Business Continuity Management Policy and Plan

Business Continuity Management Policy and Plan Version No Author Date of Update 0.3 Allan Jude and Charmaine Grundy 05/06/2015 1 P a g e

Contents Contents... 2 1. Introduction... 3 2. Purpose... 4 3. Definitions... 5 4. Role, Duties and Responsibilities... 6 4.1 Legal and Statutory duties, responsibilities and guidance... 6 4.2 Specific duties and responsibilities within the CCG... 6-7 5. Business Continuity Plans... 8 6. Initiating the Plans... 9 6.1 Causes of Service Interruption... 9 6.2 Plan Activation... 9-10 6.3 Support in Activation... 11 7. Record Keeping... 11 8. Communications... 11 9. Training Requirements... 12 10. Implementation, Monitoring and Review... 12 11. Associated Documentation... 13 Appendix 1... 14-15 Appendix 2... 16 Appendix 3... 17-18 Appendix 4... 19 Appendix 5... 20-21 2 P a g e

1. Introduction Business Continuity Management (BCM) is a statutory requirement for Blackpool Clinical Commissioning Group (CCG) to undertake. The Civil Contingencies Act 2004 and the NHS Emergency Planning Guidance 2005 requires the CCG to have a Business Continuity Management Policy (BCMP) to ensure that, in the event of a significant service interruption, critical day-to-day functions can be maintained whilst timely recovery and restoration of key services, systems and processes is also achieved. It is the policy of the CCG to take all reasonable steps to ensure that in the event of a service interruption, the organisation will be able to maintain essential services and restore normal services as soon as possible in the circumstances prevailing at the time. This Business Continuity Management (BCM) Policy aims to introduce the concept of BCM to the CCG. Alongside ensuring business continuity the CCG has to ensure emergency preparedness as a Category 2 responder. The CCG s main role will be to support Category 1 responders (main NHS providers which requires an escalation route to their commissioners and NHS England which may require support from CCGs). Details of the CCG s emergency preparedness can be found in the Emergency Planning and Resilience Policy and the Major Incident Plan. A ratified version of this document will be placed on the CCG website along with the set of EPRR documents and will be updated as required. 3 P a g e

2. Purpose This Policy sets out the general principles and corporate framework for the creation and revision of Business Continuity Management Plans relevant to the business activities of the CCG. These will be formulated in accordance with the strategic objectives for the CCG in place from time to time. This document aims to ensure that all business continuity processes carried out by the CCG are executed in an agreed and controlled manner. The business continuity management procedures described are separate from, but may operate in conjunction with, the Major Incident Response Plan in times of emergency or serious incident as per the definitions in the Major Incident Response Plan. It may also operate in conjunction with the CCG s Risk Management processes in place from time to time. In the event of service interruption, this policy sets out the framework for the CCG to: Manage and maintain the continuation of critical, core functions and services Manage the recovery and restoration of normal functions and services This policy also provides, within appendix 1, a set of scenarios highlighting the responsibilities of, and actions required by, the CCG in different eventualities. 4 P a g e

3. Definitions The following definitions apply to terms used in this policy in accordance with ISO 22301 and PAS 2015 Framework for NHS Resilience: Activity: Processes or sets of processes undertaken by the CCG, or on behalf of the CCG, that supports delivery of services. Business As Usual: Pre-defined acceptable levels of service delivery Business Continuity Management (BCM): Process to identify potential threats, assess the impact of those threats on the CCG, and building a framework to support CCG resilience to those threats, including protecting patients and stake-holders interests and achieving strategic objectives. Includes strategic and tactical capability of the CCG to plan for and respond to business interruptions in order to support continued delivery of business as usual. Critical Activities: Those activities carried out by the CCG which are most time sensitive and important for ensured continued delivery. These will be mainly those services essential for immediate life and death of patients. These activities will typically suffer if delayed by more than one hour. Disruption: Any event, planned or unplanned, which causes an interruption to the CCG s ability to continue business as usual. Essential Activities: Those activities carried out by the CCG which are sensitive and important, but not critical to life and death of patients. These activities will normally suffer if delayed by more than one day. Major Incident: An event classified as a major incident according to the CCG Major Incident Response Plan. Non-Urgent Activities: Those activities carried out by the CCG which can be postponed or delayed most easily. These activities will begin to suffer if delayed by more than one month. Routine Activities: Those activities carried out by the CCG which support business delivery on a daily basis and are not critical or essential. These activities will typically start to suffer if delayed by more than one week. Service Recovery: The process through which business as usual is reached, following an interruption or disruption event 5 P a g e

4. Role, Duties and Responsibilities 4.1 Legal and Statutory duties, responsibilities and guidance The following general (Statutory) duties apply: 1. The Civil Contingencies Act 2004 places a duty on CCGs to have business continuity plans in place to ensure that they can continue to exercise their functions in the event of an emergency so far as is reasonably practicable. The duty relates to all functions, not just their emergency response functions. CCA Definition of an emergency is as follows: An event or situation which threatens serious damage to human welfare in a place in the UK, the environment of a place in the UK, or war or terrorism which threatens serious damage to the security of the UK. 2. Healthcare Standards require the organisation to be able to continue essential routine work during an incident or emergency situation and to provide essential supplies, with documented procedures for procuring additional or alternative supplies 3. ISO 22301 gives guidance for establishing a Business Continuity Plan and Process within an organisation and this policy is written accordingly. 4.2 Specific duties and responsibilities within the CCG The following specific duties and responsibilities apply within the CCG: a) Accountable Officer (AO): The AO has overall statutory responsibility for the strategic and operational management of the CCG, including ensuring that the CCG has in place robust arrangements for business continuity management and service recovery. b) CCG Governing Body: The CCG Governing Body is responsible for setting the strategic context in which business continuity and service recovery procedures are developed, and for the formal review and approval of this Policy. The Governing Body is also responsible for determining the accepted levels of business as usual, through monitoring service delivery and approving suggested developments. Through the commissioning and contract monitoring processes, the Governing Body is responsible for gaining assurance that providers commissioned by the CCG have adequate BCM systems and processes in place to ensure service continuity. c) Director of Ambulance Commissioning: The Director of Ambulance Commissioning is responsible for Emergency Planning Resilience and Response (EPRR) a n d f o r e n s u r i n g that business continuity management plans are robust to support delivery of core business functions and to ensure these are updated as necessary. In addition the D i r e c t o r o f A m b u l a n c e C o m m i s s i o n i n g will act as the CCG s representative on the local Health Resilience Forum and be the Lancashire CCG representative on the Lancashire Emergency Planning Group. 6 P a g e

d) CCG Senior Managers (Chief Operating Officer, Chief Finance Officer and Chief Nurse) will: Ensure that their element of the BCM plan is reviewed at annual intervals and updated as necessary to maintain good quality control of document information. Notify any BCM plan revisions to the Director of Ambulance Commissioning. Support business continuity awareness and acceptance amongst staff and ensure that all of their staff are aware of their responsibilities within the BCM plan. Encourage and participate in training or exercises. e) All CCG Staff: All staff are responsible for co-operating with the implementation of this Policy and any relevant plans as part of their normal duties and responsibilities. f) Public Health B l a c k p o o l will support the CCG in regard to EPRR, including Business Continuity, by: Providing information, advice, challenge and advocacy, to promote the preparation of effective health protection arrangements Ensuring effective communication and engagement with local communities in regard to health protection Preparing for outbreaks, incidents and emergencies that present a risk to public health Working closely with Public Health England (PHE) to provide leadership of, and mobile resources for, the response to outbreaks and public health incidents and emergencies within their local authority area 7 P a g e

5. Business Continuity Plans The BCM plan will be written in accordance with the template attached to this policy (appendix 2). As the CCG is a small organisation an overarching plan will be developed that covers all work areas with exceptions for any work area highlighted. The BCM Action Plan is at appendix 3. The CCG Director leading that work area will be responsible for ensuring any exceptions relating to their work area are communicated to the Accountable Emergency Officer. The anticipated outcomes of completing the template and thus building the Business Continuity Management Plan includes: 1. Identification of critical, essential, routine and non-urgent activities of the CCG 2. Prioritising delivery of those activities in response to a disruption 3. Minimising the effects of any disruption and allowing return to business as usual as fast as possible 4. Increased staff awareness through of BCM principles and processes 5. Supporting the achievement of CCG strategic objectives and associated action plans 6. Ensuring legal compliance with planning obligations 7. Inform a response process which is flexible to meet changes in service delivery of the CCG As BCM plans are developed, the BCM policy may be adjusted as and when agreed by the CCG Governing Body to reflect the development of this strategy. 8 P a g e

6. Initiating the Plans The Business Continuity Management Plan will be initiated when any disruption to service delivery is experienced. 6.1 Causes of Service Interruption: There are many and varied possible causes of service disruption. Based on the National Risk Assessment, National Risk Register and also linked to Lancashire LRF s Community Risk Register, service continuity planning should be carried out to minimise the effects of a number of potentially disruptive events: Major accident or incident, national disaster, epidemic, terrorist attack Fire, flood, extreme weather conditions Loss of utilities, including IT and telephone systems Major disruption to staffing; epidemic, transport disruption, industrial action, inability to recruit; mass resignations (e.g. lottery syndicate). It should be borne in mind that these events may not be mutually exclusive, e.g. extreme weather leads to loss of electricity, disruption to transport, staff unable to get to work. A cause of a service disruption event may also become an internal major incident for the CCG and invoke the CCG s Major Incident Response Plan. In this event, the BCM plans should be carried out simultaneously with the response to the major incident, as far as is possible. Risks of significant service disruption will be placed on the CCGs internal risk register and action, from a risk point of view, through all appropriate channels as deemed necessary. A variety of business continuity scenarios and the responsibility of the CCG and the actions to be taken is provided for information at Appendix I. 6.2 Plan Activation The Chief Clinical Officer or Executive Director will decide whether the plan or any part of it should be activated using the process in the following flowchart. Out of hours the decision will be made by the on-call manager. Once the plan is activated the incident will be managed by the senior manager of the work area in which the incident occurred. The senior manager has responsibility for convening the Crisis Response Team to ensure that essential services are maintained and that recovery plans are put into place. The Crisis Response Team membership is at the discretion of the senior manager as each incident is different but as a minimum the team must include another senior manager, a governing body member (usually the Chief Operating Officer or Chief Finance Officer), Director of Ambulance Commissioning and a Communications Manager. Anyone called to attend the Crisis Response Team by the senior manager must attend. There are no exceptions. See appendix 4 for contact details for members of the CCG Core Team and senior managers. 9 P a g e

Records of all decisions and actions taken by the crisis response team will be made. See appendix 5 for the crisis response team notes template. Crisis Occurs (emergency plan may already be in action) Yes Consider if crisis able to be contained within usual resources No No further action at this stage Discuss crisis with CCO or COO No Activate Business Continuity Plan? Yes Set up Crisis Recovery Team Notify Affected Staff/Stakeholders/ Partner Organisations Monitor Progress (daily as a minimum) and adjust Business Continuity Plan as required 10 P a g e

6.3 Support in Activation It can be expected that the management of business continuity issues affecting the CCG will be managed during normal working hours. However, should the senior manager in charge of the response see it necessary to continue the management of the issue outside of normal office hours and where this may lead to a need for overnight accommodation for a senior member of staff who live a significant distance from base then arrangements are in place to reimburse the cost of local accommodation. The continued supply of necessary equipment to enable the CCG to maintain business as usual/business critical functions during a period of crisis will, wherever practical, be achieved through standard processes. Where this is not possible due to breakdown in current arrangements or due to the urgency of the request then the senior manager may at their discretion, use alternative methods to acquire necessary equipment through the use of CCG petty cash. In relation to continuation of the critical services of the CCG these will be prioritised and resources allocated as necessary with members of staff from within the CCG or CSU. The senior manager will have sole discretion in allocating appropriate resource including scaling up and scaling down dependent on need. 7. Record Keeping Good record keeping is paramount if the BCM plan is initiated. The senior manager leading the crisis is responsible for ensuring that accurate records are kept of all decisions and actions taken in their area of work once the BCM plan is initiated. This includes the crisis recovery team record keeping see appendix 5. All records created during the implementation of the BCM plan will be kept by the Accountable Emergency Officer. These records will be stored in line with the CCG s Record Management Policy. 8. Communications Good communication is essential at a time of crisis. A communication plan will be developed to ensure there are appropriate statements for internal and external communication and processes for ensuring communication to all CCG staff in the event of an emergency. 11 P a g e

9. Training Requirements All Governing Body members and senior managers need to be aware of the contents of this policy, and ensure that they are acquainted with the CCG s Business Continuity Plan and have access to the appropriate templates. The Director of Ambulance Commissioning will, on request, provide support, assistance and advice, including instruction in the application of the process and use of the templates to any member of the CCG. Public Health Blackpool are also available to test emergency plans and provide briefings on relevant emergency plans. 10. Implementation, Monitoring and Review The Director of Ambulance Commissioning is responsible for ensuring that this document is reviewed, and, if necessary, revised in the light of legislative, guidance or organisational change. Review shall be annually; this can be undertaken at team meetings. A full test of the Business Continuity Management Plan will be undertaken yearly. All senior managers will be expected to take part in these exercises. A cold debriefing session will take place following the exercise to establish if any changes need to be made as a result of the exercise. Senior managers will be asked to review their Business Continuity Management Plan at this stage and submit to the Accountable Emergency Officer to co-ordinate the CCG s overall plans. 12 P a g e

11. Associated Documentation This document is separate from but complementary to the following documentation which has been briefly explained below. 1. Emergency Planning and Resilience Policy This policy sets the overall context of EPRR and the CCGs responsibilities in relation to EPRR including supporting Major Incidents and Business Continuity arrangements. 2. Major Incident Response Plan The CCGs Major Incident Response Plan details the CCGs role and responsibilities in terms of major incident planning and also the role and responsibility of NHS England s Area Team Lancashire. It also provides detail regarding the CCGs on-call arrangements and their utilisation. 3. Annual Resilience Plan This plan is being developed by the B l a c k p o o l, F y l d e & W y r e Unscheduled Care Team and in collaboration with partners across the wider health and social care economy. This plan provides detail of the system and processes in place to ensure business continuity within the health economy at times of increased demand. This includes trigger pints for escalation within the acute trust, social services input and support and the arrangements of North West Ambulance Services (NWAS). 4. Integrated Risk Management Policy and Internal Risk Management Processes These documents detail how risks are reported and managed throughout the CCG. It links with business continuity as the identification of a significant risk may lead to the activation of business continuity arrangements. 13 P a g e

Appendix 1 Business Continuity - Scenarios Please find below detail regarding potential scenarios and the organisations accountable in each instance. In addition, where these require CCG input further detail is provided. Business Continuity Issue Major accident or incident, national disaster, epidemic, terrorist attack Fire, flood, extreme weather conditions 14 P a g e Organisation Affected Blackpool CCG Commissioned Provider Organisational Responsibility Blackpool CCG for local issues of limited severity Blackpool CCG for local issues of limited severity Action Required by CCG CCG may be required to instigate business continuity arrangements dependent on issue CCG may be required to instigate business continuity arrangements dependent on issue GP Practice NHS England Area Team Provision of support/assistance as required by NHS England Area Team Lancashire Wide/Multiple Organisations Blackpool CCG Commissioned Provider NHS England Area Team Blackpool CCG for local issues of limited severity Blackpool CCG for local issues of limited severity Provision of support/assistance as required by NHS England Area Team CCG may be required to instigate business continuity arrangements dependent on issue CCG may be required to instigate business continuity arrangements dependent on issue GP Practice NHS England Area Team Provision of support/assistance as required by NHS England Area Team Lancashire Wide/Multiple Organisations NHS England Area Team Provision of support/assistance as required by NHS England Area Team Notifications Upward reporting to NHS England where necessary Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG Upward reporting to NHS England where necessary Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG

Business Continuity Issue Loss of utilities, including IT and telephone systems Major disruption to staffing, epidemic, transport disruption, industrial action, inability to recruit, mass resignations Organisation Affected Blackpool CCG Commissioned Provider GP Practice Lancashire Wide/Multiple Organisations Blackpool CCG Commissioned Provider Organisational Responsibility Blackpool CCG for local issues of limited severity Blackpool CCG for local issues of limited severity NHS England Area Team with support of CCG as commissioner of IT services through CSU NHS England Area Team Blackpool CCG for local issues of limited severity Blackpool CCG for local issues of limited severity Action Required by CCG CCG may be required to instigate business continuity arrangements dependent on issue CCG may be required to instigate business continuity arrangements dependent on issue CCG to support CSU IT team and NHS England Area Team and ensuring CSU IT Business Continuity Plan is initiated Provision of support/assistance as required by NHS England Area Team CCG may be required to instigate business continuity arrangements dependent on issue CCG may be required to instigate business continuity arrangements dependent on issue GP Practice NHS England Area Team Provision of support/assistance as required by NHS England Area Team Lancashire Wide/Multiple Organisations NHS England Area Team Provision of support/assistance as required by NHS England Area Team Notifications Upward reporting to NHS England where necessary Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG Upward reporting to NHS England where necessary Upward reporting to NHS England where necessary Regular communications between NHS England Area Team and CCG Regular communications between NHS England Area Team and CCG 15 P a g e

Appendix 2 Business Continuity Plan Template Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs Threat Loss of staff Loss of telephone communication Loss of email Loss of internet Loss of network including all software packages and telephone system Fuel shortage Loss of building either due to fire or loss of utilities gas, electric and water Clinical or safety disaster Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met 16 P a g e

Appendix 3 Priority for the Restoration of Services Business Continuity Action Plan 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repairs Threat Loss of staff Priority for restoring service 4 for critical staff 6 for non critical staff Contingency measures required Matrix working for critical staff to share learning Deputies for each critical area Defer meeting dates for statutory meetings to endeavour to meet quorums Actions required to restore service Formal appointment of Successor Secure extra support from CSU Risk if priority unable to be met Impact on ability to conduct business, progress work plans and maintain governance including reporting of performance Loss of telephone communication 17 P a g e Seek extra support from CSU for interim periods 3 Use of corporate mobile phones Use of email (assuming network is still operational) Loss of email 3 Use of telephone system (assuming system is still operational as linked to network) Use of corporate mobile phones Use of postal system IT Helpdesk then contact CSU IT department IT Helpdesk then contact CSU IT department Impact on timeliness of communication and ability to progress some areas of work at the speed required eg. querying invoices Impact on ability to maintain leadership Impact on ability to conduct business in a timely manner Information governance risk

Loss of internet 4 for general use 3 for integrated financial systems Use of fax Use of courier for urgent documents Other research methods. Copies of key documents on the network. Use of corporate 3G ipads and iphones for any urgent internet requirements IT Helpdesk then contact CSU IT department concerning person identifiable information being sent via the postal system. Safe Haven fax arrangement to be used and registered mail to be used Inability to pay invoices on time Inability to receive performance report from web based packages Home working (assuming staff have access to internet at home) for urgent tasks Loss of network including all software packages and telephone system Use of alternative NHS accommodation for urgent payment of invoices 3 NA IT Helpdesk then contact CSU IT department Fuel shortage 5 Use of home working and VPN Use of alternative NHS accommodation Use of conferencing calling NA Impact on ability to performance core business, meet statutory requirements Impact on conduct of business and maintenance of statutory requirements Loss of building either due to fire or loss of utilities gas, electric and water Use of corporate ipads/iphones for Facetime 6 Use of home working and VPN Use of alternative NHS accommodation Scan any critical information held in paper format only As appropriate to the threat Possible overload on alternative NHS accommodation Risk over destruction of paper records if fire Clinical or safety disaster 1 Major incident plan to be implemented As appropriate to the threat Impact on ability to deliver core business as incident takes priority 18 P a g e

Appendix 4 Contact Details for Blackpool CCG Executive Team and Senior Managers In the event of an issue in which the Business Continuity Plan needs to be activated, or where a senior manager may need to discuss an issue with an executive lead prior to activating the Business Continuity Plan, the following contact details should be used. Please note that these contact details have been excluded from this policy and will be provided to senior managers separately and are to be used for urgent in-hours contact only. If an incident occurs out of hours which it is felt may need the urgent activation of business continuity arrangements, then contact should be made with the Blackpool CCG On-Call Manager via Blackpool BTHFT switchboard 01253 300000. 19 P a g e

Appendix 5 Crisis Response Team Notes Reason for Invoking Plan: Date: Time: Brief Summary of Situation: Department/s Affected: Other Organisations Involved / Alerted: Name of note taker: Date: 20 P a g e

Actions Required By Whom Immediate: Within 8 Working Hours: Within 1 Working Day: Within 3 Days: Within 1 Week: Situation to be reviewed every..hrs /.days Name of note taker: Date: 21 P a g e