BUSINESS CONTINUITY PLANNING

(1)

(2)

Business Continuity Planning

NHS West Cheshire Clinical Commissioning Group

April 2013 1

INDEX

Description Page

Index 1

Template 1 - Plan Version Control 2

Background 3

Purpose of Business Continuity Plan 3

Roles and Responsibilities 3

Complimentary Links 4

Service/ Clinical Commissioning Group Business Continuity Plans

4

ICT Disaster Recovery Plan 5

Property Disaster Recovery Plan 5

Template 2

• Form A - Assessment of Service Core Activities • Form B - Business Impact Analysis

• Form C - Risk Analysis

• Form D - Prevention Measures

6 7 8 9 Appendix A - Classification of severity of a business continuity

disruption

12

Appendix B - Risk Analysis process and risk matrix 13 Appendix C - Key business Continuity personnel contacts

directory

15

(3)

April 2013 2

Plan Version Control and Review

Template 1

Organisation

Address

NHS West Cheshire Clinical Commissioning Group 1829 Building

Countess of Chester Health Park Liverpool Road

Chester CH2 1HJ

Clinical Commissioning Group

Confirmation of completion Emergency Planning Service Business Continuity Plan

Responsible Person (Corporate) Date April 2013

Responsible Person (Service/CCG)

Date April 2013

Corporate Affairs Manager

Chief Officer

Confirmation of approval of Emergency Planning Service Business Continuity Plan

Proposed to NHS West Cheshire Clinical Commissioning Group Governing Body

(4)

April 2013 3

NHS WEST CHESHIRE CLINICAL COMMISSIONING GROUP

BUSINESS CONTINUITY PLANNING

Background

1. Under the Civil Contingencies Act Clinical Commissioning Groups have a duty to put in place Business Continuity Management arrangements. Local experiences of recent years which have required organisations to invoke Business Continuity Plans have included flood, fire, disruptions to electrical supply, communication failures and the fuel crisis. Other potential occurrences that also need to be considered when preparing Business Continuity Plans include the risk of Flu Pandemic and severe weather.

2. Significant events likely to cause serious interruption of the continuity of the Clinical Commissioning Group’s business warrant the activation of the NHS Commissioning Board Area Team Major Incident Plan. Minor business interruptions occur on a daily basis and are dealt with using regular and familiar systems and resources, such as general repair and maintenance contracts or routine management intervention.

Purpose of the Business Continuity Plan

3. The creation and maintenance of the Clinical Commissioning Group’s Business Continuity Plan ensures that there is a clear, workable plan for prompt action in the face of events that have the potential to compromise the normal expectations of services and delivery of objectives.

4. The Business Continuity Plan will compliment Major Incident Plans but extends beyond it. It addresses potentially serious disruptions in the services provided by the Clinical Commissioning Group that may not necessarily be of sufficiently high risk to trigger the Major Incident Plan.

5. It coordinates a planned response to an event whose impact could not be handled within routine service arrangements and would require the implementation of special planning procedures by the Clinical Commissioning Group alone to respond to it.

Roles and Responsibilities

6. The Clinical Commissioning Group Chief Officer has overall responsibility for ensuring that the Clinical Commissioning Group has Business Continuity Management arrangements in place, in line with the requirements as outlined in the Civil Contingencies Act for Category One Responders.

(5)

April 2013 4

planning. For West Cheshire Clinical Commissioning Group this is the Corporate Affairs Manager.

8. The Clinical Commissioning Group is responsible for developing, maintaining, communicating and operating their own service level procedures to mitigate the impact of any incident affecting the normal delivery of their services.

9. A serious or major business continuity disruption would be reported via established Clinical Commissioning Group on-call procedures and managed through organisational frameworks.

Complimentary Links

10. The development of the Clinical Commissioning Group’s Business Continuity Plan will compliment and link with the following:

• Major Incident Plan

• Pandemic Flu Business Continuity Plan • Winter Plan

• On Call arrangements / manual

Service/Clinical Commissioning Group Business Continuity Plans

11. The Clinical Commissioning Group is responsible for developing arrangements that includes contingency plans and a task list for the recovery process to assure the Governing Body of its resilience in the face of potential interruptions.

12. The Clinical Commissioning Group’s arrangements must ensure that they have identified and agreed any support and services required from other parties – this information must be easily accessible and distributed to all personnel who have a specific part to play in a recovery.

13. The Clinical Commissioning Group may decide the most appropriate format for their business continuity planning. The templates and appendices provided within this paper detail NHS West Cheshire Clinical Commissioning Group’s business continuity arrangements:

• Template 1 Plan version control (page 2)

• Template 2 Form A - Assessment of Core Activities (page 8) Form B - Business Impact Analysis (page 9)

Form C - Risk Analysis (page 10)

Form D - Prevention Measures (pages 11 – 13)

• Appendix A Classification of severity of a business continuity disruption • Appendix B Risk analysis process and risk matrix

(6)

April 2013 5

• Appendix D Key resources and contractors contacts directory • Appendix E ICT programmes to be restored as a priority

ICT Disaster Recovery Plan

14. In relation to any incident or situation resulting in a loss of IT, Cheshire ICT Services will develop an ICT Disaster Recovery Plan. The Clinical Commissioning Group Business Continuity Plan will identify those IT programmes on which its service is dependent to deliver its core activities.

Property Disaster Recovery Plan

(7)

April 2013 6

FORM A BUSINESS CONTINUITY PLANNING

ASSESSMENT OF SERVICE CORE ACTIVITIES

West Cheshire Clinical Commissioning Group

Core Activity Commissioning of healthcare services (including Joint Commissioning)

GP Locality Support Practice Member Services Financial Management Performance Management Contract Management Quality Improvement

Patient and Public Engagement Programme/Project Delivery Transformational Change/Delivery

Is the Service a Statutory or

Regulatory Requirement? N/A

Resources required Staffing; IT; Premises; Budget

Local and national ICT networks & support Local and national infrastructure/utilities

Accommodation required Standard Office Space

Essential equipment required

Telephones (1829 Building network)

PCs/laptops/iPads and ancillary equipment. Printer/Fax

Essential ICT Programmes Microsoft Office 2010 Packages including outlook (Email and Calendar systems)

Telephony How would you communicate

with your staff?

By Mobile Phone; Landline; Email

Have you suggestions for alternative accommodation?

Any other suitable office space in the Clinical Commissioning Group Cluster Western Cheshire area

Can any of your staff work from home, have you considered implications?

Yes – the majority of staff can work from home given the nature of the functions performed.

(8)

April 2013 7

FORM B BUSINESS CONTINUITY PLANNING

BUSINESS IMPACT ANALYSIS

List in order of priority the Clinical Commissioning Group 3 main functions and the implications in the long and short term if they were disrupted. Where possible identify any significant cost implications.

Priority Service Impact / Implications (e.g. stakeholders / vulnerable groups)

1, to be restored within 0-24 hours

Contract Management Inability to respond to significant incidents, never events and other contractual breaches.

2, to be restored within 3 days

Clinical Leadership Inability to respond to the requirements of our clinical leaders.

3, to be restored within 14 days or more

(9)

April 2013 8

FORM C BUSINESS CONTINUITY PLANNING

RISK ANALYSIS AGAINST 4 RISK SCENARIOS

PLEASE REFER TO RISK ANALYSIS PROCESS APPENDIX B

CORE ACTIVITIES DAMAGE/DENIAL

OF ACCESS TO PREMISES LOSS/DAMAGE TO IT SYSTEMS - DATA NON AVAILABILITY OF KEY STAFF LOSS / DAMAGE TO OTHER RESOURCES Priority Restored within 0 – 24 hours Risk Assessment Risk Assessment Risk Assessment Risk Assessment 1

_{Contract Management}

Priority Restored within 3 days Risk Assessment Risk Assessment Risk Assessment Risk Assessment 2

_{Clinical Leadership}

(10)

April 2013 9

FORM D BUSINESS CONTINUITY PLANNING

PREVENTION MEASURES West Cheshire Clinical Commissioning Group

Core Activity

PRIORITY 1 – restored within 0 – 24 hours

Risk Analysis Score

Prevention Measures

Contract Management

Damage/Denial of access to premises:-

n/a

Loss/Damage to ICT systems/data:-

Ensure we have remote access to key systems and data/documents.

Non availability of key staff

Ensure cross cover arrangements are in place and robust.

Loss/damage to other resources

(11)

April 2013 10

Form D BUSINESS CONTINUITY PLANNING

Core Activity

PRIORITY 2 - restored within

3 days

Clinical Leadership

n/a

Ensuring contact database for clinical leaders is up to date and shared across Senior Management team.

Non availability of key staff

Ensure cross cover arrangements are in place and robust. Loss/damage to other resources

(12)

April 2013 11

Form D BUSINESS CONTINUITY PLANNING

Core Activity

Priority 3 – restored within 14 days

Performance Management

n/a

Ensure key performance information is up to date and available to access remotely and ensure key contacts are up to date and available to access remotely (CCG pocket action cards).

Non availability of key staff n/a

(13)

April 2013 12

APPENDIX A

CLASSIFICATION OF SEVERITY OF A BUSINESS CONTIINUITY DISRUPTION

A risk assessment based approach helps us to understand each of the risks faced, set them in priority order, act on them accordingly and evaluate their progress in achieving optimum preparedness.

In terms of grading the classifications of risk severity the following categories are applied.

GREEN Low risk Low

priority

Manage situation by routine procedures AMBER Medium risk Medium priority Management responsibility and action must be specified

RED

(including any catastrophic event)

High risk High priority

Immediate action – Senior Management attention required. Senior

Management to consider informing the Board.

 Risks graded

Red

must be discussed with the responsible, or

on-call director in case this should activate the Clinical

Commissioning Group’s Major Incident Plan. Any incidents

graded

Red

would need to be reported via the Clinical

Commissioning Group Incident Reporting system.

 Risks graded Amber should be considered in the Service /

Clinical Commissioning Group Business Continuity Plan. Any

incidents graded Amber would also need to be reported via

the Clinical Commissioning Group Cluster Incident Reporting

system.

 Risks graded Green would not need to be included in the

Service/Clinical Commissioning Group Business Continuity

Plan.

(14)

April 2013 13

APPENDIX B

BUSINESS CONTINUITY PLANNING

THE RISK ANALYSIS PROCESS

In Business Continuity Management there are FOUR risk scenarios that

require assessment:

• Damage or denial of access to premises – e.g. industrial action / fire /

flooding/siege

• Loss or damage to IT systems / voice networks / hardware / software /

data – e.g. power supplies / virus

• Non-availability of key staff – e.g. pandemic flu, industrial action,

transport issues

• Loss or damage to other resources – e.g. fuel/power

The level of risk for each of these scenarios is a function of

the LIKELIHOOD that an adverse event will occur, and the

SEVERITY on stakeholders if the event actually occurs.

RISK = Likelihood (L) x Severity (S)

e.g. (L 1 x S 2 = 2), (L 2 X S 2 = 4), ( L 3 x S 3 = 9)

Score 1-2 Score 3 - 4 Score 6 - 9

(15)

April 2013 14

APPENDIX B

The Risk Matrix

RISK CRITERIA FOR LIKELIHOOD / PROBABILITY

RISK CRITERIA FOR SEVERITY/IMPACT

FACTOR SCORE INDICATORS

Major 0 – 24 hrs

3 Complete loss of Core Activity which could lead to fatalities, vulnerable people being without essential services.

Serious 24 hrs-3 days

2 Complete loss of Core Activity, no loss of life, which could lead to the immediate 0-24 hr response being unsupported (e.g. staff welfare).

Minor

3 - 14 days or more

1 Complete loss of Core Activity, non life threatening, but if not resumed within timescale impacts on partner agencies businesses, e.g. payment of invoices, effect on non crucial areas (e.g. policy).

FACTOR SCORE THREATS –

DESCRIPTION INDICATORS Very likely ` 3 More than 75% chance of occurrence Regular occurrence Circumstances frequently encountered – daily / weekly / monthly

Likely 2 40% - 74% chance

of occurrence

Likely to happen at some point within the next 1-2 years Circumstances occasionally encountered (few times a year)

Unlikely 1 0% - 40% chance

of occurrence

Only likely to happen no more than once in 3 years

LIKELIHOOD

Very Likely 3 6 9

Likely 2 4 6

Unlikely 1 2 3

(16)

April 2013 15

APPENDIX C

KEY BUSINESS CONTINUITY PERSONNEL - CONTACTS DIRECTORY

Name Job Title Service Business Continuity Role Office Tel Mobile Tel

Alison Lee Chief Officer CCG Lead Officer 01244 650364 07967 802840

Clare Dooley Corporate Affairs Manager

CCG Business Continuity Administration Lead

01244 650318 07984 451715

Gareth James Chief Finance Officer

CCG Head of Service/ Line Manager to Staff

01244 650572 07751 398223

Rob Nolan Head of

Contracting and Performance

01244 650572 07825 256587

Laura Marsh Head of Delivery CCG Head of Service/ Line Manager to Staff

01244 650397 07751 072377

Helen McCairn Head of Joint Commissioning

01244 650572 07787 893708

Paula Wedd Head of Quality and Safeguarding

01244 650504 07788 415734

Dr Huw Charles-Jones

Chair CCG Chair of CCG 01244 650364 07941 393315

(17)

April 2013 16

APPENDIX D

KEY RESOURCES AND CONTRACTORS - CONTACTS DIRECTORY

Resource Resource Provider Hours/Days of

Business

Telephone Fax Emergency Contact

Tel CWW Area Team On Call Staff CWW Commissioning

Support Services

24 HR 01772 657 640 (backup 0151 261 4200) – as for the Regional Health Control Desk then ask for the Cheshire Area Team’s first on call manager

n/a n/a

Cheshire NHS Gold Commander NHS Cheshire, Warrington and Wirral

24 HR 01772 867 640 – ask for Cheshire NHS Gold Commander

n/a n/a

Neighbouring CCG South Cheshire Clinical Commissioning Group

24HR 0845 124 9871 n/a n/a

Neighbouring CCG Vale Royal Clinical Commissioning Group

24 HR 0845 124 9871 _n/a _n/a

Neighbouring CCG Wirral Clinical

Commissioning Group

24 HR 0151 651 3914 ext 1011 (in hours)

0151 678 5111

(out of hours) – ask for the CCG on call manager

n/a n/a

Acute Hospital Provider Countess of Chester Hospital NHS Foundation Trust

24 HR 01244 365000 – ask for 1) CoCH On-call manager or 2) Director on-call

n/a n/a

Acute Hospital Provider Wirral Teaching Hospital NHS Foundation Trust

24 HR 0151 678 5111 – ask for Director/Manager on-call

n/a n/a

Acute Hospital Provider Mid Cheshire Hospitals NHS Foundation Trust

(18)

April 2013 17

Mental Health Provider Cheshire and Wirral Partnership NHS Foundation Trust

24 HR 01244 397397 (in hours) 01244 365000 (out of hours) – ask for CWP Director on 0n-call

n/a n/a

Community Services NHS Community Care Western Cheshire

24 HR 01244 397397 (in hours) 01244 365000 (out of hours) – ask for CWP 3rd tier on-call Director

n/a n/a

GP Out of Hours GP Out of Hours 24 HR Admin Team – 01244 385111

OOH Number – 01244 385300

n/a n/a

Urgent Care Centre Partners for Health - 07703 582680 (John Hodgson / Linda Gorst)

n/a n/a

Estates CWP Estates Team 24 HR 01244 397724 (in hours)

01244 365000 (out of hours) – ask for Estate Manager on-call

n/a n/a

Ambulance Services North West Ambulance Service NHS Trust

24 HR 0151 260 5220 – ask for Duty Control Manager

n/a n/a

Strategic Health Authority NHS North 24 HR 0161 233 4732 (in hours) 01772 716565 (out of hours)

n/a n/a

Local Authority Cheshire West and Chester Council (Civil Protection Unit)

(19)

April 2013 18

ICT PROGRMMES TO BE RESTORED AS A PRIORITY Priority Application Resource Provider Hours/Days of

Business

Office Tel Fax Emergency

Contact Tel

Telephony Cheshire ICT Monday to Friday 0844 800 9982 0844 800 9982

Microsoft Office Suite Cheshire ICT 8:30 am to 5pm except BH

0844 800 9982 0844 800 9982

Remote Access Cheshire ICT 8:30 am to 5pm

except BH