BUSINESS CONTINUITY PLANNING

Transcription

1 BUSINESS CONTINUITY PLANNING May

2 Version Version 1 Ratified By Date Ratified April 2013 Author(s) Responsible Committee / Officers Senior Management Team Date Issue April 2013 Review Date April 2016 Intended Audience Impact Assessed All clinical commissioning group staff Yes May

3 Further information about this document: Document name Category of Document in The Policy Schedule Author(s) Contact(s) for further information about this document This document should be read in conjunction with Published by Copies of this document are available from Corporate Clare Dooley Head of Corporate Governance Website: Copyright All Rights Reserved Version Control: Version History: Version Number Reviewing Committee / Officer 1.0 April 2013 July 2014 May 2015 Date May

4 This document can be made available in a range of alternative formats including various languages, large print, Braille and audio cassette. To discuss your requirements please ring May

5 May

6 INDEX Description Page Index 6 Template 1 - Plan Version Control 7 Background 8 Purpose of Business Continuity Plan 8 Roles and Responsibilities 8 Complimentary Links 9 Service/ Clinical Commissioning Group Business Continuity Plans 9 ICT Disaster Recovery Plan 10 Property Disaster Recovery Plan 10 Template 2 Form A - Assessment of Service Core Activities 11 Form B - Business Impact Analysis 12 Form C - Risk Analysis 13 Form D - Prevention Measures 14 Appendix A - Classification of severity of a business continuity disruption 17 Appendix B - Risk Analysis process and risk matrix 18 Appendix C - Key business Continuity personnel contacts directory 20 Appendix D - Key resources and contractor contacts directory 21 Appendix E Priority ICT programmes to be restored 23 May

7 Plan Version Control and Review Template 1 Organisation Address Clinical Commissioning Group NHS West Cheshire Clinical Commissioning Group 1829 Building Countess of Chester Health Park Liverpool Road Chester CH2 1HJ NHS West Cheshire Clinical Commissioning Group Confirmation of completion Emergency Planning Service Business Continuity Plan Responsible Person (Corporate) Head of Corporate Governance Date April 2013 Responsible Person (Service/CCG) Date April 2013 Chief Executive Officer Confirmation of approval of Emergency Planning Service Business Continuity Plan Proposed to NHS West Cheshire Clinical Commissioning Group Governing Body 18 th April 2013 May

8 Background NHS WEST CHESHIRE CLINICAL COMMISSIONING GROUP BUSINESS CONTINUITY PLANNING 1. Under the Civil Contingencies Act Clinical Commissioning Groups have a duty to put in place Business Continuity Management arrangements. Local experiences of recent years which have required organisations to invoke Business Continuity Plans have included flood, fire, disruptions to electrical supply, communication failures and the fuel crisis. Other potential occurrences that also need to be considered when preparing Business Continuity Plans include the risk of Flu Pandemic and severe weather. 2. Significant events likely to cause serious interruption of the continuity of the Clinical Commissioning Group s business warrant the activation of the NHS Commissioning Board Area Team Major Incident Plan. Minor business interruptions occur on a daily basis and are dealt with using regular and familiar systems and resources, such as general repair and maintenance contracts or routine management intervention. Purpose of the Business Continuity Plan 3. The creation and maintenance of the Clinical Commissioning Group s Business Continuity Plan ensures that there is a clear, workable plan for prompt action in the face of events that have the potential to compromise the normal expectations of services and delivery of objectives. 4. The Business Continuity Plan will compliment Major Incident Plans but extends beyond it. It addresses potentially serious disruptions in the services provided by the Clinical Commissioning Group that may not necessarily be of sufficiently high risk to trigger the Major Incident Plan. 5. It coordinates a planned response to an event whose impact could not be handled within routine service arrangements and would require the implementation of special planning procedures by the Clinical Commissioning Group alone to respond to it. Roles and Responsibilities 6. The Clinical Commissioning Group Chief Officer has overall responsibility for ensuring that the Clinical Commissioning Group has Business Continuity Management arrangements in place, in line with the requirements as outlined in the Civil Contingencies Act for Category One Responders. 7. A senior manager should be identified to act as Business Continuity Manager with the responsibility to prepare the Clinical Commissioning Group s business continuity May

9 planning. For West Cheshire Clinical Commissioning Group this is the Corporate Affairs Manager. 8. The Clinical Commissioning Group is responsible for developing, maintaining, communicating and operating their own service level procedures to mitigate the impact of any incident affecting the normal delivery of their services. 9. A serious or major business continuity disruption would be reported via established Clinical Commissioning Group on-call procedures and managed through organisational frameworks. Complimentary Links 10. The development of the Clinical Commissioning Group s Business Continuity Plan will compliment and link with the following: Major Incident Plan Pandemic Flu Business Continuity Plan Winter Plan On Call arrangements / manual Service/Clinical Commissioning Group Business Continuity Plans 11. The Clinical Commissioning Group is responsible for developing arrangements that includes contingency plans and a task list for the recovery process to assure the Governing Body of its resilience in the face of potential interruptions. 12. The Clinical Commissioning Group s arrangements must ensure that they have identified and agreed any support and services required from other parties this information must be easily accessible and distributed to all personnel who have a specific part to play in a recovery. 13. The Clinical Commissioning Group may decide the most appropriate format for their business continuity planning. The templates and appendices provided within this paper detail s business continuity arrangements: Template 1 Plan version control (page 2) Template 2 Form A - Assessment of Core Activities (page 8) Form B - Business Impact Analysis (page 9) Form C - Risk Analysis (page 10) Form D - Prevention Measures (pages 11 13) Appendix A Classification of severity of a business continuity disruption Appendix B Risk analysis process and risk matrix Appendix C Key business continuity personnel contacts directory May

10 Appendix D Key resources and contractors contacts directory Appendix E ICT programmes to be restored as a priority ICT Disaster Recovery Plan 14. In relation to any incident or situation resulting in a loss of IT, Cheshire ICT Services will develop an ICT Disaster Recovery Plan. The Clinical Commissioning Group Business Continuity Plan will identify those IT programmes on which its service is dependent to deliver its core activities. Property Disaster Recovery Plan 26. In relation to any incident or situation resulting in denial of access to premises, the NHS Commissioning Board Area Team will develop a Property Disaster Recovery Plan. The Clinical Commissioning Group Business Continuity Plan will identify the type and location of any alternative premises they may confidently have access to. If there are no reasonable alternatives the Property Disaster Recovery Plan may be implemented. May

11 BUSINESS CONTINUITY PLANNING ASSESSMENT OF SERVICE CORE ACTIVITIES FORM A Core Activity Is the Service a Statutory or Regulatory Requirement? Resources required Accommodation required Commissioning of healthcare services (including Joint Commissioning) GP Locality Support Practice Member Services Financial Management Performance Management Contract Management Quality Improvement Patient and Public Engagement Programme/Project Delivery Transformational Change/Delivery N/A Staffing; IT; Premises; Budget Local and national ICT networks & support Local and national infrastructure/utilities Standard Office Space Essential equipment required Telephones (1829 Building network) PCs/laptops/iPads and ancillary equipment. Printer/Fax Essential ICT Programmes How would you communicate with your staff? Have you suggestions for alternative accommodation? Can any of your staff work from home, have you considered implications? Microsoft Office 2010 Packages including outlook ( and Calendar systems) Telephony By Mobile Phone; Landline; Any other suitable office space in the Clinical Commissioning Group Cluster Western Cheshire area Yes the majority of staff can work from home given the nature of the functions performed. Other comments May

12 BUSINESS CONTINUITY PLANNING BUSINESS IMPACT ANALYSIS FORM B List in order of priority the Clinical Commissioning Group 3 main functions and the implications in the long and short term if they were disrupted. Where possible identify any significant cost implications. Priority Service Impact / Implications (e.g. stakeholders / vulnerable groups) 1, to be restored within 0-24 hours 2, to be restored within 3 days 3, to be restored within 14 days or more Contract Management Clinical Leadership Performance Management Inability to respond to significant incidents, never events and other contractual breaches. Inability to respond to the requirements of our clinical leaders. Inability to take corrective action on any performance deficits. May

13 BUSINESS CONTINUITY PLANNING RISK ANALYSIS AGAINST 4 RISK SCENARIOS PLEASE REFER TO RISK ANALYSIS PROCESS APPENDIX B FORM C CORE ACTIVITIES DAMAGE/DENIAL OF ACCESS TO PREMISES LOSS/DAMAGE TO IT SYSTEMS - DATA NON AVAILABILITY OF KEY STAFF LOSS / DAMAGE TO OTHER RESOURCES Priority Restored within 0 24 hours Risk Assessment Risk Assessment Risk Assessment Risk Assessment 1 Contract Management Priority Restored within 3 days Risk Assessment Risk Assessment Risk Assessment Risk Assessment 2 Clinical Leadership Priority Restored within 14 days or more Risk Assessment Risk Assessment Risk Assessment Risk Assessment 3 Performance Management May

14 BUSINESS CONTINUITY PLANNING PREVENTION MEASURES FORM D Core Activity PRIORITY 1 restored within 0 24 hours Contract Management Risk Analysis Score Prevention Measures Damage/Denial of access to premises:- Loss/Damage to ICT systems/data:- Ensure we have remote access to key systems and data/documents. Non availability of key staff Ensure cross cover arrangements are in place and robust. Loss/damage to other resources May

15 Form D Core Activity PRIORITY 2 - restored within 3 days Clinical Leadership Risk Analysis Score Prevention Measures Damage/Denial of access to premises:- Loss/Damage to ICT systems/data:- Ensuring contact database for clinical leaders is up to date and shared across Senior Management team. Non availability of key staff Ensure cross cover arrangements are in place and robust. Loss/damage to other resources May

16 Form D Core Activity Priority 3 restored within 14 days Performance Management Risk Analysis Score Prevention Measures Damage/Denial of access to premises:- Loss/Damage to ICT systems/data:- Ensure key performance information is up to date and available to access remotely and ensure key contacts are up to date and available to access remotely (CCG pocket action cards). Non availability of key staff Loss/damage to other resources May

17 APPENDIX A CLASSIFICATION OF SEVERITY OF A BUSINESS CONTIINUITY DISRUPTION A risk assessment based approach helps us to understand each of the risks faced, set them in priority order, act on them accordingly and evaluate their progress in achieving optimum preparedness. In terms of grading the classifications of risk severity the following categories are applied. GREEN Low risk Low priority Manage situation by routine procedures AMBER Medium risk Medium priority Management responsibility and action must be specified RED (including any catastrophic event) High risk High priority Immediate action Senior Management attention required. Senior Management to consider informing the Board. Risks graded Red must be discussed with the responsible, or on-call director in case this should activate the Clinical Commissioning Group s Major Incident Plan. Any incidents graded Red would need to be reported via the Clinical Commissioning Group Incident Reporting system. Risks graded Amber should be considered in the Service / Clinical Commissioning Group Business Continuity Plan. Any incidents graded Amber would also need to be reported via the Clinical Commissioning Group Cluster Incident Reporting system. Risks graded Green would not need to be included in the Service/Clinical Commissioning Group Business Continuity Plan. May

18 APPENDIX B BUSINESS CONTINUITY PLANNING THE RISK ANALYSIS PROCESS In Business Continuity Management there are FOUR risk scenarios that require assessment: Damage or denial of access to premises e.g. industrial action / fire / flooding/siege Loss or damage to IT systems / voice networks / hardware / software / data e.g. power supplies / virus Non-availability of key staff e.g. pandemic flu, industrial action, transport issues Loss or damage to other resources e.g. fuel/power The level of risk for each of these scenarios is a function of the LIKELIHOOD that an adverse event will occur, and the SEVERITY on stakeholders if the event actually occurs. RISK = Likelihood (L) x Severity (S) e.g. (L 1 x S 2 = 2), (L 2 X S 2 = 4), ( L 3 x S 3 = 9) Score 1-2 Score 3-4 Score 6-9 SEE RISK MATRIX BELOW May

19 APPENDIX B The Risk Matrix RISK CRITERIA FOR LIKELIHOOD / PROBABILITY FACTOR SCORE THREATS DESCRIPTION Very likely 3 More than 75% ` chance of occurrence Likely 2 40% - 74% chance of occurrence Unlikely 1 0% - 40% chance of occurrence INDICATORS Regular occurrence Circumstances frequently encountered daily / weekly / monthly Likely to happen at some point within the next 1-2 years Circumstances occasionally encountered (few times a year) Only likely to happen no more than once in 3 years RISK CRITERIA FOR SEVERITY/IMPACT FACTOR SCORE INDICATORS Major 0 24 hrs Serious 24 hrs-3 days Minor 3-14 days or more 3 Complete loss of Core Activity which could lead to fatalities, vulnerable people being without essential services. 2 Complete loss of Core Activity, no loss of life, which could lead to the immediate 0-24 hr response being unsupported (e.g. staff welfare). 1 Complete loss of Core Activity, non life threatening, but if not resumed within timescale impacts on partner agencies businesses, e.g. payment of invoices, effect on non crucial areas (e.g. policy). LIKELIHOOD Very Likely Likely Unlikely SEVERITY Minor Serious Major May

20 APPENDIX C KEY BUSINESS CONTINUITY PERSONNEL - CONTACTS DIRECTORY Name Job Title Service Business Continuity Role Office Tel Mobile Tel Alison Lee Chief Officer CCG Lead Officer Clare Dooley Corporate Affairs CCG Business Continuity Administration Manager Lead Gareth James Chief Finance CCG Head of Service/ Line Manager to Officer Staff Rob Nolan Head of CCG Head of Service/ Line Manager to Contracting and Performance Staff Laura Marsh Head of Delivery CCG Head of Service/ Line Manager to Staff Helen McCairn Head of Joint CCG Head of Service/ Line Manager to Commissioning Staff Paula Wedd Head of Quality CCG Head of Service/ Line Manager to and Safeguarding Staff Dr Huw Charles- Chair CCG Chair of CCG Jones Dr Andy McAlavey Medical Director CCG Clinical Leadership May

21 APPENDIX D KEY RESOURCES AND CONTRACTORS - CONTACTS DIRECTORY Resource Resource Provider Hours/Days of Business Telephone Fax Emergency Contact Tel CWW Area Team On Call Staff Cheshire NHS Gold Commander CWW Commissioning Support Services NHS Cheshire, Warrington and Wirral 24 HR (backup ) as for the Regional Health Control Desk then ask for the Cheshire Area Team s first on call manager 24 HR ask for Cheshire NHS Gold Commander Neighbouring CCG Neighbouring CCG South Cheshire Clinical Commissioning Group Vale Royal Clinical Commissioning Group 24HR HR Neighbouring CCG Wirral Clinical Commissioning Group 24 HR ext 1011 (in hours) (out of hours) ask for the CCG on call manager Acute Hospital Provider Countess of Chester Hospital NHS Foundation Trust 24 HR ask for 1) CoCH On-call manager or 2) Director on-call Acute Hospital Provider Wirral Teaching Hospital NHS Foundation Trust 24 HR ask for Director/Manager on-call Acute Hospital Provider Mid Cheshire Hospitals NHS Foundation Trust 24 HR ask for 1) senior manager on-call or 2) Director on-call May

22 APPENDIX D KEY RESOURCES AND CONTRACTORS - CONTACTS DIRECTORY Resource Resource Provider Hours/Days of Business Telephone Fax Emergency Contact Tel Mental Health Provider Cheshire and Wirral Partnership NHS Foundation Trust 24 HR (in hours) (out of hours) ask for CWP Director on 0n-call Community Services NHS Community Care Western Cheshire 24 HR (in hours) (out of hours) ask for CWP 3 rd tier on-call Director GP Out of Hours GP Out of Hours 24 HR Admin Team OOH Number Urgent Care Centre Partners for Health (John Hodgson / Linda Gorst) Estates CWP Estates Team 24 HR (in hours) (out of hours) ask for Estate Manager on-call Ambulance Services North West Ambulance Service NHS Trust 24 HR ask for Duty Control Manager Strategic Health Authority NHS North 24 HR (in hours) (out of hours) Local Authority Cheshire West and Chester Council (Civil Protection Unit) 24 HR May

23 APPENDIX E ICT PROGRMMES TO BE RESTORED AS A PRIORITY Priority Application Resource Provider Hours/Days of Office Tel Fax Emergency Business Contact Tel Telephony Cheshire ICT Monday to Friday Microsoft Office Suite Cheshire ICT 8:30 am to 5pm except BH Remote Access Cheshire ICT 8:30 am to 5pm except BH May