Transcription

This document is uncontrolled once printed.Please check on the CCG’s Intranet site for the most up to date versionBUSINESSCONTINUITYMANAGEMENTPLANDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 1 of 50Issue date: December 2014Review date: December 2015Version No:2.1

DOCUMENT CONTROLType of DocumentPolicyDocument TitleBusiness Continuity Management PlanDescription:This Business Continuity Management Plan supports the EPRR Policy and isrequired to provide the Governing Body with reasonable assurance that theCCG is meeting its obligations with regards to business continuity.Location:S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Published versionno.2.1Publication dateDecember 2014Review dateDecember 2015Marion ShipmanAuthor name, jobtitle and contactdetailsAssistant Director Governance and [email protected] 3049 4467Consultation Body/ PersonsExecutive Directors Lambeth CCGConsultation dateNovember 2014Approval andRatification BodyIntegrated Governance CommitteeApproval andRatification Date(s)17 December 2014Readership /Audience:All staff working for, and on behalf of the CCGInformationGovernance Class(Restricted orunrestricted)UnrestrictedDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 2 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Version / Change HistoryVersionDateAuthor0.129/4/2014Marion ShipmanInitial draft version for consultation2.028/11/14Josh Tarling(SECSU)Updated against EPRR Core standards and revised BIAdocumentsMarion ShipmanUpdating grammer and names of individuals. Loggist details nowkept within the incident room cupboard along with CCG TeamBCPs2.114/1/14Approving Committee /GroupReasonConsultation HistoryConsultation Body /PersonsArea of expertiseDate sentDatereturnedAndrew Parker, Directorof Governance andDevelopmentEPRR lead forLCCG3/12/136/12/2013Minor amendments – policy is in line with NHSE requirementsand similar CCG Business Continuity Management policies.Una Dalton, Director ofGovernance andDevelopmentAccountableEmergency Officer5/12/201415/12/2014Discussed at Management Team 15/12/2014. This is a newdocument developed to provide the Governing Body withreasonable assurance that the CCG is meeting its obligationswith regard to business continuity.Executive DirectorsLambeth CCGComments / Changes madeDirectorsDocument Title: Business Continuity Management PlanStatus: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Issue date: December 2014Review date: December 2015Version No: 2.1

C ONTENTSLAMBETH CCG BUSINESS CONTINUITY INCIDENT MANAGER ACTION CARD. 6Actions to be carried out following declaration . 71 Introduction . 191.0Organisational Context . 191.2Aim . 191.3Objectives . 192 Scope of Document . 194 Key Functions and Resource Requirements . 204.1The following key functions or roles of the CCG would need to continue in case of abusiness continuity incident. . 204.2The most critical functions in the case of a business continuity incident . 214.3Potential resource requirements . 215 Roles and Responsibilities . 216 Governance Arrangements . 226.15.1 Business continuity management . 226.25.2 Governance plan updating . 227 Incident Response . 227.1Incident Identification . 227.2Triggers and Incident Declaration . 237.3Plan Invocation: In Hours. 237.4Plan Invocation: Out of Hours . 247.5NHS England (London Regional Team). 257.6Incident Roles and Responsibilities . 257.7Department Recovery Plans . 267.8Incident Control Rooms . 267.9Recording actions . 268 Communications . 268.1Communications plan . 278.2Incident communications roles and responsibilities. 278.3Communication objectives . 278.4Communications during an incident . 288.5Situation Reporting . 299 Recovery and Debrief. 299.1Recovery Planning . 299.2Standing Down the Incident . 299.3Debrief Process . 309.4Post Incident Business Continuity Plan Review . 3110Training, Exercising and Testing . 3111Audit and Monitoring Compliance. 3111.1 Business Continuity plan review . 3112Statement of Evidence / References . 3113Implementation and Dissemination of Document . 3214Associated Documents . 3215Appendices . 32Appendix 1: Risk Assessments . 34Document Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 4 of 50Issue date: December 2014Review date: December 2015Version No:2.1

15.1 National, London and South East London risks . 34APPENDIX 2: generic response plans . 37plan 1 total or partial loss of building / denial of access. 37plan 2 staffing crisis . 38plan 3 loss of telecommunications and IT Services . 39plan 4 loss of electricity. 40plan 5 loss of mains water . 41plan 6 loss or failure of supplier of business critical goods or services . 42plan 7 Infectious disease outbreak. 43APPENDIX 3 suppliers of business critical systems . 44APPENDIX 4 CONTACT LIST . 45APPENDIX 5 list of staff with remote access for home working . 45Appendix 6: Debrief Form . 46APPENDIX 7 Equality & Equity Impact Assessment Checklist . 48APPENDIX 8– Incident Log Template . 49Appendix 9 BC Incident SitRep . 50Document Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 5 of 50Issue date: December 2014Review date: December 2015Version No:2.1

LAMBETH CCG BUSINESS CONTINUITY INCIDENT MANAGERACTION CARDSTOP!Are all employees safe from immediate danger?Have you called the emergency services? [if reqd](Do not assume that someone else has)THINK!(When it is safe to do so)Are you faced with an emergency situation that should be managed by theEmergency Planning and Response Resilience Team at NHS England?(If yes call NHS 01 and inform them. Follow NHS 01 instructions. If in doubt call NHS 01.)ACT!The NHS Lambeth CCG Business Continuity Plan(s) should be followed when anincident has or is likely to prevent the CCG carrying out its normal businessbeyond the maximum tolerable downtime described in appendix 1 of theBusiness Continuity Plan.Document Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 6 of 50Issue date: December 2014Review date: December 2015Version No:2.1

A CTIONSTO BE C ARRIED OUT FOLLOWING BUSINESS DISRUPTIONFor ‘Incidents’ use the Director on Call packActivation flow diagramBusinessdisruptionFirst member of staff tobecome aware informs linemanagerOut of Hours – SEL DoC0844 822 2888Notify an availabledirectorDecide levelof responseNo actionconsiderednecessaryMonitorsituationActivate BusinessContinuity planInform NHS01Document Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 7 of 50Issue date: December 2014Review date: December 2015Version No:2.1

1. Start the incident log2. Convene a Business Continuity Team; membership will depend on the nature of the incidentbut must include a CCG Director and a Loggist. A list of CCG trained is held within the LambethCCG Incident Room cupboard and with the Lambeth CCG Administration Team.3. Establish what the nature of the incident is and assess the impact on service functions4. Inform all relevant staff of the incident and what needs to be done immediately.5. Relocate to the Incident Control room (Lambeth CCG meeting room 210)6. Inform all staff on how to contact the team or how messages will be broadcast.7. Notify the Chief Officer if necessary.8. Address immediate staff concerns.9. Ensure that department Directors or deputies have activated their teams recovery plans.10.Ensure that staff are briefed about the incident and given clear instructions on whetherthey should relocate or go home, and when they are expected to return.11.Inform neighbouring NHS organisations / local authority/ social services if necessary12.Prioritise existing work using the team recovery plans13.Establish your recovery strategies14.Hold regular meetings with the Business Continuity Team (frequency depends on nature& severity of the situation) & ensure that staff are briefed on recovery plans & estimatedrecovery time15.Update NHSE London Regional Team as required16.Ensure that the health and safety of staff is prioritised17.Assess and monitor responses18.Ensure that you have a good overview of the tasks being carried out by BusinessContinuity Team members, leads and their staff19.Authorise the stand down20.Ensure debrief meetings are arranged21.Write up the log notes and final report ensuring that lessons learned are captured22.Review use of emergency procedures, business continuity plans and update wherenecessaryOnce the main priorities have been dealt with, you might consider scaling down theBusiness Continuity Team, or hand over to another member of staff to deal with themedium and long term issues, or the day-to-day recovery of the incident.If an incident is going to go on for more than 4 – 8 hours, establish a rota for staff withinthe team and regular hand over for the incident Manager roleDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 8 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Directorate functions have been categorised according to the following definitions with eachfunction being assigned a maximum tolerable downtime and Recovery Time Objective in linewith the Business Impact Analysis. See below.ABCActivities which must be continuedActivities which could be scaled down if necessaryActivities which could be suspended if necessaryBusiness impact analysis and maximum period of tolerable disruption (MPTD)MaximumPeriod ofTolerableDisruptionTeamCritical ActivityRecoveryTimeObjectiveGovernance andOD TeamsLiaise with the SE CSU IT team to ensure criticalfunctions for Lambeth CCG are maintained wherethere is a loss or denial of access to the CCG4 hoursSame day ofincidentGovernance andOD TeamsProvide material staff support during incidents4 hoursSame day ofincidentGovernance andOD TeamsProvide incident information/updates tocommunications and primary care development4 hours1 weekLBSATEmergency operation room support4 hoursSame day ofincidentService RedesignProvide surge management guidance acrossSouthwark and Lambeth4 hoursSame day ofincidentChildren andMaternityCommissioningOffering safeguarding advice and guidance andcarrying out Serious Case Reviews4 hoursSame day ofincidentOlder People andclient groupscommissioningSafeguarding4 hoursSame day ofincidentOlder People andclient groupscommissioningTo approve, broker and review continuing carepackages for OP PD and LD clients4 hoursNext working dayDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 9 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Older People andclient groupscommissioningTo approve, broker and review fast track continuingcare packages for people with EOLC needsChildren andMaternityCommissioningwriting reportsChildren andMaternityCommissioningAnswering queries around CYPS and MaternitySame day ofincidentSame day ofincidentChildren andMaternityCommissioningLiaising with and providing support and guidance toproviders and partner organisationsSame day ofincidentSame day ofincidentChildren andMaternityCommissioningCo-ordinating and Chairing Children's ContinuingCare PanelsSame day ofincidentSame day ofincidentChildren andMaternityCommissioningCo-ordinating and Chairing tri-partite funding panelSame day ofincidentSame day ofincidentMedicinesOptimisationMedication incident reportingMedicinesOptimisationProvider/patient communicationSame day ofincidentSame day ofincidentMedicinesOptimisationPrescribing GuidanceSame day ofincident1 weekLBSATFacilitation of meetings3 days1 weekLBSATOpen and distribute post for Lambeth staff3 days3 daysLBSATInvoice approval or queries3 days1 weekDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 10 of 504 hoursNext working daySame day ofNext working dayincidentSame day ofNext working dayincidentIssue date: December 2014Review date: December 2015Version No:2.1

LBSATDiary for Directors3 days1 weekLBSATAdmin support to NHS Lambeth3 days1 weekLBSATManage two generic email accounts: NHS LambethCCG (public) and LBSAT account3 days1 weekLBSATEvents Planning3 days1 weekLBSATProject Management3 days1 weekMental HealthManagement of NHS, third sector provider contracts3 days1 monthMental HealthSupport clinical commissioners to lead servicecommissioning activity3 days1 weekMental HealthDevelopment of market management strategies3 days1 monthMental HealthInvoice approval or queries3 days2 weeksChildren andMaternityCommissioningJointly Commissioning Children and MaternityServices (including procurement & contracting)3 days1 weekChildren andMaternityCommissioningAttending internal NHSL and CYPS meetings as wellas meetings with Providers and other stakeholders3 days1 weekMedicinesOptimisationInvoice approval or queries3 days2 weeksOlder People andclient groupscommissioningTo commission services for older people, people withphysical, sensory and learning disabilities3 days1 monthTo commission service people with EOLC needs3 days1 monthOlder People andclient groupsDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 11 of 50Issue date: December 2014Review date: December 2015Version No:2.1

commissioningOlder People andclient groupscommissioningTo commission community health services3 days1 monthOlder People andclient groupscommissioningTo commission stroke services3 days1 monthOlder People andclient groupscommissioningTo attend meetings3 days1 weekFinanceManagement of Cash Flow3 days3 daysFinancePayment of Suppliers including other NHS bodies3 days3 daysFinancePayment of Staff3 days3 daysEngagementManage relationships with key stakeholders HealthWatch, HWBB, Scrutiny1 week1 monthEngagementCoordinate CCG reports and responses to keystakeholders as above1 week1 monthGovernance andOD Teams(CBM) Support GB meetings – Public meeting /Seminar / Teleconference1 week1 monthGovernance andOD Teams(CBM) Support management team weekly meetings1 week1 monthGovernance andOD Teams(CBM) Governing Body ad hoc queries and support1 week1 monthGovernance andOD TeamsCo-ordinate NHS Lambeth CCG Business ContinuityPlanning1 week1 monthDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 12 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Governance andOD TeamsMonitor NHS Lambeth CCG primary care QualityAlerts ensuring that appropriate actions to addresspatient safety issues have been taken.1 week1 monthLBSATPosting information onto the intranet/internet1 weekOver 1 monthLBSATOrdering for organisation for example stationery viaSBS software system1 week1 weekLBSATPhotocopying of meeting papers1 week1 monthLBSATPosting information onto the intranet/internet1 weekOver 1 monthMental HealthDevelopment and implementation of commissioningstrategies/QIPP action plans1 week1 monthMental HealthManagement of procurement (including tender)processes1 week1 monthMental HealthDevelop business cases and funding applicationsdirectly or support other organsaitions in doing so.1 week1 monthMental HealthManagement and development of provider and otherpartner / stakeholder relationships1 week1 monthMental HealthCompletion of performance returns1 week1 monthMental HealthBudgetary management1 week1 monthMental HealthTo review and approve tertiary service fundingapplications1 week2 weeksChildren andMaternityCommissioningMonitoring Performance1 week1 weekDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 13 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Children andMaternityCommissioningCompleting performance returns and reports1 week1 weekMedicinesOptimisationPrimary care providers - medicines delivery support1 week1 weekMedicinesOptimisationBudget management1 week1 monthMedicinesOptimisationData analysis1 week1 monthMedicinesOptimisationPatient Group Directions1 week1 monthMedicinesOptimisationIndividual Funding Requests1 week1 monthMedicinesOptimisationDrug Funding/commissioning1 weekOver 1 monthOlder People andclient groupscommissioningTo monitor contracts for the named client groups1 week1 monthOlder People andclient groupscommissioningTo provide performance reports1 week1 monthOlder People andclient groupscommissioningTo review and update services specifications1 week1 monthFinanceIn year financial management and delivery of statutoryfinancial targets1 week1 week1 week1 weekFinanceEnsure financial governance and strong systems ofinternal controls including Counter FraudDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 14 of 50Issue date: December 2014Review date: December 2015Version No:2.1

arrangementsMedicinesOptimisationManagement of CVD/Respiratory / Diabetes Service2 weeksOver 1 monthEngagementSupport commissioners to draft and implementengagement plans1 monthOver 1 monthEngagementDraft annual CCG statutory report on consultation1 monthOver 1 monthEngagementBuilding engagement skills and capacity of CCG staff,governing body and membership1 monthOver 1 monthEngagementDevelop and co-ordinate delivery of engagement andcommunications strategy1 monthOver 1 monthGovernance andOD TeamsParticipate in emergency planning exercises1 monthOver 1 monthGovernance andOD TeamsSign off serious incidents via agreed monitoringprocess updating NHSE (London)1 monthOver 1 monthGovernance andOD Teams(CBM) Business programme updates1 monthOver 1 monthGovernance andOD TeamsRisk Management: Liaise with external auditors1 monthOver 1 monthGovernance andOD TeamsRisk Management: maintain CCG risk registers andwrite reports1 monthOver 1 monthPrimary andCommunity CareCommissioningLine management1 month1 monthPrimary andCommunity CareCommissioningBudgetary management including processing ofinvoices1 month1 monthDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 15 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Primary andCommunity CareCommissioningCompletion of performance returns1 month1 monthPrimary andCommunity CareCommissioningManagement of GP Delivery Framework1 month1 monthPrimary andCommunity CareCommissioningOversee implementation of 111 programme1 Month1 MonthPrimary andCommunity CareCommissioningOversee Out of Hours provision1 month1 monthMedicinesOptimisationPathway Redesign/commissioning1 monthOver 1 monthMedicinesOptimisationPolicy development1 monthOver 1 monthMedicinesOptimisationAcute providers performance management1 monthOver 1 monthMedicinesOptimisationAPC hosting / running1 monthOver 1 monthFinanceProduction of financial statements and reports(internal, external and statutory)1 month1 monthFinanceSupport the delivery of QIPP programmes andsupport to the costings of new models of care1 month1 monthGovernance andOD TeamsRisk Management – Complaints reporting to IGCOver 1 monthOver 1 monthGovernance andOD TeamsRisk ManagementOver 1 monthOver 1 monthDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 16 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Governance andOD TeamsPALs reporting to IGCOver 1 monthOver 1 monthGovernance andOD Teams(CBM) Governing Body meetings and papers –updating CCG websiteOver 1 monthOver 1 monthGovernance andOD TeamsSupport clinical commissioners to understand qualityOver 1 monthissues for commissioned servicesOver 1 monthGovernance andOD TeamsEnsure appropriate actions to address patient safetyOver 1 monthissues have been takenOver 1 monthLBSATArchiving/request archived filesOver 1 monthOver 1 monthLBSATArchiving/request archived filesOver 1 monthOver 1 monthService RedesignEnable clinical commissioners to lead servicetransformation workOver 1 monthOver 1 monthDevelop strategic intentions, including QIPP based onOver 1 monthrobust informationOver 1 monthService RedesignService RedesignService RedesignLead process of whole system engagement intransformation workOver 1 monthOver 1 monthDevelop transformation business cases and ensureOver 1 monthgovernanceOver 1 monthService RedesignBuild commissioning relationships with providersOver 1 monthOver 1 monthService RedesignRecommend market management strategiesOver 1 monthOver 1 monthService RedesignLine managementOver 1 monthOver 1 monthService RedesignBudget managementOver 1 monthOver 1 monthDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 17 of 50Issue date: December 2014Review date: December 2015Version No:2.1

Primary andCommunity CareCommissioningPrimary andCommunity CareCommissioningDevelop Strategic Intentions, including QIPP basedOver 1 monthon robust informationOver 1 monthOver 1 monthPrimary andCommunity CareCommissioningDevelop business cases for re-provision and ensureOver 1 monthrobust governanceOver 1 monthPrimary andCommunity CareCommissioningBuild commissioning relationships with providers andOver 1 monthkey stakeholdersOver 1 monthPrimary andCommunity CareCommissioningPrimary andCommunity CareCommissioningDevelop Market Management strategiesOver 1 monthRecommend Contract and Performance strategiesOver 1 monthOver 1 monthDevelop comprehensive interface with NHS England Over 1 monthOver 1 monthPrimary andCommunity CareCommissioningManagement of procurement (including tender)processesOver 1 monthOver 1 monthFinanceFinancial Planning - development of strategic andintegrated plan and agreement of budgetsOver 1 monthOver 1 monthFinanceProvide financial support to the negotiation of nonacute contractsOver 1 monthOver 1 monthFinanceTraining and support to clinical commissioners andbudget managersOver 1 monthOver 1 monthDocument Title: Business Continuity Management PlanDocument Status: RatifiedFile Location: S:/Lambeth Share/Lam/CCG/Governance and Development/Governance/Policy/Page 18 of 50Issue date: December 2014Review date: December 2015Version No:2.1

1I NTRODUCTION1.1 O RGANIS ATIONAL C ONTEXTAs Category 2 responders under the Civil Contingencies Act 2004, Clinical CommissioningGroups (CCGs) are required to have a business continuity plan in place to manage the effect ofany incident that might disrupt its normal business. NHS Lambeth Clinical CommissioningGroup (CCG) is the lead commissioner for acute and community healthcare in the Borough ofLambeth, and associate commissioner for mental health services. As such it needs to ensurethat its critical activities are identified, protected so far as is reasonably practicable, and canrecover in a planned way.The CCG Business Continuity Plan should be followed when an incident, major or minor, has oris expected to prevent the CCG from continuing its business as usual.1.2A IMThe aim of this plan is to ensure that the CCG has a robust Business Continuity ManagementPlan (BCMP) in place across the organisation to meets its statutory obligations and support itsvision, values and strategic objectives. A sound Business Continuity Plan (or set of plans)provides reasonable assurance to the Governing Body and evidence for internal and externalauditors and inspecting / reviewing bodies.1.3O BJECTIVESThe objectives of this plan are: To ensure that the CCG is compliant with its legal and regulatory obligations To ensure that key products and services are identified and protected, ensuring theircontinued availability To ensure that there is an effective incident management capability To ensure that staff are trained to respond effectively to an incident or disruption throughappropriate exercising To ensure that interested party requirements are understood

22. Review use of emergency procedures, business continuity plans and update where necessary Once the main priorities have been dealt with, you might consider scaling down the Business Continuity Team, or hand over to another member of staff to deal with the medium and long term issues, or the day-to-day recovery of the incident.