Business Continuity Management Framework April 2013 Author: Responsibility: Janet Young All Staff Effective Date: 1 April 2013 Review Date: 1 April 2014 Reviewing/Endorsing committees Approved by Governance and Risk Sub Group Governance & Risk Group March 2013 Date Ratified by CCG Board April 2013 Version Number 1
POLICY DEVELOPMENT PROCESS Names of those involved in policy development Name Designation Email Janet Young Governance & Risk Manager Names of those consulted regarding the policy approval Date Name Designation Email March 2013 Edward Baker Resilience Support Office Equality Impact Assessment prepared and held by Date Name Designation Email Committee where policy was discussed/approved/ratified Committee/Group Date Status Governance & Risk Group 11 March 2013 Approved Equality Impact Assessment Bedfordshire Clinical Commissioning Group is committed to promoting equality in all its responsibilities as commissioner of services, as a provider of services, as a partner in the local economy and as an employer. This policy will contribute to ensuring that all users and potential users of services and employees are treated fairly and respectfully with regard to the protected characteristics of age, disability, gender, reassignment, marriage or civil partnership, pregnancy and maternity, race, religion, sex and sexual orientation. Business Continuity Management Framework Page 2
1. Introduction The Civil Contingencies Act 2004 delivers a single framework for the provision of civil protection in the UK. The principle objectives of the Act are to ensure consistency of planning across all government departments and its agencies, whilst setting clear responsibilities for frontline responders at a local level. The Act divides responder organisations into two categories, depending on the extent of their involvement in civil protection work, and places a proportionate set of duties on each. Category 1 responders are those organisations at the core of emergency response (e.g. emergency services, local authorities). Category 2 responders are co-operating bodies that are placed under lesser obligations beneath the CCA than a Category 1 responder. Primarily their role is cooperating and sharing relevant information with Category 1 responders. They should be engaged in discussions where they can add value. Furthermore, they must respond to reasonable requests. From 1 April 2013 the NHS Commissioning Board Area Team will take on the overall leadership of the local NHS in terms of emergency planning and response. CCGs will be Category 2 responders. 2. Responding to Emergencies As a Category 2 responder, CCGs have a role in both planning and prevention, and responding to emergencies. 2.1 Planning and prevention Generally the CCG s role will be to co-operate and share relevant information with category 1 responders but they will be engaged in Local Health Resilience Partnership (LHRP) discussions where they will add value. CCGs must maintain robust business continuity plans for their organisations. Corporately, CCGs will support the NHS Commissioning Board in discharging its emergency preparedness, resilience and response (EPRR) duties locally, ensuring representation on the LHRP. As commissioners, CCGs will be required to include relevant EPRR elements (including business continuity planning) in contracts with provider organisations. 2.2 Response As Category 2 Responders under the Civil Contingencies Act, CCGs must respond to reasonable requests to assist and co-operate. Business Continuity Management Framework Page 3
This will include supporting the NHS Commissioning Board Area Team should any emergency require wider NHS resources to be mobilised. CCGs must have a mechanism in place to support NHS Area Teams to effectively mobilise all applicable providers that support primary care services should the need arise. CCGs are responsible for maintaining service delivery across their local health economy to prevent business as usual pressures and minor incidents within individual providers from becoming significant incidents or emergencies. This could include the management of commissioned providers to effectively co-ordinate increases in activity across their health economy. CCGs need a process that enables them to escalate significant incidents and emergencies to the NHS Area Team as applicable. 3 Responsibilities The CCG s Accountable Emergency Planning Officer (Director of Strategy & Redesign) is responsible for ensuring business continuity standards are met and will have director level representation at the Local Health Resilience Partnership. They will also ensure that contracts with provider organisations contain relevant emergency preparedness, resilience (including business continuity) and response elements. The Chief Operating Officer is responsible for ensuring that the CCG supports the NHS Commissioning Board in discharging its EPRR functions and duties locally. 4 On-call procedures As commissioners of patient services, CCGs are required to have in place a robust process whereby providers with whom the CCG commission services can access someone from the CCG 24 hours a day, seven days a week. This individual should be able to either make decisions on behalf of the CCG or be authorised to act on behalf of a group of CCGs who have commissioned the service. This may include, but is not limited to, committing expenditure on behalf of the commissioning organisation. Call out arrangements for CCGs should be made sufficiently robust to enable notification and escalation in the event of a major incident or emergency. This would allow the NHS CB area team director to contact the CCG out of hours to advise of, for example, a major incident impacting the wider health economy. CCGs must ensure that there are effective 24/7 business as usual contact arrangements in place to escalate and mobilise the response of its commissioned services to ensure providers can contribute effectively to the wider health response as required - for example during a period of surge. Business Continuity Management Framework Page 4
5 Business Continuity CCGs must be able to maintain continuous levels in key services when faced with disruption from identified local risks such as severe weather, fuel or supply shortages or industrial action. Business continuity management gives organisations a framework for identifying and managing risks that could disrupt normal service. It helps to anticipate, prepare for, prevent, respond to and recover from disruptions, whatever their source and whatever part of the business they affect. Disruptions can be caused by periods of severe pressure (for example in winter) a long-term increase in demand for services, external emergencies and disasters, and internal system failures. Planning to tackle these effects does way beyond the initial emergency response. Business continuity plans must take into account the following:- Organisations must identify and manage internal and external risks and opportunities relating to the continuity of their operations Plans must be maintained based on risk-assessed worst-case scenarios Risk assessments should take into account community risk registers and at very least include worst-case scenarios for:- Severe weather (including snow, heat wave, prolonged periods of cold weather and flooding) Staff absence (including industrial action) The working environment, buildings and equipment Fuel shortages Surges in activity IT and communications Supply chain failure Associated risks in the surrounding area The risk assessment should consider things such as: 1. The records and documents you need everyday 2. The resources and equipment you need to operate 3. The access you need to your premises 4. The skills and knowledge your staff have that you need to run your service 5. External stakeholders you rely on or who rely on you 6. The legal obligations you are required to meet 7. The impact of ceasing to perform critical business activities 8. How long your service can survive without performing these activities. Organisations must develop, use and maintain a formal and documented process for business impact analysis and risk assessment. Business Continuity Management Framework Page 5
Organisations must identify all critical activities using a business impact analysis. This should set out the effect business disruption may have on the organisation and how this will be overcome, including the maximum period of tolerable disruption. Organisations must highlight which of their critical activities have been put on the corporate risk register and how these risk are being addressed. Business continuity plans should set out how the plans will be called into use, escalated and operated. Organisations must develop, use, maintain and test procedures for receiving and cascading warnings and other communications before, during and after a disruption or significant incident. Plans should set out the alerting arrangements for external and self-declared incidents, including trigger points and escalation procedures. The procedures for escalating emergencies to Area Teams 24-hour arrangements for alerting managers and other key staff, including how up-to-date contact lists will be maintained. The responsibilities of key staff and departments The responsibilities of the Chief Operating Officer How mutual aid arrangements will be called into use and maintained Where the incident or emergency will be managed from How the independent healthcare sector may help if required The insurance arrangement that are in place and how they may apply. 6. Training All staff on emergency on-call rotas needs to have the relevant training. Executives responsible for business continuity management in CCGs and those (if any) on NHS CB Area Team emergency response on-call rosters will need to undertake Strategic Leadership in a Crisis training. Business Continuity Management Framework Page 6