BUSINESS CONTINUITY MANAGEMENT PLAN

Transcription

1 BUSINESS CONTINUITY MANAGEMENT PLAN UNIQUE REF NUMBER: AC/XX/068/V2.0 DOCUMENT STATUS: Approved by Audit & Governance Committee 20 July 2017 DATE ISSUED: August 2017 DATE TO BE REVIEWED: August P a g e

2 AMENDMENT HISTORY VERSION DATE AMENDMENT HISTORY D1.0 02/03/2016 Initial Draft D2.0 10/03/2016 Revised after initial CCG review V1.0 17/03/2016 Final Version V2.0 24/05/2017 Full revision of plan significant changes to layout REVIEWERS This document has been reviewed by: NAME DATE TITLE/RESPONSIBILITY VERSION David Morris 02/03/2016 D1.0 Sue Johnson 10/03/2016 Deputy Chief Finance Officer D2.0 Sue Johnson 17/03/2016 Deputy Chief Finance Officer V1.0 Emma Smith 24/05/2017 Governance Support Manager V2.0 APPROVALS This document has been approved by: NAME DATE VERSION Audit Committee 17/03/2016 V1.0 Audit & Governance Committee (in principle) 20/07/2017 V2.0 N.B: the version of this policy posted on the intranet must be a PDF copy of the approved version. DOCUMENT STATUS This is a controlled document. Whilst this document may be printed, the electronic version posted on the intranet is the controlled copy. Any printed copies of the document are not controlled. RELATED DOCUMENTS These documents will provide additional information. DOCUMENTS ICT Disaster Recovery Plan Fire Evacuation plan Business Continuity Policy Health & Safety Policy Information Governance Policy Risk Management Strategy Incident Response Plan Security Policy Crisis Management Plan Communications Plan Civil Contingencies Act LOCATION Dudley ICT Service, FMC NHS Property Services BHHSCC CCG Website & Intranet CCG Website & Intranet CCG Website & Intranet CCG Website & Intranet CCG Website & Intranet CCG Website & Intranet CCG Website & Intranet CCG Website & Intranet Internet 2 P a g e

3 Contents 1.0 Purpose of the Business Continuity Plan Aim Plan Scope Plan Storage Activation and Escalation Specific Potential Risks Alternative Bases/Incident Control Room Alerting Process for Staff & External Agencies Objectives Command and Control Crisis Management Team Roles and Responsibilities Emergency Pack Communications Plan Response & Recovery Recovery from Incidents Recovery Process Leading and managing the recovery process CCG arrangements Activation of the Recovery Arrangements Handover Procedures Stand-Down Procedures Post-Business Continuity Incident Actions APPENDICS: Appendix 1 Potential Risk Checklist Appendix 2 Incident Control Room Appendix 3 Contact List for Staff and External Organisations Appendix 4 Teleconference Details Appendix 5 Role and Responsibilities Action Cards Appendix 6 Decision Log and Other Templates Appendix 7 Business Impact Analysis for CCG P a g e

4 1.0 Purpose of the Business Continuity Plan Dudley CCG s vision is: To promote good health and ensure high quality health services for the people of Dudley. Dudley CCG s policy is to develop, implement and maintain a Business Continuity Management System (BCMS) that ensures that business critical functions are available and that the CCG is able to maintain acceptable levels of service and consistency in support of our vision and goals. The CCG will take all reasonable steps to ensure that the organisation can respond appropriately and continue to deliver key processes in the event of a disruption and can continue to respond to the needs of our population. The scope of our BCMS will extend across the whole organisation and cover all our teams. All staff are expected to support and adhere to the BCMS and ensure that it becomes part of the way the CCG achieves its goals and priorities. The CCG will recognise when the BCMS needs review and updating and will work with its service provider to ensure that our business continuity policies, strategies and plans are updated on a regular basis, or when there are significant changes to the way the CCG meets its goals, or as a consequence of any deployment of the BCMS as the result of a disruption. We invite all our colleagues to embrace the business resilience methodologies we employ as we work together to improve the health and healthcare within our local communities. Paul Maubach Chief Accountable Officer Matthew Hartland Chief Operating and Finance Officer 4 P a g e

5 1.1 Aim This plan aims to define the strategic and tactical capability of Dudley CCG to plan for and respond to major business interruptions to enable Dudley CCG to continue its business prioritised activities at an acceptable predefined and agreed level. To achieve this aim Dudley CCG will adopt a system of Business Continuity Management (BCM). This system is delivered following the structures outlined and agreed in the Dudley CCG Business Continuity Policy. Business Continuity Management is seen as the process by which Dudley CCG maintain and recovers its business and operational effectiveness against risks and threats which if realised may materialise as serious business continuity incident and could ultimately escalate into a full scale Crisis or Situation. Dudley CCG will: 1) Respond to a disruptive incident (incident management) 2) Maintain delivery of critical activities/services during an incident (business continuity) 3) Return to business as usual (recovery) The following definitions apply: 1.2 Plan Scope The following business function teams are covered by this plan: Business Functions of the (organisation type) covered by this plan Function Commissioning Communications and Public Insight Continuing/Intermediate Healthcare Finance Governance IT Membership Development & Primary Care Purpose Management of CCG s commissioning responsibilities Protect organisation s reputation Ensure statutory duties to inform and report fulfilled Ensure that FoI legislation adhered to Maintain effective complaints service Ensure production of Annual Report Management of CHC process/intermediate Care Services in Dudley including patient assessments Reporting and forecasting financial data Maintaining financial processes Management of Corporate Governance and Information Governance activities for the CCG Develop and implement IT strategy Facilitate CCG IT Strategy Board Facilitate EMIS Development Board Point of contact and escalation point for day to day IT services provided by Dudley Group of Hospitals FT Facilitate Vanguard IT subgroup Management of third party infrastructure, systems and suppliers To engage and develop CCG member practices and improve the quality of services provided within primary care Business Support OD and HR Provision of administrative support to CCG teams OD - internal and external HR functions Administration and office management 5 P a g e

6 Performance & Contracting Quality & Safety Safeguarding POD Team Provide timely and accurate information and analysis for Board and senior management decision making Ensuring robust contracting arrangements with providers To ensure robust market research to inform the commissioning cycle To ensure robust research governance for all CCG research Quality and safety assurance that providers deliver good quality and safe care to the population of Dudley CCG Support and advice to CCG Lead safeguarding agenda across Dudley Provide assurance that Safeguarding Governance is appropriate Call centre which handles requests for repeat prescriptions The following sites are covered within this business continuity plan: Buildings occupied by the CCG s staff and covered within this plan Brierley Hill Health and Social Care Centre, Venture Way, Brierley Hill, DY5 1RU Tiled House, 200 Tiled House Lane, Pensnett, West Midlands, DY5 4LE 1.3 Plan Storage An electronic copy of this plan with personal information removed is stored in the CCG s publication scheme on the CCG s website under Our policies and procedures, policies and procedures relating to the conduct of business and the provision of services : A full version is stored within the CCG s intranet Hard copies of this plan are stored by the: 1. Business Support Team, Brierley Hill Health and Social Care Centre 2. Governance Team, Brierley Hill Health & Social Care Centre 3. Chief Accountable Officer (at an offsite address) 4. Chief Operating & Finance Officer (at an offsite address) 5. Deputy Chief Finance Officer (at an offsite address) 6. All Directors (at an offsite address) 1.4 Plan Review & Monitoring The plan will be reviewed annually by the Corporate Team or in the event of a major change to the CCG s objectives or activities or a deployment of the Business Continuity Plan. The plan will be reviewed annually by the Audit & Governance Committee where the outcome of the reviews of the plan will be reported by the Corporate Team. Monitoring and managing amendments and delegating or escalating actions required as a result of reviews will be the responsibility of the Corporate Team. Individual function Business Continuity Plans will be completed by the Corporate Team and signed off by Service Leads at least annually or whenever a variation is required. 6 P a g e

7 2.0 Activation and Escalation This plan covers the alerting process, activation mechanism, roles and responsibilities of the Incident Manager, Crisis Management Team, guidance relating to Command, Control and Recovery. This plan is flexible and meant to be used as generic guidance in the response to a business continuity incident/interruption. 2.1 Specific Potential Risks The response to an emergency incident does not necessarily or automatically translate into the activation of the Business Continuity Plan, Incidents may cause temporary or partial interruption of activities with limited or long term impact. It is the responsibility of the Incident Manager and Crisis Management Team to establish the appropriate level of response. A local physical risk assessment has been carried out in relation to the CCG bases and is attached in Appendix 1. Below are the potential risks that the CCG could face. Loss of staff Loss of Information Technology and Telecoms Loss of Facilities/Utilities and Buildings Flooding/Severe Weather Infectious Diseases (e.g. Pandemic Flu) Fire Fuel Shortage Industrial Action Action cards for each of these potential risks are available in Appendix 1 For the purposes of decision making in the event of a business continuity incident Dudley CCG s Chief Operating and Finance Officer has ultimate responsibility for either authorising staff to be sent home or to another location. In the absence of the Chief Operating and Finance Officer, the Chief Accountable Officer or the Chief Nurse can make the decisions for staff. The process for activation is: INCIDENT OCCURS Initially managed within a team Incident escalates to a MAJOR INCIDENT INCIDENT MANAGER contacted Incident Manager assesss situation (See tool below) Crisis Management roles allocated dependant on attendance Cirsis Mangement Team convenes at the CONTROL CENTRE Incident Manager contacts CRISIS MANAGEMENT TEAM Decision made to invoke CRISIS MANAGMENT PLAN Major incident manged using Business Continuity Plan 7 P a g e

8 The Incident Manager determines level of response using decision tree tool below: Business as Usual - Predefined acceptable levels of service delivery. Recovery This type of incident can be recoverable through routine management via local business continuity processes Crisis Management - A time of instability in which the impacts of an event(s) threatens the CCG s operations, survival or reputation. 2.2 Alternative Bases/Incident Control Room An alternative base for staff at Brierley Hill Health & Social Care has been identified as Stourbridge Health & Social Care Centre, John Corbett Drive, Stourbridge DY8 4JB which can house a maximum of 25 people and can be used on a rotational basis. This base will also be used as the Incident Control Room for the Crisis Management Team. All staff initially, will be expected to work from home via citrix. The strategy would be that all staff based at Brierley Hill Health & Social Care Centre would have an identified work base within one month of an incident either at Stourbridge Health & Social Care Centre, Tiled House, GP Practices or neighbouring CCGs. Stourbridge Health & Social Care Centre latest test was carried out on the 14 April Currently certain CCG ID Badges have been activated to enable access to Stourbridge Health & Social Care Centre, namely the identified Crisis Management Team, Business Support Team, Governance Team and the IT Team. Other ID badges will be activated as and when required. If the premises at Tiled House are inaccessible the staff will be re-located to Brierley Hill Health & Social Care Centre to hot desk or meeting rooms will be allocated as offices due to the confidential nature of their role. Therefore any meetings booked for these rooms would be affected and staff will be requested to source alternative location or re-arrange these meetings under these circumstances. Full details of the Incident Control Room are available in Appendix 2 8 P a g e

9 2.3 Alerting Process for Staff & External Agencies Dudley CCG is part of the Black Country On-Call rota which means that someone from one of the four CCGs will be covering the Black Country and would be alerted to any incident occurring within the area. The On-Call person will escalate any incident to the Accountable Officer or Chief Operating & Finance Officer who will then decide whether to activate the plan and the Crisis Management Team. The composition of this team will dependent on the type and scale of the incident and its potential impact on the organisation. Staff Operational Managers will communicate to their staff by the following methods: Business hours 9am 5pm Managers will verbally or via communicate information to staff on site or by telephone/mobile to those away from the office. Both methods will result in a follow up communication via . Out of hours The Incident Manager or their deputy will contact all of the Senior Management Team and they will then be responsible for their team members and communicate information relating to the incident/business interruption and this will be followed up by an . ** Should a senior manager be on leave and the deputy will need to be contacted. External Agencies On being alerted, the Incident Manager should liaise with appropriate external agencies as listed below: Dudley Metropolitan Borough Council (MBC) Dudley Group Foundation NHS Trust (DGFT) Dudley & Walsall Mental Health Trust (DWMHT) West Midlands Hospital Ramsey Healthcare (WMH) Full Contact Details of all Staff, External Agencies and Suppliers are available in Appendix 3 If the incident is of sufficient impact it is important that the Crisis Management Team are convened as soon as possible whether this is at the Incident Control Centre (Stourbridge Health & Social Care Centre) or a virtual meeting via teleconferencing. Details of how to initiate a telephone conference is attached in Appendix Objectives To ensure the delivery of prioritised activities during a business continuity incidents/interruption. All activities identified under this category require immediate recovery. Prioritised Activities Recovery Time Objective Team Discharging patients from acute trust 1 DAY CI013 Managing incoming telephone calls and enquiries 1 DAY CI001 Maintain supplies of key goods and services for patients 1 DAY CI003 Managing day to day IT issues, queries and requests 3 DAYS IT005 Completing patient assessments 3 DAYS CI012 Co-ordinating resolution of building maintenance issues (BHHSCC) 3 DAYS OM009 9 P a g e

10 Co-ordinating resolution of building maintenance issues (Tiled House) 3 DAYS CI009 Payment Runs for BACS, Cheques, RFT's 3 DAYS FIN015 Management of Business Continuity Arrangements 3 DAYS GOV006 Reactive press 3 DAYS CPI018 Prepare and submit Area Team Assurance pack 3 DAYS PERF003 Monthly statutory Assurance returns to Area Team 3 DAYS PERF004 Prepare and submit statutory returns 3 DAYS PERF005 Approve Invoices 3 DAYS COM016 Co-ordinating, organising and recording activities including appeals, panel meetings & SITREP/MDT Meetings Approve requests for placements - mental health, learning disability and children 3 DAYS CI002 3 DAYS COM017 Finance mandates/invoices for Providers 3 DAYS CI011 Answer complaints line 3 DAYS CPI009 Requisitioning and receiving all goods and supplies (BHHSCC) 3 DAYS OM004 Requisitioning and receiving all goods and supplies (Tiled House) 3 DAYS CI Command and Control 3.1 Crisis Management Team The suggested membership of the Crisis Management Team is: Accountable Officer Chief Operating & Finance Officer / Deputy Chief Nurse / Deputy Director of Commissioning Director of Communications & Patient Insight Director of Membership Development & Primary Care Director of Organisational Development and HR Business Continuity Lead Loggist 3.2 Roles and Responsibilities The roles and responsibility action cards are available in Appendix 5. The Crisis Management Team are to: Evaluate the extent of the situation and the potential consequence to business continence Provide Dudley CCG Executive and stakeholders with reports of the scale of impact on normal services the incident has had. Maintain a decision log based on the response to the incident Authorise the recovery procedure in order to maintain strategy prioritised activities Liaise with users and stakeholders who may be involved with the incident Order or obtain new or replacement equipment to deliver critical services if required 10 P a g e

11 Maintain a log of costs incurred to maintain the services Establish the return to normal working The role of the loggist: A debrief, inquiry or legal proceedings may occur after any incident and the recording of data and collection of information should be designed to assist in preparing the subsequent report on the actions taken by the Dudley CCG. With the Corporate Manslaughter Bill, Dudley CCG needs to ensure all decisions taken by the Crisis Management Team are accurately recorded by a Loggist. For this reason the CRISIS MANAGEMENT TEAM should ensure: Their decision/actions are recorded/ logged by the Loggist at each of the CMT meetings When mobile phones are used and decisions are not recorded, the content of the conversations should be written in the decision log where possible or alternative means of communication used to ensure these can be recorded. The completed log sheets and any original documentation should be kept securely as it may be required in any subsequent debrief or inquiry. These log books need to be retained for 10 years and then may be destroyed. All notes of meetings held by the CMT should be recorded/logged as they are being made to ensure their accuracy. Template action logs and agendas are available in Appendix Emergency Pack There are two emergency packs available one based at Stourbridge Health & Social Care Centre and one at Tiled House. The pack contains: Business Continuity Plan Business Continuity Policy & Strategy Action sheets and Stationary IT equipment and cables High Vis Jackets First Aid Kit Cordon tape Extensions leads x 5 Cable covers The following kit has been assigned and is stored in the Communications Room at Stourbridge Health & Social Care Centre: Cisco 3840 POE 48 Port Switch x 1 Brother 6180 Printer x 1 CISCO 7911 IP telephone x 2 Meraki - AP MR18 x 1 CAT 5 2M lead x 10 CAT 5 10M lead x Communications Plan During a prolonged period of Business Continuity disruption the Incident Manager in collaboration with the Director of Communications & Patient Insight will communicate with and update external partner organisations through various different appropriate methods depending on the situation. A Communications Plan and Process is held by the Communications Team and they would leave on this, 11 P a g e

12 however there is an electronic version available in the Business Continuity base folder on the shared drive. 4.0 Response & Recovery Once a Business Continuity Incident has been declared the Crisis Management Team need to devise a four phase recovery response to cover the following timescales: 4 Hours 24 Hours 48 Hours 7 Days 14 Days 1 month and longer Following an incident Dudley CCG may need to undertake a number of organisational recovery activities which may include (but may not be limited to) some or all of the following: Identifying appropriate support mechanisms which can be made available to staff and their families, recognising that staff may be affected directly by the incident through death, illness or disability Staffing and resources to address the new environment Physical reconstruction of facilities Reviewing key priorities for service provision and restoration Financial implications, remunerations and commissioning agreements Routine annual performance targets Equipment or restocking of supplies The Crisis Management Team needs to pay specific attention to the Recovery Time Objectives outlined in the Business Impact Analysis of Dudley CCG which can be found in Appendix Recovery from Incidents When should recovery planning begin? Recovery should be considered from the beginning and not left until the Response phase is over. For example as people plan to run down or cease services to create capacity to deal with the emergency, it makes sense that they should also plan how to start them up again. Recovery planning may be affected by the circumstances at the end of the emergency e.g. premises may be damaged, utilities may not function normally immediately, staff may not be able to work normally. The aftermath of the incident may also increase workload e.g. the need to monitor affected people or provide psychological support and there is likely to be a backlog of work resulting from the postponement of noncritical work. 4.2 Recovery Process The process covers the following: Preventing the escalation of the impact of the emergency i.e. restoring services as quickly as possible, prioritising those which are most important to the organisation Restoring the well-being of individuals, infrastructure etc Restoring targets, governance arrangements, financial management Considering opportunities created by the emergency e.g. for identifying and implementing improvements 12 P a g e

13 Recording information to ensure lessons learned and experiences are available for the future. The process will need to be phased in a sustainable way taking account of the needs of the workforce, who themselves may need to recover from the incident i.e. Numbers of members of staff available to return to work at any time A phasing in period to allow the resumption of normal services, depending on the residual skills and resources available Provision of psychological support to staff Recruitment at a potentially difficult time Ensuring all buildings are adequately cleaned, sanitised and otherwise made ready for the resumption of services Dealing with depleted supplies and necessary maintenance or replacement of facilities/equipment. 4.3 Leading and managing the recovery process CCG arrangements Within the CCG, recovery will be included on the agenda of the Crisis Management Team. The guiding principle will be to prioritise the re-introduction of services depending on the impact on the organisation. The re-introduction of performance targets needs to recognise that there may be a loss of skilled staff and their experience. Also people who have been working under acute pressure for prolonged periods are likely to require rest and continuing support Examples of additional issues that may need to be managed as part of the recovery process High levels of staff absence potential bereavement or exhaustion Staff anxious, confused and worried (psychological impact) Consequences of risks being taken Consequences of civil disorder e.g. vandalism to premises Consequences of disruption to daily life in some incidents education, transport, utilities etc as other organisation try to restore normality Financial consequences of pandemic Disruption of internal infrastructure, IT, facilities, cleaning 4.4 Activation of the Recovery Arrangements The Crisis Management Team will determine the time for the decision of the CCG stand down from emergency procedures. This decision will not necessarily coincide with receipt of notification of stand down by other agencies including other NHS organisations if the incident is more widespread. The Crisis Management Team will assess the impact of the incident on the CCG services and, if appropriate, use the organisation s Business Continuity plan to ensure that NHS service provision is maintained All staff that has been asked to stand by awaiting further instructions should be informed that the incident is over. Before stand down, the Incident Manager will nominate an individual to continue to monitor any ongoing issues following the incident. Following stand down the Incident Manager will arrange debriefing sessions and support for staff involved in the incident where needed. The content of the debrief will be set by the Incident Manager and the session will be facilitated by the CCG Business Continuity Lead. The Incident Manager will ensure that counselling support is available for staff throughout the incident (where possible) and afterwards. 13 P a g e

14 Following an incident the CCG management will meet to discuss how to deal with the backlog created by the incident reviewing recovery arrangements outlined in the CCG business continuity plan due to suspension of any service, and any affect it may have the CCGs ability to deliver its services and continue to meet targets. Additional staffing may be required to cover the backlog whilst operating a normal service to current service users. 4.5 Handover Procedures In a prolonged incident it may be necessary for additional members to be brought in to cover the roles of the Crisis Management Team, these are identified as deputies in Section 3 of this plan and if unavailable additional suitable senior management can be called from the Incident management support list. When the changeover staff arrives ensure that adequate time is given to the handover to ensure all actions completed thus far are communicated to the covering team. It is recommended that this is provided in the form of a briefing which includes the key issues and actions covered until this point. 4.6 Stand-Down Procedures The Incident Manager in agreement with the other members of the Crisis Management Team and appropriate operational managers and staff will decide when to stand down. After ensuring that the business continuity incident has been resolved, the Incident Manager will be responsible activating the cascade of the stand down message to all staff and agencies involved using communication cascade call trees. Prior to the stand down being agreed it is essential that all recovery issues and actions are agreed and activated to assist in the return to normal working arrangements. 4.7 Post-Business Continuity Incident Actions 1) Ensure internal debriefs are conducted as soon as possible after the incident led by the Business Continuity Manager. 2) Contribute and participate in any NHS England de-briefs if required to do so. (Take the decisions and actions log to confirm accuracy of reported actions) 3) Reports a. Complete serious untoward incident (SUI) reports if appropriate b. Obtain relevant logs/reports from staff c. Complete and submit de-brief forms d. Write a short incident report include learning points and recommendations e. Circulate lessons learned to Crisis Management Team and the Business Continuity Manager for assimilation into the revised corporate BC plan 4) Implement Recovery Plans for areas where non-critical work was suspended to redeploy staff into critical services where necessary. Operate a system to deliver the backlog of work along with current workload issues to assist in the return to normal working. 14 P a g e

15 APPENDICS: Appendix 1 Potential Risk Checklist Appendix 2 Incident Control Room Appendix 3 Contact List for Staff and External Organisations Appendix 4 Teleconference Details Appendix 5 Role and Responsibilities Action Cards Appendix 6 Decision Log and Other Templates Appendix 7 Business Impact Analysis for CCG DOCUMENT LOCATIONS: Business Continuity Base Folder J Drive/Dudley CCG/@Governance/#Corporate Governance/Business Continuity/#Business Continuity Activation Plan Safe Inventory Checklist J Drive/Dudley CCG/@Governance/#Corporate Governance/Business Continuity/#Business Continuity Activation Plan Contact Lists Electronically J Drive/Dudley CCG/@Governance/#Corporate Governance/Business Continuity/#Business Continuity Activation Plan/Contact Lists Distance Travelled to Work Analysis J Drive/Dudley CCG/@Governance/#Corporate Governance/Business Continuity/General Information Proposed Timetable for the Management of Business Continuity Process J Drive/Dudley CCG/@Governance/#Corporate Governance/Business Continuity/Training & Testing/Training Plan P a g e

16 16 P a g e

17 17 P a g e

18 APPENDIX 1 CHECKLIST MANAGING THE LOSS OF PREMISE Having been alerted, you now need to consider what actions need to be taken. Use this action card as a checklist, but keep an accurate record of messages received or given on your personal log sheet. 1) On being alerted, confirm current situation with the caller 2) Incident Manager/Loggist: Commence preparation of Incident Log Identify activities immediately affected by the disruption Review key functions at regular intervals as listed in the department/ service BIA, to ensure all critical and essential services are continuing Where there is disruption to service delivery/ functions, inform the appropriate Director 3) Incident Manager Assess key risks and the likely duration of the incident Assess damage to actual CCG assets and inform AO/COFO Identify what mitigating actions are currently in place Inform the Accountable Officer or Director On Call Work with Community Health Partnerships pre disruption to identify suitable LIFT premises from within the existing estate for occupation on an interim basis post disruption (including GP Premises) Agree alternative work arrangements/ arrange for non-prioritised staff to support the prioritised activities or take annual leave Inform all staff initiate call cascades (See appendix 3) Liaise with Communications Team to alert key stakeholders and other interested parties 4) Resources Incident Manager to liaise with Accountable Officer/ Chief Officer regarding extra resources required; i.e. staff/ equipment Incident Manager to assess damage to actual CCG assets and inform AO/CO 5) Health & Safety / Risks Ensure the health and safety of all staff is upheld at all times Implement action plan to address issues arising from Physical Risk Assessment 6) Recovering considerations and actions Consider restoration timescales for suspended activities Post Incident Debrief Prepare post incident report and document lessons learnt and policy review Communication with interested parties on return to normal 7) At the end of the incident Document all the discussions and actions and file according to Records Management Policy

19 APPENDIX 1 CHECKLIST MANAGING THE LOSS OF DATA/VOICE Having been alerted, you now need to consider what actions need to be taken. Use this action card as a checklist, but keep an accurate record of messages received or given on your personal log sheet. 1) On being alerted, confirm current situation with the caller 2) Incident Manager/Loggist: Commence preparation of Incident Log Identify activities immediately affected by the disruption Review key functions at regular intervals as listed in the department/ service BIA, to ensure all critical and essential services are continuing Where there is disruption to service delivery/ functions, inform the appropriate Director 3) Incident Manager Assess key risks and the likely duration of the incident Assess damage to actual CCG assets and inform AO/COFO Identify what mitigating actions are currently in place Inform the Accountable Officer or Director On Call Work with Community Health Partnerships pre disruption to identify suitable LIFT premises from within the existing estate for occupation on an interim basis post disruption (including GP Premises) Agree alternative work arrangements/ arrange for non-prioritised staff to support the prioritised activities or take annual leave Inform all staff initiate call cascades (See appendix 3) Liaise with Communications Team to alert key stakeholders and other interested parties 4) Resources Incident Manager to liaise with Accountable Officer/ Chief Officer regarding extra resources required; i.e. staff/ equipment Incident Manager to assess damage to actual CCG assets and inform AO/CO 5) Health & Safety / Risks Ensure the health and safety of all staff is upheld at all times Implement action plan to address issues arising from Physical Risk Assessment 6) Recovering considerations and actions Consider restoration timescales for suspended activities Post Incident Debrief Prepare post incident report and document lessons learnt and policy review Communication with interested parties on return to normal 7) At the end of the incident Document all the discussions and actions and file according to Records Management Policy

20 APPENDIX 1 CHECKLIST MANAGING THE LOSS OF STAFF Having been alerted, you now have to consider what actions are needed. Use this Action Card as a checklist, but keep an accurate record of messages received or given on your personal log sheet. 1) On being alerted, confirm current situation with the caller 2) Incident Manager/Loggist Commence preparation of Incident Log Identify activities immediately affected by the disruption To ascertain current staffing levels and identify staff available Assess current risks and actions being taken to mitigate these 3) Line Managers To ascertain current staffing levels and identify staff available Assess current risks and actions being taken to mitigate these 4) Incident Manager Identify each department s time sensitive activities at that moment Authorise for staff to work at home or at an alternative location Authorise for part time staff to work additional hours/accrue time in lieu as required Authorise annual leave if/as required Authorise overtime if/as required Authorise use of interim staff In all above, liaise with the finance department 5) Health & Safety Incident Manager to assess the potential duration of the incident and arrange for alternate staff to take over at an agreed time if incident is prolonged 6) Recovering considerations and actions Consider interim staff use until situation stabilises Consider overtime until all non-critical/ suspended activities have been fully restored 7) At the end of the incident Deliver hot debrief for the staff involved Prepare post incident report Consider if situation is short or long term, if long term, consider Contract reviews, and recruitment

21 APPENDIX 3 INCIDENT CONTROL ROOM 3 RD FLOOR - STOURBRIDGE HEALTH & SOCIAL CARE CENTRE, JOHN CORBETT DRIVE, STOURBRIDGE DY8 4JB The areas shaded out are the bookable rooms that have been allocated to Dudley CCG as part of the Business Continuity Plan. This is the 3 rd Floor of SHSCC CONTACTS: David Passey Area Property and Asset Manager, CHP T: E: D.Passey@communityhealthpartnerships.co.uk Diane Malkin Tenant Liaison Manager, CHP T: E: D.Malkin@communityhealthpartnerships.co.uk

22 APPENDIX 4 Telephone Conferencing Facility To enact the Telephone Conferencing Facility someone (preferably someone from the Business Support Team) will need to have access to a CICSO phone. The telephone conference facility should therefore be able to be carried out from someone based at Stourbridge Health & Social Care Centre, Tiled House or a GP practice. Process: 1) Notify the people involved in the call of the external number they need to dial and at what time see below 2) Put the phone on speaker 3) Press more and meet me 4) Type in the conference call set up number see below 5) You will hear a beep when people join External Number to Call Number to set up call

23 APPENDIX 5 ACTION CARD 1 INCIDENT MANAGER NOMINATED PERSONS ROLES To receive calls from On Call Director for the Black Country To conduct a further risk assessment if required To escalate the incident as appropriate Undertake the role of BC Incident Response Lead To act as spokesperson for the service at strategic meetings and for media interviews Having been alerted, you now need to consider what actions need to be taken. Use this action card as a checklist, but keep an accurate record of messages received or given on your personal log sheet. 1) On being alerted to an incident, confirm details of current situation with the notifying manager. 2) Obtain further information Ascertain steps being taken to mitigate impact Liaise with notifying manager on how best to resolve the situation Put in place plans to receive updates until incident resolves Close the log once management of the incident has been completed 3) Declare Business Continuity Incident if necessary Trigger Sheet Business Continuity Incident declared Business Continuity Incident (Standby) 4) Undertake role of Incident Manager Commence Incident Log to record all information relating to this incident 5) Alerting others request activation of call out cascade 6) Request activation of Crisis Management Team Utilise Business Continuity Plan for generic response Prepare first agenda for the Incident Management Team 7) Chair initial meeting of Incident Response Team Appoint Loggist Ensure an accurate Decisions and Actions Log is kept of meetings 8) Inform key stakeholders as appropriate 9) Activate the Recovery Incident Team 10) Acting as spokesman Work in conjunction with/ take advice from the Communication Team 11) Health & Safety Assess the potential duration of the incident and the requirement for another director to take over responsibilities at an agreed time 12) At the end of the incident

24 APPENDIX 5 ACTION CARD 2 CRISIS MANAGEMENT TEAM Having been alerted, you now need to consider what actions need to be taken. Use this action card as a checklist, but keep an accurate record of messages received or given on your personal log sheet. 1) On being alerted to an incident, confirm details of current situation with incident manager Obtain service BCP Commence Incident Log and update throughout incident 2) Communicate the details of your incident to your service/ department staff Inform staff to obtain staff Action Card Provide regular information to staff and ensure staff provide regular update to you 3) Impact assess the incident on the critical functions of your service or department Collate information with staff with regards to your department Identify steps being taken to mitigate the effects 4) Prioritise critical and essential functions within your department Review key functions at regular intervals as listed in the department/ service BIA, to ensure all critical and essential services are still running Where there is a disruption to service/ functions being delivered, inform BC Accountable Officer as directed 5) Communication Communicate with BC Accountable Officer as requested to keep them updated of how the incident develops Inform BC Lead of any resource requirements e.g. staff or equipment 6) Health & Safety Assess the potential duration of the incident and the requirement for another person to take over the responsibilities at an agreed time 7) At the end of the incident Hand the log book to the BC Accountable Lead once the incident has closed and you are no longer the manager if this is a prolonged incident Liaise with the BC Accountable Lead re attending a debriefing of incident Consider Hot debrief for your staff

25 APPENDIX 5 ACTION CARD 3 STAFF Having been alerted, you need to consider the following actions. Use this action card as a checklist. 1) On being alerted to an incident, confirm details of current situation with incident manager Obtain service BCP if required to do so by your Line Manager 2) Impact assess the incident on critical functions you perform Collate information as requested by or with your manager relating to your service or department Identify any disruption that is likely to your key functions Identify steps that are being taken to mitigate the effects 3) Prioritise critical and essential functions within your department Review and prioritise key functions to be carried out at regular intervals with agreement of your Manager as listed in the department/ service BIA, to ensure all critical and essential services continue. Where there is a disruption to service delivery / functions, inform the service lead and BC Lead as directed 4) Communication Communicate with your manager regularly or as requested and keep them updated on how the incident is affecting your key function 5) Resources Inform your manager of any additional resource requirements e.g staff or equipment 6) Record Keeping If requested to do so, obtain a log book from the Business Continuity Plan and complete as necessary Hand the log to your BC Lead/ Incident Manager once the incident has closed or you are no longer working 7) Health & Safety Assess the potential duration of the incident and the requirement for another person to take over the responsibilities at an agreed time 8) At the end of the incident Liaise with the BC Accountable Lead re attending a debriefing of incident

26 APPENDIX 5 ACTION CARD 4 LOGGIST NOMINATED PERSONS ROLES To maintain an accurate combined log of messages received by incident mangers To maintain an accurate combined log of decisions and actions taken by incident managers 1) Agree roles and immediate action with Incident Manager 2) Ensure that all managers are keeping accurate individual logs 3) Compile a combined log of messages sent and received 4) Compile a combined log of decision and actions agree by the Crisis Management Team 5) Ensure all complete logs are signed and date and that pages are numbered 6) Health & Safety In agreement with the Incident Team Manager, assess the duration of the incident and the requirement of another loggist to take over responsibilities at an agreed time, A new loggist should sign and date a new log sheet 7) At the end of the incident Hand the log book to the Business Continuity Lead/ Incident Manager once the incident has closed or you are no longer acting as a loggist Liaise with the BC Lead/ Incident Manager re attending a debrief of the incident

27 INITIAL MEETING OF THE CRISIS MANAGEMENT TEAM A G E N D A APPENDIX 6 Incident Venue / Time 1. Confirm the chair and identify who will log issues and agreed actions for the meeting. 2. Create a common understanding of the emergency and the impact on the Dudley CCG. 3. Agree and prioritise the matters for urgent decisions. 4. Agree tasks and who will lead on them. 5. Establish communication and information links with other command levels. 6. Consider the media strategy and messages to staff and other stakeholders. 7. Identify and prioritise the strategic/tactical risks. 8. Consider longer term operational issues. 9. Agree frequency of meetings if future meetings necessary 10. Agree authorisation of expenditure 11. Any Other Business. 12. Date and Time of Next Meeting Dudley CCG Business Continuity Plan

28 APPENDIX 6 INITIAL MEETING OF THE CRISIS MANAGEMENT TEAM A C T I O N L O G Date Time Decision/Action Taken By Whom Update Cost Incurred? Dudley CCG Business Continuity Plan

29 Dudley CCG Key Process Listing by Order of Recovery and Recovery Time Objective No Process Ref Process RTO Score 1 CI013 Discharging patients from actue trust 1 DAY CI001 Managing incoming telephone calls and enquiries 1 DAY CI003 Maintain supplies of key goods and services for patients 1 DAY IT005 Managing day to day IT issues, queries and requests 3 DAYS CI012 Completing patient assessments 3 DAYS OM009 Co-ordinating resolution of building maintenance issues 3 DAYS CI009 Co-ordinating resolution of building maintenance issues 3 DAYS FIN015 Payment Runs for BACS, Cheques, RFT's 3 DAYS GOV006 Management of Business Continuity Arrangements 3 DAYS CPI018 Reactive press 3 DAYS PERF003 Prepare and submit Area Team Assurance pack 3 DAYS PERF004 Monthly statutory Assurance returns to Area Team 3 DAYS PERF005 Prepare and submit statutory returns 3 DAYS COM016 Approve Invoices 3 DAYS CI002 Co-ordinating, organising and recording activities including appeals, panel meetings & SITREP/MDT Meetings 3 DAYS COM017 Approve requests for placements - mental health, learning disability and children 3 DAYS CI011 Finance mandates/invoices for Providers 3 DAYS CPI009 Answer complaints line 3 DAYS OM004 Requisitioning and receiving all goods and supplies 3 DAYS CI004 Requisitioning and receiving all goods and supplies 3 DAYS MEM001 Managing the implementation of the primary care development strategy, including leading task and finish project groups 1 WEEK GOV001 Management of Governing Body & Supporting Structures 3 DAYS FIN003 Prepare, submit and publish Annual Report and accounts 3 DAYS QUA003 Serious Incident Management for Providers and the CCG 3 DAYS CPI013 Global s - maintaining list and communicating with Groups 1 WEEK OM007 Receiving key data and information and disseminating appropriately 3 DAYS QUA008 Attendance at HCAI meetings/oph liaison 1 WEEK QUA012 Root Cause Analysis of very serious incidents (table top reviews/ 72 hour briefs) 1 WEEK FIN002 Prepare financial plans/set budgets 1 WEEK OM008 Provision of day to day secretarial services 1 WEEK CI008 Provision of day to day secretarial services 1 WEEK CI007 Receiving key data and information and disseminating appropriately 3 DAYS OM006 Managing diaries and appointments 3 DAYS CI006 Managing diaries and appointments 3 DAYS CPI001 Manage the Freedom of Information process 3 DAYS OM010 Managing the deployment of the team 1 WEEK PERF012 Data and Analytical Requests from any stakeholder including media 1 WEEK CI010 Managing the deployment of the team 1 WEEK FIN008 Order and manage cash 1 WEEK PERF007 New Contract build or Contract renewal for all Commissioned Services 1 WEEK COM005 Prepare Operational Capacity and Resilience Plan 1 WEEK FIN001 Financial reporting to NHS England, CCG Board & Committees and other statutory bodies 1 WEEK COM002 Prepare and publish Operational/Strategic Plans 1 WEEK PERF008 Preparation and collation of papers for Contract Review Meetings 1 WEEK SG012 Gain oversight of serious safeguarding incidents in provider organisations 1 WEEK PERF011 Transactional Contract enactment (variations, queries, issue of notices and monitoring and reporting) 1 WEEK OD001 Vanguard - MCP Development 1 WEEK OM002 Co-ordinating, organising and recording activities including Board and Committee meetings 1 WEEK SG003 Deliver advice and guidance to health staff across the CCG and provider organisations 1 WEEK SG011 Delivery of health overview reporting in cases of Serious Case Reviews and Domestic Homicide reviews 1 WEEK FIN009 Maintain and disburse petty cash 1 WEEK 118

30 52 CPI024 Update information messages on website 1 WEEK FIN006 Generating and inputting income and payment requests 1 WEEK CPI019 Responding to requests for Parliamentary Briefings 1 WEEK GOV002 Corporate Governance & Statutory Support 1 WEEK FIN005 Monthly monitoring and forecasting against financial and activity budgets 1 WEEK PERF009 Prepare and submit performance reports to the Collaborative Forum 1 WEEK MEM004 Managing membership development activities including the co-ordination of membership and locality meetings 1 WEEK QUA006 Preparation for and attendance at Announced and Unannounced visits 1 WEEK OM001 Managing incoming telephone calls and enquiries 1 WEEK QUA002 Preparing and reporting to Quality and Safety Committee 1 WEEK GOV005 Management of IG Arrangements incl Services from CSU 1 WEEK COM004 Contribute to the development of the Joint Strategic Needs Assessment 1 WEEK MEM006 Primary Care Contracts Management Process 1 WEEK PERF010 Coordinate Contract negotiations with Providers 1 WEEK FIN007 Monitor, progress and authorise requisitions, orders and non POs 1 WEEK CPI011 Proactive press releases 1 WEEK PERF001 Performance reporting to Finance and Performance Committee and Board 1 WEEK FIN013 Maintain key financial controls and authorised signatory lists 1 WEEK CPI008 Manage the complaints process 1 WEEK COM003 Ensure appropriate consultation takes place in relation to the development of plans 1 WEEK COM007 Agree contracts with service providers 1 WEEK PERF006 Ad-hoc analysis supporting other CCG functions 1 WEEK MEM005 Manage relationships and co-ordinate activities of member practices 1 MONTH COM008 Develop business cases to support developments for approval by Clinical Development Committee 1 WEEK COM015 Report on Individual Funding Requests 1 WEEK SG001 Reporting to Quality and Safety Committee 1 WEEK SG002 Delivering safeguarding supervision 1 WEEK CPI021 Writing the Annual report 1 WEEK COM006 Develop CQUINs, KPIs and service specifications for inclusion in contracts 1 WEEK OD010 Planning and implementing the process of enabling change management, responsiveness and resilience building 1 WEEK GOV004 Management of Corporate Records & Documents incl Publication Scheme 1 WEEK SG007 Preparation and undertaking of audit of safeguarding and Looked After Children arrangements across the borough 1 WEEK CPI022 Update social media 1 WEEK FIN014 Financial governance including liaison with auditors 1 WEEK CPI016 Posters/design work 1 WEEK HR003 Advise variations to payroll provider 1 WEEK GOV003 Management of Corporate & Operational Risk 1 WEEK OD011 Planning and implementing talent management initiatives 1 WEEK FIN004 Prepare and submit statutory returns 1 WEEK SG005 Managing escalation process when professional disagreements occur 1 WEEK CI005 benchmarking activity reports 1 WEEK CPI002 Duty to involve patients and public in commissioning decisions 1 WEEK SG010 Development of safeguarding processes/pathways and policies 1 WEEK QUA011 Attend Primary Care Group / Locality Meetings 1 MONTH CPI005 Patient and Public Engagement Forums (POP, HCF and PPG) 1 WEEK QUA016 Updating Quality and Safety risk register 1 WEEK MEM002 Preparing and presenting reports to the primary care commissioning committee 1 MONTH MEM003 Preparing and presenting reports from the primary care commissioning committee to the Board 1 MONTH PERF002 Internal daily reporting of Provider and CCG performance 1 MONTH HR004 Recording staff absence 1 WEEK FIN011 Enter journals for accounting corrections and accruals 1 WEEK CPI010 Writing and distributing the members newsletter 1 MONTH QUA004 Provide advice and guidance to governance team at DGFT & other providers 1 WEEK OD007 Succession planning 1 WEEK SG004 Preparation of CCG safeguarding reports 1 WEEK 69