BUSINESS CONTINUITY PLAN

BUSINESS CONTINUITY PLAN Additional copies of this Plan can be found in the Incident Control Room located in the office next to the Boardroom, second floor, Charter House. East and North Hertfordshire Clinical Commissioning Group Page 1 of 43

DOCUMENT CONTROL SHEET Document Owner: Director of Operations Document Author(s): EPRR Lead Version: 5.0 FINAL Directorate: Operations Approved By: Governing Body Date of Approval: 15 January 2015 Date of Review: 15 January 2016 Change History: Version Date Reviewer(s) Revision Description 1.0 July 2013 Valarie Penn Updated following JW comments 2.0 August 2013 Valarie Penn General update following Draft Business Impact Assessments 3.0 October 2013 John Webster Whole Document Review Updates to Plan, Business Impact Assessments and Policy Statement in line with EPRR Core Standards 4.0 November 2013 Valarie Penn Updated following Exec Comments 4.1 January 2015 Oskan Edwardson Annual Update for approval 5.0 January 2015 Jas Dosanjh Formatting Implementation Plan: Development and Consultation Dissemination EPRR Consultant Executive Team Staff can access this policy via the intranet and will be notified of new/revised versions via the staff briefing. This policy will be included in CCG Publication Scheme in compliance with the Freedom of Information Act 2000. Training The emergency and business continuity response arrangements within the plan will be ineffective if the staff expected to implement them at the time are unaware of them. Therefore all staff will be made aware of the plan at their corporate induction training and mandatory risk training, and will also be made aware of where the overarching and departmental plans can be located. If there are any significant changes to the plan, then this will be communicated to departmental leads to cascade to all staff. Business Continuity arrangements w i l l be exercised at least once a year in order to validate the effectiveness and highlight any gaps which can then be corrected. East and North Hertfordshire Clinical Commissioning Group Page 2 of 43

Monitoring and Review This document will be reviewed on an annual basis or when there are changes in the working systems of the organisation; or major changes to the contact arrangements of staff or suppliers that affect the content. The date of the review will be recorded on the front of the document. It is the responsibility of the identified departmental leads to update local departmental plans on an ongoing basis and the Emergency Planning Manager to ensure the generic section of this document is kept update Equality and Diversity Associated CCG Documents January 2015 - Equality Impact Assessment (Appendix 5) January 2015 - Privacy Impact Assessment (Appendix 6) The following documents must be read in conjunction with this policy: Major Incident Plan System Escalation Plan Major Incident Action Cards CCG Risk Register/Risk Management Dashboard References The ISO Standard for Business Continuity (ISO 22301) British Standard NHS Business Continuity Management (BS25999) East and North Hertfordshire Clinical Commissioning Group Page 3 of 43

Contents Section No. Section Name Page No. 1.0 Introduction 5 2.0 Scope 6 3.0 Purpose 7 4.0 Definitions 7 5.0 Role and Responsibilities 8 6.0 Plan Activation 8 6.1 Business Continuity Management Team (Crisis and Recovery Team) 9 6.2 Continuing Services in the Event of a Disruption 9 6.3 Failure of IT Systems 10 6.4 Failure of Telecommunications 11 6.5 Failure of Utilities Electricity / Gas / Water Supplies 11 6.6 Loss of CCG Buildings 12 6.7 Fuel Shortages 12 6.8 Staff Shortages 12 6.9 Communications 12 Appendix 1 Business Continuity Management CCG Policy Statement 13 Appendix 2 Business Recovery Template 14 Appendix 3 Key Contacts List 16 Appendix 4 Business Impact Assessments 17 Appendix 5 Equality Impact Assessment 42 Appendix 6 Privacy Impact Assessment 43 East and North Hertfordshire Clinical Commissioning Group Page 4 of 43

1.0 Introduction The Civil Contingencies Act 2004 came into force in November 2005 and focuses on local arrangements for civil protection, establishing a statutory framework of roles and responsibilities for local responders (such as CCGs) as Category 2 Responders. It is a requirement of the Act that the CCGs have Business Continuity Plans in place to support the CCG s Major Incident Plan. 1.1 Policy statement It is the policy of East & North Hertfordshire Clinical Commissioning Group (CCG) to develop, implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy. It is the policy of the CCG to take all reasonable steps to ensure that in the event of a service interruption, the organisation will be able to respond appropriately and continue to deliver its essential functions and that we are able to respond to the needs of our local population. A service interruption is defined as: Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions. (www.cabinetoffice.gov.uk/ukresilience). The CCGs Policy Statement is provided at Appendix 1. 1.2 Resources The CCG recognises its obligations with regards to emergency planning, resilience, responding to major incidents and business continuity. Funds, as identified as being necessary, will be made available in the event of a major incident to ensure the CCG meets its obligations with respect to these. 1.3 Emergency Planning - Business Continuity The Cabinet Office s Expectations and Indicators of Good Practice Set for Category 1 and 2 Responders describes seven expectations regarding the Civil Contingencies Act (2004), Regulations (2005) and guidance: 1. Duty to assess risk 2. Duty to maintain plans Emergency Plan 3. Duty to maintain plans Business Continuity 4. Duty to communicate with the public 5. Business Continuity Promotion 6. Information sharing 7. Cooperation Clinical Commissioning Groups are Category 2 Responders and as such will be required to co-operate with Category 1 Responders in the event of an emergency. They are also required to have Business Continuity Plans and Major Incident Plans. These requirements will be achieved in three stages: East and North Hertfordshire Clinical Commissioning Group Page 5 of 43

Stage 1 A Business Impact Assessment: The impacts of the loss of staff, communications, data systems, transport and buildings. Appendix 2 provides details of the Business Impact Assessments undertaken at Departmental level within the CCG. Some functions are hosted by or delivered through contracts with other organisations (e.g. PropCo Ltd). These assessments are also provided at Appendix 2 Stage 2 - A Business Continuity Plan: The measures to be taken internally in the event of such a loss. The Business Continuity Plan will comprise the mitigating actions arising from the Impact Assessments, the key contacts that will instigate the relevant mitigating actions and the contact details of all staff that might have to undertake those actions - be it communicating with others or changing their way of working. Stage 3 A Major Incident Plan: The measures to be taken in support of Category 1 responders in the event of an Emergency. This details the organisation s response to: an event or situation which threatens serious damage to human welfare; an event or situation which threatens serious damage to the environment; War, or terrorism, which threatens serious damage to the security of the UK. The CCG is required to equip nominated staff with the Major Incident Plan, the Business Continuity Plan, an incident control centre, an emergency telephone line and a list of all relevant telephone and email contacts. The plans have been built on experience and will be subject to a desktop test, as part of best practice, in order that they are further refined. The result of the desktop testing will be reported to the CCG Governing Body. 2.0 Scope The scope of this plan is to provide overarching organisational guidance of business continuity management and the invocation process within the CCG, and an outline of responsibilities. The following table indicates the links with other CCG and System Resilience Plans: Document Community Risk Register LRF Flood Plan LRF Pandemic Influenza Plan LRF Severe Weather Plan The CCG is a Level 2 responder for Emergency Preparedness Resilience and Response which will be led by the Hertfordshire and South Midlands Area Team. These plans will be owned by the Local Resilience Forum with input from the Local Health resilience Partnership. However, the CCG will have a role in planning for and responding to the relevant incident. East and North Hertfordshire Clinical Commissioning Group Page 6 of 43

3.0 Purpose The purpose of the Business Continuity Plan is to outline the responsibility of the CCG and their staff in the event of a crisis in order to maintain as normal a service as practically possible. The over-riding aim is to ensure a prompt and efficient recovery of critical activities from any incident or physical disaster that may affect the CCG s ability to operate and deliver their commissioning service in support of the NHS economy. It must be recognised that any event not only impacts on staff, premises, technology and operations, but also on the CCG s brand, status, relationships and reputation and that all business continuity arrangements should ensure that the CCGs meet their legal, statutory and regulatory obligations to both their staff and dependent stakeholders. 4.0 Definitions 4.1 Business Continuity Management is the process that helps manage the risks to the smooth running of the organisation in the delivery of its services, ensuring that essential business can continue in the event of a disruption and can be sustained in the event of an emergency. It is aimed at reducing or eliminating the risks of business interruption and it is necessary to have contingency plans in place to ensure normal business functions can be resumed as soon as possible. 4.2 A Service Interruption can be defined as Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions For the NHS, Business Continuity Management is defined as the management process that enables an NHS organisation: To identify those key services which, if interrupted for any reason, would have the greatest impact upon the community, the health economy and the organisation. To identify and reduce the risks and threats to the continuation of these key services. To develop plans which enable the organisation to recover and/or maintain core services in the shortest possible time. There are many and varied possible causes of service disruption; these may range from the loss of infrastructure e.g. offices; buildings; IT systems; managing a power cut or extreme weather to arranging service provision during an emergency or epidemic. These events may not be mutually exclusive i.e. extreme weather can lead to loss of electricity or staff being unable to get to work. 5.0 Roles and Responsibilities Overall accountability for the smooth running of the organisation lies with the CCG s Accountable Officer. The Director of Operations is the lead Director for Business Continuity and will be responsible for providing positive assurance to the Governing Body on the CCG s plans. 5.1 Executive Directors are responsible for maintaining their individual services, and for alerting the need to activate Business Continuity Plans if such an event occurs within their directorate. East and North Hertfordshire Clinical Commissioning Group Page 7 of 43

5.2 Designated Associate Directors and Assistant Directors must ensure that any changes of contact details of key staff noted in their plans are updated as required, that their Directorate plans are reviewed at least annually and that any new services that are developed are included in the plans. 5.3 The Head of Emergency Preparedness, Response and Business Continuity [joint role with the Head of Risk Management] will provide specialist guidance during the invocation of any part of the Business Continuity Plans and will assist in coordinating any actions required. 5.4 The Communications Team will be responsible for informing the public of events where necessary, following agreement of the Accountable Officer or Director of Operations (designated deputy), and will also keep staff informed of developments as appropriate. 5.5 All CCG employed staff are responsible for co-operating with the implementation of the Business Continuity Plans as part of their normal duties and responsibilities. 6.0 Plan activation A nominated post holder from each department will decide in discussion with the Heads of Department and the Director of Operations whether the plan or any part of it should be activated using the process in the following flow chart. Out of hours the decision will be made with the direction of the on call CCG director/manager East and North Hertfordshire Clinical Commissioning Group Page 8 of 43

6.1 Business Continuity Management Team (Crisis and Recovery Team) A team will be convened t o oversee the process of ensuring essential services are maintained and that recovery plans are put into place, Membership may include the following: Director of Operations or nominated Deputy Associate Director where incident has occurred Lead for Emergency Preparedness, Response & Business Continuity Communications Manager Estates representation (as required) Any other personnel deemed necessary, i.e. representative of HR, specialist advice, etc. The team will meet initially on a daily basis and will keep notes of the meeting, actions taken, resources committed, and progress made using the template a t Appendix 3. Incident Control Centre location and resources: located in the Office next to the Boardroom, Second Floor, Charter House, WGC. Includes additional paper copies of this Plan. 6.2 Continuing Services in the event of a Disruption As part of the Business Impact Assessment process, a critical function analysis has been carried out to determine those parts of the service that are a priority to maintain or reinstate. The CCG is responsible for commissioning a wide range of patient services to the local population and the following will be restored and maintained as soon as is practically possible. Maintaining an emergency response and support to Category 1 responders; Incident investigation; Mobilisation of the workforce, and support for staff safety and welfare; Provision of IT (through a shared service (called Herts Beds and Luton ICT Shared Service) with ENHCCG as the host for this service); Maintaining communications with the general public and CCG staff; Essential Finance functions; including the making and receiving of payments; Essential HR processes; Safeguarding adults and children; and Continuity of contract management responsibilities. The critical function analysis also identifies those functions that are less critical and could be suspended. Service Function Financial management Planning services - preparing commissioning plans Commissioning services through pathway development and redesign Contract management acute contracts Contract management community and third sector Length of time function can be suspended for 7 days 28 days 28 days 14 days 14 days East and North Hertfordshire Clinical Commissioning Group Page 9 of 43

Performance and data analysis Governance duties to ensure continuous compliance with statutory duties Partnership working to ensure joined up working to improve the health and wellbeing of patients Support and guidance to member practices Quality and safety Administration 14 days 14 days 14 days 14 days 14 days 14 days If an incident occurs and this plan is activated, permission will be sought from the Accountable Officer, or in their absence the Director of Operations (or nominated Deputy) to suspend the mainstream service functions detailed above and release the CCG staff who cover these functions to provide support to critical functions provided in other areas of the CCG. Each department has identified its own critical functions that are required to maintain its service and have their own local departmental plans which a r e accessible in both paper copy and electronically. It is the responsibility of designated Associate/Assistant Directors to communicate the location of these plans to their staff. In the event of an emergency, or business interruption, the CCG will endeavor to maintain services as usual or as close to the usual standard as possible. However, where it is clear that this is not achievable, the Head of Service in conjunction with the Director of Operations ( or on-call Director/Manager if out of hours) will decide which priority functions of the department must continue, depending on the nature of the business interruption. There are some generic areas that could potentially affect all departments and these are described below: 6.3 Failure of IT systems The CCG, like many organisations, rely upon IT systems for their day to day business. A disaster that prevents the organisation from accessing these systems whether caused by the failure of the systems themselves, or being due to an incident such as fire or flooding will potentially have a serious impact on the continuation of the CCG s functions. While it is impossible to consider and document a recovery plan for every disaster that may occur the impact of the loss of IT systems to each department is covered in the individual departmental plans and it is expected that they can be adapted to cater for any specific incident. If there is a failure in the IT system or any standalone computer for important data for a prolonged period of time, staff will need to change to a paper back-up system where possible to capture the data so that this can be recorded on the system retrospectively. The development of telecommunications that are reliant upon the IT network makes it likely that telephone failure will also result from any IT network failure. The priority in which restoration is required will depend on the service area and is detailed in individual departmental plans. East and North Hertfordshire Clinical Commissioning Group Page 10 of 43

If there is a loss of hardware or software through theft or damage then advice should be sought from the IT provider and the incident reported to the CCG s Risk team (via the Associate Director of Governance). The maintenance of the CCG IT systems is provided by the Herts Beds and Luton ICT Shared Service (HBL ICT) under a Service Level Agreement (SLA). Under the terms of this SLA HBL ICT will invoke their Emergency Disaster and Recovery Plan to cope with any event causing prolonged interruption of service. 6.4 Failure of Telecommunications The telephone lines are provided under contract with BT, and the system is under a maintenance contract with Vodafone. MTPASS SIM cards have been requested for the on-call phone and those of the Emergency Planning Officer and the on-call Directors and managers. This will provide resilience in terms of key staff needing to respond to potential incidents covered by this plan. Each departmental plan identifies in more detail the actions required should the telephone systems be inactive. The priority in which restoration of phone lines are required will depend on the service area and if crucial will be detailed in individual departmental plans. CCG contact in the first instance: HBLICT Service Desk on 07748 111561* Note this number is only activated if the Phone System is down at Charter House If electricity has failed then prior consideration needs to be given to the ability to recharge mobile phone batteries. 6.5 Failure of Utilities Electricity / Gas / Water Supplies Resolution is via NHS Property Services The fault should be reported and a request made as to whether they are able to give an indication of the length of time the supply will be unavailable. If heating is lost an assessment should be made to the effect of the loss of the heating related to the time of year and the forecast temperature as to whether services can continue from the affected location. For plumbing emergencies: contact NHS Property Services CCG contact in the first instance: NHS Property Services In the event that the water supply fails the impact of the following must be assessed: Toilets Hand hygiene Drinking water East and North Hertfordshire Clinical Commissioning Group Page 11 of 43

6.6 Loss of CCG Building If premises are unable to be used then services may need to be suspended or relocated. Local departmental plans will detail who to contact and measures to be taken. The Lead for Emergency Preparedness, Response & Business Continuity will assist in finding alternative accommodation should CCG buildings be affected. Alternative locations for staff will include HCT HQ at Howard Court, HPFT HQ at Waverley Road, St Albans and HVCCG HQ at Hemel Hempstead. Initiation of these arrangements will be agreed by the Director of Operations (or nominated Deputy) or by agreement with the on-call Director/Manager. 6.7 Fuel Shortages In the event of a fuel shortage the ability to maintain services may be affected. If it has been necessary for the invocation of the National Fuel Plan then the Business Continuity Management Team will be convened to oversee the management of the situation within the CCG It is unlikely there will be provision of fuel for staff to get to their work base and the responsibility for alternative travel arrangements is with the individual members of staff in discussion with their line manager. 6.8 Staff Shortages The absence of staff will have a varying effect depending on their role. In some cases roles can be covered by other staff but others may be highly specialised and necessary arrangements will be detailed in departmental plans as to whether a service can continue particularly if the service depends on that person alone. There may be a scenario when a number of staff are all incapacitated at the same time such as pandemic influenza. The departmental manager will be responsible for assessing the impact on the ability to continue to provide a service and what contingencies can be put in place, and whether some non- critical services can be cancelled as detailed in the individual departmental plans. 6.9 Communication If an event occurs that is so severe that alternative arrangements for the provision of care commissioned by the CCGs need to be communicated to the local population, this will be carried out via the Communications Manager after discussion with the Director of Operations. East and North Hertfordshire Clinical Commissioning Group Page 12 of 43

Appendix 1 Business Continuity Management Policy Statement Business Continuity Management (BCM) is an important part of NHS East & North Hertfordshire CCG s risk management arrangements. The Civil Contingencies Act (CCA) 2004 1 identifies all CCGs as Category 2 Responders, and imposes a statutory requirement on each CCG to have robust BCM arrangements in place to manage disruptions to the delivery of services. It is the policy of NHS East & North Hertfordshire CCG to develop implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy. The aim of Business Continuity Management is to prepare for any disruption to the continuity of the business, whether directly - i.e. within the responsibility control or influence of the business, or indirectly - i.e. due to a major incident occurring to a partner, supplier, dependent or third party, or from a natural disaster. It is recognised that plans to recover from any disruption must consider the impacts not only to our staff, premises, technology and operations, but that NHS East & North Hertfordshire CCG must also plan to maintain its brand, status, relationships and reputation. Business Continuity arrangements should ensure that the CCG continues to meet i t s legal, statutory and regulatory obligations to its staff and to its dependent stakeholders. All NHS East & North Hertfordshire CCG departments are to continue to develop and implement BCM for their areas of business. In order for this to be achieved, members of each department have been nominated as Business Continuity Leads to represent their part of the business for Business Continuity Management. These individuals are responsible for reviewing and maintaining the departmental Business Continuity arrangements within the CCG. To ensure that the BCMS fully meets the changing needs of the business all Business Continuity Plans will be exercised, reviewed and audited annually. In accordance with the NHS E n g l a n d Guidance 2, NHS East & North Hertfordshire CCG BCMS will be in accordance with and aligned to the ISO 22301 3. Lesley Watts Accountable Officer Date 1 NM Government (2004) Civil Contingencies Act 2 NHS England (2013) Board Business Continuity Framework 3 ISO 22301 Societal Security - Business Continuity Management Systems Requirements East and North Hertfordshire Clinical Commissioning Group Page 13 of 43

Appendix 2 Business Recovery Template Reason for Invoking Plan: Date: Time: Brief Summary of Situation: Department/s Affected: Other Organisations Involved / Alerted: Date: East and North Hertfordshire Clinical Commissioning Group Page 14 of 43

Actions Required (including Resources) By Whom Immediate: Within 8 Working Hours: Within 1 Working Day: Within 3 Days: Within 1 Week: Situation to be reviewed every..hrs /.days East and North Hertfordshire Clinical Commissioning Group Page 15 of 43

Appendix 3 Key CCG Contacts On Call Member Role Email Work Mobile Work Number 1 CHRIS BADGER Assistant Director of Health Integration, ENHCCG & Hertfordshire County Council Chris.Badger@hertfordhsire.gov.uk 07976 306 255 01992 556 300 2 DENISE BOARDMAN Interim Director of Commissioning, ENHCCG Denise.Boardman@enhertsccg.nhs.uk 07887 982 757 01707 369 620 3 JACQUI BUNCE Associate Director of Strategy, ENHCCG Jacqui.Bunce@enhertsccg.nhs.uk 07796 175 964 01707 369 712 4 JO BURLINGHAM Assistant Director of Commissioning, ENHCCG Jo.Burlingham@enhertsccg.nhs.uk 07765 576 571 01707 367 279 5 NOREEN COLES Assistant Director of Finance, ENHCCG Noreen.Coles@enhertsccg.nhs.uk 07889 235 910 01707 369 468 6 HELEN EDMONDSON AD of Locality Commissioning, ENHCCG Helen.Edmondson@enhertsccg.nhs.uk 07825 681 121 01707 367 224 7 SHARN ELTON Director of Operations, ENHCCG Sharn.Elton@enhertsccg.nhs.uk 07825 048 839 01707 367 278 8 SARAH FEAL Company Secretary, ENHCCG Sarah.Feal@enhertsccg.nhs.uk 07920 765 395 01707 369 655 9 BEVERLEY FLOWERS Director of Strategic Partnerships, ENHCCG Beverley.Flowers@enhertsccg.nhs.uk 07918 368 383 01707 367 217 10 JAMES GLEED Associate Director Commissioning Primary Care ENHCCG James.Gleed@enhertsccg.nhs.uk 07917 085 057 01707 369496 11 EDWARD JAMES AD Financial Services, ENHCCG Edward.James@enhertsccg.nhs.uk 07799895242 01707369495 12 ALAN POND Chief Finance Officer, ENHCCG Alan.Pond@enhertsccg.nhs.uk 07899 062 426 01707 369 478 13 SHEILAGH REAVEY Director of Nursing & Quality, ENHCCG Sheilagh.Reavey@enhertsccg.nhs.uk 07920 234 124 01707 369 773 14 CATH SLATER Assistant Director of Quality and Patient Safety, ENHCCG Cath.Slater@enhertsccg.nhs.uk 07769 927 942 01707 367 268 15 LESLEY WATTS Accountable Officer, ENHCCG Lesley.Watts@enhertsccg.nhs.uk 07554 330 375 01707 369 613 East and North Hertfordshire Clinical Commissioning Group Page 16 of 43

Appendix 4 Business Impact Assessments East and North Hertfordshire Clinical Commissioning Group Version: Ratified by: Governing Body Date ratified: January 2015 Job title of originator/author: Director of Operations Name of responsible committee/individual: Accountable Officer Date issued: January 2015 Review date: January 2016 Target audience: All CCG staff East and North Hertfordshire Clinical Commissioning Group Page 17 of 43

The Business Impact Assessments Section 1: Critical Functions of the Governing Body Members 1.1 Governing Body 1.2 Accountable Officer Section 2: Critical Functions of Directorates 2.1 Finance [including ICT] 2.1.2 HBL ICT Shared Service 2.2 Commissioning 2.3 Nursing and Quality 2.4 Strategic Planning 2.4.1 Continuing Healthcare 2.4.2 Medicines Management 2.5 Operations [detail of BIA to follow when directorate is fully formed] East and North Hertfordshire Clinical Commissioning Group Page 18 of 43

SECTION 1 Critical Functions of the CCG Governing Body Members To provide leadership (including clinical leadership) in their individual/specialist areas To undertake statutory roles and duties (SIRO, Caldicott Guardian, Safeguarding, Data Protection Officer) To attend meetings of the CCG Governing Body and the Committees of which they are members To ensure that the Governing Body meets its duties Section 1.1 East and North Hertfordshire CCG Governing Body Key Contacts: Hari Pathmanathan - Chair Lesley Watts - Accountable Officer Alan Pond - Finance Director (SIRO) Sharn Elton - Director of Operations (EPRR responsibilities) Denise Boardman - Interim Director of Commissioning Sheilagh Reavey - Director of Nursing and Quality (Caldicott Guardian) Beverley Flowers - Director of Strategic Partnerships Minimum Levels of Service that need to be maintained a. Performance of statutory duties within set timescales / 3 days b. Availability of clinical leadership within 24 hours c. Ongoing governance of the organisation within 5 working days d. Scheduled meetings of the Governing Body and key committees to the prescribed frequency Contingency Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 19 of 43

Threat Priority for restoring service Contingency measures required Loss of staff 3 a/b) Deputies for each statutory and clinical lead role. Secure external support where necessary. 4 c/d) Defer meeting dates. Endeavour to meet quorums at meetings. Chair s action subject to ratification. Loss of telephone communica 3 a-d) Use of email instead (using email contact list for all GB members and corporate staff). Loss of email 3 a-d) Use of telephone and postal or despatch systems (using telephone and address contact lists for all GB members). Actions required to restore service Formal appointment of successors if loss persists. Contact ICT helpdesk Contact ICT helpdesk Risk if priority unable to be met Impact on stability of clinical/statutory leadership. Impact upon ability to conduct business, progress work plans and maintain governance / assurance. Impact on ability to maintain stability of clinical/statutory leadership. Impact on ability to maintain clinical/statutory leadership. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Loss of Internet Loss of Microsoft Loss of access to stored documents (servers) 4 a-d) Other research methods. Copies of key documents stored in Microsoft Office format. 3 a-d) Copies of key documents stored in.pdf format. 4 a-d) Copies of key documents stored on alternate servers, battle box and on intranet, emergency encrypted memory stick Contact ICT helpdesk Contact ICT helpdesk Contact ICT helpdesk or Head of Governance for hardcopies and emergency encrypted memory stick Loss of 6 Hot desk working will apply N/A if at HQ N/A individual Fuel Shortage 5 d) Use of telephone conferencing. N/A Impact on conduct of business on the work plans and maintenance of governance Loss of 6 c-d) Use of alternate NHS accommodation and VPN for home working. 6 c-d) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Hemel One (HVCCG) HQ Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ Possible overload on alternate NHS accommodation. East and North Hertfordshire Clinical Commissioning Group Page 20 of 43

Section 1.2 East and North Hertfordshire CCG Accountable Officer (AO) To undertake the statutory roles and the duties of the post Key Contacts: Hari Pathmanathan - Chair Lesley Watts - Accountable Officer Alan Pond - Finance Director (SIRO) Sharn Elton - Director of Operations (EPRR responsibilities) Denise Boardman - Interim Director of Commissioning Sheilagh Reavey - Director of Nursing and Quality (Caldicott Guardian) Beverley Flowers - Director of Strategic Partnerships Minimum Levels of Service that need to be maintained: a. Statutory roles (Health and Safety, Employment Rights, Occupiers Liability) b. Strategic Leadership c. Governance regarding decision making d. Outward facing role ( front of house ) e. Delivery of and progress against objectives Contingency: Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 21 of 43

Threat Priority for restoring service Contingency measures required Loss of staff 2 a-e) Succession planning of deputies for each statutory and lead role of the AO. Secure external support where necessary. Loss of 3 a-e) Use of email instead (using email telephone contact list for all GB members and communication corporate staff). Loss of email 3 a-e) Use of telephone and postal or systems (using telephone and address contact lists for all GB members and corporate staff). Loss of Internet 4 a-e) Other research methods. Copies of key documents stored in Microsoft Office format. Loss of Microsoft Office Loss of access to stored Loss of individual 3 a-e) Copies of key documents stored in.pdf format. 4 a-e) copies of key documents stored on alternate servers and on intranet N/A Fuel Shortage 5 a-e) Use of Virtual Private Networking for staff with laptops. Use of video conferencing and telephone conferencing. Loss of a-e) Use of alternate NHS accommodation 6 and VPN for home working. 6 a-e) Use of alternate NHS accommodation and VPN for home working. Actions required to restore service Formal appointment of successor if loss persists. Contact HBLICT Service Desk during core hours* Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year. 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays Contact HBLICT Service Desk during core hours* Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays Contact HBLICT Service Desk during core hours* Contact HBLICT Service Desk during core hours* Contact HBLICT Service Desk during core hours* N/A As appropriate to the threat Hemel One (HVCCG) HQ Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ Risk if priority unable to be met Impact on workloads of other Governing Body Members and risk of objectives not being achieved. Impact on ability to manage the CCG and risk of objectives not being achieved. Impact on ability to manage the CCG and risk of objectives not being achieved. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Registered Mail will be used. Impact on ability to manage the CCG and risk of objectives not being achieved. Possible overload on alternate accommodation. East and North Hertfordshire Clinical Commissioning Group Page 22 of 43

SECTION 2 Critical Functions of the Directorates Section 2.1 Critical Functions of the Finance Director To develop the financial strategy for the organisation To ensure sound financial management across the organisation To provide financial governance across the organisation To undertake the statutory roles and duties including: Bribery Act, Public Contracts and Public Procurement To oversee the ICT service Key Contacts: Alan Pond - Chief Finance Officer (and SIRO) Noreen Coles - Deputy Chief Finance Officer Eddie James - Assistant Director Financial Services Neil Hales - Assistant Director of Contracts Minimum Levels of Service that need to be maintained: a. Access to Invoicing and Payments system within 3 days (including contract payments & pay of CCG staff) b. Monitoring financial position within 3 days (within 1 day if within first week of month) c. Monitoring bank accounts within 3 days Contingency: Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 23 of 43

Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of staff 3 a-c) Deputies for each statutory and lead role of the Finance Director.(FD) a-c) Secure external support where necessary. Loss of telephone communication Formal appointment of successor if loss persists. 3 a-c) Use of email instead Contact HBLICT Service Desk during core hours* Impact on workloads of FD and finance teams and risk of financial objectives not being achieved. Impact on ability monitor financial position. Loss of email 3 a-c) Use of telephone and postal or systems (using telephone and address contact lists internal and external). Loss of Internet 4 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays Contact HBLICT Service Desk during core hours* Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays Contact HBLICT Service Desk during core hours* Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays Impact on ability to manage the CCG with risk of statutory requirements not being met and other financial objectives not being achieved. Loss of Microsoft Office 3 a-c) Copies of key documents stored in.pdf format. Contact HBLICT Service Desk East and North Hertfordshire Clinical Commissioning Group Page 24 of 43

Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of access to stored documents (servers) 3 a-c) copies of key documents stored on alternate servers and on intranet. Contact HBLICT Service Desk during core hours* Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays Loss of individual 3 a) Contingent process for invoice payment IT systems (cheque system). 4 4 b-c) Contingent process for financial and account monitoring. a) Manual invoicing process. Fuel Shortage 5 b-c) Use of Virtual Private Networking for staff with laptops. b-c) Use of conferencing. Contact relevant service provider Contact relevant service provider Contact relevant service provider N/A Impact on ability pay other organisations with risk of service disruption. Impact on ability to manage finances with risk of not meeting statutory financial balance and other financial objectives. Impact on cash flow. Impact on ability to manage finances with risk of not meeting statutory financial balance and other financial objectives. Loss of buildings: 6 a-c) Use of alternate NHS accommodation and VPN for home working. 6 a-c) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Hemel One (HVCCG) HQ Howards Court (HCT) HQ few places Waverley Rd (HPFT) HQ Possible overload on alternate NHS Accommodation. East and North Hertfordshire Clinical Commissioning Group Page 25 of 43

Section 2.1.2 Critical Functions of HBL ICT Shared Service ICT functionality (core information and communications technology, data processing incorporating resilience to include: email, telecommunications, back & restore, antivirus, physical and logical controls) Pharmacy and Medicines Optimisation (oversight of prescribing financial management) Pharmacy and Medicines Optimisation discharge statutory functions of controlled drugs Key Contacts: Phil Turnock - Director of HBL ICT Shared Service Keith Fairbrother - Head of Infrastructure Minimum Levels of Service that need to be maintained: a) To continue critical or sensitive business operations (ICT) b) To facilitate effective co-ordination of recovery tasks (ICT) Contingency: Priority for the Restoration of Services 8. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 9. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 10. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 11. Important: Within 3 days Will affect services without causing danger to patients 12. Necessary: Within 7 days Minor disruption to services 13. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 14. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 26 of 43

Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of staff 1 a-c) Secure immediate cover. Formal appointment of successors if loss persists. 4 d) Secure external support where necessary. Loss of telephone communication 1 a-d) Use of email instead. Invoke Major Incident Process Loss of email 2 a-d) Use of telephone and postal or dispatch systems. Loss of Internet 4 a-c) Other research methods. Copies of key documents stored in Microsoft Office format. Invoke Major Incident Process Invoke Major Incident Plan Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used. Loss of Microsoft Office Loss of access to stored documents (servers) Loss of individual IT systems 3 a-c) Copies of key documents stored in.pdf format. 3 a-c) Copies of key documents stored on alternate servers and on intranet. Invoke Major Incident Process N/A Invoke Major Incident Process Fuel Shortage Use of Virtual Private Networking for staff with laptops. Use of telephone conferencing. N/A Loss of buildings: 6 6 a-c) Use of alternate NHS accommodation and VPN for home working. a-c) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Hemel One (HVCCG HQ) Howards Court (Few places HCT HQ) Waverley Road, St Albans, HPFT Possible overload on alternate NHS accommodation Loss of staff 3 After 24 hours prioritisation Secure replacement or agency Impact of uncontrolled of essential tasks with statutory deadlines. staff. Communication and Statutory SII reporting times not met. East and North Hertfordshire Clinical Commissioning Group Page 27 of 43

Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met 4 After 2 days prioritisation Impact of provider quality being unof urgent tasks. reviewed and/or regulatory compliance not delivered. 5 1 week would impact on meetings. Impact of organisation governance and assurance being disrupted. Loss of telephone Use of email instead (using email Impact of instant two-way flow of communication contacts list). Contact HBLICT Service Desk during core hours* communication interrupted. 3 After 24 hours prioritisation Impact of uncontrolled of essential tasks with statutory deadlines. Outside core hours ICT Director oncall - TBC communication, risks un-reported, quality un-reviewed and some 4 After 2 days prioritisation statutory deadlines not being of urgent tasks. Service Desk is available 365 days a year 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays achieved. Loss of email 3 4 Use of telephone and postal or dispatch systems (using telephone and address contact lists for all staff). After 24 hours prioritisation of essential tasks with statutory deadlines. After 2 days prioritisation of urgent tasks. Loss of Internet 4 Other research methods. Copies of key documents stored in Microsoft Office format. Contact HBLICT Service Desk during core hours* Outside core hours ICT Director oncall - TBC Service Desk is available 365 days a year 0730-2200 Monday Friday 0800-2000 Weekends and Bank Holidays Contact HBLICT Service Desk during core hours* Outside core hours ICT Director oncall - TBC Impact of some statutory deadlines not being achieved, uncontrolled communication (including media), unreported risks and un-reviewed quality. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be Loss of Microsoft Office 3 Copies of key documents stored in.pdf format. Contact HBLICT Service Desk during core hours* East and North Hertfordshire Clinical Commissioning Group Page 28 of 43

Threat Priority for restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met Loss of access to stored documents (servers) Loss of individual IT systems 3 copies of key documents stored on alternate servers and on intranet. Contact HBLICT Service Desk during core hours* Outside core hours ICT Director oncall - TBC Use of telephone and paper systems Contact HBLICT Service Desk (including paper versions of records). during core hours* STEIS 3 After 24 hours prioritisation of essential Outside core hours ICT Director oncall Impact of statutory deadlines tasks with statutory deadlines. - TBC regarding SI reporting and monitoring not being met. Statutory Service Desk is available 365 days a reporting not achievable. year SAFEGUARD 4 After 2 days prioritisation of urgent tasks. 0730-2200 Monday Friday Impact of unreported and un- 0800-2000 Weekends and Bank reviewed risks. Statutory reporting Holidays not achievable. After 2 days prioritisation of urgent Websites and 4 tasks. Impact of uncontrolled Extranet communication. Fuel Shortage Use of Virtual Private Networking for staff with laptops. Use of telephone conferencing. N/A Longer term impact of some statutory deadlines not being achieved, uncontrolled communication (including media), unreported risks and un-reviewed quality. Loss of buildings: 6 a-n) Use of alternate NHS accommodation and VPN for home working. As appropriate to the threat Hemel One (HVCCG HQ) 6 a-n) Use of alternate NHS accommodation Howards Court HCT HQ (few places) and VPN for home working. Possible overload on alternate NHS 5 a-n) Use of alternate NHS accommodation Waverley Rd, St Albans (HPFT) accommodation and VPN for home working. East and North Hertfordshire Clinical Commissioning Group Page 29 of 43

2.2 Critical Functions of the Commissioning Director Retain the organisational structure of the 6 localities Retain the organisational structure the 4 programme boards for specific work streams Responsive management support at practice level Maintain the CCG hotline that is pertinent to patient specific queries Key Contacts: Denise Boardman - Interim Director of Commissioning Jo Burlingham - Associate Director Commissioning Kay Dhesi - Interim Assistant Director Commissioning James Gleed - Assistant Director Primary Care Development Minimum Levels of Service that need to be maintained a. Responsiveness to commissioned services for patient specific queries b. Approval mechanism to authorise payments by finance directorate c. Communicating progress to locality structures and to the CCG executive Contingency Priority for the Restoration of Services 1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours Will degrade to Critical if not addressed within this time band 3. Essential: Within 24 hours Major disruption no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days Will affect services without causing danger to patients 5. Necessary: Within 7 days Minor disruption to services 6. Routine: Within 14 days Will not directly disrupt services but will cause inconvenience 7. Non-Urgent: Within 28 days Will involve non-urgent repair East and North Hertfordshire Clinical Commissioning Group Page 30 of 43