business continuity planning - west cheshire … · business continuity planning. ... reasonable...

BUSINESS CONTINUITY PLANNING

Business Continuity Planning NHS West Cheshire Clinical Commissioning Group October 2016 1


Version Version 2

Ratified By NHS West Cheshire Clinical Commissioning Group

Date Ratified April 2013

Author(s)

Responsible Committee / Officers

Senior Management Team

Date Issue April 2013

Review Date October 2017

Intended Audience All clinical commissioning group staff

Impact Assessed Yes

Further information about this document:

Document name Business Continuity Planning

Category of Document in The Policy Schedule

Author(s) Contact(s) for further

information about this document

This document should be read in conjunction with

Published by

Copies of this document are available from

Corporate

Clare Dooley Head of Corporate Governance 01244 650318 [email protected]

NHS West Cheshire Clinical Commissioning Group

Website: www.westcheshireccg.nhs.uk

Copyright © 2015. All Rights Reserved

Version Control:

Version History:

Version Number Reviewing Committee / Officer

Date

1.0 NHS West Cheshire Clinical Commissioning Group April 2013 NHS West Cheshire Clinical Commissioning Group July 2014 NHS West Cheshire Clinical Commissioning Group May 2015

2.0 NHS West Cheshire Clinical Commissioning Group October 2016


mailto:[email protected]

http://www.westcheshireccg.nhs.uk/


This document can be made available in a range of alternative formats including various languages,

large print, Braille and audio cassette. To discuss your requirements please ring 01244 650368


INDEX

Description Page Index 6

Template 1 - Plan Version Control 7

Background 8

Purpose of Business Continuity Plan 8

Roles and Responsibilities 8

Complimentary Links 9

Service/ Clinical Commissioning Group Business Continuity Plans

9

ICT Disaster Recovery Plan 10

Property Disaster Recovery Plan 10

Template 2

• Form B - Business Impact Analysis 12 • Form C - Risk Analysis 13 • Form D - Prevention Measures 14

Appendix A - Classification of severity of a business continuity disruption

17

Appendix B - Risk aAnalysis process and risk matrix 18

Appendix C - Key business continuity personnel contacts directory

20

Appendix D - Key resources and contractor contacts directory 21

Appendix E – Priority ICT programmes to be restored 23

• Form A - Assessment of Service Core Activities 11


Plan Version Control and Review Template 1

Organisation Address


1829 Building Countess of Chester Health Park Liverpool Road Chester CH2 1HJ

Clinical Commissioning Group Confirmation of completion Emergency Planning Service Business Continuity Plan

Responsible Person (Corporate)

Date April 2013

Responsible Person (Service/CCG)

Date April 2013


Head of Governance

Chief Executive Officer

Confirmation of approval of Emergency Planning Service Business Continuity Plan

Proposed to NHS West Cheshire Clinical Commissioning Group Governing Body 18th April 2013


NHS WEST CHESHIRE CLINICAL COMMISSIONING GROUP

BUSINESS CONTINUITY PLANNING

Background

1. Under the Civil Contingencies Act Clinical Commissioning Groups have a duty to put in place Business Continuity Management arrangements. Local experiences of recent years which have required organisations to invoke business continuity plans have included flood, fire, disruptions to electrical supply, communication failures and the fuel crisis. Other potential occurrences that also need to be considered when preparing business continuity plans include the risk of flu pandemic and severe weather.

2. Significant events likely to cause serious interruption of the continuity of the clinical

commissioning group’s business warrant the activation of the NHS England Major Incident Plan. Minor business interruptions occur on a daily basis and are dealt with using regular and familiar systems and resources, such as general repair and maintenance contracts or routine management intervention.

Purpose of the Business Continuity Plan

3. The creation and maintenance of the clinical commissioning group’s business

continuity plan ensures that there is a clear, workable plan for prompt action in the face of events that have the potential to compromise the normal expectations of services and delivery of objectives.

4. The business continuity plan will compliment major incident plans but extends

beyond it. It addresses potentially serious disruptions in the services provided by the clinical commissioning group that may not necessarily be of sufficiently high risk to trigger the major incident plan.

5. It coordinates a planned response to an event whose impact could not be handled

within routine service arrangements and would require the implementation of special planning procedures by the clinical commissioning group alone to respond to it.

Roles and Responsibilities

6. The clinical commissioning group Chief Executive Officer has overall responsibility for ensuring that the clinical commissioning group has business continuity management arrangements in place, in line with the requirements as outlined in the Civil Contingencies Act for Category One Responders.

7. A senior manager should be identified to act as business continuity manager with

the responsibility to prepare the clinical commissioning group’s business continuity planning. For NHS West Cheshire Clinical Commissioning Group this is the Head of Governance.


8. The clinical commissioning group is responsible for developing, maintaining, communicating and operating their own service level procedures to mitigate the impact of any incident affecting the normal delivery of their services.

9. A serious or major business continuity disruption would be reported via established

clinical commissioning group on-call procedures and managed through organisational frameworks.

Complimentary Links

10. The development of the clinical commissioning group’s business continuity plan

will compliment and link with the following:

• EPRR policy • Pandemic flu business continuity plan • Winter plan • On-call arrangements / action card

Service/Clinical Commissioning Group Business Continuity Plans

11. The clinical commissioning group is responsible for developing arrangements that

includes contingency plans and a task list for the recovery process to assure the governing body of its resilience in the face of potential interruptions.

12. The clinical commissioning group’s arrangements must ensure that they have

identified and agreed any support and services required from other parties – this information must be easily accessible and distributed to all personnel who have a specific part to play in a recovery.

13. The clinical commissioning group may decide the most appropriate format for their

business continuity planning. The templates and appendices provided within this paper detail NHS West Cheshire Clinical Commissioning Group’s business continuity arrangements:

• Template 1 Plan version control (page 2)

• Template 2 Form A - Assessment of Core Activities (page 8)

Form B - Business Impact Analysis (page 9) Form C - Risk Analysis (page 10) Form D - Prevention Measures (pages 11 – 13)

• Appendix A Classification of severity of a business continuity disruption

• Appendix B Risk analysis process and risk matrix

• Appendix C Key business continuity personnel contacts directory


• Appendix D Key resources and contractors contacts directory

• Appendix E ICT programmes to be restored as a priority

ICT Disaster Recovery Plan

14. In relation to any incident or situation resulting in a loss of IT Midlands and Lancashire Commissioning Support Unit ICT Services will develop an ICT Disaster Recovery Plan. The clinical commissioning group business continuity plan will identify those IT programmes on which its service is dependent to deliver its core activities.

Property Disaster Recovery Plan

26. In relation to any incident or situation resulting in denial of access to premises,

NHS England will develop a property disaster recovery plan. The clinical commissioning group business continuity plan will identify the type and location of any alternative premises they may confidently have access to. If there are no reasonable alternatives the property disaster recovery plan may be implemented.


BUSINESS CONTINUITY PLANNING ASSESSMENT OF SERVICE CORE ACTIVITIES

FORM A

Core Activity Commissioning of healthcare services (including Joint Commissioning) GP Locality Support Practice Member Services Financial Management Performance Management Contract Management Quality Improvement Patient and Public Engagement Programme/Project Delivery Transformational Change/Delivery

Is the Service a Statutory or Regulatory Requirement?

N/A

Resources required Staffing; IT; Premises; Budget Local and national ICT networks & support Local and national infrastructure/utilities

Accommodation required Standard Office Space

Essential equipment required Telephones (1829 Building network) PCs/laptops/iPads and ancillary equipment. Printer/Fax

Essential ICT Programmes Microsoft Office 2010 Packages including outlook (Email and Calendar systems) Telephony

How would you communicate with your staff?

By Mobile Phone; Landline; Email

Have you suggestions for alternative accommodation?

Any other suitable office space in the clinical commissioning group (West Cheshire) area

Can any of your staff work from home, have you considered implications?

Yes – the majority of staff can work from home given the nature of the functions performed.

Other comments


BUSINESS CONTINUITY PLANNING BUSINESS IMPACT ANALYSIS FORM B

List in order of priority the clinical commissioning group 3 main functions and the implications in the long and short term if they were disrupted. Where possible identify any significant cost implications.

Priority Service Impact / Implications (e.g. stakeholders / vulnerable groups)

1, to be restored within 0-24 hours

Contract Management Inability to respond to significant incidents, never events and other contractual breaches.

2, to be restored within 3 days

Clinical Leadership Inability to respond to the requirements of our clinical leaders.

3, to be restored within 14 days or more

Performance/Quality Management

Inability to take corrective action on any performance/quality deficits.


BUSINESS CONTINUITY PLANNING RISK ANALYSIS AGAINST 4 RISK SCENARIOS

PLEASE REFER TO RISK ANALYSIS PROCESS APPENDIX B FORM C

CORE ACTIVITIES DAMAGE/DENIAL OF ACCESS TO

PREMISES

LOSS/DAMAGE TO IT SYSTEMS - DATA

NON AVAILABILITY OF KEY STAFF

LOSS / DAMAGE TO OTHER

RESOURCES Priority Restored within 0 – 24 hours Risk Assessment Risk Assessment Risk Assessment Risk Assessment

1 Contract Management

Priority Restored within 3 days Risk Assessment Risk Assessment Risk Assessment Risk Assessment

2 Clinical Leadership

Priority Restored within 14 days or more Risk Assessment Risk Assessment Risk Assessment Risk Assessment

3 Performance/Quality Management


BUSINESS CONTINUITY PLANNING PREVENTION MEASURES

FORM D

Core Activity PRIORITY 1 – restored within

0 – 24 hours

Risk Analysis Score

Prevention Measures

Contract Management Damage/Denial of access to premises:- n/a

Loss/Damage to ICT systems/data:- Ensure we have remote access to key systems and data/documents.

Non availability of key staff Ensure cross cover arrangements are in place and robust.

Loss/damage to other resources n/a


Form D

Core Activity PRIORITY 2 - restored within

3 days

Risk Analysis Score

Prevention Measures

Clinical Leadership

Damage/Denial of access to premises:- n/a

Loss/Damage to ICT systems/data:- Ensuring contact database for clinical leaders is up to date and shared across Senior Management team.

Non availability of key staff Ensure cross cover arrangements are in place and robust.



Form D

Core Activity Priority 3 – restored within

14 days

Risk Analysis Score

Prevention Measures

Performance / Quality Management

Damage/Denial of access to premises:- n/a

Loss/Damage to ICT systems/data:- Ensure key performance information is up to date and available to access remotely and ensure key contacts are up to date and available to access remotely (CCG pocket action cards).

Non availability of key staff n/a



APPENDIX A CLASSIFICATION OF SEVERITY OF A BUSINESS CONTIINUITY DISRUPTION

A risk assessment based approach helps us to understand each of the risks faced, set them in priority order, act on them accordingly and evaluate their progress in achieving optimum preparedness.

In terms of grading the classifications of risk severity the following categories are applied.

GREEN Low risk Low

priority Manage situation by routine procedures

AMBER Medium risk

Medium priority

Management responsibility and action must be specified

RED (including any catastrophic event)

High risk High priority

Immediate action – Senior Management attention required. Senior Management to consider informing the Board.

Risks graded Red must be discussed with the responsible, or on-call director in case this should activate the E P R R Plan. Any incidents graded Red would need to be reported via the clinical commissioning group incident reporting system.

Risks graded Amber should be considered in the Service / clinical commissioning group business continuity plan. Any incidents graded Amber would also need to be reported via the clinical commissioning group c luster incident reporting system.

Risks graded Green would not need to be included in the Service/clinical commissioning g roup business c ontinuity Plan.


APPENDIX B

BUSINESS CONTINUITY PLANNING THE RISK ANALYSIS PROCESS

In business continuity management there are FOUR risk scenarios that require assessment:

• Damage or denial of access to premises – e.g. industrial action / fire / flooding/siege

• Loss or damage to IT systems / voice networks / hardware / software / data – e.g. power supplies / virus

• Non-availability of key staff – e.g. pandemic flu, industrial action, transport issues

• Loss or damage to other resources – e.g. fuel/power

The level of risk for each of these scenarios is a function of the LIKELIHOOD that an adverse event will occur, and the SEVERITY on stakeholders if the event actually occurs.

RISK = Likelihood (L) x Severity (S)

e.g. (L 1 x S 2 = 2), (L 2 X S 2 = 4), ( L 3 x S 3 = 9)

Score 1-2 Score 3 - 4 Score 6 - 9

SEE RISK MATRIX BELOW


APPENDIX B

The Risk Matrix

RISK CRITERIA FOR LIKELIHOOD / PROBABILITY

FACTOR SCORE THREATS – DESCRIPTION

INDICATORS

Very likely `

3 More than 75% chance of occurrence

Regular occurrence Circumstances frequently encountered – daily / weekly / monthly

Likely 2 40% - 74% chance of occurrence

Likely to happen at some point within the next 1-2 years Circumstances occasionally encountered (few times a year)

Unlikely 1 0% - 40% chance of occurrence

Only likely to happen no more than once in 3 years

RISK CRITERIA FOR SEVERITY/IMPACT

FACTOR SCORE INDICATORS

Major 0 – 24 hrs

3 Complete loss of Core Activity which could lead to fatalities, vulnerable people being without essential services.

Serious 24 hrs-3 days

2 Complete loss of Core Activity, no loss of life, which could lead to the immediate 0-24 hr response being unsupported (e.g. staff welfare).

Minor 3 - 14 days or more

1 Complete loss of Core Activity, non life threatening, but if not resumed within timescale impacts on partner agencies businesses, e.g. payment of invoices, effect on non-crucial areas (e.g. policy).

LIKELIHOOD

Very Likely 3 6 9

Likely 2 4 6

Unlikely 1 2 3

SEVERITY

Minor

Serious

Major


APPENDIX C

KEY BUSINESS CONTINUITY PERSONNEL - CONTACTS DIRECTORY

Name Job Title Service Business Continuity Role Office Tel Mobile Tel

Alison Lee Chief Executive Officer

CCG Lead Officer 01244 650364 07967 802840

Clare Dooley Head of Governance

CCG Business Continuity Administration Lead

01244 650318 07984 451715

Gareth James Chief Finance Officer

CCG Director of Service/ Line Manager to Staff

01244 650572 07751 398223

Lee Hawksworth Director of Operations


01244 650572 07825 256587

Laura Marsh Director of Commissioning Delivery


01244 650397 07751 072377

Paula Wedd Director of Quality and Safeguarding

CCG Head of Service/ Line Manager to Staff

01244 650504 07788 415734

Dr Huw Charles- Jones

GP Chair CCG Chair of CCG 01244 650364 07941 393315

Dr Andy McAlavey Medical Director CCG Clinical Leadership 01244 650364 07760 102145


APPENDIX D

KEY RESOURCES AND CONTRACTORS - CONTACTS DIRECTORY

Resource Resource Provider Hours/Days of Business

Telephone Fax Emergency Contact Tel

NHS England NHS Cheshire and Merseyside

24 HR 01772 867 640 – ask for NHS Gold Commander

n/a n/a

Neighbouring CCG South Cheshire Clinical Commissioning Group

24HR 0845 124 9871 n/a n/a

Neighbouring CCG Vale Royal Clinical Commissioning Group

24 HR 0845 124 9871 n/a n/a

Neighbouring CCG Wirral Clinical Commissioning Group

24 HR 0151 651 3914 ext 1011 (in hours) 0151 678 5111 (out of hours) – ask for the CCG on call manager

n/a n/a

Acute Hospital Provider Countess of Chester Hospital NHS Foundation Trust

24 HR 01244 365000 – ask for 1) CoCH On-call manager or 2) Director on-call

n/a n/a

Acute Hospital Provider Wirral Teaching Hospital NHS Foundation Trust

24 HR 0151 678 5111 – ask for Director/Manager on-call

n/a n/a

Acute Hospital Provider Mid Cheshire Hospitals NHS Foundation Trust

24 HR 01270 255141 – ask for 1) senior manager on-call or 2) Director on-call


APPENDIX D

KEY RESOURCES AND CONTRACTORS - CONTACTS DIRECTORY

Mental Health Provider Cheshire and Wirral Partnership NHS Foundation Trust

24 HR 01244 397397 (in hours) 01244 365000 (out of hours) – ask for CWP Director on 0n-call

n/a n/a

Community Services Cheshire and Wirral Partnership NHS Foundation Trust

24 HR 01244 397397 (in hours) 01244 365000 (out of hours) – ask for CWP 3rd

tier on-call Director

n/a n/a

GP Out of Hours GP Out of Hours 24 HR Admin Team – 01244 385111 OOH Number – 01244 385300

n/a n/a

Urgent Care Centre Partners for Health - 07703 582680 (John Hodgson / Linda Hodgson)

n/a n/a

Estates NHS PropCo 24 HR 01244 397724 (in hours) 01244 365000 (out of hours) – ask for Estate Manager on-call

n/a n/a

Ambulance Services North West Ambulance Service NHS Trust

24 HR 0151 260 5220 – ask for Duty Control Manager

n/a n/a

Local Authority Cheshire W est and Chester Council (Civil Protection Unit)

24 HR 0845 124 9830 n/a n/a


APPENDIX E

ICT PROGRMMES TO BE RESTORED AS A PRIORITY

Priority Application Resource Provider Hours/Days of Business

Office Tel Fax Emergency Contact Tel

Telephony Midlands and Lancashire ICT

Monday to Friday 0844 800 9982 0844 800 9982

Microsoft Office Suite Midlands and Lancashire ICT

8:30 am to 5pm except BH

0844 800 9982 0844 800 9982

Remote Access Midlands and Lancashire ICT

8:30 am to 5pm except BH

0844 800 9982 0844 800 9982

business continuity planning - west cheshire … · business continuity planning. ... reasonable...

Documents