NHS Lancashire North CCG Business Continuity Management Policy and Plan

Agenda Item 12.0. NHS Lancashire North CCG Business Continuity Management Policy and Plan Version 2 Page 1 of 25

Version Control Version Reason for update 1.0 Draft for consideration by Executive Committee Feedback from 2.0 senior managers Date of update Updated by: 22/10/14 J.A. Thompson 08/01/15 J. A Thompson Accountable Emergency Officer sign off NHS LNCCG Governing Body sign off Page 2 of 25

Contents Page No 1.0 Introduction 4 2.0 Purpose 4 3.0 Definitions 6 4.0 Roles, Duties & Responsibilities 8 4.1 Legal And Statutory Duties, Responsibilities And Guidance 8 4.2 Specific Duties And Responsibilities Within The CCG 8 5.0 Business Continuity Management Plan 10 6.0 Initiating The Plan 11 6.1 Causes Of Service Interruption 11 6.2 Activating The Plan 11 7.0 Record Keeping 14 8.0 Communication 14 9.0 Training Requirements 15 10.0 Implementation, Monitoring And Review 15 11.0 Associated Documentation 16 Appendices Appendix 1 Business Continuity - Scenarios 17 Appendix 2 Business Continuity Management Plan Template 19 Appendix 3 Business Continuity Plan 20 Appendix 4 Contact Details for NHS Lancashire North CCG On-Call Managers 22 Appendix 5 Crisis Response Team Notes 23 Page 3 of 25

Business Continuity Management Policy 1.0 INTRODUCTION. Business Continuity Management (BCM) is a statutory requirement for NHS Lancashire North Clinical Commissioning Group (CCG) to undertake. The Civil Contingencies Act 2004 and the NHS Emergency Planning Guidance 2005 requires the CCG to have a Business Continuity Management Policy (BCMP) to ensure that, in the event of a significant service interruption, critical day-to-day functions can be maintained whilst timely recovery and restoration of key services, systems and processes is also achieved. It is the policy of the CCG to take all reasonable steps to ensure that in the event of a service interruption, the organisation will be able to maintain essential services and restore normal services as soon as possible in the circumstances prevailing at the time. Alongside ensuring business continuity the CCG has to ensure emergency preparedness as a Category 2 responder. The CCG s main role will be to support Category 1 responders (main NHS providers which requires an escalation route to their commissioners and NHS England which may require support from CCGs). Details of the CCG s emergency preparedness can be found in the Emergency Planning and Resilience Policy and the Major Incident Plan. A ratified version of this document will be placed on the CCG website along with the set of EPRR documents and will be updated as required. 2.0 PURPOSE This Policy sets out the general principles and corporate framework for the creation and revision of a Business Continuity Management Plan relevant to the business activities of the CCG. These will be formulated in accordance with the strategic objectives for the CCG in place from time to time. This document aims to ensure that all business continuity processes carried out by the CCG are executed in an agreed and controlled manner. The business continuity management procedures described are separate from, but may operate in conjunction with, the Major Incident Response Plan in times of emergency or serious incident as per the definitions in the Major Incident Response Plan. It may also operate in conjunction with the CCG s Risk Management processes in place from time to time. Page 4 of 25

In the event of service interruption, this policy sets out the framework for the CCG to: Manage and maintain the continuation of critical, core functions and services Manage the recovery and restoration of normal functions and services Appendix 1, sets out a number of scenarios that may cause the CCG to initiate its Business Continuity Plan. Page 5 of 25

3. DEFINITIONS The following definitions apply to terms used in this Policy, in accordance with ISO22301. Activity: Processes or sets of processes undertaken by the CCG, or on behalf of the CCG, that supports delivery of services. Business As Usual: Pre-defined acceptable levels of service delivery. Business Continuity Management (BCM): Process to identify potential threats, assess the impact of those threats on the CCG, and building a framework to support CCG resilience to those threats, including protecting patients and stake-holders interests and achieving strategic objectives. Includes strategic and tactical capability of the CCG to plan for and respond to business interruptions in order to support continued delivery of business as usual. Critical Activities: Those activities carried out by the CCG which are most time sensitive and important for ensured continued delivery. These will be mainly those services essential for immediate life and death of patients. These activities will typically suffer if delayed by more than one hour. Disruption: Any event, planned or unplanned, which causes an interruption to the CCG s ability to continue business as usual. Essential Activities: Those activities carried out by the CCG which are sensitive and important, but not critical to life and death of patients. These activities will normally suffer if delayed by more than one day. Major Incident: An event classified as a major incident according to the CCG Major Incident Response Plan. Non-Urgent Activities: Those activities carried out by the CCG which can be postponed or delayed most easily. These activities will begin to suffer if delayed by more than one month. Page 6 of 25

Routine Activities: Those activities carried out by the CCG which support business delivery on a daily basis and are not critical or essential. These activities will typically start to suffer if delayed by more than one week. Service Recovery: The process through which business as usual is reached, following an interruption or disruption event Page 7 of 25

4. ROLES, DUTIES & RESPONSIBILITIES 4.1 Legal and Statutory duties, responsibilities and guidance The following general (Statutory) duties apply: 1.The Civil Contingencies Act 2004 (CCA) places a duty on CCGs to have business continuity plans in place to ensure that they can continue to exercise their functions in the event of an emergency so far as is reasonably practicable. The duty relates to all functions, not just their emergency response functions. CCA Definition of an emergency is as follows: An event or situation which threatens serious damage to human welfare in a place in the UK, the environment of a place in the UK, or war or terrorism which threatens serious damage to the security of the UK. 2. Healthcare Standards require the organisation to be able to continue essential routine work during an incident or emergency situation and to provide essential supplies, with documented procedures for procuring additional or alternative supplies 3. ISO22301 gives guidance for establishing a Business Continuity Plan and Process within an organisation and this policy is written accordingly. 4.2 Specific duties and responsibilities within the CCG The following specific duties and responsibilities apply within the CCG: 4.2.1 CCG Governing Body: The CCG Governing Body is responsible for setting the strategic context in which business continuity and service recovery procedures are developed, and for the formal review and approval of this Policy. The Governing Body is also responsible for determining the accepted levels of business as usual, through monitoring service delivery and approving suggested developments. Through the commissioning and contract monitoring processes, the Governing Body is responsible for gaining assurance that Page 8 of 25

providers commissioned by the CCG have adequate BCM systems and processes in place to ensure service continuity. 4.2.2 Accountable Officer (AO): The AO has overall statutory responsibility for the strategic and operational management of the CCG, including ensuring that the CCG has in place robust arrangements for Emergency Planning Resilience and Response (EPRR) and for ensuring that business continuity management plans are robust to support the delivery of core business functions and to ensure these are updated as necessary. The AO will be supported by the Senior Manager Planning and Partnerships. 4.2.3 CCG Executive Officers and Senior Managers will: Ensure that their element of the BCM plan is reviewed at six monthly intervals and updated as necessary to maintain good quality control of document information. Notify any BCM plan revisions to the senior Manager with responsibility to support the Executive GP lead. Support business continuity awareness and acceptance amongst staff and ensure that all of their staff are aware of their responsibilities within the BCM plan. Encourage and participate in training or exercises. 4.2.4 All CCG Staff: All staff are responsible for co-operating with the implementation of this Policy and any relevant plans as part of their normal duties and responsibilities. 4.2.5 Lancashire County Council Public Health via a memorandum of understanding with the CCG, will ensure that adequately tested emergency plans are in place to protect the health of NHS Lancashire North CCG population from threats ranging from relatively minor disease outbreaks to full-scale public health emergencies and will ensure that NHS Lancashire North CCG has access to, and is briefed on, relevant emergency plans. Senior Manager Planning and Partnerships will liaise with Public Health Lancashire. Page 9 of 25

5. BUSINESS CONTINUITY PLANS The BCM plan will be written in accordance with the template attached to this policy (Appendix 2). As the CCG is a small organisation an overarching plan will be developed that covers all work areas with exceptions for any work area highlighted. The CCG senior manager leading that work area will be responsible for ensuring any exceptions relating to their work area are communicated to the Senior Manager Planning and Partnerships The anticipated outcome of completing the template and thus building the Business Continuity Management Plan includes: 1. Identification of critical, essential, routine and non-urgent activities of the CCG 2. Prioritising delivery of those activities in response to a disruption 3. Minimising the effects of any disruption and allowing return to business as usual as fast as possible 4. Increased staff awareness through of BCM principles and processes 5. Supporting the achievement of CCG strategic objectives and associated action plans 6. Ensuring legal compliance with planning obligations 7. Inform a response process which is flexible to meet changes in service delivery of the CCG As the BCM plan is developed, the BCM policy may be adjusted as and when agreed by the CCG Governing Body to reflect the development of CCG strategy. Page 10 of 25

6. INITIATING THE PLAN The Business Continuity Management Plan will be initiated when any disruption to service delivery is experienced. 6.1 Causes of Service Interruption: There are many and varied possible causes of service disruption. Based on the National Risk Assessment, National Risk Register and also linked to Lancashire LRF s Community Risk Register, business continuity planning should be carried out to minimise the effects of a number of potentially disruptive events: Major accident or incident, national disaster, epidemic, terrorist attack Fire, flood, extreme weather conditions Loss of utilities, including IT and telephone systems Major disruption to staffing; epidemic, transport disruption, industrial action, inability to recruit; mass resignations (e.g. lottery syndicate). It should be borne in mind that these events may not be mutually exclusive, e.g. extreme weather leads to loss of electricity, disruption to transport, staff unable to get to work. A cause of a service disruption event may also become an internal major incident for the CCG and invoke the CCG s Major Incident Response Plan. In this event, the BCM plans should be carried out simultaneously with the response to the major incident, as far as is possible. Risks of significant service disruption will be placed on the CCGs internal risk register and action, from a risk point of view, through all appropriate channels as deemed necessary. See appendix 1 which provides a variety of business continuity scenarios and the responsibility of the CCG and the actions to be taken. 6.2 Plan activation The senior manager in the work area concerned will decide with discussion with other senior managers and either the Chief Officer or Chief Finance Officer whether the plan or any part of it should be activated using the process in the following flowchart. Out of hours the decision will be made by the on-call manager. Page 11 of 25

Once the plan is activated the incident will be managed by the senior manager of the work area in which the incident occurred. The senior manager has responsibility for convening the crisis response team to ensure that essential services are maintained and that recovery plans are put into place. The crisis response team membership is at the discretion of the senior manager as each incident is different but at a minimum the team must include another senior manager, a governing body member (usually the Chief Officer or Chief Finance Officer), Senior Manager Planning and Partnerships and a Communications Manager. Anyone called to attend the crisis response team by the senior manager must attend. There are no exceptions. See appendix 4 for contact details for members of the CCG executive officers and senior managers. Records of all decisions and actions taken by the crisis response team will be made in accordance with the templates in the BCM plan. Page 12 of 25

Process plan for activation Page 13 of 25

6.3 Support in Activation It can be expected that the management of business continuity issues affecting the CCG will be managed during normal working hours. However, should the senior manager in charge of the response see it necessary to continue the management of the issue outside of normal office hours and where this may lead to a need for overnight accommodation for a senior member of staff who lives a significant distance from base then arrangements are in place to reimburse the cost of local accommodation. The continued supply of necessary equipment to enable the CCG to maintain business as usual/business critical functions during a period of crisis will, wherever practical, be achieved through standard processes. Where this is not possible due to breakdown in current arrangements or due to the urgency of the request then the senior manager may at their discretion, use alternative methods to acquire necessary equipment through the use of CCG petty cash. In relation to continuation of the critical services of the CCG these will be prioritised and resources allocated as necessary with members of staff from within the CCG or CSU. The senior manager will have sole discretion in allocating appropriate resource including scaling up and scaling down dependent on need. 7. RECORD KEEPING Good record keeping is paramount if the BCM plan is initiated. The senior manager leading the crisis is responsible for ensuring that accurate records are kept of all decisions and actions taken in their area of work once the BCM plan is initiated. This includes the crisis recovery team record keeping see appendix 5. All records created during the implementation of the BCM plan will be kept by the Corporate Affairs Manager. These records will be stored in line with the CCG s Record Management Policy. 8. COMMUNICATIONS Good communication is essential at a time of crisis. A communication plan will be developed to ensure there are appropriate statements for internal and external communication and processes for ensuring communication to all CCG staff in the event of an emergency. Page 14 of 25

9. TRAINING REQUIREMENTS All Governing Body members and senior managers need to be aware of the contents of this policy, and ensure that they are acquainted with the CCG s Business Continuity Plan and have access to the appropriate templates. This training/awareness raising will be initiated by the Corporate Affairs Manager who will keep a log of attendance. The Senior Manager Planning and Partnerships will, on request, provide support, assistance and advice, including instruction in the application of the process and use of the templates to any member of the CCG and CSU. The Emergency Planning and Resilience Policy also provides detail regarding the overarching EPRR training provision, along with detail on refresher training which will include all elements of EPRR. Training will reflect the requirements of the CCG in terms of business continuity and will be in line with the requirements of the National Occupational Standards for Civil Contingencies and which relate to the category status and responsibilities of the CCG. 10 IMPLEMENTATION, MONITORING AND REVIEW The Senior Manager Planning and Partnerships is responsible for ensuring that this document is reviewed, and, if necessary, revised in the light of legislative, guidance or organisational change. Review shall be at intervals of no greater than 6 months; this can be undertaken at team meetings. A full test of the Business Continuity Management Plan will be undertaken yearly. All senior managers will be expected to take part in these exercises. A cold debriefing session will take place following the exercise to establish if any changes need to be made as a result of the exercise. Senior managers will be asked to review their Business Continuity Management Plan at this stage and submit to Senior Manager Planning and Partnerships to co-ordinate the CCG s overall plans. Page 15 of 25

11. ASSOCIATED DOCUMENTATION This document is separate from but complementary to: 1. Emergency Planning and Resilience Policy - This policy sets the overall context of EPRR and the CCGs responsibilities in relation to EPRR including supporting Major Incidents and Business Continuity arrangements. 2. Major Incident Response Plan - The CCGs Major Incident Response Plan details the CCGs role and responsibilities in terms of major incident planning and also the role and responsibility of NHS England s Area Team Lancashire. 3. Lancashire North CCG On Call pack The CCG has developed an On-Call rota to ensure that an emergency contact is in place at all times in the event of issues within the acute provider or a major incident being declared by the Area Team. 4. Annual Resilience Plan - This plan has been developed by the Lancashire North Unscheduled Care Network and in collaboration with partners across the wider health and social care economy. This plan provides detail of the system and processes in place to ensure business continuity within the health economy at times of increased demand. This includes trigger points for escalation within the acute trust, social services input and support and the arrangements of North West Ambulance Services (NWAS). 5. Integrated Risk Management Policy and Internal Risk Management Processes - These documents detail how risks are reported and managed throughout the CCG. It links with business continuity as the identification of a significant risk may lead to the activation of business continuity arrangements. Page 16 of 25

Appendix 1 Business Continuity - Scenarios Please find below detail regarding potential scenarios and the organisations accountability in each instance. In addition, where these require CCG input further detail is provided. Any of the scenarios listed in column 1 may affect business continuity in the CCG, in commissioned providers, GP member practices, or Lancashire wide/multiple organisations. Business Continuity Issues Organisation Effected Organisational Responsibility Action Required by CCG Notifications Major accident or incident, national disaster, epidemic, terrorist attack Lancashire North CCG NHS LNCCG for local issues of limited severity CCG may be required to instigate business continuity arrangements dependent on issue Upward reporting to NHS England where necessary Fire, flood, extreme weather conditions Loss of utilities, including IT and telephone systems Commissioned provider NHS LNCCG for local issues of limited severity CCG may be required to instigate business continuity arrangements dependent on issue GP Practice NHS England Area Team Provision of support/assistance as required by NHS England Area Team Lancashire wide/multiple organisations Lancashire North CCG Commissioned provider NHS England Area Team NHS LNCCG for local issues of limited severity NHS LNCCG for local issues of limited severity Provision of support/assistance as required by NHS England Area Team CCG may be required to instigate business continuity arrangements dependent on issue CCG may be required to instigate business continuity arrangements dependent on issue GP Practice NHS England Area Team Provision of support/assistance as required by NHS England Area Team Lancashire Wide/Multiple organisations Lancashire North CCG NHS England Area Team NHS LNCCG for local issues of limited severity Provision of support/assistance as required by NHS England Area Team CCG may be required to instigate business continuity arrangements dependent on issue Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG Upward reporting to NHS England where necessary Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG Upward reporting to NHS England where necessary Page 17 of 25

Major disruption to staffing; epidemic, transport disruption, industrial action, inability to recruit; mass resignations Commissioned provider NHS LNCCG for local issues of limited severity CCG may be required to instigate business continuity arrangements dependent on issue GP Practice NHS England Area Team Provision of support/assistance as required by NHS England Area Team and ensure UHMB as provider activate their IT business continuity plan. Lancashire wide/multiple organisations Lancashire North CCG Commissioned provider NHS England Area Team NHS LNCCG for local issues of limited severity NHS LNCCG for local issues of limited severity Provision of support/assistance as required by NHS England Area Team CCG may be required to instigate business continuity arrangements dependent on issue CCG may be required to instigate business continuity arrangements dependent on issue GP Practice NHS England Area Team Provision of support/assistance as required by NHS England Area Team Lancashire wide/multiple organisations NHS England Area Team Provision of support/assistance as required by NHS England Area Team Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG Upward reporting to NHS England where necessary Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG Page 18 of 25

Appendix 2 Business Continuity Plan Template Priority for restoration of services 1. Critical: Immediate response Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to critical if not addressed within this time band. 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function. 4. Important: Within 3 days Will affect services without causing danger to patients. 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non- urgent: Within 28 days Will involve non-urgent repair Threat Loss of staff Loss of network including all software packages and telephone system Fuel shortage Loss of building either due to fire or loss of utilities- gas, electric and water Clinical or safety disaster Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Page 19 of 25

Appendix 3 Business Continuity Action Plan Priority for restoration of services 1. Critical: Immediate response Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to critical if not addressed within this time band. 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function. 4. Important: Within 3 days Will affect services without causing danger to patients. 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non- urgent: Within 28 days Will involve non-urgent repair Threat Loss of staff Loss of telephone communication Priority for restoring service 4 for critical staff 6 for noncritical staff Contingency measures required Matrix working for critical staff to share learning Deputies for each critical area Defer meeting dates for statutory meetings to endeavour to meet quorums See extra support from CSU for interim periods 3 Use of corporate mobile phones Use of email (assuming network is still operational) Actions required to restore service Formal appointment of successor. Secure extra support from CSU Contact UHMB IT department Risk if priority unable to be met Impact on ability to conduct business, progress work plans and maintain governance including reporting of performance. Impact on timeliness of communication and ability to progress some areas of work at the speed required e.g. querying invoices Page 20 of 25 Loss of email 3 Use of telephone system (assuming system is still operational as linked to network) Use of corporate mobile phones. Contact UHMB IT department Impact on ability to maintain leadership Impact on ability to conduct

Loss of internet Loss of network including all software packages and telephone system 4 for general use 3 for integrated financial system 3 2 for time critical returns e.g. annual accounts Use of postal system Use of fax Use of courier for urgent documents Other research methods. Copies of key documents to be kept on network shared drive. Use of corporate 3G ipads and mobiles for any urgent internet requirements Home working (assuming staff have access to internet at home) for urgent tasks Use of alternative NHS accommodation for urgent payment of invoices Keep and file one hard copy of all time critical returns Fuel shortage 5 Use of home working and VPN Use of alternative NHS accommodation Use of conference calling Use of corporate ipads/phones etc. Contact UHMB IT department Contact UHMB IT department business in a timely manner. Information governance risk concerning person identifiable information being sent via the postal system, Safe Haven fax arrangements to be used and registered mail to be sued. Inability to pay invoices on time Inability to receive performance report from web based packages Impact on ability to perform core business, meet statutory requirements. Impact on conduct of business and maintenance of statutory requirements Loss of building either due to fire or loss of utilities- gas, electric and water Clinical or safety disaster 1 Use of home working and VPN Use of alternative NHS accommodation Scan any critical information held in paper format only. Major incident plan to be implemented As appropriate to the threat As appropriate to threat Potential overload on alternative NHS accommodation Risk over destruction of paper records in fire. Impact on ability to deliver core business priorities Reputational risk to organisation Page 21 of 25

Appendix 4 In the event of an issue in which the Business Continuity Plan needs to be activated, or where a senior manager may need to discuss an issue with an executive lead prior to activating the Business Continuity Plan, the normal office contact details should be used. Please note that these contact details are to be used for urgent in-hours contact only. If an incident occurs out of hours which it is felt may need the urgent activation of business continuity arrangements then contact should be made with the NHS Lancashire North CCG On-Call Manager via UHMB Switchboard 01539 732288 or Blackpool Fylde and Wyre Hospitals Trust switchboard 01253 300000. Page 22 of 25

APPENDIX 5 Crisis Response Team Notes Reason for Invoking Plan: Date: Time: ---------------------------------------------------------------------------------------------------------------- Brief Summary of Situation: ---------------------------------------------------------------------------------------------------------------- Department/s Affected: ---------------------------------------------------------------------------------------------------------------- Other Organisations Involved / Alerted: ---------------------------------------------------------------------------------------------------------------- Name of note taker: Date: Page 23 of 25

Actions Required By Whom Immediate: Within 8 Working Hours: Within 1 Working Day: Within 3 Days: Within 1 Week: Situation to be reviewed every..hrs /.days Page 24 of 25

Name of note taker: Date: Page 25 of 25