BUSINESS CONTINUITY PLAN

(1)

Business Continuity Plan – Jan 2015 to Jan 2016 (FINAL v.5.3)

East and North Hertfordshire Clinical Commissioning Group

Page 1 of 50

BUSINESS CONTINUITY PLAN

Additional copies of this Plan can be found in the Incident Control

Room located in the office next to the Boardroom, second floor,

(2)

Page 2 of 50 DOCUMENT CONTROL SHEET

Document Owner: Director of Operations

Document Author(s): EPRR Lead

Version: 5.3 FINAL

Directorate: Operations

Approved By: Governing Body

Date of Approval: 15 January 2015

Date of Review: 15 January 2016

Change History: Implementation Plan: Development and Consultation  EPRR Consultant  Executive Team

Dissemination Staff can access this policy via the intranet and will be notified of new/revised versions via the staff briefing.

This policy will be included in CCG Publication Scheme in compliance with the Freedom of Information Act 2000.

Version Date Reviewer(s) Revision Description

1.0 July 2013 Valarie Penn Updated following JW

comments

2.0 August 2013 Valarie Penn General update following Draft Business Impact Assessments

3.0 October 2013 John Webster Whole Document Review –

Updates to Plan, Business Impact Assessments and Policy Statement in line with EPRR Core Standards

4.0 November

2013

Valarie Penn Updated following Exec Comments

4.1 January 2015 Oskan Edwardson Annual Update – for approval

5.0 January 2015 Jas Dosanjh Formatting

5.1 April 2015 Jas Dosanjh

Sharn Elton

Appendix 3 updated. Critical Functions of the Operations Director added to Appendix 4 – section 2.5 5.2 June 2015 Anne Ephgrave Critical Functions of HR added

to Appendix 4 – section 2.3.1 5.3 July 2015 Phil Turnock Addition of section 6.3.1

(3)

Page 3 of 50

Training The emergency and business continuity response

arrangements within the plan will be ineffective if the staff expected to implement them at the time are unaware of them. Therefore all staff will be made aware of the plan at their corporate induction training and mandatory risk training, and will also be made aware of where the overarching and departmental plans can be located.

If there are any significant changes to the plan, then this will be communicated to departmental leads to cascade to all staff. Business Continuity arrangements w i l l be exercised at least once a year in order to validate the effectiveness and highlight any gaps which can then be corrected.

Monitoring and Review

This document will be reviewed on an annual basis or when there are changes in the working systems of the organisation; or major changes to the contact arrangements of staff or suppliers that affect the content. The date of the review will be recorded on the front of the document.

It is the responsibility of the identified departmental leads to update local departmental plans on an ongoing basis and the Emergency Planning Manager to ensure the generic section of this document is kept update

Equality and Diversity

January 2015 - Equality Impact Assessment (Appendix 5) January 2015 - Privacy Impact Assessment (Appendix 6)

Associated CCG Documents

The following documents must be read in conjunction with this policy:

 Major Incident Plan  System Escalation Plan  Major Incident Action Cards

 CCG Risk Register/Risk Management Dashboard References

 The ISO Standard for Business Continuity (ISO 22301)

(4)

Page 4 of 50 Contents

Section No. Section Name Page No.

1.0 Introduction 5

2.0 Scope 6

3.0 Purpose 7

4.0 Definitions 7

5.0 Role and Responsibilities 8

6.0 Plan Activation 8

6.1 Business Continuity Management Team (Crisis and Recovery Team)

9

6.2 Continuing Services in the Event of a Disruption 9

6.3 Failure of IT Systems 10

6.4 Failure of Telecommunications 11

6.5 Failure of Utilities – Electricity / Gas / Water Supplies 12

6.6 Loss of CCG Buildings 12

6.7 Fuel Shortages 12

6.8 Staff Shortages 12

6.9 Communications 13

Appendix 1 Business Continuity Management – CCG Policy Statement

14

Appendix 2 Business Recovery Template 16

Appendix 3 Key Contacts List 17

Appendix 4 Business Impact Assessments 18

Appendix 5 Equality Impact Assessment 49

(5)

Page 5 of 50 1.0 Introduction

The Civil Contingencies Act 2004 came into force in November 2005 and focuses on local arrangements for civil protection, establishing a statutory framework of roles and responsibilities for local responders (such as CCGs) as Category 2 Responders. It is a requirement of the Act that the CCGs have Business Continuity Plans in place to support the CCG’s Major Incident Plan.

1.1 Policy statement

It is the policy of East & North Hertfordshire Clinical Commissioning Group (CCG) to develop, implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy.

It is the policy of the CCG to take all reasonable steps to ensure that in the event of a service interruption, the organisation will be able to respond appropriately and continue to deliver its essential functions and that we are able to respond to the needs of our local population. A service interruption is defined as:

‘Any incident which threatens personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions.’ (www.cabinetoffice.gov.uk/ukresilience).

The CCGs Policy Statement is provided at Appendix 1. 1.2 Resources

The CCG recognises its obligations with regards to emergency planning, resilience, responding to major incidents and business continuity. Funds, as identified as being necessary, will be made available in the event of a major incident to ensure the CCG meets its obligations with respect to these.

1.3 Emergency Planning - Business Continuity

The Cabinet Office’s “Expectations and Indicators of Good Practice Set for Category 1 and 2 Responders” describes seven expectations regarding the Civil Contingencies Act (2004), Regulations (2005) and guidance:

1. Duty to assess risk

2. Duty to maintain plans – Emergency Plan 3. Duty to maintain plans – Business Continuity 4. Duty to communicate with the public

5. Business Continuity Promotion 6. Information sharing

7. Cooperation

(6)

Page 6 of 50

Stage 1 – A Business Impact Assessment:

The impacts of the loss of staff, communications, data systems, transport and buildings.

Appendix 4 provides details of the Business Impact Assessments undertaken at Departmental level within the CCG. Some functions are hosted by or delivered through contracts with other organisation’s (e.g. PropCo Ltd). These assessments are also provided.

Stage 2 - A Business Continuity Plan:

The measures to be taken internally in the event of such a loss.

The Business Continuity Plan will comprise the mitigating actions arising from the Impact Assessments, the key contacts that will instigate the relevant mitigating actions and the contact details of all staff that might have to undertake those actions - be it communicating with others or changing their way of working.

Stage 3 – A Major Incident Plan:

The measures to be taken in support of Category 1 responders in the event of an ‘Emergency’.

This details the organisation’s response to:



an event or situation which threatens serious damage to human welfare;



an event or situation which threatens serious damage to the environment;



War, or terrorism, which threatens serious damage to the security of the UK. The CCG is required to equip nominated staff with the Major Incident Plan, the Business Continuity Plan, an incident control centre, an emergency telephone line and a list of all relevant telephone and email contacts.

The plans have been built on experience and will be subject to a desktop test, as part of best practice, in order that they are further refined. The result of the desktop testing will be reported to the CCG Governing Body.

2.0 Scope

The scope of this plan is to provide overarching organisational guidance of business continuity management and the invocation process within the CCG, and an outline of responsibilities.

The following table indicates the links with other CCG and System Resilience Plans: Document

Community Risk Register The CCG is a Level 2 responder for Emergency Preparedness Resilience and Response which will be led by the NHS England Midlands and East (Central Midlands) Area Team. These plans will be owned by the Local Resilience Forum with input from the Local Health

resilience Partnership. However, the CCG will have a role in planning for and responding to the relevant incident.

LRF Flood Plan

LRF Pandemic Influenza Plan

(7)

Page 7 of 50 3.0 Purpose

The purpose of the Business Continuity Plan is to outline the responsibility of the CCG and their staff in the event of a crisis in order to maintain as normal a service as practically possible. The over-riding aim is to ensure a prompt and efficient recovery of critical activities from any incident or physical disaster that may affect the CCG’s ability to operate and deliver their commissioning service in support of the NHS economy. It must be recognised that any event not only impacts on staff, premises, technology and operations, but also on the CCG’s brand, status, relationships and reputation and that all business continuity arrangements should ensure that the CCGs meet their legal, statutory and regulatory obligations to both their staff and dependent stakeholders.

4.0 Definitions

4.1 Business Continuity Management is the process that helps manage the risks to the smooth running of the organisation in the delivery of its services, ensuring that essential business can continue in the event of a disruption and can be sustained in the event of an emergency. It is aimed at reducing or eliminating the risks of business interruption and it is necessary to have contingency plans in place to ensure normal business functions can be resumed as soon as possible.

4.2 A Service Interruption can be defined as ‘Any incident which threatens

personnel, buildings or the operational procedures of an organisation and which requires special measures to be taken to restore normal functions’

For the NHS, Business Continuity Management is defined as the management process that enables an NHS organisation:



To identify those key services which, if interrupted for any reason, would have the greatest impact upon the community, the health economy and the organisation.



To identify and reduce the risks and threats to the continuation of these key services.



To develop plans which enable the organisation to recover and/or maintain core services in the shortest possible time.

There are many and varied possible causes of service disruption; these may range from the loss of infrastructure e.g. offices; buildings; IT systems; managing a power cut or extreme weather to arranging service provision during an emergency or epidemic. These events may not be mutually exclusive i.e. extreme weather can lead to loss of electricity or staff being unable to get to work.

5.0 Roles and Responsibilities

Overall accountability for the smooth running of the organisation lies with the CCG’s Accountable Officer. The Director of Operations is the lead Director for Business Continuity and will be responsible for providing positive assurance to the Governing Body on the CCG’s plans.

(8)

Page 8 of 50 5.2 Designated Associate Directors and Assistant Directors must

ensure that any changes of contact details of key staff noted in their plans are updated as required, that their Directorate plans are reviewed at least annually and that any new services that are developed are included in the plans. 5.3 The Head of Emergency Preparedness, Response and Business Continuity will provide specialist guidance during the invocation of any part of the Business Continuity Plans and will assist in coordinating any actions required.

5.4 The Communications Team will be responsible for informing the public of events where necessary, following agreement of the Accountable Officer or Director of Operations (designated deputy), and will also keep staff informed of developments as appropriate.

5.5 All CCG employed staff are responsible for co-operating with the implementation of the Business Continuity Plans as part of their normal duties and responsibilities.

6.0 Plan activation

A nominated post holder from each department will decide in discussion with the Heads of Department and the Director of Operations whether the plan or any part of it should be activated using the process in the following flow chart. Out of hours the

(9)

Page 9 of 50 6.1 Business Continuity Management Team (Crisis and Recovery Team)

A team will be convened t o oversee the process of ensuring essential services are maintained and that recovery plans are put into place, Membership may include the following:

 Director of Operations or nominated Deputy

 Associate Director where incident has occurred

 Lead for Emergency Preparedness, Response & Business Continuity

 Communications Manager

 Estates representation (as required)

 Any other personnel deemed necessary, i.e. representative of HR, specialist advice, etc.

The team will meet initially on a daily basis and will keep notes of the meeting, actions taken, resources committed, and progress made using the template a t Appendix 3. Incident Control Centre location and resources: located in the Office next to the Boardroom, Second Floor, Charter House, WGC. Includes additional paper copies of this Plan.

6.2 Continuing Services in the event of a Disruption

As part of the Business Impact Assessment process, a critical function analysis has been carried out to determine those parts of the service that are a priority to maintain or reinstate. The CCG is responsible for commissioning a wide range of patient services to the local population and the following will be restored and maintained as soon as is practically possible.

 Maintaining an emergency response and support to Category 1 responders;

 Incident investigation;

 Mobilisation of the workforce, and support for staff safety and welfare;

 Provision of IT (through a shared service (called Herts Beds and Luton ICT Shared Service) with ENHCCG as the host for this service);

 Maintaining communications with the general public and CCG staff;

 Essential Finance functions; including the making and receiving of payments;

 Essential HR processes;

 Safeguarding adults and children; and

 Continuity of contract management responsibilities

 System leadership role.

The critical function analysis also identifies those functions that are less critical and could be suspended.

Service Function Length of time function

can be suspended for

Financial management 7 days

Planning services - preparing commissioning plans 28 days

Commissioning services through pathway development and

redesign 28 days

(10)

Page 10 of 50

Contract management – community and third sector 14 days

Performance and data analysis 14 days

Governance duties to ensure continuous compliance with statutory

duties 14 days

Partnership working to ensure joined up working to improve the

health and wellbeing of patients 14 days

Support and guidance to member practices 14 days

Quality and safety 14 days

Administration 14 days

If an incident occurs and this plan is activated, permission will be sought from the Accountable Officer, or in their absence the Director of Operations (or nominated Deputy) to suspend the mainstream service functions detailed above and release the CCG staff who cover these functions to provide support to critical functions provided in other areas of the CCG.

Each department has identified its own critical functions that are required to maintain its service and have their own local departmental plans which a r e accessible in both paper copy and electronically. It is the responsibility of designated Associate/Assistant Directors to communicate the location of these plans to their staff.

In the event of an emergency, or business interruption, the CCG will endeavor to maintain services as usual or as close to the usual standard as possible. However, where it is clear that this is not achievable, the Head of Service in conjunction with the Director of Operations ( or on-call Director/Manager if out of hours) will decide which priority functions of the department must continue, depending on the nature of the business interruption.

There are some generic areas that could potentially affect all departments and these are described below:

6.3 Failure of IT systems

The CCG, like many organisations, rely upon IT systems for their day to day business. A disaster that prevents the organisation from accessing these systems whether caused by the failure of the systems themselves, or being due to an incident such as fire or flooding will potentially have a serious impact on the continuation of the CCG’s functions.

While it is impossible to consider and document a recovery plan for every disaster that may occur the impact of the loss of IT systems to each department is covered in the individual departmental plans and it is expected that they can be adapted to cater for any specific incident. If there is a failure in the IT system or any stand-alone computer for important data for a prolonged period of time, staff will need to change to a paper back-up system where possible to capture the data so that this can be recorded on the system retrospectively.

(11)

Page 11 of 50 departmental plans.

If there is a loss of hardware or software through theft or damage then advice should be sought from the IT provider and the incident reported to the CCG’s Risk team (via the Associate Director of Governance).

The maintenance of the CCG IT systems is provided by the Herts Beds and Luton ICT Shared Service (HBL ICT) under a Service Level Agreement (SLA). Under the terms of this SLA HBL ICT will invoke their Emergency Disaster and Recovery Plan to cope with any event causing prolonged interruption of service.

6.3.1 Objectives for the Recover of Services

Recovery of Services:

The recovery of Services in a Disaster Recovery or Business Continuity scenario is defined by two Objectives:

Recovery Time Objective:

The Recovery Time Objective (RTO) is defined as the time period after a disaster at which business functions need to be restored.

Recovery Point Objective:

The Recovery Point Objective (RPO) is the maximum period of time based data loss (relative to the disaster) which cannot be recovered.

The standard RPO & RTO within the agreed partnership service agreements is:

 RPO – 1 day from date of failure

 RTO = 24 hours from the time of failure Restore:

Restoration of services will be managed through the agreement ICT Major Incident processes which will include full engagement of the CCG executive. Whereby the standard RPO or RTO cannot be achieved, this will be brokered with the CCG Executive during the respective phases of the Major Incident process.

6.4 Failure of Telecommunications

The telephone lines are provided under contract with BT, and the system is under a maintenance contract with Vodafone.

MTPASS SIM cards have been requested for the on-call phone and those of the Emergency Planning Officer and the on-call Directors and managers. This will provide resilience in terms of key staff needing to respond to potential incidents covered by this plan.

Each departmental plan identifies in more detail the actions required should the telephone systems be inactive. The priority in which restoration of phone lines are required will depend on the service area and if crucial will be detailed in individual departmental plans.

CCG contact in the first instance: HBLICT Service Desk on 07748 111561*

(12)

Page 12 of 50 If electricity has failed then prior consideration needs to be given to the ability to recharge mobile phone batteries.

6.5 Failure of Utilities – Electricity / Gas / Water Supplies Resolution is via NHS Property Services

The fault should be reported and a request made as to whether they are able to give an indication of the length of time the supply will be unavailable.

If heating is lost an assessment should be made to the effect of the loss of the heating related to the time of year and the forecast temperature as to whether services can continue from the affected location.

For plumbing emergencies: contact NHS Property Services CCG contact in the first instance: NHS Property Services

In the event that the water supply fails the impact of the following must be assessed:

 Toilets

 Hand hygiene

 Drinking water

6.6 Loss of CCG Building

If premises are unable to be used then services may need to be suspended or relocated. Local departmental plans will detail who to contact and measures to be taken. The Lead for Emergency Preparedness, Response & Business Continuity will assist in finding alternative accommodation should CCG buildings be affected.

Alternative locations for staff will include HCT HQ at Howard Court, HPFT HQ at Waverley Road, St Albans and HVCCG HQ at Hemel Hempstead. Initiation of these arrangements will be agreed by the Director of Operations (or nominated Deputy) or by agreement with the on-call Director/Manager.

6.7 Fuel Shortages

In the event of a fuel shortage the ability to maintain services may be affected. If it has been necessary for the invocation of the National Fuel Plan then the Business Continuity Management Team will be convened to oversee the management of the situation within the CCG

It is unlikely there will be provision of fuel for staff to get to their work base and the responsibility for alternative travel arrangements is with the individual members of staff in discussion with their line manager.

6.8 Staff Shortages

(13)

Page 13 of 50 There may be a scenario when a number of staff are all incapacitated at the same time such as pandemic influenza. The departmental manager will be responsible for assessing the impact on the ability to continue to provide a service and what contingencies can be put in place, and whether some non- critical services can be cancelled as detailed in the individual departmental plans.

6.9 Communication

(14)

Page 14 of 50 Appendix 1

Business Continuity Management Policy Statement

“Business Continuity Management (BCM) is an important part of NHS East & North Hertfordshire CCG’s risk management arrangements. The Civil Contingencies Act (CCA) 20041 identifies all CCGs as ‘Category 2 Responders’, and imposes a statutory requirement on each CCG to have robust BCM arrangements in place to manage disruptions to the delivery of services.

It is the policy of NHS East & North Hertfordshire CCG to develop implement and maintain a Business Continuity Management System (BCMS) in order to ensure the prompt and efficient recovery of our critical activities from any incident or physical disaster affecting our ability to operate and deliver our services in support of the NHS economy.

The aim of Business Continuity Management is to prepare for any disruption to the continuity of the business, whether directly - i.e. within the responsibility control or influence of the business, or indirectly - i.e. due to a major incident occurring to a partner, supplier, dependent or third party, or from a natural disaster.

It is recognised that plans to recover from any disruption must consider the impacts not only to our staff, premises, technology and operations, but that NHS East & North Hertfordshire CCG must also plan to maintain its brand, status, relationships and reputation.

Business Continuity arrangements should ensure that the CCG continues to meet i t s legal, statutory and regulatory obligations to its staff and to its dependent stakeholders. All NHS East & North Hertfordshire CCG departments are to continue to develop and implement BCM for their areas of business.

In order for this to be achieved, members of each department have been nominated as Business Continuity Leads to represent their part of the business for Business Continuity Management. These individuals are responsible for reviewing and maintaining the departmental Business Continuity arrangements within the CCG. To ensure that the BCMS fully meets the changing needs of the business all Business Continuity Plans will be exercised, reviewed and audited annually. In accordance with the NHS E n g l a n d Guidance2, NHS East & North Hertfordshire CCG BCMS will be in accordance with and aligned to the ISO 223013.”

……… ………

Lesley Watts Date Accountable Officer

1

NM Government (2004) Civil Contingencies Act

2

NHS England (2013) Board Business Continuity Framework

(15)

Page 15 of 50 Appendix 2

Business Recovery Template

Reason for Invoking Plan:

Date:

Time:

Brief Summary of Situation:

Department/s Affected:

Other Organisations Involved / Alerted:

(16)

Page 16 of 50 Actions Required (including Resources)

Immediate:

Within 8 Working Hours:

Within 1 Working Day:

Within 3 Days:

Within 1 Week:

Situation to be reviewed every ………..hrs / …….days

(17)

East and North Hertfordshire Clinical Commissioning Group Page 17 of 50 Appendix 3

Key CCG Contacts

On Call Member Role Email Work Mobile Work Number

(18)

East and North Hertfordshire Clinical Commissioning Group Page 18 of 50 Appendix 4

Business Impact Assessments

East and North Hertfordshire

Clinical Commissioning Group

Version:

Ratified by: Governing Body

Date ratified: January 2015

Job title of originator/author: Director of Operations

Name of responsible committee/individual: Accountable Officer

Date issued: January 2015

Review date: January 2016

(19)

East and North Hertfordshire Clinical Commissioning Group Page 19 of 50

The Business Impact Assessments

Section 1:

Critical Functions of the Governing Body Members

1.1 Governing Body 1.2 Accountable Officer

Section 2:

Critical Functions of Directorates

2.1 Finance [including ICT] 2.1.2 HBL ICT Shared Service 2.2 Commissioning

(20)

East and North Hertfordshire Clinical Commissioning Group Page 20 of 50 SECTION 1 – Critical Functions of the CCG Governing Body Members

 To provide leadership (including clinical leadership) in their individual/specialist areas

 To undertake statutory roles and duties (SIRO, Caldicott Guardian, Safeguarding, Data Protection Officer)

 To attend meetings of the CCG Governing Body and the Committees of which they are members

 To ensure that the Governing Body meets its duties

Section 1.1 – East and North Hertfordshire CCG Governing Body Key Contacts:

 Hari Pathmanathan - Chair

 Lesley Watts - Accountable Officer

 Alan Pond - Finance Director (SIRO)

 Sharn Elton - Director of Operations (EPRR responsibilities)

 Denise Boardman - Interim Director of Commissioning

 Sheilagh Reavey - Director of Nursing and Quality (Caldicott Guardian)

 Beverley Flowers - Director of Strategic Partnerships Minimum Levels of Service that need to be maintained

a. Performance of statutory duties within set timescales / 3 days b. Availability of clinical leadership within 24 hours

c. Ongoing governance of the organisation within 5 working days

d. Scheduled meetings of the Governing Body and key committees to the prescribed frequency Contingency

Priority for the Restoration of Services

1. Critical: Immediate Response - Danger to staff and/or patients. Prevents provision of an essential service/function 2. Urgent: Within 8 hours – Will degrade to ‘Critical’ if not addressed within this time band

3. Essential: Within 24 hours – Major disruption – no danger to staff and/or patients. Does not prevent provision of an essential service/function 4. Important: Within 3 days – Will affect services without causing danger to patients

5. Necessary: Within 7 days – Minor disruption to services

(21)

Threat

Priority for restoring

service

Contingency measures required Actions required to restore service Risk if priority unable to be met

Loss of staff 3 a/b) Deputies for each statutory and clinical lead

role. Secure external support where necessary.

Formal appointment of successors if loss persists.

Impact on stability of clinical/statutory leadership.

4 c/d) Defer meeting dates. Endeavour to meet

quorums at meetings. Chair’s action subject to ratification.

Impact upon ability to conduct business, progress work plans and maintain governance / assurance.

Loss of telephone communica tion

3 a-d) Use of email instead (using email contact list for

all GB members and corporate staff). Use mobile phones provisioned by the CCG

Contact ICT Service Desk Impact on ability to maintain

stability of clinical/statutory leadership.

Loss of email 3 a-d) Use of telephone and postal or despatch

systems (using telephone and address contact lists for all GB members).

Contact ICT Service Desk Impact on ability to maintain

clinical/statutory leadership. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used.

Loss of Internet

4 a-d) Other research methods. Copies of key

documents stored in Microsoft Office format.

Contact ICT Service Desk

Loss of Microsoft Office

3 a-d) Copies of key documents stored in .pdf

format.

Contact ICT Service Desk Loss of access

to stored documents (servers)

4 a-d) Copies of key documents stored on

alternate servers, battle box and on intranet, emergency encrypted memory stick

Contact ICT helpdesk or Head of Governance for hardcopies and emergency encrypted memory stick

Loss of individual IT system

6 Hot desk working will apply N/A if at HQ N/A

Fuel Shortage 5 d) Use of telephone conferencing

NB: could use unified Communications (Lync)

N/A Impact on conduct of business on

the work plans and maintenance of governance

Loss of

buildings: 6 c-d) Use of alternate NHS accommodation

As appropriate to the threat Hemel One (HVCCG) HQ

Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ

Possible overload on alternate and VPN for home working.

6 c-d) Use of alternate NHS accommodation

and VPN for home working.

(22)

East and North Hertfordshire Clinical Commissioning Group Page 22 of 50 Section 1.2 – East and North Hertfordshire CCG Accountable Officer (AO)

 To undertake the statutory roles and the duties of the post Key Contacts:

 Hari Pathmanathan - Chair

 Lesley Watts - Accountable Officer

 Alan Pond - Finance Director (SIRO)

 Sharn Elton - Director of Operations (EPRR responsibilities)

 Beverley Flowers - Director of Strategic Partnerships Minimum Levels of Service that need to be maintained:

a. Statutory roles (Health and Safety, Employment Rights, Occupiers Liability) b. Strategic Leadership

c. Governance regarding decision making d. Outward facing role (‘front of house’) e. Delivery of and progress against objectives Contingency:

(23)

Threat

Priority for

restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met

Loss of staff 2 a-e) Succession planning of deputies for

each statutory and lead role of the AO. Secure external support where necessary.

Formal appointment of successor if loss persists.

Impact on workloads of other Governing Body Members and risk of objectives not being achieved. Loss of

telephone communication

3 a-e) Use of email instead (using email

contact list for all GB members and corporate staff).

Contact HBLICT Service Desk during core hours*

Outside core hours on-call ICT Duty Manager Further Escalation to the HBL ICT Director

Service Desk is available 365 days a year. 0730-2200 Monday – Friday

0800-2000 Weekends and Bank Holidays

Impact on ability to manage the CCG and risk of objectives not being achieved.

Loss of email 3 a-e) Use of telephone and postal or systems

(using telephone and address contact lists for all GB members

and corporate staff).

Outside core hours ICT on-call Duty Manager –

Further Escalation to the HBL ICT Director

Service Desk is available 365 days a year 0730-2200 Monday – Friday

Impact on ability to manage the CCG and risk of objectives not being achieved. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Registered Mail will be used.

Loss of Internet 4 a-e) Other research methods. Copies of

key documents stored in Microsoft Office format.

Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year 0730-2200 Monday – Friday

0800-2000 Weekends and Bank Holidays Loss of Microsoft

Office

3 a-e) Copies of key documents stored in .pdf

format. Stored and managed on a tablet device

0800-2000 Weekends and Bank Holidays Loss of

access to stored documents (servers)

4 a-e) copies of key documents stored

on alternate servers and on intranet

0800-2000 Weekends and Bank Holidays Loss of

individual IT systems

N/A

Fuel Shortage 5 a-e) Use of Virtual Private Networking for

staff with laptops.

Use of video conferencing and telephone conferencing.

N/A Impact on ability to manage the CCG and

risk of objectives not being achieved. Loss of

buildings: 6

a-e) Use of alternate NHS accommodation and VPN for home working.

Howards Court (HCT) HQ (few places) Waverley Rd (HPFT) HQ

Possible overload on alternate accommodation.

6 a-e) Use of alternate NHS accommodation

(24)

East and North Hertfordshire Clinical Commissioning Group Page 24 of 50 SECTION 2 – Critical Functions of the Directorates

Section 2.1 Critical Functions of the Finance Director

 To develop the financial strategy for the organisation

 To ensure sound financial management across the organisation

 To provide financial governance across the organisation

 To undertake the statutory roles and duties including: Bribery Act, Public Contracts and Public Procurement

 To oversee the ICT service Key Contacts:

 Alan Pond - Chief Finance Officer (and SIRO)

 Noreen Coles - Deputy Chief Finance Officer

 Eddie James - Assistant Director Financial Services

 Neil Hales - Assistant Director of Contracts Minimum Levels of Service that need to be maintained:

a. Access to Invoicing and Payments system within 3 days (including contract payments & pay of CCG staff) b. Monitoring financial position within 3 days (within 1 day if within first week of month)

c. Monitoring bank accounts within 3 days Contingency:

(25)

Threat

Priority for

Loss of staff 3 a-c) Deputies for each statutory and lead

role of the Finance Director.(FD)

a-c) Secure external support where necessary.

Formal appointment of successor if loss persists.

Impact on workloads of FD and finance teams and risk of financial objectives not being achieved. Loss of telephone

communication

3 a-c) Use of email instead Contact HBLICT Service Desk during core

hours*

Outside core hours ICT on-call Duty Manager Further Escalation to the HBL ICT Director Service Desk is available 365 days a year 0730-2200 Monday – Friday

Impact on ability monitor financial position.

Loss of email 3 a-c) Use of telephone and postal or systems

(using telephone and address contact lists – internal and external).

Outside core hours ICT on-call Duty Manager Further Escalation to the HBL ICT Director

Impact on ability to manage the CCG with risk of statutory requirements not being met and other financial objectives not being achieved.

Loss of Internet 4 a-c) Other research methods. Copies of key

Outside core hours ICT on-call Duty Manager Further Escalation to the HBL ICT Director

0800-2000 Weekends and Bank Holidays Loss of Microsoft

Office

3 a-c) Copies of key documents stored in .pdf

format.

(26)

Threat

Priority for

Loss of access to stored documents (servers)

3 a-c) copies of key documents stored on alternate

servers and on intranet.

Outside core hours ICT on-call Duty Manager- Further Escalation to the HBL ICT Director

Loss of individual 3 a) Contingent process for invoice payment

(cheque system).

b-c) Contingent process for financial and account monitoring.

a) Manual invoicing process.

Contact relevant service provider

Impact on ability pay other organisations with risk of service disruption.

Impact on ability to manage finances with risk of not meeting statutory financial balance and other financial objectives. Impact on cash flow. IT systems

4

Fuel Shortage 5 b-c) Use of Virtual Private Networking for staff

with laptops.

b-c) Use of conferencing.

N/A Impact on ability to manage

finances with risk of not meeting statutory financial balance and other financial objectives. Loss of buildings:

6 a-c) Use of alternate NHS accommodation

Howards Court (HCT) HQ few places Waverley Rd (HPFT) HQ

Possible overload on alternate NHS and VPN for home working.

6 a-c) Use of alternate NHS accommodation

(27)

East and North Hertfordshire Clinical Commissioning Group Page 27 of 50 Section 2.1.2 Critical Functions of HBL ICT Shared Service

 ICT functionality (core information and communications technology, data processing incorporating resilience to include: email, telecommunications, back & restore, antivirus, physical and logical controls)

 Pharmacy and Medicines Optimisation (oversight of prescribing financial management)

 Pharmacy and Medicines Optimisation discharge statutory functions of controlled drugs Key Contacts:

 Phil Turnock - Director of HBL ICT Shared Service

 Simon Carey - Associate Director of Service Development and Assurance

 Keith Fairbrother - Head of Infrastructure

Minimum Levels of Service that need to be maintained:

a) To continue critical or sensitive business operations (ICT) b) To facilitate effective co-ordination of recovery tasks (ICT)

Contingency:

Priority for the Restoration of Services

13. Routine: Within 14 days – Will not directly disrupt services but will cause inconvenience 14. Non-Urgent: Within 28 days – Will involve non-urgent repair

(28)

Threat

Priority for

Loss of Primary Data Centre – Waverley Road

1 a-b) Fail-over of critical services to Secondary

Data Centre

a-b) Invoke BC & DR via Major Incident Process

Invoke Major Incident Process Invoke Disaster Recovery Plan

Loss of some critical ICT Services at CCG sites

Loss Secondary Data Centre – Charter House

1 a-b) Fail-over of critical services to Primary Data

Centre

Loss of ICT Services at CCG sites

Loss of Core Network (WAN)

1 a-b) Assessment of network configuration to

determine any available components, route traffic across resilient network links.

a-b) route traffic across N3 where possible a-b) Invoke BC & DR via Major Incident Process

Loss of some critical ICT Services at CCG sites

Loss of N3 1 a-b) Re configure core switch and reroute traffic

through WAN is feasible.

Loss on NHS mail for sending secure PID

Loss of SAN 1 a-b) fail over to secondary SAN

a-b) re-provision storage to any spare redundant storage disks

Loss of Compute Services

1 a-b) fail over to secondary/spare compute servers,

including commissioning additional virtual servers. a-b) Invoke BC & DR via Major Incident Process

Loss ITSM Toolset 2 a-b) revert to manual processes & suspension of

SLA recording

Reduction service response

Loss of staff 1 a-c) Secure immediate cover. Formal appointment of Unable to provide support to partnership

clients successors if loss persists.

4 d) Secure external support where

(29)

Threat

Priority for

Loss of telephone communication

1 a-d) Use of email instead. Invoke Major Incident Process Reduced support services

Loss of email 2 a-d) Use of telephone and postal or dispatch

systems.

Invoke Major Incident Process

Inherent Info Governance Risk around confidential information in the postal system. Safe haven

facsimile arrangements will be required and Special Mail will be used.

Invoke Major Incident Plan Potential reduced support services

format.

Service Desk is available 365 days a year

0730-2200 Monday – Friday 0800-2000 Weekends and Bank Holidays

Minimal disruption Loss of access to

stored documents (servers)

3 a-c) Copies of key documents stored on

alternate servers and on intranet.

Invoke Major Incident Process Potential reduced support services

Loss of individual IT systems

3 Recover from disk Invoke Major Incident Process Potential reduced support services

Fuel Shortage Use of Virtual Private Networking for staff

with laptops. Use of telephone conferencing.

N/A Potential reduced support services

Loss of buildings: 6

6

a-c) Use of alternate NHS accommodation and VPN for home working.

As appropriate to the threat Hemel One (HVCCG HQ)

Howards Court (Few places HCT HQ) Waverley Road, St Albans, HPFT

Possible overload on alternate NHS accommodation

Potential reduced support services

Loss of staff 3 After 24 hours prioritisation Secure replacement or agency Impact of uncontrolled

of essential tasks with statutory deadlines. staff. Communication and

Statutory SII reporting times not met.

4 After 2 days prioritisation Impact of provider quality being un-

of urgent tasks. reviewed and/or regulatory

(30)

Threat

Priority for

5 1 week would impact on meetings. Impact of organisation governance

and assurance being disrupted. Loss of telephone

3

Use of email instead (using email Invoke Major Incident Process

Invoke Disaster Recovery Plan

Impact of instant two-way flow of

communication contacts list). communication interrupted.

After 24 hours prioritisation Impact of uncontrolled

of essential tasks with statutory deadlines. communication, risks un-reported,

quality un-reviewed and some

4 After 2 days prioritisation statutory deadlines not being

of urgent tasks. achieved.

Loss of email

3

4

Use of telephone and postal or dispatch systems (using telephone and address contact lists for all staff).

After 24 hours prioritisation of essential tasks with statutory deadlines.

After 2 days prioritisation of urgent tasks.

Impact of some statutory deadlines not being achieved, uncontrolled

communication (including media), unreported risks and un-reviewed quality. Inherent Info Governance Risk around confidential information in the postal system. Safe haven

(31)

East and North Hertfordshire Clinical Commissioning Group Page 31 of 50 2.2 Critical Functions of the Commissioning Director

 Retain the organisational structure of the 6 localities

 Retain the organisational structure the 4 programme boards for specific work streams

 Responsive management support at practice level

 Maintain the CCG hotline that is pertinent to patient specific queries

Key Contacts:

 James Gleed - Assistant Director Primary Care Development

 Helen Edmondson - Associate Director – Commissioning and Locality Development

 Trudi Southam - Interim Associate Director – Planned Care Minimum Levels of Service that need to be maintained

a. Responsiveness to commissioned services for patient specific queries b. Approval mechanism to authorise payments by finance directorate

c. Communicating progress to locality structures and to the CCG executive

Contingency

6. Routine: Within 14 days – Will not directly disrupt services but will cause inconvenience

(32)

Threat

Priority for

restoring service Contingency measures required Actions required to restore service Risk if priority unable to be met

Loss of staff 3 a) Secure immediate cover. Formal appointment of Impact on workloads of other staff

successors if loss persists. and potential risk clinical gap.

Additional burden on primary care

5 b-c) Secure external support where

necessary. Loss of telephone

communication

3 a-b) Use of email instead Contact clinical support unit Impact on timeliness of advice and impact

on governance and assurance systems.

Loss of email 3 a-c) Use of telephone and postal or

despatch

Contact HBLICT Service Desk during core hours* Outside core hours ICT – On-call Duty Manager Escalation to ICT Director

Impact on timeliness of advice and impact on governance and assurance systems. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used.

Contact HBLICT Service Desk during core hours* Outside core hours On-call Duty Manager Escalation to ICT Director

0800-2000 Weekends and Bank Holidays Hard copy of documents in ICC battle box Loss of Microsoft

Office

format.

Contact HBLICT Service Desk during core hours* Outside core hours ICT Director on-call - TBC Service Desk is available 365 days a year 0730-2200 Monday – Friday

0800-2000 Weekends and Bank Holidays Loss of access to

stored documents (servers)

3 a-c) Copies of key documents stored on

Contact HBLICT Service Desk during core hours* Outside core hours On-call Duty Manager Escalation to ICT Director

0800-2000 Weekends and Bank Holidays Loss of individual

IT systems

N/A (hot desk)

Fuel Shortage 5 a-c) Use of Virtual Private Networking for

staff with laptops. Use of tel. conferencing.

N/A Impact on workload and timeliness of

advice and impact on governance and assurance systems.

Loss of buildings: 6

6

a-c) Use of alternate NHS accommodation and VPN for home working.

As appropriate to the threat Hemel One (HVCCG HQ) Howards Court (HCT) HQ Waverley Rd (HPFT) HQ

(33)

East and North Hertfordshire Clinical Commissioning Group Page 33 of 50 2.3 Critical Functions of the Nursing and Quality Director

 To ensure statutory functions are adhered to relating to: Patient Advice Liaison Service, Complaints and Serious Incidents

 To ensure statutory functions are maintained for Safeguarding Adults and Children

 To ensure adherence to Corporate and Clinical Governance legislation

 To provide responsive management support and reporting including incident investigation

 Ensure providers implement appropriate actions, where necessary, as these affect quality and safety

 Ensure Continuing Health Care functions are performed including: procurement of care, new referrals and associated administration processes

Key Contacts:

 Cath Slater - Associate Director Quality and Patient Experience

 Anne Southworth - Assistant Director IFR and Policy Approval

 Sarah Feal - Company Secretary

 Jessica Linskill - Lead Nurse, Quality Minimum Levels of Service that need to be maintained

a. Onward notification of any highlighted patient safety investigation b. Ensure ability to respond to patient enquiries

c. Ensure statutory governance arrangements are adhered to with upward reporting to Executive

Contingency:

(34)

Threat

Priority for

restoring service Contingency measures required

Actions required to restore service

Risk if priority unable to be met

Loss of staff 3

5

a-b) Secure immediate cover

a) Secure external support where necessary

Formal appointment of successors if loss persists

Impact on workloads of other staff with governance and risks

Loss of telephone communication

4 a-c) Use of email instead Contact HBLICT Service Desk

during core hours*

Outside core hours ICT On-call Duty Manager

Escalation to ICT Director Service Desk is available 365 days a year

Impact on timeliness in providing advice

dispatch systems

Impact on timeliness of governance and clinical advice.

Impact on governance and assurance systems. Inherent Info Governance Risk around confidential information in the postal system. Safe haven facsimile arrangements will be required and Special Mail will be used.

Loss of Internet 4 a-c) Other research methods. Copies

of key documents stored in Microsoft Office

format.

Outside core hours On-call Duty Manager

(35)

Threat

Priority for

3 a-c) Copies of key documents stored in

.pdf

format.

Loss of access to stored documents (servers)

3 a-c) copies of key documents stored on

Loss of individual IT systems

N/A

Fuel Shortage 5 a-c) Use of Virtual Private Networking

for staff with laptops. Use of telephone conferencing.

N/A Impact on timeliness of alerts and clinical

advice.

Impact on governance and assurance systems.

Loss of

buildings: 6 a-c) Use of alternate NHS

accommodation

and VPN for home working and decant Incident Control Room to Bexhill Hospital.

As appropriate to the threat Hemel One (HVCCG) HCT HQ Howards Court Waverley Road, St Albans (HPFT)

(36)

East and North Hertfordshire Clinical Commissioning Group Page 36 of 50 2.3.1 Critical Functions Human Resources

 To deliver the contents of the HR Business Continuity Policy.

 To ensure statutory functions are delivered including: Staff pay and pre booked annual leave

 Ensure HR Functions are performed including: recruitment of staff to critical core functions, , contracts, staff wellbeing and safety

 To ensure statutory functions are maintained for any Employment Relations issues

 To ensure compliance with critical legislation, standards and best practice

 To provide responsive management support and reporting including investigations Key Contacts:

 Anne Ephgrave - HR Manager

 Jenny Holland - Senior HR Advisor Minimum Levels of Service that need to be maintained

a. Basic Staff pay is available

b. Ensure ability to respond to basic HR issues and concerns

c. Ensure statutory governance arrangements are adhered to with upward reporting to Executive d. Maintenance of HR compliance for safety of organization and staff

Contingency:

(37)

Threat

Priority for

Loss of staff 3

5

a-b) Secure immediate cover

a) Secure external support where

necessary

Formal appointment of successors if loss persists

Access occupational health advice

Impact on workloads of other staff

Compliance with legislation/timelines missed Loss of telephone

communication

4 a-c) Use of email instead Contact HBLICT Service Desk

during core hours*

Impact on timeliness in providing advice and impact on staff

dispatch systems

Outside core hours On-call Duty Manager

Impact on timeliness of HR Advice

Impact on Staff records which may could have consequence re pay, pensions.

Loss of Internet 4 a-c) Use of hard copy personal files Contact HBLICT Service Desk

during core hours*