Business Continuity Plan


Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Business Continuity Plan

  1. 1. NHS Haringey BUSINESS CONTINUITY PLAN March 2009 Revision September 2009 1
  2. 2. CONTENTS Page SECTION 1 – INTRODUCTION 4 1.1 OVERVIEW 4 1.2 DEFINITION 4 1.3 AIM 4 1.4 OBJECTIVES 4 1.5 ROLES & RESPONSIBILITIES 5 1.5.1 Chief Executive 1.5.2 Accountable Directors 1.5.3 Communications Team 1.5.4 All Staff 1.6 PLAN ASSUMPTIONS 5 SECTION 2 – RECOVERY STRATEGIES 6 2.1 COMMAND AND CONTROL STRATEGY 6 2.1.1 Emergency Management Team 2.2 ACCOMMODATION AND LOSS OF SITE STRATEGY 7 2.2.1 B1, St Ann’s Hospital 2.2.2 Hospitals/Health centres/Primary Care Centres 2.2.3 Flooding 2.2.4 Site Information 2.3 LOSS OF UTILITY SERVICES STRATEGY 7 2.3.1 Utilities 2.3.2 Telephony Failure 2.4 INFORMATION TECHNOLOCY STRATEGY 8 2.4.1 Incident Severity 2.4.2 Method of Notification 2.5 LOSS OF STAFF AND HUMAN RESOURCES STRATEGY 8 SECTION 3 – STAFF AND PUBLIC ANNOUNCEMENTS 8 3.1 Communication Strategy 8 SECTION 4 – SERVICE DELIVERY REQUIREMENTS 9 SECTION 5 – TRAINING 9 SECTION 6 – IMPLEMENTATION, MONITORING & REVIEW 9 2
  3. 3. 6.1 Implementation 9 6.2 Monitoring 10 6.3 Review and Learning 10 SECTION 7 – REFERENCES AND LINKS TO 10 OTHER POLICIES & PROCEDURES 3
  4. 4. SECTION 1 – INTRODUCTION 1.1 OVERVIEW The Civil Contingency Act 2004 identifies Primary Care Trusts (PCTs) as a Category 1 responder, along with organisations such as Health Protection Agency, Acute and Foundation Trusts etc. This means that, among other responsibilities, we must maintain business continuity plans to ensure we can continue to perform our functions in the event of an emergency, so far as reasonably practicable. We can then help others in the event of an emergency. In addition, business continuity management is an important part of the PCT’s risk management arrangements. No specific distinction is made between commissioning and support services, but the PCT must ensure that the highest level of service is maintained, regardless of what might happen to clinical/non clinical procedures, infrastructure or facilities. Robust business continuity plans must be put in place to manage disruption to the delivery of services, the cause of which may be many and varied. Examples are loss of power, fire, flood, an external incident or staff absence in adverse weather conditions, sickness. Events may not be mutually exclusive: extreme weather may lead to loss of electricity or disruption to transport may lead to staff unable to get to work. The business continuity plan is separate from, but may operate alongside, the PCT’s Major Incident Plan, including the Pandemic Flu Plan. 1.2 DEFINITION A service interruption is defined as ‘any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions’. Essential services must be maintained and normal services restored as soon as possible. 1.3 AIM The aim of this plan is to ensure that the critical functions of the PCT undertaken over its various sites are reinstated as soon as possible, ensuring an unbroken level of front line services, whilst full restoration is planned for and implemented. 1.4 OBJECTIVES To mobilise organisational resources to manage the recovery of PCT business. To ensure immediate remedial action. To demonstrate that short term measures are in place to limit disruption and restore critical service delivery. To demonstrate that medium term measures are in place to limit disruption and restore critical services and a return to normal service delivery. To demonstrate long term recovery action. 4
  5. 5. To review and learn lessons. 1.5 ROLES & RESPONSIBILITIES 1.5.1 Chief Executive The Chief Executive has overall responsibility for ensuring that the PCT has in place effective arrangements to respond to an incident that has the potential to affect service provision. 1.5.2 Accountable Directors Directors are accountable for providing a business continuity plan for their individual Directorates nominating a lead to: Complete an analysis of core functions and risk identification. Business continuity plans are completed for each risk identified. Business continuity plans are cascaded to appropriate staff within the directorate, who will be given appropriate training. Plans and core function analyses are reviewed annually or as soon as appropriate. 1.5.3 Communications Team In the event of an incident, the Communications Team is responsible for ensuring the management of communications to the public and media. 1.5.4 All Staff All staff are responsible for making themselves familiar with their individual roles as set out in: The PCT’s Business Continuity Plan Individual Departmental business continuity plans This information will be available on the NHS Haringey Intranet and included as part of induction. NB: Staff home/contact details have been gathered for internal communication purposes only and will not be included in any externally published information. 1.6 PLAN ASSUMPTIONS This plan often assumes a worst-case scenario in which critical information systems and resources are destroyed by fire, theft, sabotage, destructive natural or other unexpected events and which in turn prevent key service delivery functions being undertaken. It is assumed that all relevant PCT policy applying to the storage of record and file management, computer security and virus protection are being applied. It also assumes that normal fire prevention, physical security and safety at work standards are also being applied. 5
  6. 6. SECTION 2 – RECOVERY STRATEGIES 2.1 Command and Control Strategy The PCT’s Director of Communications and Partnerships (in hours) and the Oncall Director (out of hours,) are responsible for the following: Evaluating the extent of the disruption/damage and the potential consequences Implementing measures to prevent loss or damage to life, or property and resources and if required making any site safe and secure Cascading any necessary internal alert Authorising recovery procedures in order to provide an operational service to staff and service users Disseminating information to the public through the news and media by the Communications Team Ordering and acquiring replacement equipment, either where so authorised in Standing Financial Instructions (SFIs) and Standing Orders (SOs) or with Director approved waiver. (NB: if a waiver of SFIs or SOs is invoked this must be reported to the Audit & Governance Committee) Keeping control of expenditure arising from recovery operations Organising the return to normality once the emergency period has passed. 2.1.1 Emergency Management Team Managing severe disruption through to normal service delivery may require the formation of a specific Emergency Management Team which may consist of all or some of the following, reporting to the Chief Executive, with a lead appointed by the Chief Executive depending on the type of incident: Director of Communications and Partnerships Director of Public Health Director of Estates & Facilities Director of Human Resources Communications Team Emergency Planning Manager In the event of an incident resulting in the loss, or partial loss, of critical PCT functions, the Emergency Management Team will meet regularly throughout the duration of the service disruption. The Team, which will require a roaming IT profile so they can log on wherever they are based, will have full authority to decide which elements of the recovery plan should be invoked and will be responsible for the overall management, co-ordination, control and monitoring of the emergency situation. The Chief Executive will nominate a deputy Emergency Team Leader as appropriate. 6
  7. 7. 2.2 ACCOMMODATION AND LOSS OF SITE STRATEGY 2.2.1 St Ann’s Hospital In the event of partial or complete loss of St Ann’s Hospital, unaffected parts of the building will be utilised, wherever possible, to locate critical business functions. The displacement of non-critical functions, or functions that can be re-sited with little impact, will be carried out to provide accommodation for critical business functions. In the event of serious extensive damage to St Ann’s Hospital, it may be necessary to relocate to other premises. Alternative pre-selected locations with sufficient provisions for IT, communications, and work stations will include The Laurels Health Living Centre If necessary, further property may be leased on a short term basis until such time as full replacement or refurbishment has taken place in the damaged premises. The provision of portakabins will also be considered as a possible option. 2.2.3 Hospitals/Health Centres and Primary Care Centres Further discussions required to complete this section. 2.2.4 Flooding Details of the PCT’s strategy and actions in the event of flooding at a PCT site are held by the Estates’ Department in the ‘Emergency Manual’. Copies are held by relevant On-Call Maintenance Staff and the Emergency Management Team. 2.2.5 Site Information Documents containing full site information are held by On-Call Duty Maintenance Staff. 2.3 LOSS OF UTILITY SERVICES STRATEGY 2.3.1. Utilities The Facilities and Estates’ Department ‘Emergency Manual’ details the PCT’s operational response to several utility supply (including electricity, heating /hot water, water and gas), failures. 2.3.2 Telephony Failure Details of the strategy for dealing with major failures of the telephony system are set out in the Haringey Local Resilience Forum Telephony Failure Guide. 2.4 Information Technology Strategy The PCT’s Department of Information Technology has produced a wide ranging set of IT contingency plans, contained within the ‘IT Disaster Recovery Plan’. 7
  8. 8. 2.4.1 Incident Severity The IT Disaster Recovery Plan uses the following to determine the severity of incident affecting the Trust’s IT systems. Category Downtime Damage Minor Up to 1 day Insignificant Medium 2 to 3 days Small Large 4 to 10 days Partial Major More than 10 days Severe A Major Incident would be one where the failure of the application, server or communication link would affect either a single site or multiple sites with multiple users for an excessive time period and primary diagnostics cannot establish a reasonable timescale for resolution. 2.4.2 Method of Notification The IT Department should be notified of a critical incident via the following: Office Hours - by telephone from Director of Communications and Partnerships via the IT Helpdesk Out of Hours - by telephone by member of EMT or designated member of staff to the On-Call Technician 2.5 Loss of Staff and Human Resources This is included in the Major Incident plan and Flu Pandemic Plan. SECTION 3 STAFF AND PUBLIC ANNOUNCEMENTS 3.1 Communication Strategy All internal and external communications, to be made in accordance with policies and guidelines, will be routed through the PCT’s Communications Office at:- St Ann’s Hospital, S t Ann’s Road London, Telephone number (in hours): 020 8442 6322 Mobile out of hours: 07768298876 In the case of a major incident involving Gold Control, communications will be led by the organisation chairing Gold (including internal communications which will be co-ordinated by Gold Control). All internal, patient, relative and carer information will be channelled through the PCT Communications Office. All internal and external communications will be the responsibility of the duty Director/Communications Manager. SECTION 4 SERVICE DELIVERY REQUIREMENTS 8
  9. 9. 80% of purchases are procured through the NHS supply chain and the Business Continuity Champion for NHS Supply Chain confirms they have: 1) Site specific Crisis Management Plans (CMP) applicable to all sites Crisis management is defined as a) incident management - a business interruption of < 24 hours duration; b) business continuity management for business interruption > 24 hours duration. 2) NHS Supply Chain Pandemic Flu Plan at tactical and operational level. As activated by the World Health Organisation (WHO) levels of alert. In the event of a national fuel crisis, the NHS Supply chain has developed contingency plans involving the immediate isolation of enough fuel to last for approximately three weeks. In addition, we expect business priority to fuel due to the national importance of our business. SECTION 5 TRAINING Risk assessment training will be provided through the risk management team. Each Directorate/Department is responsible for ensuring that staff receive training appropriate to individual business continuity plans, as these are developed. SECTION 6 IMPLEMENTATION, MONITORING, REVIEW AND LEARNING 6.1 Implementation This policy and procedure will be distributed to all Directors and Heads of Department setting out their responsibilities. The policy will be available on the PCT website. 6.2 Monitoring The development of plans against a timetable approved by the Board will be monitored by the Corporate Team. Progress will be reported quarterly to the Audit & Governance Committee, through which the PCT Board will be kept informed. The Board will also receive reports in the Annual Emergency Planning Report as required by the Department of Health Emergency Planning Guidelines 2005. Assurance on emergency planning, including business continuity planning, will be presented to the Audit & Governance Committee and the Board in line with Standards for Better Health (core standard 24). 9
  10. 10. 6.3 Review and Learning Following an incident, the process of debriefing is important to enable each department to learn lessons from the incident with a view to future improvements. These lessons will be incorporated into future plans and shared as best practice. Informal ‘hot’ debriefs immediately following an incident are an essential part of the debriefing process in order to maximise recall and quickly disseminate useful information and provide the opportunity to ensure that staff are safe to continue duty, drive home, etc. It is important that any debriefing process includes staff from all levels of the command and control chain. The process should identify negative and positive aspects of the incident and identify recommendations to be included in the final report. At the conclusion of the incident, the Director of Communications and Partnerships will prepare a report on the incident, including the debriefing process, together with an action plan to address the issues raised. The report and action plan will be submitted for information to the Audit & Governance Committee This policy will be reviewed annually or as required. SECTION 7 REFERENCES AND LINKS TO OTHER POLICIES AND PROCEDURES Links with the following: Major Incident Plan Flu pandemic Plan Heat wave plan 2007 Public Health Continuity Plan Ηαρινγεψ Local Resilience Forum Telephone Failure Guide Estates emergency manual References: Civil Contingencies Act 2004 Planning for a possible flu pandemic – Home Office Business Continuity Management – Cabinet Office March 2007 Business Continuity & Contingency Management – Office of Government Commerce Business Continuity and Planning Procedure –Haringey TPCT 2008 Haringey TPCT– Contingency Plan 2008 10