakeholders, including NHS England, CCGs Suppliers Ambulance Services (SWAST) If relevant neighbouring Trusts Local Authority Provide public information to maintain the reputation of the CSU and keep relevant authorities informed. When able recommence normal operations Continually monitor the situation so that Director on call has all the information needed to stand down the BCP Following the recovery process: Conduct debrief and identify any additional staff welfare needs (e.g. counselling) Use information gained from the staff debrief to review and update the business continuity management plan Initiated by Date/Time Initiated by Date/Time 29
ACTION CARD 04 EXECUTIVE LEADERSHIP TEAM - CHECKLIST Role: The primary function of this role is to provide the strategic overview and ensure that the Emergency Response Team is properly resourced to carry out its role and responsibilities. Actions for Considerations: Ensure the CSU is fully prepared to effectively manage any disruption to services Ensure safe maintenance of core acute services and independent contractor services Ensure effective partnerships are in place to manage pressures Ensure resources are available to manage emerging pressures as a direct consequence of the business interruption Keep in close communication with the Emergency Response Team so there is no duplication of effort and ensure that the Team is resourced with suitable fresh replacements during an extended incident Ensure that HR resource is adequate and able to cope during a protracted event due to requests for support and assistance from CCGs as well as CSU staff In discussion with Local Authority, Acute Trusts and the NHS England area team to make decisions over whether to apply for dispensation over key access targets Clarify when and for how long targets can be suspended, if required Ensure the CSU is able to recover and return to normal levels working with the Emergency Response Team to establish a Recovery Working Group if necessary Initiated by Date/Time 30
ACTION CARD 05 OPERATIONS DIRECTORS AND SENIOR MANAGERS Role The role of operations directors and senior managers in the Emergency Response Team is to assist the director on call to manage the incident and lead the recovery of all resources, facilities and core services. Responsibilities In addition to the specific actions listed for the Emergency Response Team the operations directors and senior managers have been chose for their ability to respond to this particular situation and should work together as a unit to decide how they can best contribute to and carry out the Emergency Response Team tasks Work methodically and systematically through the plan but also remain vigilant, so that the team can generate the appropriate response despite any unforeseen gaps in the plans Obtain external advice on the hazard and its source and how to contain it if appropriate Think creatively and be prepared to implement mutual aid agreements, coordinate and deploy resources where required Have the authority to take executive decisions in the light of best available information, including being prepared to establish emergency spending protocols. Ensure that any and all costs incurred as a result of a Business Continuity Incident should be recorded and assigned to a separate budget code Be prepared to establish a Recovery Working Group in discussion with the Executive Leadership Team to consider the phased recovery of services and those items required to return the services to normality. 31
ACTION CARD 06 INCIDENT ROOM MANAGER Role: The role of the Incident Room Manager is to set up the Incident Room and ensure effective management of the log keeping, administration and communication functions of the Incident room in support of the Director on call. Actions for Considerations: Upon notification that a an Incident Room is required by the Director on Call, proceed to the appropriate Incident Room (usually South Plaza or Wynford House) Alert and activate the Incident Room administration team and log keeper (s) Keep own timed log of events and decisions until arrival of the log keeper Set up the Incident Room and test all communications and IT functions using the Standard Operating Procedures Notify the Director on call that the room is fully operational and request an update on the situation Delegate administrative functions appropriately: a) Email monitoring b) Log Keeper (Must be an approved or trained Loggist) c) Minute taking (separate to Log Keeper function) d) Situation Report (SITREP) duties should they exist Ensure the Log Keeper commences formal incident log and all messages, actions and decisions are recorded Ensure all incident room members maintain personal logs, which are timed and dated Ensuring when actions are required they are correctly allocated and that they are completed to agreed timescales this may require support and direction from the Director on call Initiated by Date/Time 32
Actions for Considerations: Ensure that staff are kept up to date with the incident response Maintain and develop contact lists and electronic filing systems Maintain welfare requirements of room facilitating on-going cover in protracted incidents, including refreshments and meal breaks Ensure the room is kept in a tidy and professional state Support the Director on call as required In conjunction with the Director on call, establish communication links with other Incident rooms, NHS trusts and other partners as appropriate Initiated by Date/Time After the Incident: Once the incident is declared as stood down and the Director on call agrees to stand down the incident room, ensure that all the logs, records and documents are handed in and there are no gaps in the records Coordinate and assist with the arrangements for debriefing. Attend any debriefing sessions as directed and contribute to the post incident report Ensure that any lessons learned as a result of the event are collated and fed back into the Business Continuity Plans 33
ACTION CARD 07 ADMINISTRATION SUPPORT TEAM Role: The role of the Admin support team is to provide administration, clerical and secretarial support to the Emergency Response Team in the Incident room Initiated by Actions for Considerations: Date/Time Upon notification report to the appropriate Incident Room (usually South Plaza or Wynford House) for a briefing on the nature and details of the incident Assist setting up the Incident Room using the Standard Operating Procedures Keep own timed log of events and decisions Ensure relevant stationery supplies are available Receive and pass information by phone or in person Pass all messages received to the Incident Room Manager Ensure that tasks are completed as per procedure so that others are able to locate and understand your work Ensuring that when actions are required they are correctly allocated and that they are completed to the agreed timescales Ensure the room is kept in a tidy and professional manner Support the Incident Room Manager Note: If at any time you do not understand the task, or the process of completing the task, - then ask the Incident Room Manager for further clarification If your workload is unachievable in the time allocated then speak to the Incident Room Manager who will arrange support / additional resources Once the incident is declared as stood down and the Director on call agrees to stand down the incident room, ensure that your logs, records and documents are collated and passed to the incident room manager Assist with disconnecting all the equipment and returning the room to normal and contribute to the debriefing process 34
ACTION CARD 08 COMMUNICATIONS MANAGER Role: The role of the Communications Manager is to maintain effective communications across the CSU, the CCGs, partner organizations and key stakeholders, including the public and media in conjunction with other responding agencies Initiated by Actions for Considerations: Date/Time Upon notification report to the appropriate Incident Room (usually South Plaza or Wynford House) and report to the Director on call for a full briefing on the nature and details of the incident) Keep own timed log of events and decisions Monitor any Media coverage Provide media and communication advice when requested Co-ordinate arrangements for the health community to deal with media liaison Work with other agencies to generate press statements as required Identify and contact appropriate people within the health community for interviews or specialist information Ensure all decisions and actions taken are recorded After the Incident Once the incident is declared as stood down and the Director on call agrees to stand down the incident room, ensure that your logs, records and documents are collated and passed to the incident room manager Attend any debriefing sessions as directed and contribute to the post incident report Follow up communication with those involved to ensure they are all briefed about the outcome of the event. Ensure that all those that have been alerted are aware the incident has been stood down 35
ACTION CARD 09 LOGGIST Role: The role of the Loggist is to ensure that all actions, decisions and significant events are recorded in the log book to provide an audit trail of the command and control judgments. The Emergency Response Team and the Executive Leadership Team will each need the support of a designated log keeper. The following are best practice instructions, if all else fails, record as much as you can Initiated by Actions for Considerations: Date/Time Record your name at the start of the logging session Record time, date and number each entry consecutively All major actions and decisions are to be recorded in the log along with who has been tasked with the action and timescale for completion; the logbook should also record any change of staff in the key roles As a minimum, these will include: the nature of the decision the reason for the decision the date and time of the decision who has taken the decision / authority designation the extent of consultation and advice from external stakeholders who has been notified of decisions made any review date set for revocation of the decision(s) where relevant The details logged must be sufficient to allow the person taking over the task to understand what has happened to date, and be used as a briefing aide to assist Situation Reports 36
Actions for Considerations: Initiated by Date/Time Closing the Log: 1) Line through any blank spaces, Z line through large spaces; 2) Confirm decisions and actions with management group, sign and then pass to the Incident Room Manager; If you make a mistake: 1) During the session: Line through with a single line; 2) After the session: Amendments to be added in red pen at the bottom of text. After the Incident: Once the incident is declared as stood down and the Director on call agrees to stand down the incident room, ensure that all the logs, records and documents are handed into the incident room manager and there are no gaps in the records Attend any debriefing sessions as directed and contribute to the post incident report 37
ACTION CARD 10 RESOURCE MANAGER Role: The role of the Resource Manager is to maintain resilient levels of skilled resources to sustain an effective response to a prolonged business continuity incident through the development and management of a robust resource plan Actions for Considerations: Upon notification report to the appropriate Incident Room (usually South Plaza or Wynford House) and report to the Director on call for a full briefing on the nature and details of the incident) Keep own timed log of events and decisions Manage all skill / resource requests Establish a resource plan to cover the duration of the incident. This includes identifying required skills and deputies and drawing up staffing rotas in conjunction with directors and heads of services and others as appropriate Act as a focal point for all resource issues arising from the incident Ensure skill and resource issues are considered when response options are being developed and implemented by the Emergency Response Team Liaise with Trade Union representatives, as necessary After the Incident Once the incident is declared as stood down and the Director on call agrees to stand down the incident room, ensure that your logs, records and documents are collated and passed to the incident room manager Attend any debriefing sessions as directed and contribute to the post incident report Initiated by Date/Time 38
Appendix C PRIORITIES OF SERVICE FUNCTIONS NHS SOUTH WEST CSU (EXAMPLE LAYOUT ONLY PLEASE REFER TO DIRECTORATE LEVEL DETAILED BUSINESS CONTINUITY PLANS) RED Work on Mitigating Actions / Control Measures has not commenced AMBER Mitigating Actions / Control Measures are under development procedures and agreements planned to be complete within 6 months GREEN Mitigating Actions / Control measures are complete and procedures and agreements are in place, and there are no outstanding issues PRIORTY 1 TIMESCALE EXAMPLE CRITERIA Critical Immediate response within one hour Danger/distress to staff and/or patients Prevents provision of an essential service/function Senior Command arrangements Maintaining senior command base Health Protection advice Clinical Care to the most vulnerable patients Maintaining basic functions of in-patient facility, to include utilities, catering and security DIRECTORATE SERVICE FUNCTION RISK CONSEQUENCES MITIGATING ACTIONS / CONTROLLING MEASURES 1 Corporate Services and Communications Business Continuity / Communications Break in business continuity and lack of resilience to respond to the risks posed Lapse in communication Breach of legislation Breach of contract Uncertainty about the extent of problem and impact leading to restricted business function Business Continuity Plans Contingency Planning Communications network Media management RAG RATING COMPLETION DATE (For RED Risks) 39
DIRECTORATE SERVICE FUNCTION RISK CONSEQUENCES MITIGATING ACTIONS / CONTROLLING MEASURES 2 Information Technology Information Technology File server Access Operating system failure No access to user/directorate files Key Servers/files replicated across the various physical locations. RAG RATING COMPLETION DATE (For RED Risks) 3 Information Technology Information Technology Core Server systems (Security, DNS, LAN) Plus File and email servers A/C failure No access to user/directorate files Loss of access to all Systems Key Servers/files replicated across the various physical locations. Manual intervention required to restart servers from new location 40
PRIORTY 2 TIMESCALE EXAMPLE CRITERIA Essential Response within one day Disruption/discomfort to staff and/or patients Restricts normal business operation Clinical care to vulnerable patients Vulnerable adults and children: Supervision and Coordination DIRECTORATE SERVICE FUNCTION RISK CONSEQUENCES MITIGATING ACTIONS / CONTROLLING MEASURES 1 Corporate Services and Communications Communications Business Continuity and maintaining channels of communication Failure to act responsively by not keeping channels for communication open to inform the situation and to manage media effectively Poor communication leading to confusion/panic and hysteria impacting on business continuity Restricted business function Business Continuity Plans Contact lists Access to temporary office function and verbal/written communications RAG RATING COMPLETION DATE (For RED Risks) 41
PRIORTY 3 TIMESCALE EXAMPLE CRITERIA Important Response within three days Urgent clinical care Urgent HR, Finance, Commissioning and Communications requirements DIRECTORATE SERVICE FUNCTION RISK CONSEQUENCES MITIGATING ACTIONS / CONTROLLING MEASURES 1 Corporate Services and Communications Communications Assess communications strategy in light of developments Failure to assess short to medium term effects of issue may result in loss of reputation and financial cost Reputation damage Financial loss Multi-agency communication team RAG RATING COMPLETION DATE (For RED Risks) 42
PRIORTY 4 TIMESCALE EXAMPLE CRITERIA Desirable Interim response within one week Will not directly disrupt services but will cause inconvenience to staff and/or patients. Complaints Routine media arrangements DIRECTORATE SERVICE FUNCTION RISK CONSEQUENCES MITIGATING ACTIONS / CONTROLLING MEASURES 1 Corporate Services and Communications Governance Assurance Failure to maintain governance arrangements Affects health and social wellbeing Organisation s reputation Contact list Electronic or hard copy documentation Access to communication network RAG RATING COMPLE TION DATE (For RED Risks) 43
PRIORTY 5 TIMESCALE EXAMPLE CRITERIA Other Response within one month Will involve non-urgent repairs Recruitment and Selection Patient and public involvement: public consultation Training and workforce development DIRECTORATE SERVICE FUNCTION RISK CONSEQUENCES MITIGATING ACTIONS / CONTROLLING MEASURES 1 Corporate Service and Communications Business continuity Lack of resilience Loss of business continuity and reputation Impact assessment of current position with development of additional controls to manage the position RAG RATING COMPLETION DATE (For RED Risks) 44
Appendix D NHS SOUTH WEST CSU ALTERNATIVE FACILITIES / RELOCATION (EXAMPLE LAYOUT ONLY PLEASE SEE DETAILED DIRECTORATE BUSINESS CONTINUITY PLANS FOR THE SPECIFIC ARRANGEMENTS THAT HAVE BEEN MADE FOR THOSE DIRECTORATES FOR SPECIFIC INCIDENTS). IN GENERAL Staff may be able to work from home using their mobiles and laptops Staff may be able to travel and work from other CSU bases if these are not effected Staff may be able to use other NHS organisation premises and facilities eg Hospital and community bases DIRECTORATE SERVICE FUNCTION ALTERNATIVE FACILITY / RELOCATION (i.e. Work from home, or name of alternative site) RECIPROCAL ARRANGEMENTS (Alternative Site Agreement in place) 1 Corporate Services and Communications Business Continuity / Communication Lyngford House/Work from home mobile communications mobile phones, txt local, nhs.net 2 Information Technology Information Technology File server Access YDH Yes Yes YES / NO 45