Corporate Business Continuity Plan. Alison Whitehead, Head of Resilience. Fiona Noden, Director of Operations and Performance

Transcription

1 Trust Board Agenda Item 12. Date: Title of Report Purpose of the report and the key issues for consideration/decision Corporate Business Continuity Plan The Corporate Business Continuity Plan sets out the Trusts framework for anticipating, preparing for, preventing and responding to disruption which causes unplanned, negative deviation from the expected delivery of services. Prepared by: Name & Title Presented by: Action Required (please X) Strategic/Corporate Objective(s) supported by this paper Alison Whitehead, Head of Resilience Fiona Noden, Director of Operations and Performance Approve Adopt Receive for information Safe, effective, caring: Patients First, Team Work Is this on the Trust s risk register? No Yes If Yes, Score Which Standards apply to this report? CQC NHSLA BAF Objectives 14/15 WWL Wheel 13/14 Governance Governance As above Performance Have all implications related to this report been considered? Finance Revenue & Capital National Policy/Legislation NHS Contract Human Resources Consultation/Communication Other: EPRR national core standards If action required please state: Yes/No/NA Any Action Required Na. Na. Equality & Diversity Na. Na. Patient Experience No Governance & Risk Management Na. Na. Terms of Authorisation Na. Na. Human Rights Na. Na. Carbon Reduction Yes/ No/NA Na. Na. Na. Na. Na. Any Action Required Na. Na. No Na. Na. Na. Previous Meetings Please insert the date the paper was presented next to the relevant group ECC Audit Committee Quality & Safety Committee Finance & Investment Committee Management Board IM&T Strategy Committee HR Committee NED Other Na. Na. Na. Na. Na. Na. Na. Na. REMC 29.05

2 March 2014 Corporate Business Continuity Plan Version 1 Business Continuity Plan v1 Page 1 of 55

3 TYPE OF DOCUMENT NAME DATE DOCUMENT DEVELOPED REVIEW DATE DOCUMENT OWNER RESPONSIBLE DIRECTOR CONSULTATION INTENDED AUDIENCE Plan WWL Corporate Business Continuity Plan March 2014 v1 March 2016 (or as applicable) Alison Whitehead, Head of Resilience Director of Operations and Performance Divisional Directors of Performance Heads of Nursing Senior Managers On-call Heads of Governance Mitigation plan owners security / car park, IT,telecoms, procurement, medical equipment, Switchboard, erostering and operational estates Chief Executive All Executive / Deputy / Associate Directors Divisional Medical Directors Divisional Directors of Performance Senior Managers On-Call Heads of Nursing Head of Resilience Version number Issue Date Revisions from previous issue Date of approval by Committee 1.0 June 2014 New Plan Emergency Planning Meeting February 2014 REMC May 2014 Trust Board June 2014 If you are reading this plan for the first time, turn to Page 11 / 12, for advice on activation of this plan Action Cards are on Page 24 Business Continuity Plan v1 Page 2 of 55

4 Responding CONTENTS SECTION A: BACKGROUND INFORMATION 1 Background to the Plan 5 2 Overview of the Plan 2.1 Aim Objectives Audience Ownership Testing and Validation Exercises and Training Audit and Review Publication and Distribution Insurance Arrangements 7 3 Relationship to Other Plans 3.1 Divisional Business Continuity Plans Major Incident Plan CBRN Plan Pandemic Influenza Plan Regional and National Plans 8 4 Principles Underpinning the Plan 4.1 Prioritisation of Trust Services Risk Based Assessment Determining the Trust s Detailed Response Three Stages of Response 10 SECTION B: THE RESPONSE TO DISRUPTION 5 Response to Disruption / Plan Activation Initial Response Sources of Advice for Plan holders Roles and Responsibilities 12 6 Plan Activation 6.1 Circumstances for Activation Plan Activation - Examples Process of Activation Impact Assessment 14 7 Response 7.1 Command and Control Structure Continuity Management Team Incident Management Actions Business Continuity Actions Recovery Actions Plan Close Down Incident Debrief 19 Business Continuity Plan v1 Page 3 of 55

5 Action Cards SECTION C: APPENDICES A Incident Management Team Meeting Log 20 B Incident Debrief Agenda Template 21 C Incident Debrief Report 23 D Action Cards for: 1 Executive on Call / Chief Executive 25 Senior Manager On Call / 26 2 Incident Management Lead 3 Divisional Directors of Performance & 27 Directors of affected areas 4 Senior Managers of the affected area 29 5 Heads of Nursing / Head of Resilience 29 6 Incident Management Team 30 E Continuity Strategies and Mitigation Plans 1 Loss of equipment 32 2 Loss or failure of IT 34 3 Loss or failure of telecommunications 36 4 Loss of staff and key skills 38 (e.g. flu, weather, health and safety incidents, industrial action) 5 Loss of power 40 6 Loss of water supply 42 7 Loss of medical gas 44 8 Denial of site (e.g. lifts, corridors, entire site etc.) 46 9 Supply chain disruption 48 F Trust Wide Service Priorities - Priority Rating Information by Division 1 Division of Medicine 51 2 Division of Specialist Services 51 3 Division of Surgery 52 4 Corporate / Other 53 G References 54 Business Continuity Plan v1 Page 4 of 55

6 SECTION A 1. Background to the Plan Introduction The NHS needs to be able to plan for and respond to a wide range of incidents and emergencies that could affect health or patient care. Wrightington, Wigan & Leigh NHS Trust (WWL), as a Category 1 Responder under the Civil Contingencies Act 2004 (CCA), must be able to show that it can deal with such incidents whilst maintaining services to patients. This work is referred to as emergency preparedness, resilience and response (EPRR). Healthcare resilience is defined as the ability of an organisation to adapt and respond to disruptions, whether internal or external, to deliver organisationally agreed critical activities (PAS 2015). A disruption is an event, whether anticipated (e.g. a labour strike or hurricane) or unanticipated (e.g. a blackout or earthquake), which causes unplanned, negative deviation from the expected delivery of products or services according to an organisations objectives (BS NHS 25999). WWL must be able to maintain continuous levels in key services when faced with disruption from identified local risks such as severe weather, fuel or supply shortages or industrial action. Business continuity management provides a framework for identifying and managing risks and helps organisations anticipate, prepare for, prevent, respond to and recover from disruptions, whatever their source and whatever part of the business they affect. This Corporate Business Continuity Plan (BCP) sets out the Trust s approach to business continuity management. This revised BCP reflects national and NHS guidance 1, PAS 2015, ISO and best practice. It forms part of a suite of plans and arrangements that enable the Trust to deliver its civil protection responsibilities in respect of business continuity management and emergency preparedness. All NHS organisations must be able to maintain continuous levels of service when faced with disruption from identified local risks. Joint working arrangements between NHS organisations are essential, focusing on the best needs of patients, not performance targets of the organisation. The responsibility for business continuity management lies ultimately with the Chief Executive. At WWL, this is delegated to the Director of Operations (Accountable Emergency Officer) and The Head of Resilience is nominated to implement and maintain the business continuity management programme. 1 NHS Commissioning Board Business Continuity Management Framework (service resilience) Business Continuity Plan v1 Page 5 of 55

7 2. Aims and Objectives 2.1 Aim The aim of this BCP is to provide a coherent framework to guide the Trust s response to serious and widespread disruption affecting key services and activities. 2.2 Objectives The objectives of this BCP are, during serious and widespread disruption: To ensure the Trust can continue delivery of its key services and To support the Trust in delivering its duty of care towards employees and patients To set out an order of prioritisation for recovery of Trust services so that resources can be effectively targeted To inform planning and decision making To help guide the Trust s Executive and Management Team in their strategic coordination of the response To ensure the impact on patients, staff, the Trust and other stakeholders is managed as effectively as possible. 2.3 Audience This BCP is primarily an internal WWL document. It is intended to support the decision making of senior managers within the Trust including the Chief Executive, Executive Directors and Senior Managers 2.4 Ownership This BCP is owned by the Chief Executive, Executive Directors and Senior Managers. The Head of Resilience is responsible for updating this Plan, for version control, and for ensuring that any major revisions to its contents are agreed at the Risk and Environmental Management Committee (REMC). 2.5 Testing and Validation This BCP, published in April 2014 will be exercised within 12 months using an internal table top exercise to ensure it is valid. Thereafter, it will be exercised at least every 2 years. Local business continuity plans will be reviewed at least every year and this will be monitored by the Head of Resilience. 2.6 Exercises and Training The knowledge and skills of staff around business continuity (in line with the National Occupational Standards for Civil Contingencies) will be achieved and maintained through: An internal table top exercise will take place a minimum of every 2 years to test the validity of the Plan and the response of those key stakeholders responsible for incident management response Briefing sessions on business continuity will be given to the executive team, on-call senior manager s, and divisional management teams at least annually Business continuity will be covered on the monthly Trust induction programme A mandatory podcast around business continuity and emergency planning will be viewed by all staff every two years Business continuity advice and information is available to all staff on the intranet Business Continuity Plan v1 Page 6 of 55

8 A record of all training sessions will be maintained by the Head of Resilience and presented to the Risk and Environmental Management committee (REMC) on an annual basis. 2.7 Audit and Review This BCP will be subject to continuous review in the light of a range of factors including: Revised and new guidance and good practice e.g. that which may arise from the review of the CCA Department of Health requirements Feedback from internal and external scrutiny and review Learning from actual incidents experienced by this Trust and others Restructure and service redesign affecting critical services. Any minor revisions to this BCP will be approved by the Emergency Planning Meeting. All major revisions will be approved by the Risk and Environmental Management Committee (REMC). 2.8 Publication and Distribution This BCP and the individual Divisional level plans that support it will be made available to all staff expected to be involved in delivering the Trust s response to serious and widespread disruption. Plans will also be made available on the Business Continuity Section of the intranet. Due to the nature of its contents, it is not intended that this BCP will be disclosed if a request to do so is made under the Freedom of Information Act (FOIA). The Director of Finance and IM&T will lead on responding to FOIA requests relating to the Trust s business continuity arrangements. 2.9 Insurance Arrangements During working hours all insurance claims should be handled by the Financial Controller who can be contacted on Ext Any claim outside of working hours should be reported using the contact details held in the Resilience folder 3. Relationship to Other Plans This BCP has been developed to direct the Trust s response to serious and widespread disruption to its activities, regardless of the cause. However, depending on the type, location and duration of the incident triggering the disruption it may be necessary to also invoke one or more of the Trust s other contingency plans: 3.1 Departmental Business Continuity Plans Each department and team within the Trust carrying out critical activities is required to have a detailed Business Continuity Plan. These Plans will be used to manage disruptions and significant incidents based on recovery time objectives and timescales identified in the business impact analyses. Depending on the nature of the incident triggering this BCP to be activated, it may also be necessary to activate one or more of the Departmental Business Continuity Plans to allow more detailed and focused decision making and resulting actions. These plans are available on the Emergency Planning section of the intranet, under Local Business Continuity Plans. Business Continuity Plan v1 Page 7 of 55

9 3.2 Major Incident Plan The Trust has a Major Incident Plan which provides a framework for managing, responding, co-ordinating and controlling its resources, as defined under the Civil Contingencies Act. This includes incidents causing mass casualties such as a terrorist attack or significant road traffic accident. If responding to a major incident also causes widespread and serious disruption to normal Trust activities, then this BCP may need to be activated alongside the Major Incident Plan. 3.3 CBRN Plan The Trust has a specific plan to respond to a Chemical Biological Radiological or Nuclear incident (see the Major Incident Plan). If a CBRN incident causes widespread and serious disruption to Trust activities, then this BCP may need to be activated as well as the CBRN Plan. 3.4 Pandemic Influenza Plan The Trust has a Pandemic Influenza Plan that sets out how the additional responsibilities and actions required in a Pandemic will be delivered. However, due to the specific impacts a flu pandemic will present for the Trust, (additional responsibilities, the extended duration and extra demand for some services), the Pandemic Influenza Plan will support the arrangements set out in this BCP and vice versa. 3.5 Regional and National Plans There are some situations that, should they occur, will trigger a regional and / or national response in addition to the need to activate this BCP. One example is a fuel shortage, the impacts of which may cause serious and widespread disruption to the Trust e.g. if staff are unable to travel to work. In such a situation, the Trust would refer to this Plan to manage the internal impacts on service delivery whilst also ensuring it meets its responsibilities under the relevant regional and national arrangements. The Head of Resilience will advise of where there is a need to consider regional and national plans in addition to this BCP. 4. Principles Underpinning this BCP 4.1 Prioritisation of Trust Services (Also see Appendix G (page 52)) The Trust will endeavour to minimise the impact of serious and widespread disruption. In a serious incident where many or all services are disrupted, it would not be possible to recover them all immediately / at the same time. As the Trust delivers many services, it needs to have a system in place to prioritise recovery order and resource allocation. Ensuring there is a logical framework to the order in which services are prioritised for support and resources will contribute to reducing the negative impacts of an incident. The priority rating of a service only relates to the order of recovery in an emergency or disruption and is not a general statement on how important a service is to the Trust. Activities are categorised according to their priority for recovery. Those activities whose loss, as identified during the Business Impact Analysis (BIA), would have the greatest impact in the shortest time and which need to be recovered most rapidly may be termed critical activities. Whilst focus should be on critical activities, the Trust must recognise that other activities will also need to be recovered within their maximum tolerable period of Business Continuity Plan v1 Page 8 of 55

10 disruption. As part of the Business Impact Analysis process, all Trust services have been assessed (by relevant managers) against a set of criteria. This has resulted in all services being assigned a priority rating of 1-5, with 1 being the highest priority for recovery. The rating determines how quickly the service needs to be functioning again in the event of an incident 2 : Priority 1 the service must recovered within 1 hour or less Priority 2 the service must be recovered within 24 hours Priority 3 the service must be recovered within 3 days Priority 4 the service must be recovered within 7 days Priority 5 the service can be recovered after 7 days 4.2 Risk Based Assessment A Category 1 responder has a duty under the Civil Contingencies Act 2004 to assess the risk of an emergency occurring in relation to emergencies which affect or may affect the area in which the functions of the general Category 1 responder are exercisable 3. Risk assessments should take into account community risk registers and at the very least include worse-case scenarios for 4 : Severe weather Shortage of staff Working environment, buildings and equipment Fuel shortages Surges in activity IT and communications The Trust has a Risk Management Policy in place reflecting the risk management processes, involving the identification, evaluation and treatment of risk as part of a continuous process aimed at helping the Trust and individuals to reduce the incidence and impact of the risks they face. Risk management is therefore a fundamental part of both the operational and strategic thinking of every part of service delivery within the organisation. This includes strategic, performance, finance, reputation and operational risks. The table below highlights the nature and scope of the six most commonly occurring disruptions to services and the overall risk level they may present: No Risk / Threat Description C L Risk Rating 1 Loss of IT / telecoms 4 3 Sig 2 Shortage of staff e.g. flu, adverse weather 4 2 Mod 3 Working environment, buildings and equipment 4 2 Mod 4 Surges in activity 5 2 Mod 5 Severe weather 3 3 Mod 6 Fuel shortages 3 1 Low 7 Associated risks in the surrounding area e.g. 5 1 Low C = Consequence, rated from 1 5 where 1 = negligible and 5 = catastrophic L = Likelihood, rated from 1 5 where 1 = rare and 5 = almost certain 2 Timescales as proposed in the Department of Health s NHS Resilience and Business Continuity Management Guidance 3 Civil Contingencies Act NHS Commissioning Board Business Continuity Management Framework (service resilience) Business Continuity Plan v1 Page 9 of 55

11 Continuity strategies in relation to these most commonly occurring disruptions to service can be found in Appendix E (Page 31) Some associated risks in the surrounding area of Greater Manchester (those with a risk score of 15+) as identified in the Community Risk Register: Risk C L Risk score Biological substance release Major pollution of controlled waters Severe inland flooding Local fluvial flooding Localised extremely hazardous flash flooding Influenza type disease Exotic zoonotic notifiable disease e.g. avian influenza, rabies Technical failure of national electricity network Mass gatherings Determining the Trust s Detailed Response The purpose of this BCP is to provide a high level framework to guide the strategic management of serious and widespread disruption. It is not intended to provide specific detail of the response the Trust will take. This will be decided at the time of disruption and will change depending on factors such as the type of disruption, when it occurs, which services it affects and the likely duration. The specific details of how a service is recovered e.g. what equipment and resources are needed is contained within departmental level business continuity plans. 4.4 Three Stages of Response The Trust s response to serious and widespread disruption will be managed as three distinct but related stages. Each phase has a slightly different emphasis in terms of priorities and actions and is distinct to a particular stage in the life of an incident: Incident Management i.e. the immediate response to a disruptive incident Business Continuity i.e. the recovery and maintenance of the Trust s critical services during an incident Recovery i.e. resuming business as usual Examples of the actions likely to be taken in each stage are set out in Section 7 of this Corporate Plan Business Continuity Plan v1 Page 10 of 55

12 SECTION B The Response to Disruption / Plan Activation Business Continuity Plan v1 Page 11 of 55

13 Business Continuity Plan v1 Page 12 of 55

14 5 Initial Response 5.1 Plan Holder Actions Initial Advice When an incident happens, refer to Section B The Response to Disruption / Plan Activation (page 11). You may be: asked to collate and provide INFORMATION about how an incident or issue may or has already impacted on your services ALERTED that an issue has arisen but that your participation is not required at this time asked to ACTIVATE your Departmental Business Continuity Plan asked to PARTICIPATE in delivering a cross-trust corporate response to the incident asked to ATTEND at a designated location to participate in planning the response to the incident asked to ACTIVATE this plan and / or the Major Incident Plan You will be updated with whatever information is available BUT please bear in mind that in the early stages of a disruption, information may be scarce. Depending on the level of disruption / expected disruption, the Executive on Call, Senior Manager on Call and affected Director of Performance / Head of Service will decide on whether this plan should be placed on standby or activated. Upon notification of a disruption, follow the procedures in this BCP that apply to you and your role in managing an incident and the recovery from it. 5.2 Sources of Advice for Plan Holders If you are at all unsure how to proceed during an incident or an emergency, or you are unclear about your role in its management you can, in the following order: Contact the Bed Manager / Site Co-ordinator You can do this by dialling 0 from a Trust phone or telephoning This will put you through to the Trust Switchboard who will make contact with the Bed Manager / Site Coordinator. Contact the Senior Manager On-Call You can do this by dialling 0 from a Trust phone or telephoning This will put you through to the Trust Switchboard who will make contact with the Senior Manager On-Call Contact an Executive Director / the Chief Executive You can do this by dialling 0 from a Trust phone or telephoning This will put you through to the Trust Switchboard who will make contact with the Executive Director On- Call or Chief Executive. 5.3 Roles and Responsibilities The roles and responsibilities of the main parties involved in managing and coordinating the Trust s response to serious and widespread disruption (the Incident Management Team) are summarised in action cards and these can be found as Appendix D to this BCP. Business Continuity Plan v1 Page 13 of 55

15 Action cards are included for: Chief Executive, Executive on Call and Executive Directors Senior Manager on Call Divisional Directors of Performance / Directors of affected areas Directorate Managers of affected areas Heads of Nursing Head of Resilience Incident Management Team 6. Plan Activation The following sections detail the circumstances under which this BCP will be activated and the process used to activate it. The process of activation, including determining whether it is necessary, is the responsibility of the Senior Manager on Call and Executive On Call. There are 24 / 7 arrangements are in place to contact those on-call via Switchboard. 6.1 Circumstances for Activation of this BCP This BCP will be activated if there is Corporate Level Disruption occurring or threatened. Corporate level disruption is defined as serious and / or widespread disruption to Trust Services. Corporate level disruption will be deemed to have occurred in the event of one or more of the following occurring: Disruption cannot be dealt with through normal operational procedures or via the implementation of a single Departmental Business Continuity Plan A significant number of Priority 1 and 2 Trust services are unable to operate Special arrangements need to be implemented by the Trust in order to deal with the disruption Existing response arrangements within Departmental Business Continuity Plans are in danger of or have been overwhelmed A co-ordinated Trust-wide response is required to deal with the disruption An issue is likely to cause widespread disruption of the majority of Trust Services A major site/building accommodating multiple Trust services is evacuated Widespread sharing and reallocation of resources between Divisions and Directorates is required An initially small level of disruption has the potential to escalate into widespread disruption Prompt, co-ordinated action by the Trust could prevent minor disruption escalating into serious disruption. 6.2 Plan Activation Examples Examples of events that may have sufficient impact to cause this BCP to be activated include: Severe weather e.g. snow preventing staff from getting to work Significant reduction in staffing resources e.g. as the result of an influenza pandemic Serious disruption to the working environment, building and equipment e.g. major equipment failure, evacuation, fire, loss of a utility Fuel shortages e.g. disruption to the road fuel supply Surges in activity e.g. adverse weather, influenza pandemic Significant / prolonged loss of IT / communications e.g. telephone and bleep systems down, server failure resulting in loss of key information system Inability to use Trust buildings e.g. as a result of a serious fire Business Continuity Plan v1 Page 14 of 55

16 6.3 Process of Activation - Impact Assessment If an incident has occurred or is threatened, the Senior Manager on Call (and where appropriate, the Executive on Call) will carry out an Impact Assessment to determine the level of disruption / expected disruption. The relevant Divisional / Directorate Managers will also be involved in the Impact Assessment as appropriate. Once the Impact Assessment has been carried out, the situation will be graded at a level 1-4 depending on its impact and the required response. Where the initial Impact Assessment grades the situation as a level 3 or 4, the Senior Manager on Call will contact the Executive on Call immediately to discuss and confirm the rating. A summary of the grading outcomes is outlined below. The Assessment is designed to assess the initial impact of actual/threatened serious and widespread disruption to the Trust so that the actual/threatened situation can be assessed and the appropriate plans/arrangements activated. Consider the following factors: Impact Tick Further info e.g. particular services Loss / denial of access to Trust site part of, some of, significant areas Actual / threatened loss of utility / utilities minor, moderate, serious Unable to access key IT / comms systems individual service / department, several, significant numbers Failure of key supplier of essential services - Non-essential / less critical, disruption of key supplier intermittent / planned, disruption of key supplier actual / threatened / total Minor injuries to staff / patients, actual / threatened serious injuries to staff / patients / visitors etc. Major Incident Plan activated Other Plans / arrangements activated or likely to be activated Departmental Plan(s) already activated Local BCPs unable to meet response needed Significant number of Priority 1 and 2 services likely to fail Significant number of Priority 1 and 2 services unable to operate Incident Level Grade (circle) 1 / 2 / 3 / 4 Name of Executive On Call contacted (if Level 3 or 4) Incident Level Grade agreed with Executive On Call Yes / No Name and designation of person(s) involved in completing the assessment Date (DD/MM/YY) and time of completion Date: Time: Business Continuity Plan v1 Page 15 of 55

17 Guidance to grading an incident: Level 1 Minor incident / disruption One or more of the following apply: The incident is not serious or widespread and is unlikely to affect business operations to a significant degree No significant impact on patient safety The incident can be dealt with by relevant managers / implementation of service level BCPs One or a small number of local BCPs are implemented Actions to be taken: Senior Manager On-call to notify relevant managers that disruption should be managed by local BCPs One or more of the following apply: Level 2 Minor incident / disruption The incident is expected to be fully resolved and closed within 24 hours Limited impact on patient safety The incident can be dealt with by relevant managers / implementation of service level BCPs One or a number of local BCPs are implemented Actions to be taken: Senior Manager On-call to notify relevant managers that disruption should be managed by local BCPs Level 3 Significant incident / disruption One or more of the following apply: The incident / disruption is likely to last longer than 24 hours Significant impact on patient safety Access to systems / services for more than 24 hours A number of services are seeking to activate local BCPs and management of the incident using these does not seem viable Actions to be taken: Activate local BCPs and this BCP if necessary Senior Manager On-call to notify appropriate DDOPs and Executive On-call Senior Manager On-cal to closely monitor the situation Incident Management Team will be established if necessary and the SMOC and EXOC will determine the composition and set-up of this Team If necessary, notify the SHA via Regional Health Control ( ) Business Continuity Plan v1 Page 16 of 55

18 One or more of the following apply: Level 4 Major incident / disruption Disruption / loss of major or multi-occupancy sites Major impact on patient safety Major wide-scale incident in a geographical area affecting several services Significant disruption to business activities Local BCPs inadequate to deal with the incident Corporate BCP activated Incident Management Team required to respond Possible Major Incident Plan activation Actions to be taken: Activate Corporate BCP Senior Manager On-call and Executive On-call will establish an Incident Management Team and will determine the composition and set-up of this Team dependent on the type of incident / disruption. Notify the SHA via Regional Health Control ( ) It is important that templates are completed and all information and actions logged, particularly if following the incident an external or internal enquiry is held. Logs books are available in the Hospital Control Room, or downloadable from the Intranet (Emergency Planning section). 7. Response The response to serious and wide scale disruption cannot be planned for in exact detail. What is required will depend on the nature of the incident, when it occurs, its unique impacts etc. The composition of the Incident Management Team responsible for managing the Trust s response will also vary depending on the incident. 7.1 Response Command and Control Structure Incident Management Team The Trust s response to serious and widespread disruption will be managed by an Incident Management Team. The Incident Management Team will be based either in the Board Room, Trust HQ (access details available from the senior manager on-call), or another suitable venue depending on the nature / location of the incident. The Incident Management Team, depending on the incident may comprise of: Chief Executive / Executive Director(s) Senior Manager On-call (Incident Management Lead) Divisional Directors of Performance Directorate Managers of severely impacted / high priority Trust services Communications Lead HR Lead Risk Management Lead Finance Lead IM&T Lead Estates Lead Business Continuity Plan v1 Page 17 of 55

19 Security and Car Park Lead Legal Lead Significant supplier / stakeholders Representative from the Mental Health Trust / CCG / NHS North Up-to-date contact details can be found in the On-Call Pack (distributed to all senior managers and executives), or from the Emergency Planning Drive (\\Fas02\shr2$\RESILIENCE) The Head of Resilience will support meetings of the Incident Management Team where possible. The Executive s administrative team will provide admin support to the Incident Management Team where possible. As soon as practicable, the Incident Management Team will hold an initial meeting to discuss the following: Whether the composition of the Team is suitable or whether additional representation is required Location and frequency of future meetings Assessing the current and ongoing impact of the incident The strategy required to ensure that Trust services can continue to be delivered in accordance with the priority rating time frames Any need to suspend lower priority services in order to support continued delivery of higher priority services (referencing Service Priority Information Appendix F (Page 51) How resources will be mobilised and any financial decisions that need to be made Consider if mutual aid arrangements need to be called into use Production of an Action Plan and assigning responsibility for delivering actions Communication and liaison with key stakeholders (including the press) Record keeping and reporting requirements. All meetings of the Incident Management Team will be held at Trust HQ, Board Room unless an alternative is deemed more appropriate due to the nature / location of the incident. 7.2 Incident Management Actions Incident management actions agreed by the Incident Management Team will include, depending on the circumstances: Agreement on the location, frequency and composition of the Incident Management Team meetings Ongoing assessment of the impact of the incident and the relevance of this for incident management, business continuity and recovery Development of a Business Continuity Strategy to ensure the continued delivery of critical Trust services within agreed timescales, including the resources required Ensuring the health, safety and welfare of staff, contractors and visitors Reporting on the incident as required e.g. to the SHA, Department of Health etc and seeking their support if required Giving staff immediate instructions about what they should do Requesting the call in of additional staff as required (through departmental contact lists Business Continuity Plans) Media management Temporary suspension of lower priority services Maintaining logs e.g. for incident management, expenditure, injuries, etc. Establish how finances and unexpected spending will be covered and how this will be available to track / audit Translation and transportation services for patients Business Continuity Plan v1 Page 18 of 55

20 Liaising with the emergency services and community providers Communicating with staff, service users and other stakeholders Liaison with insurers. 7.3 Business Continuity Actions Business Continuity actions agreed by the Incident Management Team will include, depending on the circumstances: Assessing the impact of the incident and the relevance of this for business continuity and recovery Liaising with the emergency services and community providers Acquiring and allocating resources to enable delivery of the Trust s most critical services Moving of services to an alternative site e.g. neighbouring Trust to ensure continued delivery of critical activities Cancelling non urgent treatment and activities Communication with range of stakeholders including staff, customers, suppliers, wider health economy about the impact of the incident etc. Mobilising alternative resources Delivery of a reduced range of (critical) services Ensuring the longer term health, safety and welfare needs of staff Development of a strategy to ensure the recovery of critical Trust services within agreed timescales, including the resources required Contacting the Trust Insurers (Griffiths and Armour) through the Financial Controller, Finance 7.4 Recovery Actions Recovery actions agreed by the Incident Management Team will include, depending on the circumstances: Damage limitation and salvage Longer term emotional support to staff e.g. debrief, time off for extra hours worked etc. Move back to original workplace Assessing the impact of the incident s impacts in the longer term e.g. loss of income, delays to meeting targets etc. and agreeing how these will be dealt with Return to normal delivery for all services Communicating return to business as normal message to all stakeholders Managing longer term communications relating to the incident Plan closedown. 7.5 Plan Closedown The Incident Management Team is responsible for closing down this BCP at the stage it considers most appropriate. This would not normally be before they are confident that the risk of serious and widespread disruption has ended. The Incident Management Team will carry out a further Impact Assessment and, if satisfied that serious and wide scale disruption no longer exists, will formally close down this BCP. Closing down of this BCP may mean that there are no further actions required in relation to the disruption. Or, the Incident Management Team may decide that further actions are still necessary, but that these are able to be managed at a Divisional level. Business Continuity Plan v1 Page 19 of 55

21 7.6 Incident Debrief The Senior Manager On-Call (Incident Management Lead) is required to ensure that an Incident Debrief Report (Appendix B) is completed which contains information on the following: A description of the incident/threat A timeline of the incident/threat, plan activation, response and closure highlighting main actions Summary of the immediate impacts of the incident/threat Any fatalities / injuries to Trust staff, patients or other stakeholders Ability to deliver / recover the Trust s services in accordance with priority rating timescales Expenditure/ losses connected to the incident/threat Longer term impacts of the incident e.g. on reputation, income level, staff, patients, buildings, equipment etc. Success of this BCP in providing a framework to manage the disruption to the Trust Any difficulties with implementing this BCP Suggestions as to how this BCP or departmental BCPs could be improved The Debrief Report will be scrutinised by the Operational Management Team (lead by an Executive and Senior Manager) and who will ensure that any longer term actions required by the Trust to mitigate against future disruption can be taken. Other records relating to the incident must be submitted to the Head of Resilience who will hold these centrally in case they are required for any future use e.g. in an inquiry, to respond to a complaint etc. All incident debriefs, including lessons to be learned, will be made available on the intranet. Business Continuity Plan v1 Page 20 of 55

22 Appendix A: Incident Management Team Meeting Decision and Action Log Sheet of The purpose of this form is to provide a structure for and reference of decision making in incident management, business continuity and recovery phases. Keep original copy of this form (it may be required in the future e.g. in an inquiry / investigation) Date: Time: Meeting Attendees: Number Decision Taken / Action Agreed Context / reason for By Who? Action Notes decision / action Completed? Business Continuity Plan v1 Page 21 of 55

23 Appendix B: Incident Debrief Agenda TEMPLATE 1 Debrief Details Day/Date/Time: Venue: Facilitator: Include room, floor/level, building, street address and general reception contact details. Name, title, contact number Minute taker Name, title, contact number Related Emergency Event or Exercise: Exercise Debrief for <Insert exercise name> conducted on <Insert dates/times etc> <Response OR Recovery> Operation Debrief for <insert event type> at <Insert location> on <insert dates/times> 2 Event and Consequence Summary Outlined below is a brief summary of the related event: Day/Date/Time: Type of Emergency: On-call Senior Manager and Executive Incident Management Team: Support Agencies: Summary of current known consequences: May include injuries / fatalities, cost of damage or economic impact / specific infrastructure damage, environmental effects etc.: 3 Debrief Purpose & Scope The purpose of this debrief is to identify good practice and lessons to be learned in relation to: Planning and Preparedness (if applicable) Response (if applicable) Communication (if applicable) Co-ordination (if applicable) Recovery (if applicable) XXXX Debrief scope exclusions / this debrief does not relate to: XXXX XXXX Business Continuity Plan v1 Page 22 of 55

24 4 Agenda <Time> 1. Debrief welcome (Include introductions of attendees and debrief objectives) Facilitator <Time> 2. Sequence of Events Facilitator <Time> 3. What went well? Why? Facilitator <Time> 4. What did not go well? Why? Facilitator <Time> 5. Incident Management Considerations Facilitator <Time> 6. Related Issues What other matters need to be considered? <Time> 7. <ENTER OTHER DISCUSSION POINTS IF REQUIRED> TBA <Time> 8. Review record of debrief findings TBA Open Forum <Time> 9. Debrief close (Summary and thanks) Facilitator 5 Invited Attendees No. Name Position Organisation Business Continuity Plan v1 Page 23 of 55

25 Appendix C: Incident Debrief Report 1. Introduction This is a report on the Trust s management of serious and widespread disruption affecting its activities via the activation of its Corporate Business Continuity Plan. 2. Management The main staff involved in managing the response were: [Insert name and role i.e. Incident Management Team member, specialist adviser etc] 3. Description of the incident/threat 4. Timeline The incident / disruption began on [insert date] and ended on [insert date] The main actions and events involved: [insert a description of the main actions relating to plan activation, response and closure] 5. Impacts The initial impacts reported/ experienced were: [insert summary of initial impacts including: ability to deliver/recover the Trust s services in accordance with priority rating timescales, reputation, income level, staff, patients, buildings, equipment, stakeholders etc] As the situation developed, the additional following impacts were reported/ experienced: [insert summary of further impacts including: ability to deliver/recover the Trust s services in accordance with priority rating timescales, reputation, income level, staff, patients, buildings, equipment, stakeholders etc] 6. Fatalities / Injuries [Insert details of any fatalities / injuries to Trust staff, patients or other stakeholders] 7. Expenditure / Financial Losses [Insert details of any expenditure/losses] 8. Delivery of the Corporate Business Continuity Plan [Insert details on how the Corporate business Continuity Plan supported management of the disruption or where there were aspects of it that were unhelpful or where additional information would have been useful. Include good practice and lessons learned from the debrief process (planning and preparedness, response, communication, co-ordination and recovery] 9. Conclusion / Summary Information [Include any other relevant information e.g. significant risks for the Trust exposed by the incident] 10. Summary of Recommendations [Based on the lessons learned in 8, detail any actions, including implementer and time frame] Business Continuity Plan v1 Page 24 of 55

26 Action Cards Appendix D: Role / Function Role and Responsibilities Action Cards Action Card Number BUSINESS CONTINUITY INCIDENT MANAGEMENT TEAM Executive On-call / Chief Executive 1 Senior Manager On-call 2 Divisional Directors of Performance / Directors of affected areas 3 Senior Managers (of the affected areas) 4 Heads of Nursing / Head of Resilience 5 Incident Management Team 6 Business Continuity Plan v1 Page 25 of 55

27 Executive On-call / Chief Executive BCM Action Card 1 Activation Reach agreement with the Senior Manager On Call about whether this Corporate Plan should be formally activated Reach agreement with the Senior Manager On Call about who will form the Incident Management Team Ensure sufficient resources are made available to the Senior Manager On Call to proceed with setting up the Incident Management Team Ensure the activation of any other plans that are needed e.g. Major Incident Plan Arrange for / notify the SHA about the disruption and work with them to manage the impacts if appropriate. Response Lead the Incident Management Team Ensure sufficient leadership resources are available to support delivery of this Corporate Plan and any other plan activated e.g. Major Incident Plan Ensure the Trust Chair is updated on the management of the disruption. Work alongside the Communications Team to ensure information to the press, staff and public is coordinated and consistent, particularly where other partner agencies such as police, CCG etc are involved in the response. Closure Scrutinise the Incident Debrief Report Agree and identify resources to deliver improvement actions identified in the Incident Debrief Report. NB: These actions are only a guide and many decisions will have to be made on the day dependant on the incident. RECORD EVERYTHING WHO? WHAT? WHERE? WHEN? WHY? HOW? Business Continuity Plan v1 Page 26 of 55

28 BCM Action Card 2 Senior Manager On-Call / Incident Management Lead Activation Carry out an Initial Impact Assessment (Page 14) of the actual/threatened disruption in conjunction with the affected Directorate /Divisional Directors of Performance as appropriate Grade the incident to determine the response (Page 15) Reach agreement with the Executive On Call about whether this Corporate Plan should be formally activated Agree with the affected Divisional Directors of Performance as appropriate about who will form the Incident Management Team Lead on the set up of the Incident Management Team in conjunction with the affected Divisional Directors of Performance as appropriate Ensure the activation of any other plans that are needed e.g. Major Incident Plan Arrange for administrative support to the Incident Management Team Response Form part of the Incident Management Team Ensure the recovery and/or continued delivery of Trust services in accordance with their Priority rating and recovery timescales Ensure resources are managed as per the priority ratings in Appendix F Coordinate information and responses to requests for information in conjunction with Communications Team Closure Chair the Incident Management Team Debrief Ensure delivery of any improvement actions identified in the Incident Debrief Report. NB: These actions are only a guide and many decisions will have to be made on the day dependant on the incident. RECORD EVERYTHING WHO? WHAT? WHERE? WHEN? WHY? HOW? Business Continuity Plan v1 Page 27 of 55

29 Divisional Directors of Performance / Directors of affected areas BCM Action Card 3 Activation Notify appropriate managers of actual / threatened serious and widespread disruption to the Trust Discuss with appropriate managers whether to activate your Divisional Business Continuity Plan Provide information to support the Impact Assessment of the disruption carried out by the Senior Manager on Call if requested to do so Response Form part of the Incident Management Team if requested Take responsibility for coordinating resources within your area of responsibility as per your divisional business continuity plan Ensure the recovery and/or continued delivery of Trust services in accordance with their priority rating and recovery timescales Ensure resources are managed as per the priority ratings in Appendix F and as requested by the Incident Management Team Coordinate information and responses to requests for information from within your respective areas Ensure staff within your respective areas remain fully aware of the situation Liaise on a regular basis / as requested with the Incident Management Team Ensure clinical involvement and communications where applicable Ensure Directorate level response to any other plans activated is delivered e.g. Major Incident Plan. Closure Ensure delivery of any improvement actions identified in the Incident Debrief Report. NB: These actions are only a guide and many decisions will have to be made on the day dependant on the incident. RECORD EVERYTHING WHO? WHAT? WHERE? WHEN? WHY? HOW? Business Continuity Plan v1 Page 28 of 55

30 Senior Managers of the affected area BCM Action Card 4 Activation Carry out initial Impact Assessment of the actual / threatened disruption in conjunction with Senior Manager On Call Reach agreement with Senior Manager On Call as to whether a request should be made to the Exec On Call for this Corporate BCP to be activated Form part of the Incident Management Team as requested Response Form part of the Incident Management Team as requested Ensure the recovery and / or continued delivers of Trust services in accordance with their priority rating and recovery time scales Ensure that resources are managed as per the priority ratings in Appendix F Co-ordinate information and responses to requests for information from within your respective services Ensure clinical involvement and communications where necessary Closure Ensure delivery of any improvement actions identified in the Incident Debrief Report. NB: These actions are only a guide and many decisions will have to be made on the day dependant on the incident. RECORD EVERYTHING WHO? WHAT? WHERE? WHEN? WHY? HOW? Business Continuity Plan v1 Page 29 of 55

31 Heads of Nursing / Head of Resilience BCM Action Card 5 Activation When informed of a disruption notify the Senior Manager On-call Support and provide information (where possible) to support the Impact Assessment of the disruption carried out by the Senior Manager on Call. Response Support the Incident Management Team Ensure all information relating to decision making is recorded and kept in a safe place Ensure minutes of meetings are taken Ensure effective liaison between the Trust and partner agencies Closure Support completion of the Incident Debrief Report Collect and hold documentation from the incident and forward to the Head of Resilience NB: These actions are only a guide and many decisions will have to be made on the day dependant on the incident. RECORD EVERYTHING WHO? WHAT? WHERE? WHEN? WHY? HOW? Business Continuity Plan v1 Page 30 of 55