North West London Clinical Commissioning Groups BUSINESS CONTINUITY PROCEDURES V4.0 NWL CCGS BUSINESS CONTINUITY PROCEDURES About this Plan: CCGs are not expected to continue to deliver all functions in the event of a major incident or major business disruption. Therefore, CCGs have these business continuity procedures to allow some functions or services to be scaled up by scaling down or even suspending some non-critical functions. Please Note: The procedures documented in this plan should be used in conjunction with the Local Business Continuity Plan in APPENDIX A. DOCUMENT DETAIL: Document Name Business Continuity Procedures Version 4.0 Author Mark Haggerty Accountable Emergency Officer BHH -Rob Larkman CWHHE- Clare Parker Date of Issue February 2017 Review Date February 2018 TRAINING AND EXERCISE DETAIL: Exercised On September 2016 Exercise Type Tabletop Exercise Ex. Requirement Annual Tabletop Exercise or Three Yearly Live Exercise Next Exercise June 2017 Staff Training All Staff Major Incident Training Requirements Response Staff Emergency Preparedness Training Programme 1
CONTENTS BUSINESS DISRUPTION RESPONSE FLOWCHART... 4 SECTION ONE PLAN INTRODUCTION... 5 1. OVERVIEW... 5 1.1 LEGAL REQUIREMENT... 5 1.2 AIM OF THE PLAN... 5 1.3 OBJECTIVES... 5 2. UNDERSTANDING THE PRIORITY RATINGS... 6 3. KEY INFORMATION... 6 3.1 RISK ASSESSMENT & BUSINESS CONTINUITY PLAN TRIGGERS... 6 3.2 FINANCIAL MANAGEMENT... 7 3.3 INSURANCE... 7 SECTION TWO BUSINESS CONTINUITY RESPONSE... 8 4. BUSINESS CONTINUITY RESPONSE AIMS... 8 5. ROLES AND RESPONSIBILITIES... 8 5.1 ALL STAFF... 8 5.2 TEAM LEADERS/MANAGERS... 8 5.3 CONTINUITY LEADS... 8 5.4 ON-CALL DIRECTOR/INCIDENT DIRECTOR... 8 6. BUSINESS CONTINUITY RESPONSE... 9 6.1 INITIAL ASSESSMENT AND ESCALATION... 9 6.2 RESPONDING USING THE RECOVERY TIME OBJECTIVE (RTO) AND MAXIMUM TOLERABLE PERIOD OF DISRUPTION (MTPD)... 9 6.3 LOGGING AND SITUATION REPORTING (APPENDIX C)... 9 7. SPECIFIC STRATEGIES... 10 7.1 LOSS OF PREMISES STRATEGY... 10 7.2 LOSS OF UTILITY SERVICES STRATEGY... 10 7.3 LOSS OF INFORMATION TECHNOLOGY... 10 7.4 LOSS OF STAFF STRATEGY... 10 8. LINKS WITH OTHER PLANS... 11 8.1 MAJOR INCIDENT PLAN... 11 8.2 OTHER PLANS... 11 9. EXTERNAL LIAISON DURING A BUSINESS CONTINUITY EVENT... 11 9.1 NHS ENGLAND LONDON... 11 9.2 LIAISON WITH OTHER PARTNER AGENCIES OR GOVERNMENT BODIES... 11 10. COMMUNICATIONS... 11 10.1 INTERNAL COMMUNICATIONS... 11 10.2 MEDIA ENQUIRIES... 11 SECTION THREE - RESTORATION AND RECOVERY... 12 11. RESTORATION... 12 11.1 SCALED DOWN AND SUSPENDED SERVICE AND FUNCTIONS... 12 11.2 RELOCATION FOR RESUMPTION OF SERVICE... 12 12. RECOVERY... 12 12.1 DEBRIEF... 12 12.2 INCIDENT DOCUMENTATION... 13 12.3 POST-INCIDENT RECOVERY... 13 APPENDIX A LOCAL BUSINESS CONTINUITY PLAN... 14 WHO SHOULD USE THIS PLAN... 14 HOW TO USE THIS PLAN... 14 APPENDIX B ACTION CARDS... 15 INTRODUCTION TO ACTION CARDS... 15 ACTION CARD 1 MANAGER/TEAM LEADER... 16 ACTION CARD 2 CONTINIUTY LEAD... 17 APPENDIX C LOGS SITREPS AND LOG SHEETS... 18 SITREP REPORT ALL TEAMS... 18 INCIDENT MESSAGES AND ACTIONS LOG... 19 2
Version Control It is the responsibility of the Business Continuity Team (BCT) to ensure that these procedures adheres to current guidance. The BCT will update and review this plan following any incident/exercise debrief or changes to the organisational structure. Furthermore, this plan will be ratified in accordance with BHH/CWHHE guidance and procedures. Date Version Author Changes/ Reason Documents Replaced (if any) 03/2014 1.0 M.Haggerty First version PCT 02/2015 2.0 M Haggerty Implementing recommendations as a result of Version One the 2014 EPRR Assurance Process: Incorporating CWHHE/ Removing Information which is already published within the BC Policy 02/2016 3.0 M Haggerty Annual Review Version Two Implementing recommendations as a result of the assurance process 02/2017 4.0 M Haggerty Annual Review implementing recommendations as a result of the assurance process reflecting the new EPRR definitions Version Three 3
BUSINESS DISRUPTION RESPONSE FLOWCHART Level One Local Management Team Leaders/Managers assess the situation and the extent of the disruption making sure staff are safe before determining if the function(s) they provide can continue by reorganising and focusing the resources under their line management. ESCALATION If the disruption is too great and their function(s) cannot be maintained with the resources available then the management of the disruption should be escalated to the appropriate continuity lead (or their deputy) so further resources can be sourced elsewhere. (Refer to your Local Business Continuity Plan Appendix A) Level Two Department Management On the receipt of a request for assistance, the continuity lead will activate their local level Business Continuity Plan (Appendix A) and using their action card (Appendix B) will manage the allocation of resources across their department or CCG. The overall response at a local level will depend entirely on how contained the incident is, the continuity priority of the teams or business functions involved. Department Plan Team Service Function Team (Bronze/ Operational Continuity Lead (Silver/Tactical) INCIDENT or DISRUPTION *Incident or Disruption may affect all or some teams depending on the location, type, and scale. Team leaders/managers who cannot continue their functions contact their continuity lead who will coordinate additional resources The Continuity Lead will be of an appropriate level of seniority (Director or Assistant Director) within their CCG or Department ESCALATION If there is an actual disruption and a HIGH PRIORITY team/function which cannot be managed with the resources available, then the management of the disruption should be escalated through the Major Incident Procedures so further resources can be sourced from within NWL CCGs (Situation Reporting Form is available in Appendix C). Level Three NWL CCGs Wide Management (and beyond) Once informed of a disruption the on-call director should evaluate the situation using their on-call pack and make the decision whether to declare a critical/ major incident or put NWL CCGs at standby. Once this has been carried out then the usual major incident procedures should be followed until the declared or standby status is stood-down. On-Call Director (Gold/Strategic) Activate Major Incident Procedures Refer to the Incident Response Plan/ On-Call Pack 4
SECTION ONE PLAN INTRODUCTION 1. OVERVIEW This plan provides procedures for managing business disruptions, regardless of cause, to ensure that, at a minuimum NWL CCGs are able to provide its key critical functions and proritise business recovery. NWL CCGs will endeavour to manage disruptions at the lowest level practicable, starting with team leaders/managers, who will escalate any additional resource requests directly to their appropriate Continuity Lead. The Business Continuity procedures will only activate the abridged Major Incident command and control structure in the event of an actual or threatened disruption which cannot be managed at a local level. However, in the event of a critical or major incident the business continuity procedures will always be activated in support of the incident response. For ease of use this plan has been divided into the following sections: Section One Aims and objectives, overview of the priority rating system and risk assessments; Section Two Business continuity response, roles & responsibilities, links with other plans, and communications; Section Three Restoration and recovery arrangements, post incident debriefing, reporting and back to business as usual timeline; Appendices Local Business Continuity Plan, action cards, log sheets, and sit reps. Full versions of business continuity and major incident plans have been circulated and are accessible to on-call staff via PageOne Documents and HaroCCG.BEHHincidentcontrol@nhs.net, hardcopies are also located in the Incident Coordination Centres (Control Rooms). Edited versions of the aforementioned plans are available to all staff and key stakeholders on BHH/CWHHE CCG Emergency Preparedness webpages. This plan, like all NWL CCGs resilience arrangements, will be updated on an annual basis or to reflect any changes in the organisation s structure, or following any recommendations from internal (or external) incidents and exercises. In addition, any major changes to national guidance or legislation may also trigger a review of the plan. 1.1 LEGAL REQUIREMENT These Business continuity procedures have been prepared with reference to the NHS England Business Continuity Framework, which itself is based on guidance in the PAS 2015:2010 Framework for health services resilience, ISO 22301 Business Continuity Management Systems Requirements and ISO 22313 Business Continuity Management Systems - Guidance. Furthermore the Civil Contingencies Act 2004 requires responders to maintain Business Continuity Management Plans to ensure that they can continue to exercise their functions in the event of an emergency, so far as is reasonably practicable. 1.2 AIM OF THE PLAN The aim of the plan is to address business interruption rather than incident response and to ensure: NWL CCGs are able to cope with the effects of an emergency situation or business disruption, be that predicted or unforeseen. That such an event is handled in a manner that enables CCGs to continue with minimal disruption to its services or core business functions. 1.3 OBJECTIVES The Objectives of this plan are to ensure: 1. NWL CCGs are compliant with its legal and regulatory obligations; 2. Risk assess NWL CCGs vulnerability to disruptive events; 3. Identify its critical functions and activities, ensuring their continuity; 4. Ensure staff are properly communicated with; 5. Staff receive adequate support in the event of a disruption. 5
2. UNDERSTANDING THE PRIORITY RATINGS In a disruption or major incident CCGs will not be expected to keep all its services operating at business as usual levels, instead CCGs will proritise service delivery to ensure the continuation of its HIGH PRIORTY business functions; to achieve this, staff and resources from MEDIUM and LOW priority functions may be utilised elsewhere. All CCGs functions and services have been priority rated at either HIGH, MEDIUM or LOW for continuity and recovery purposes. The prority rating is calculated on the impact to the CCG if that function or service was completely suspended for 4, 8, 24, and 48 hours. For continuity and recovery decision making processes the priorities are defined as - HIGH PRIORITY (Category A) A function or service that CANNOT be stopped safely for between 4 to 48 hours without causing a breach of statutory duty, massive financial loss or major reputational damage. MEDIUM PRIORITY (Category B) A function or service that COULD be scaled down for up to 48 hours without causing a breach of statutory duty, massive financial loss or major reputational damage. LOW PRIORITY (Category C) A function or service that COULD be suspended for up to 48 hours without causing a breach of statutory duty, massive financial loss or major reputational damage. It is this information that will be used in the response to determine which services and functions can safely be scaled back or suspended to maintain the HIGH PRIORITY services or functions When recovering services HIGH PRIORITY functions will be recovered first before the MEDIUM and LOW priority rated functions. 3. KEY INFORMATION For further information regarding definitions and strategic framework please refer to the Business Continuity/EPRR Policy. 3.1 RISK ASSESSMENT & BUSINESS CONTINUITY PLAN TRIGGERS The CCA 2004 requires responders to carry out risk assessment using the following three phase process (Cabinet Office March 2012). 1. Contextualisation: nature and scope of the risk 2. Risk evaluation: identifying threats and hazards that present significant risks, analysing their likelihood and impact 3. Risk treatment: decide which risks are unacceptably high, developing plans and strategies to mitigate these risks. 6
The following list highlights the nature and scope of some locally identified business continuity risks or triggers which are likely to result in the activation of our business continuity procedures. These triggers and risks have been developed using both local and community risk registers. The triggers or risks which are likely to result in activation of this Plan include: Non-availability of key staff; Damage or denial of access to premises; Loss or damage to IT systems / Backup files / voice networks / hardware / software / data; Loss or damage to other resources including key Utilities (water, electric, gas etc); Loss of inputs and outputs from supply chain partners and contractors. Business Continuity Planning, and its processes focuses Continuity Leads attention to the risks that might impact on the delivery of their services. Managers should also take notice of indicators of risk identified through other internal mechanisms, such as: Adverse incident reporting Security reports Fire reports Health and Safety reports Accident reports 3.2 FINANCIAL MANAGEMENT It is acknowledged that during the initial response from a business continuity incident additional costs may be incurred either through the procurement of additional supplies and services. As a consequence of this and in accordance with our governance framework the On-Call Director or Continuity Lead has authority to authorise these costs, however it is the responsibility of this individual to maintain adequate logs and records of all financial activity undertaken in respect of the response to an incident or business disruption. Where the action has financial implications, it is essential that the records are adequate to identify: The expenditure that has been incurred and for what item or service When and where the item or service is to be provided To whom the expenditure is payable the company or organisations name and address, and a named individual as contact The relevant terms and conditions of sale When the bill is payable The name of individual approving the expenditure at the time The date of the transaction In order to provide an appropriate audit trail. Copies of such information will be supplied as soon as possible to the Director of Finance, or an officer nominated by the Director to oversee the financial implications of the incident. 3.3 INSURANCE In accordance with the current legal framework NW L CCGs has insurance with the NHS litigation Authority. 7
SECTION TWO BUSINESS CONTINUITY RESPONSE 4. BUSINESS CONTINUITY RESPONSE AIMS The aims of the overall business continuity response (regardless of level) are to: Alert and mobilise the relevant staff and cascade any necessary internal alerts; Evaluate the extent of the disruption/damage and the potential consequences; Mitigate the effects of the disruption, regardless of cause, once it has occurred; Minimise the reporting lines to prevent miscommunication and ensure a co-ordinated response; Ensure the continuation of critical services until the disruption is over; and Organise the return to normal working after the disruption as rapidly and efficiently as possible. 5. ROLES AND RESPONSIBILITIES 5.1 ALL STAFF All staff have a role to play in business continuity in raising alerts, assisting managers in keeping their departments running as normal as possible, and being flexible in their working arrangements. 5.2 TEAM LEADERS/MANAGERS Team leaders/managers keep their business as usual role in a business disruption and are responsible for the coordination of their team for which they are usually responsible. However, all team leaders/managers need to be aware of their continuity lead and their teams critical business functions. 5.3 CONTINUITY LEADS Continuity Lead Role Each CCG has an identified continuity lead. The continuity lead is a person with existing line management responsibility and seniority, and whose role to ensure business continuity arrangements are implemented within their CCG. They are also the first point of contact to manage any incident or disruption that requires extra resources or assistance. Continuity Lead Responsibilities The main responsibilities of the business continuity leads are to: Ensure that teams and managers within their agreed remit complete an analysis of critical functions and risks using the Business Continuity Management proforma; Ensure that Business Continuity Plans are completed for each risk identified; Provide the decision making for business continuity in an emergency or disruptive event, unless support is required from the On-Call Director (see below); Ensure that Business Continuity Planning is activated and resourced appropriately to maintain all critical functions, working towards restoration of normal services; Ensure that Business Continuity Plans are cascaded to appropriate staff within their remit who are given appropriate training; and Ensure that Business Continuity Management Plans are reviewed annually or sooner as appropriate. 5.4 ON-CALL DIRECTOR/INCIDENT DIRECTOR On-call Director/Incident Director Role The Director On-Call or in their unavoidable absence, another of the organisation s Directors will initially take the role of NWL CCGs Incident Director. However, the initial Director On-Call can be replaced by a more appropriate Director if the situation requires it. The main responsibilities of the on-call director are to: Activate the Major Incident Procedures if the disruption has reached the thresholds to be considered a major incident; Feed requests for additional resources into the relevant departments or CCG. 8
6. BUSINESS CONTINUITY RESPONSE 6.1 INITIAL ASSESSMENT AND ESCALATION It is the responsibility of the business continuity lead to ensure that each area within their remit have undertaken an initial assessment of the impact arising from any event resulting in, or potentially causing, business disruption. Where resources to support business continuity cannot be found within the staff under the management of this individual, they must escalate this to the on-call director. 6.2 RESPONDING USING THE RECOVERY TIME OBJECTIVE (RTO) AND MAXIMUM TOLERABLE PERIOD OF DISRUPTION (MTPD) Using the Recovery Time Objective (RTO) to inform the response All CCGs services and business functions have been assessed to ascertain the impact to our organisation over a series of times (4, 8, 24, and 48 hours) if they were completely stopped for whatever reason. The impact is rated either Minor, Moderate, Serious, Major or Catastrophic depending on the likely impacts on human welfare, legal and regulatory duties, financial loss, reputation and/or environmental damages the stopping of the team would have. Ideally, CCGs would like to recover any service two hours before it is likely to have Major impacts, this calculation is known as the Recovery Time Objective (RTO). Most services or functions have a recovery time objective of 48hours + which means the suspension of this team is highly unlikely to have a major impact on the CCGs overall functioning for at least 48hours. These teams are therefore rated at either LOW or MEDIUM priority and if required could be scaled back or suspended to support a HIGH priority team or function. Functions/teams that have recovery time objective of 2 or 6 hours may require the activation of the major incident procedures. Using the Maximum Tolerable Period of Disruption (MTPD) to inform response In the same way as the recovery time objective was assessed, all CCGS Services have been assessed to ascertain their maximum tolerable period of disruption (MTPD), which is the amount of time the team or function can be stopped entirely before the possibility of full recovery becomes highly unlikely or impossible. This is set as the hour the impact of the loss has been assessed as being catastrophic. The loss of the majority of the teams or services will not reach a catastrophic impact level within 48 hours, giving them a maximum tolerable period of disruption of 48 hours +. However, the few teams or functions that have been assessed of having a catastrophic impact on CCGs within 48 hours of disruption should be prioritised above all else. Please Note: Impacts are only rated for the first 48hours of disruption, if the incident or disruption has lasted for over this then the impacts on affected teams or functions will have to be rated again for the next 48 hours. This could mean that Teams and functions that were previously considered LOW or MEDIUM priority now score higher or have specific RTO and MTPD times. 6.3 LOGGING AND SITUATION REPORTING (APPENDIX C) When responding to a disruption continuity leads and senior managers should ensure: Decision(s)/actions are recorded/logged; Details/contents of phone conversations should be documented; Completed forms/original documentation or other evidence should be kept securely as it may be required in any subsequent debrief or inquiry. (Action logs can be found in Appendix C) External Sitreps In response to an incident, NHS England may request regular updates, via the completion of SitReps. The on-call Director will authorise all returns (For NHSE sitrep details refer to on-call pack). Internal Sitreps Furthermore, in the event of a business disruption/major incident CCGs or the relevant department(s) will be asked to complete and submit internal sitreps to the on-call/incident director (Appendix C). Please note this form must be completed in full by all Departments or CCG on the receipt of a DECLARED Major Incident message and every hour thereafter until the incident is STOOD DOWN OR as per request for BUSINESS CONTINUITY response purposes 9
7. SPECIFIC STRATEGIES The general actions that all staff and continuity leads should take in the event of a business disruption can be found in their Local Business Continuity Plan in Appendix A. 7.1 LOSS OF PREMISES STRATEGY NWL CCGs operates its functions out of a range of premises across North West London, the response to loss of premises will depend on the type of premises affected. 7.2 LOSS OF UTILITY SERVICES STRATEGY The loss of a utility service may make CCGs premises temporarily unfit for purpose and an extended long-term loss of essential utilities may require the relocation of staff. Electricity Electricity is the most critical of the utility supplies as the loss of power supply has the potential to be catastrophic for many aspects of the CCGs business. Without electricity most office-based functions will come to an immediate standstill, although standby generators are available at some sites, an extended interruption to electricity supply will undoubtedly cause impacts on service provision especially as loss of power will often result in disruptions to water and gas supplies as these may depend on electrically operated pumps or relays. Gas/ Heating The loss of gas or heating will depend on the weather. However, in the worst case an extended loss of heating in a period of cold weather could require the relocation of the department. Water Initially the loss of mains water for drinking purposes is relatively easy to address by sourcing bottled water from existing, or alternative, suppliers. However, the loss of mains water for sanitation is potentially more problematic. NHS Clinical sites are recognised as priority sites by Water Companies for restoration of services. 7.3 LOSS OF INFORMATION TECHNOLOGY The loss of information technology, will be an hindrance to staff, nevertheless managers should ensure staff have access to paper based systems. Where non-networked IT equipment (i.e. laptops) can be used instead these should be allocated from across departments on the basis of core business outputs. Each IT Service should have in place its own Core Service Continuity and Disaster Recovery Plan. It is also recommended that all staff should have NHS.NET account in addition to their CCG email account. The system is independent of the CCGs systems and will therefore continue to operate in most business disruption scenarios, including loss of access to sites, server failure etc. Staff using NHS Mail can continue to access their emails as long as they have access to the internet. Telephony Failure Predominantly the telephone services within NWL CCGs are provided by Voice over IP services. However, in the event this fails NWL CCGs Premises (which should have been identified in the business impact assessment), should have a landline (BT Analogue phone line) installed for further resilience. All continuity leads, their deputies and senior members of staff should also have a mobile phone. 7.4 LOSS OF STAFF STRATEGY Shortages of staff can happen for many different reasons - from industrial disputes to severe weather negatively affecting the transport system. However, regardless of cause, continuity leads will ensure that HIGH priority functions have adequate staffing even if that means scaling back or suspending MEDIUM and LOW priority teams or functions for up to 48 hours. If the loss of staff is widespread and continues beyond 48 hours then the Incident Director should consider activating Major Incident Procedures so that further workforce management strategies can be put in place. 10
8. LINKS WITH OTHER PLANS The Business Continuity Procedures can be used on their own in response to business disruptions or incidents regardless of cause. However, they can also be used as part of the response to other specific incidents or disruptions as detailed below. 8.1 MAJOR INCIDENT PLAN The Business Continuity Procedures will always be activated to some degree with the declaration of a Critical or Major Incident. This will ensure that the on-call senior managers and director are not overwhelmed with operational issues while dealing with the major incident but at the same time still receive assurance from the continuity leads that services or core business functions are operating effectively. 8.2 OTHER PLANS The following plans may be partly or wholly implemented as a result of the activation of the Business Continuity Plan are: Major Incident Response Plan Severe Weather Heatwave Procedures Cold Weather Plan Fuel Plan Flu Pandemic Plan Infectious Outbreak Plan Recovery Plan 9. EXTERNAL LIAISON DURING A BUSINESS CONTINUITY EVENT 9.1 NHS ENGLAND (LONDON) NWL CCGs will liaise with the NHS England (London) in the event of a serious business disruption or if a Major incident is declared (refer to incident response plan (IRP)). 9.2 LIAISON WITH OTHER PARTNER AGENCIES OR GOVERNMENT BODIES NWL CCGs will liaise with other partner organisations as appropriate. 10. COMMUNICATIONS (For further information regarding communications please refer to IRP) The Communications lead will implement the communications plan and ensure that communications with other stakeholders and the media are managed appropriately. The On-Call Director will agree with the communications lead the following: Method of communication; Content of messages; Frequency and timing of messages. 10.1 INTERNAL COMMUNICATIONS It is vital that staff are kept up to date with accurate information about the business disruption, all communications with staff will be mindful of the personal, as well of the professional impact of the incident. 10.2 MEDIA ENQUIRIES All media enquiries will be referred to the Communications Lead, On-Call Director or your Continuity Lead, no member of staff should discuss any aspect of the incident with the media. 11
SECTION THREE - RESTORATION AND RECOVERY 11. RESTORATION When restoring a service or business function the following should be taken into consideration. 11.1 SCALED DOWN AND SUSPENDED SERVICE AND FUNCTIONS When restoring functions that have been scaled down or suspended, a reassessment should be made of the recovery time objective (using impact over time) to set the order for restoration and prioritisation for resources. 11.2 RELOCATION FOR RESUMPTION OF SERVICE If the building the CCG or department operates out of is lost, or there is a denial of access then the following options should be considered for resumption: Budge up share premises and resources with another CCG or department; Displacement Higher priority services to displace non-affected lower priority services; Reciprocal arrangements share premises or outsource to another NHS organisation (Mutual Aid); Third Party Alternative liaise with the local authority, commercial partner or social enterprise property; 12. RECOVERY 12.1 DEBRIEF Within 48 hours of recovery, the continuity lead ending the response to a business disruption will facilitate a hot debrief. A hot debrief is: o o o A process for learning lessons from the incident; A forum for staff to express immediate issues which may concern them; An opportunity to thank staff. A hot debrief may help NWL CCGs identify staff who may need further support but should NOT: o o o o be allowed to become over-emotional or confrontational; be used to criticise individuals; be overly detailed; be used to provide any form of post incident psychological support. The hot debriefs should be minuted and last no more than an hour. Once the hot debriefs have been conducted the Business Continuity Team will organise a series of Cold structured debriefs. These will happen no more than four weeks after the end of the incident and will consist of a facilitated session looking at what worked and did not work in the incident response and how the response could be improved in the future. The results of the debrief will feed into a full incident report by the Business Continuity Team who will gather further details about the response effort from incident logs and messages. The report will: Summarise the sequence of events Identify the individuals involved Describe the actions of staff Provide an accurate timeline 12
12.2 INCIDENT DOCUMENTATION After an incident all documents including logs, notes, post-its, flip charts, electronic documents, memos, and message pads must be retained, and be sent to the Business Continuity Team, The Heights, Harrow on the Hill (Tele:-02089661066). It will be the responsibility of the Accountable Emergency Officer(s) for sourcing an appropriately secure premises to store the documents to facilitate any future internal or external investigations in accordance with current Department of Health s record management codes of practice and our Corporate Record management Policy. 12.3 POST-INCIDENT RECOVERY Recovery planning starts at the very beginning of the business continuity response, where continuity leads look at the recovery time objective for all effected teams and functions. This information is then used to assess which services can be scaled down and suspended in support of the HIGH priority business functions and services. Within 48 hours of the hot debrief (see above) the Incident Director s or the Continuity Lead s management team will have an initial meeting to assess the disruption to the operational functions caused by the incident, including any long-term implications and how to return to business as usual. This assessment will include: Effects on staffing (e.g. loss of staff through injury or sickness, impact of overtime worked by staff during the incident on staffing levels); Support needs of staff affected by the incident (including trauma support); Disruption caused to key business outputs; Damage inflicted to property; Financial losses; Future provision of services or business functions in the short-, medium- and long-term. The results of the aforementioned assessment will be used to formulate a post-incident recovery action plan with timescales for the return to business as usual (For further information please refer to NWL CCGs Recovery Plan.) 13
APPENDIX A LOCAL BUSINESS CONTINUITY PLAN WHO SHOULD USE THIS PLAN This plan should be used by the Team Leader/Managers of the listed teams or functions and the named continuity lead or their nominated deputy. HOW TO USE THIS PLAN This plan should be used in two ways first for the initial response to a disruption and alerting (team leaders/ managers); and secondly to support tactical decision making by listing the criticalities, recovery time objectives, maximum tolerable periods of disruption of teams and functions as well as key contact details and building addresses. If you have not yet developed a local Business Continuity Plan please refer to your existing plan to ascertain your CCGs or Departments Critical Functions. 14
APPENDIX B ACTION CARDS INTRODUCTION TO ACTION CARDS During a business disruption members of staff may be asked to perform a key role on behalf of the CCG, these roles might be different from their usual responsibilities so action cards have been developed to support staff in this situation. If the disruption lasts for more than 8hours then it may be necessary for another member of staff to take over the action card role (because they are providing relief, or they have more localised appropriate experience) this can only happen after a full briefing has to been given, in writing, on the actions taken todate and outstanding issues. Until this has taken place, the member of staff originally assigned to the action card will be considered as still in place and responsible for all actions associated with the role. All staff with a specific role should: Be familiar with the contents of their own action card; Use it from the moment they are contacted about a disruption. 15
ACTION CARD 1 MANAGER/TEAM LEADER BUSINESS CONTINUITY ACTION CARD MANAGER/TEAM LEADER As a team leader/ manager you are responsible for the same teams and functions you are on a day to day basis. IN response to a disruption as a Manager/Team Leader you will: Contact your designated Continuity Lead or nominated deputy as identified in your local business continuity plan, and complete the situation report (Sitrep) form (Appendix C) On the request of the continuity lead scale down or suspend your service or function and release your resources to support another area of BHH/CWHHE. You will NOT: Take resources from another team unless authorised by the continuity lead Remember: Business Impact Assessments are only rated for the first 48hours of disruption, if the incident or disruption has lasted for over this then the impacts on affected teams or functions will have to be rated again for the next 48 hours. This could mean that Teams and functions that were previously considered LOW or MEDIUM priority now score higher or have specific RTO and MTPD times. USING THE LOCAL BUSINESS CONTINUITY PLAN The Local Business Continuity Plan is found in Appendix A. It will cover a group of teams or business functions within your CCG or department. The continuity lead (or their nominated deputies) contact details are on the first page. Check, your team or function should be contained on the list on the front. If not contact the continuity lead who will refer you to the correct lead. If the incident is in your area then first follow the emergency actions to ensure the safety of staff. Finding your RTO and Priority 16
ACTION CARD 2 CONTINIUTY LEAD BUSINESS CONTINUITY ACTION CARD CONTINIUTY LEAD As a continuity lead you are responsible for co-ordinating business continuity measures across your CCG. This may involve scaling down or suspending some of the your services or functions to keep the HIGH priority rated functions running or in support the wider BHH/CWHHE wide response. IN response to a disruption as a Continuity Lead you will: Consider scaling down or suspend some services to release resources to support another area of business If you need further resource to keep the minimum level of service then you will escalate this through the on-call director and you will need to complete the situation report (Sitrep) form (Appendix C) You will NOT: Take resources from another department or CCG unless authorised by the oncall director or incident director Remember: Impacts are only rated for the first 48hours of disruption, if the incident or disruption has lasted for over this then the impacts on affected teams or functions will have to be rated again for the next 48 hours. This could mean that Teams and functions that were previously considered LOW or MEDIUM priority now score higher or have specific RTO and MTPD times. USING THE LOCAL BUSINESS CONTINUITY PLAN The Local Business Continuity Plan is found in Appendix A. It will cover a teams or services within your CCG or department The continuity lead (or their nominated deputies) contact details are on the first page. If the incident is in your area then first follow the emergency actions to ensure the safety of staff. Finding your RTO and Priority 17
APPENDIX C LOGS SITREPS AND LOG SHEETS SITREP REPORT FORM TO BE SUBMITTED ON INITIAL ESCALATION (SEE PAGE 4) OR DURING A DECLARED MAJOR INCIDENT SITUATION REPORT (SITREP) FORM Please note this form must be completed in full by all Departments or CCG on Initial Escalation OR on receipt of a DECLARED Major Incident message and every hour thereafter until the incident is STOOD DOWN OR as per request for BUSINESS CONTINUITY response purposes TIME (HH:MM): DATE (DD/MM/YY): CONTACT NO. CCG OR DEPARTMENT: SENIOR MEMBER OF STAFF: RECORDED BY: CURRENT SITUATION (Briefly provide an overview of how your team/ area is functioning): CURRENT STATUS (Delete as appropriate) A: Unaffected, by the incident or disruption B: Affected by the incident or disruption but with no or negligible impact on service delivery Affected by the incident directly but meeting minimum service delivery requirements OR Affected by C: the incident indirectly as resources have been redeployed elsewhere but minimum service being maintained Directly affected by the incident and not meeting minimum service delivery/ OR Suspended as part of D: the incident response. Resources available to support the response (i.e. staff, buildings, IT equipment): Resources currently deployed elsewhere in support of the response (i.e. staff, buildings, IT equipment): ACTIONS TAKEN (Actions agreed in the return phone call from on-call staff should be recoded below, and in the Incident Messages and Actions Log ACTION UNDERTAKEN BY TIME (HH:MM) DATE (DD/MM/YY) SIGNATURE PASSED TO: 18
INCIDENT MESSAGES AND ACTIONS LOG Entry No. Date DD/MM/YY Time HH:MM Information/Message (ingoing or outgoing) Example 01 15/09/13 16:40 Major incident declared message received From Contact details Action Taken Undertaken By Time HH:MM Gold Command 020 4822 3070 Forwarded call on to next areas in the cascade Robert Smith Initials 16:45 RS DO NOT DESTROY ENSURE ALL LOG FORMS ARE RETURNED TO THE BUSINESS CONTINUITY TEAM WITHIN 24HRS OF INCIDENT STAND DOWN 19
20