NHS Manchester Clinical
Commissioning Group
Business Continuity Plan
(BCP)
Date Approved: 18 March 2019
Positive – Collaborative - Fair
Business Continuity Plan
Page 2 of 48
VERSION CONTROL
Title: NHS Manchester Clinical Commissioning Group (CCG)
Business Continuity Plan (BCP)
Version: 2.0
Author: Andrew Bidolak, Senior Resilience Manager, Greater
Manchester Shared Services
Supersedes:
Previous version (Version 1.0)
Approved by: Manchester Health & Care Commissioning
Governance Committee
Approved date:
18 March 2019
Review date:
Annually
Target audience:
All MHCC Staff [and GP Practices including GP Partners (or
where the practice is a company, each director) and
individuals in a practice directly involved with the business or
decision making of their CCG]
Equality Impact
Assessment Date: 20 November 2017
VERSION HISTORY
Version Date approved Comment
1.0 28 November 2017 Initial version
2.0 18 March 2019 Updated version
Business Continuity Plan
Page 3 of 48
Contents
1 1 Plan Summary .................................................................................................... 4
2 2 Purpose .............................................................................................................. 5
3 3 Introduction ........................................................................................................ 5
3.1 Scope ............................................................................................................ 5
3.2 Assumptions .................................................................................................. 6
3.3 Ownership and review ................................................................................... 6
3.4 Distribution .................................................................................................... 7
3.5 Awareness, training, testing and exercising................................................... 7
4 4 CCG Information ................................................................................................ 8
4.1 CCG summary ............................................................................................... 8
4.2 CCG stakeholders and interested parties ...................................................... 8
4.3 CCG priority activities .................................................................................... 9
4.4 Resources supporting CCG priority activities .............................................. 10
5 5 Incident Response ............................................................................................ 11
5.1 Detection and assessment .......................................................................... 11
5.2 Activation and notification ............................................................................ 11
5.3 Coordination ................................................................................................ 13
5.4 Communications .......................................................................................... 15
5.5 Resources and continuity options/strategies ............................................... 15
5.6 Documentation processes ........................................................................... 17
5.7 Action checklists .......................................................................................... 17
5.8 Incident stand down ..................................................................................... 18
6 6 Incident Recovery ............................................................................................. 19
6.1 Incident recovery group ............................................................................... 19
6.2 Incident recovery group membership .......................................................... 19
7 7 APPENDICES .................................................................................................. 21
7.1 Manchester CCG Contacts Directory .......................................................... 22
7.2 PREMISES: Maps, directions and instructions ............................................ 23
7.3 Incident Detection/Notification Sheet ........................................................... 24
7.4 Incident Impact Assessment Form .............................................................. 26
7.5 Action Checklists ......................................................................................... 27
7.6 Accessing the CCG Generic NHSmail Email Account ................................. 28
Business Continuity Plan
Page 4 of 48
7.7 Meeting Agenda for Incident Management Team ...................................... 311
7.8 Post Incident Review ................................................................................. 322
7.9 Overview of Directorates and Teams ........................................................ 323
8 8 Equality Analysis Establishing Relevance to Equality .................................... 334
Page 5 of 48
1 Plan Summary
As a member of staff you should… As an organisation we will…
• Become familiar with any role(s) that
are relevant to your involvement with
the arrangements set out in this plan.
• Participate in training and exercising
activities that are intended to support
you to fulfil your role(s) within the
arrangements described in the plan.
• Offer feedback on how arrangements
described within this plan could be
improved, particularly following your
involvement in relevant training,
exercising or actual incidents.
• Ensure that this plan and supporting
processes are clear and help staff
understand what they need to do.
• Identify a team or individual with
responsibility for:
o Keeping this plan under review to
ensure they are in line with the
guidance.
o Providing advice, training and
support for staff on how this plan
should be implemented and
monitored.
o Auditing this plan and its
associated processes and
procedures at least once every
year.
Business Continuity Plan (Version 2.0)
Page 6 of 48
2 Purpose
This Business Continuity Plan (BCP) aims to identify and document the priorities,
resources, responsibilities and procedures that will help Manchester CCG to formally
manage a disruptive incident while implementing business continuity and recovery
options.
The document is intended to support staff from Manchester CCG in the event of them
having to respond to an incident that disrupts the continued delivery of CCG priority
activities and whose impact could harm the CCG’s operational functioning, financial
position or reputation. As such, it is envisaged the document may be called upon in
high pressure situations when staff are under stress. Therefore, the document is
intentionally concise and only contains information, guidance and tools that are likely
to prove useful during a disruptive incident.
In this plan we refer to staff as NHS Manchester CCG staff who work collaboratively
as Manchester Health and Care Commissioning (MHCC).
3 Introduction
The plan consists of four sections and a number of appendices. This introductory
section outlines the plan’s scope, assumptions, ownership, distribution and the
requirements for BCP awareness raising, training, testing and exercising. A CCG
information section provides a summary of key information about the CCG,
including details of CCG staff and stakeholders as well as the priority activities and
essential resources in the event of disruption. The incident response section
documents important aspects of incident response, such as activation of the plan,
notification, incident response roles and responsibilities, communication procedures
and incident stand down. The incident recovery section outlines the CCG approach
to recovery from disruption.
Supplementary to the main body of the plan are a number of appendices that provide
information applicable to the CCG in the event of a disruptive incident, such as the
CCG Contacts Directory and Action Checklists that support the business continuity
priorities of the CCG.
Business Continuity Plan (Version 2.0)
Page 7 of 48
3.1 Scope
This plan is intended to offer support and direction in the face of a range of disruptive
challenges that may affect Manchester CCG. It is difficult to anticipate the extent,
duration or impact of disruptions and so the arrangements described within this plan
are not intended to address every eventually as incidents, by their nature, are
different and procedures may have to be modified to take in to account the particular
circumstances of an event.
This plan is primarily focused on providing information and guidelines on how to
maintain or recover priority activities within the operational scope of Manchester
CCG. The plan sets out procedures and considerations relating to a formal
business continuity response by the CCG to a disruptive incident. The plan
does not seek to address approaches to informal troubleshooting for lower level
disruptions.
3.2 Assumptions
This plan assumes the following:
• continued operation of the public telephone service
• continued availability of the internet and email communication despite
localised outages
• the scale of a disruptive incident being manageable within the capability and
capacity of the CCG and its staff
• a copy of this plan being accessible to relevant staff, either electronically or in
its printed form
In the event that any or all of the above assumptions are not met, staff should (a)
take all reasonable precautions to ensure their own safety and the safety of those
they work with/for and/or (b) escalate the situation to an appropriate level within the
CCG or, in the event of an emergency, to the relevant external agency e.g.
emergency responders.
Business Continuity Plan (Version 2.0)
Page 8 of 48
3.3 Ownership and review
The Chief Accountable Officer of Manchester CCG is the owner of this plan and is
responsible for its accuracy and maintenance. The Chief Accountable Officer is
responsible for ensuring that the continuity requirements of the CCG are sufficiently
resourced and remain adequately robust. The Chief Accountable Officer may
delegate the task of completing this BCP to an appropriate member of the CCG but
responsibility for its content remains with the Chief Accountable Officer.
Plan review: The Chief Accountable Officer of Manchester CCG will ensure that this
BCP is reviewed at least annually and that an appropriate review cycle is
implemented for the checking and update of essential contact details. Contact details
should be reviewed at least quarterly.
Post incident review: In the event of a disruption that negatively impacts upon the
CGG, it is important to identify any learning from the incident response. When
disruptions occur the Chief Accountable Officer will consider whether or not a formal
post incident review should take place. A post incident review will generally take the
form of a meeting chaired by the Chief Accountable Officer, or nominated deputy,
that includes interested parties who will consider:
(1) what went well during the incident;
(2) what, as a result of the incident, needs to be improved; and
(3) the actions required to address any identified gaps, issues or areas for
improvement.
A template for a post incident review is included within Appendix 7.8.
3.4 Distribution
Following approval by the Manchester Health and Care Commissioning Governance
Committee, this BCP should be made available to relevant interested parties. If
necessary, a restricted version that excludes confidential contact numbers and
supplier details can be made available.
Business Continuity Plan (Version 2.0)
Page 9 of 48
Copies of the Manchester CCG BCP will be held in the following locations:
• On the CCG shared network drive
• Within the ‘Manchester CCG’ folder of the CCG’s NHSmail generic mailbox
• Within ‘hard copy’ BCP folders stored in appropriate staff areas
• On an appropriate staff intranet page (E.R.N.I.E. – Employee Resource
Network and Information Exchange}
The Chief Accountable Officer of Manchester CCG must ensure that appropriate
version control is maintained for copies of this BCP.
3.5 Awareness, training, testing and exercising
The Chief Accountable Officer of Manchester CCG will ensure that relevant staff are
made aware of this plan and its content. The Chief Accountable Officer will also
ensure that appropriate training, testing and exercising is undertaken to validate the
information and arrangements detailed within this BCP. It is for the Chief Accountable
Officer to ensure that all relevant staff participate in training, testing and exercising.
In terms of the frequency of testing and exercising, the following minimum standards
should be adhered to:
Testing: A test of communications cascades using the CCG Contacts Directory
should be undertaken at least every 6 months
Exercising: A table top, scenario-based exercise should be held at least annually
4 CCG Information
4.1 CCG summary
Provided within Table 1 is a summary of key details relating to Manchester CCG. As
well as including key names, numbers and locations, the table also includes an
indication of suppliers or contractors that play an important role in supporting the
running of the CCG (‘CCG Dependencies’).
Business Continuity Plan (Version 2.0)
Page 10 of 48
Table 1: Summary of CCG details
CCG Name: NHS Manchester Clinical Commissioning Group
Chief Accountable
Officer (CAO): Ian Williamson
CAO Email: [email protected]
Accountable
Emergency Officer
(AEO):
Ian Williamson
AEO Email: [email protected]
Key functions of the
CCG:
Commission high quality and cost effective health
services for the local population
CCG Headcount: 270 (NOTE: excludes staff within Population Health and
Wellbeing)
CCG Teams or Sub-
elements:
CCG Board; CCG Senior Management Team;
DIRECTORATES: Clinical; Commissioning; Finance;
Nursing and Safeguarding; Performance and Quality;
Planning and Operations; Population Health and
Wellbeing – see Appendix 7.9 for Directorates detail
Main CCG Location:
(Full address)
Parkway Business Centre, Princess Road, Manchester,
M14 7HR
CCG Telephone: 0161-219-9497
CCG Email: [email protected]
Other CCG
Locations:
(Full address)
Citywide services located at Parkway Business Centre,
Princess Road, Manchester, M14 7HR
CCG Dependencies:
[nature of dependency]
Manchester Health & Care Commissioning
[partnership with CCG and Manchester City Council];
NHS Property Services [facilities management];
Greater Manchester Shared Services (GMSS)
[support services provider];
Business Continuity Plan (Version 2.0)
Page 11 of 48
4.2 CCG stakeholders and interested parties
Included within Table 2 are the main CCG stakeholders. Although the list is not
exhaustive it does describe the CCG’s main stakeholders and interested parties and
outlines the nature of the CCG’s relationship with them.
Table 2: Summary of CCG Stakeholders (add/delete rows as required)
Stakeholder: Member GP Practices • Provider of primary care
healthcare services
Stakeholder: Greater Manchester
Health and Social Care
Partnership
• Commissioner
Stakeholder: Greater Manchester
Shared Services
• Provider of key commissioning
support functions such as IT,
communications
Stakeholder: NHS Property Services • Facilities management provider
Stakeholder: Manchester City Council • Co-commissioner of
healthcare services
Stakeholder: Northern Care Alliance
(North Manchester
General)
• Provider of secondary
healthcare services
Stakeholder: Manchester
University
Foundation Trust
• Provider of secondary
healthcare services
Stakeholder: Greater Manchester
Mental Health
• Provider of mental health
services
Stakeholder: GTD Healthcare • Out of hours primary care
provider
Stakeholder: Manchester Local
Care Organisation
• Provider of community
healthcare services
Stakeholder: GP Federations • Links with Manchester GP
practices
Business Continuity Plan (Version 2.0)
Page 12 of 48
4.3 CCG priority activities
Taking in to account analysis of the impacts of disruption to the CCG, the Chief
Accountable Officer of Manchester CCG has determined priority activities in the
event of a business continuity disruption and these are listed in Table 3. It is
recognised that these priorities are subject to review depending upon the extent and
duration of an impact.
Table 3: CCG priority activities
Most
Urgent:
• Handle patient complaints
• Respond to Freedom of Information (FoI) and MP enquiries
• Maintain sound financial management
• Undertake performance management of commissioned
healthcare providers
• Undertake incident investigations
• Support requirements for safeguarding
• Monitor the safety of healthcare services
• Fulfil requirements as a Category 2 Responder
under the Civil Contingencies Act
Less
Urgent:
• Commission healthcare services
• Provide pharmacy support to member practices
• Lead on commissioning contract management, mainly mental
health
• Redesign healthcare pathways
• Collaborate with other CCGs and relevant statutory and
voluntary sector bodies to integrate healthcare services
• Promote the NHS Constitution
• Promote the involvement of patients in decision making
• Seek continuous improvement in the quality of services
• Maintain appropriate governance arrangements
Not Urgent: • Promote healthcare research
Business Continuity Plan (Version 2.0)
Page 13 of 48
4.4 Resources supporting CCG priority activities
Resource requirements of the CCG’s priority activities are documented in Table 4.
The list captures the resources that are used as part of routine operations for these
activities. Additional or replacement resources may be required in order to resume or
restore CCG priority activities following a disruption.
Table 4: Resources supporting CCG priority activities (add/delete rows as required)
Information, data, records,
documents:
• Commissioned healthcare provider contracts
• Safeguarding information
• Financial information, ledgers and records
• Freedom of Information requests
• Patient complaints
• On-call rota
IT software, databases, systems: • Access to NHSmail
• Microsoft Office applications
• Internet browser
• Access to DATIX database
Network drives & folders: • Access to folders on network drive
Telecommunications:
• Landline telephones
• Mobile telephones
• Wireless internet devices (iPads)
• Network enabled laptops
Specialist equipment: • n/a
Furniture, office equipment &
storage:
• Desks and chairs
• Monitors, keyboards, mice
• Printer
• Secure filing cabinets and drawers
Supplies & stationery: • Paper
• Replacement printer toner and drums
Qualified or expert practitioners,
specific technical
skills:
• Healthcare commissioning expertise
• Medicines management expertise
• Finance and accounting expertise
Other CCG specific resources: • n/a
Business Continuity Plan (Version 2.0)
Page 14 of 48
5 Incident Response
5.1 Detection and assessment
Upon detection or notification of a disruptive incident, a member of the CCG should
gather as much information as possible about the event or circumstances. An
Incident Detection/Notification Sheet is provided in Appendix 7.3 to help with
collation of initial reports or information about the situation giving cause for concern.
It should be recognised that some disruptions are limited in their nature and extent.
For instance, a short term loss of power, a time-limited cordon affecting CCG
premises or a problem affecting a small number of computers are examples of
events that may possibly be responded to and managed by individual staff members
working flexibly within business as usual capabilities or by accessing routine support
(e.g. calling the IT helpdesk). However, if a CCG staff member detects or is notified
of a situation that challenges, or may challenge, the functioning of the CCG’s priority
activities, they should escalate the matter to a relevant CCG colleague or manager.
As soon as is practicable after detection or notification of a disruptive incident, the
Chief Accountable Officer, or his/her nominated deputy, should be advised of the
situation and should assess the actual or the potential impacts upon the CCG and
the functioning of its priority activities.
When making an assessment of a disruptive incident, the Chief Accountable Officer,
or his/her nominated deputy, should seek to establish:
• the nature or cause of the incident (e.g. building fire, prolonged severe
weather, flu pandemic)
• the actual or potential disruption (e.g. denial of site access, loss of
information, significant staff shortages)
• the known or potential impacts (e.g. staff safety threatened, breach of duties
likely, priority activities at risk, stakeholder expectations not met)
• the extent and duration of the identified impacts, if known (e.g. CCG- wide
impacts, impacts on specific priority activities; disruption likely to last for days,
weeks, months)
Business Continuity Plan (Version 2.0)
Page 15 of 48
By gathering and evaluating this information, the relevant senior CCG staff member
should be better placed to decide if activation of a formal CCG business continuity
response is required.
An Incident Impact Assessment Form is provided within Appendix 7.4 to assist
the CCG with documenting the nature of the disruption and its associated
consequences.
5.2 Activation and notification
Activation of a formal BC response is likely to be the result of a judgment call on the
part of the senior CCG staff member(s) who discovers or receives information about
a disruptive incident. It is important, therefore, that as much information as possible is
gathered about the nature of the event. It is usually better to stand up an incident
response rather than let a situation develop beyond the capacity of the CCG to
manage the situation. A process for activation is set out in Figure 1. The Chief
Accountable Officer or, in his/her absence, their appointed deputy has the authority
to activate a formal CCG business continuity response. In the first instance, a formal
response is likely to involve convening an Incident Management Team to consider
immediate steps required to address the circumstances of the disruptive incident.
Circumstances that may prompt the CCG to consider activating a formal business
continuity response could arise from situations such as:
a) significant impact upon CCG priority activities (see section 4.3)
b) loss of critical CCG resources (see section 4.4)
c) complete denial of access to CCG premises
Business Continuity Plan (Version 2.0)
Page 16 of 48
Figure 1: Activation of a formal CCG business continuity response
In the event of a disruptive incident requiring activation of a formal business
continuity response, Table 5 provides a suggested list of people who may need to be
notified by the CCG. The nature, extent and duration of any impacts should be
considered before communicating with interested parties. Contact details are
provided in Appendix 7.1.
As a minimum, notification of a business continuity incident should include known
information covering the following:
• Date/time of the incident
• Incident summary
• Staff/teams affected
• Location(s) affected
• Initial indication of what to do/ not to do
Impact of disruption upon CCG assessed
CCG staff discover or receive
notification of disruptive incident
Activate formal CCG
BC response
Monitor situation
Significant impact on CCG priority
activities
Limited or no impact on CCG priority activities
Business Continuity Plan (Version 2.0)
Page 17 of 48
Table 5: Notification (see Appendix 01 for contact details)
Stakeholder/Organisation Potential messages
CCG staff
• Incident taking place
• Impact on CCG
• Action required/being taken
• What to do/where to go
CCG Member Practices
• Incident taking place
• Impact on CCG
Greater Manchester Health
and Social Care Partnership
(GMHSCP)
• Incident taking place
• Impact on CCG
• Request for escalation or support
Greater Manchester
Shared Services (GMSS)
• Incident taking place
• Request for support
Landlord, estates and facilities • Incident taking place
• Request for support
5.3 Coordination
In order to better coordinate the response to a disruptive incident that extends
beyond the scope of an individual, or individuals, to manage the resulting impacts,
the CCG Chief Accountable Officer or, in his/her absence, their appointed deputy will
establish a business continuity Incident Management Team comprising appropriate
members of the CCG and, if necessary, relevant participants from partner or
stakeholder organisations.
By default, the Chief Accountable Officer of Manchester CCG or, in his/her absence,
their appointed deputy will lead the CCG Incident Management Team.
Table 6 provides an indication of the possible roles and responsibilities in the event
of a CCG Incident Management Team being established.
Business Continuity Plan (Version 2.0)
Page 18 of 48
Table 6: Incident Management Team (IMT) – Roles and responsibilities
Role
(role fulfilled by) Responsibilities
IMT Lead(s)
(CCG CAO or deputy)
• Activate an appropriate CCG Incident
Management Team
• Brief CCG Incident Management Team
members and participants
• Decide appropriate response actions and
direct the CCG Incident Management Team
• Ensure key information about incident response is
recorded
• Decide whether to stand down formal incident
response
Business Continuity Plan (Version 2.0)
Page 19 of 48
Table 6: Incident Management Team (IMT) – Roles and responsibilities
Role
(role fulfilled by) Responsibilities
IMT Admin Support
(CCG admin staff)
• Assist with mobilising a CCG Incident
Management Team
• Support Incident Management Team meetings
• Assist with maintaining incident logs or documents
• Support the CCG Incident Management
Team Lead as directed
IMT Member
(relevant CCG
manager/staff)
• Support the CCG Incident Management Team
Lead as directed
• Liaise with partners and stakeholders as required
• Update the CCG Incident Management Team as
requested
IMT Participant
(partner/stakeholder rep.)
• Provide, as appropriate, assistance to the
CCG Incident Management Team
• Update the CCG Incident Management Team as
requested
As described in Table 6, it is the responsibility of the Incident Management Team
Lead (or leads if the incident extends over a prolonged period) to ensure the team is
appropriately activated, briefed and staffed. The Incident Management Team Lead
must also decide the requirements (e.g. frequency, format, focus, location) for any
team meetings or reporting procedures and whether to escalate or de-escalate the
formal incident response.
It should be noted that the membership of an Incident Management Team will usually
be determined by the nature of the disruptive incident affecting the CCG. Therefore,
in order to support effective coordination the Incident Management Team Lead
should be mindful of the specific impacts and interested parties associated with the
circumstances causing disruption.
The primary location from which Manchester CCG will coordinate its formal business
Business Continuity Plan (Version 2.0)
Page 20 of 48
continuity response is:
Primary location for coordinating a CCG business continuity incident
Room M2.2
Parkway 3
Parkway Business Centre
Manchester
M14 7HR
Tel: 0161-765-4017
In the event of the primary location being unavailable, the Incident Management
Team Lead will identify an appropriate alternative space for incident coordination. If a
physical location is not required, the Incident Management Team Lead may consider
a remote coordination arrangement, such as by teleconference (see Table 7), so that
key decisions may be made promptly.
Coordination will typically be supported by holding structured Incident Management
Team meetings or discussions. A template Incident Management Team Meeting
Agenda is provided in Appendix 7.7.
5.4 Communications
In the event of a disruptive incident, the communications channels described in Table
8 are available to Manchester CCG.
Business Continuity Plan (Version 2.0)
Page 21 of 48
Table 8: CCG communications channels
Channel Details Limitations
Teleconference:
Dial-in number: 0800-032-8069
Dial-in Passcodes:
• Chairperson: 97617746 then #
• Participant: 28549517 then #
Require communication of
dial- in details
Individual email:
Emails to personal email accounts
Requires access internet
access and relevant
contact details
Generic Mailbox: cmccg.manchester-ccgs-
Requires access to NHSmail
and familiarity with login;
Staff text
message
cascade:
Cascade by personal mobiles or
cascade via ‘text by email’ option in
NHSmail
Requires sharing of
confidential personal mobile
numbers;
requires setup of
distribution lists
CCG message cascade Via CCG email distribution list,
website or other corporate
communications
mechanism
Requires availability of
corporate communications
mechanisms
5.5 Resources and continuity options/strategies
In the event of a disruptive incident, the following continuity options/strategies are
available to Manchester CCG.
PEOPLE
Remote working
In some circumstances an appropriate continuity strategy may be for members of
Manchester CCG to work remotely, either from home or from other premises.
Business Continuity Plan (Version 2.0)
Page 22 of 48
Staffing options
In the event that Manchester CCG faces a significant negative impact upon its
staffing levels, the Incident Management Team Lead may consider one or more of
the following staffing options for continuity of priority activities:
1. suspension of specific CCG activities in order to maintain priority activities
2. redeployment of CCG staff, as appropriate, to more urgent activities
3. seek staffing assistance from partner organisations, e.g. neighbouring CCG(s)
4. use of agency staff
Staff Welfare
Manchester CCG takes the welfare and wellbeing of its staff seriously. The
organisation has a duty of care to its employees and will seek to support staff
affected by a disruptive incident in a proportionate and appropriate manner. Staff
should be aware of the following options for support:
Capita Employee Assistance Programme (EAP): Capita’s experienced and
qualified telephone counsellors provide around the clock support to help with a range
of personal and work related problems in areas such as stress, relationship
difficulties, bereavement, anxiety, family worries, alcohol/drug abuse, employment, or
financial concerns.
You can access the EAP at any time, day or night, either by:
• Calling 0800-716-017
• Visiting the EAP website (http://www.firstassistonline.com/login.aspx)
and then typing in the following: 72990 in the Access Code field and
72990 in the Password field
PREMISES
Premises options
In the event that Manchester CCG faces a significant negative impact upon its main
premises, the Incident Management Team Lead may consider one or more of the
Business Continuity Plan (Version 2.0)
Page 23 of 48
following options for continuity of priority activities:
1. remote working by CCG staff
2. seek premises assistance from partner organisations, e.g. neighbouring
CCG(s)
3. rental of temporary accommodation
Alternative premises
In the event of Manchester CCG needing to temporarily relocate staff to alternative
accommodation or premises, the location(s) listed below have been identified as
having potential to accommodate some or all CCG requirements.
Alternative Location A
Address: Manchester Town Hall Extension
Contact
Name:
To be confirmed
Contact
Number:
See Appendix 7.1
Notes: Arrangements under review at time plan issued
Business Continuity Plan (Version 2.0)
Page 24 of 48
RESOURCES
Resource options
In the event that Manchester CCG faces a significant negative impact upon its key
resources, the Incident Management Team Lead may consider one or more of the
following resource options for continuity of priority activities:
1. utilise any backup or standby resources
2. reallocation of CCG resources, as appropriate, to more urgent activities
3. seek resource assistance from partner organisations, e.g. neighbouring
CCG(s)
4. rental or purchase of replacement resources
5.6 Documentation processes
In the event that Manchester CCG activates a formal business continuity response to
a disruptive incident, the Incident Management Team Lead will ensure that key
information is recorded about the incident, the actions taken and the decisions made.
Although the CCG needs to respond flexibly to the requirements for documenting
details during the incident response, the following processes should help the CCG to
ensure that key information is recorded:
• Keeping minutes or notes of Incident Management Team meetings
• Maintaining an Actions Tracker for Incident Management Team meetings
• Maintaining a Key Decisions Log for the incident response
• Maintaining an incident documents file
• Maintaining Personal Logs as appropriate
Templates for the above processes can be found
• On the CCG shared network drive
• Within the ‘Manchester CCG’ folder of the NHSmail generic mailbox
• Within BCP folders stored in staff areas at Parkway
• On the appropriate staff intranet page
Business Continuity Plan (Version 2.0)
Page 25 of 48
5.7 Action checklists
Based upon the CCG priorities indicated in section 2.4 (CCG priority activities), the
procedures listed in Table 9 have been identified as those that will support continuity
of CCG priority activities. Action Checklists that give specific instructions for these
procedures are contained within Appendix 7.5.
Table 9: List of procedures with an Action Checklist
Checklist CCG Procedure (add/delete rows as required)
A Reporting IT/computer network issues
B Accessing the CCG generic NHSmail email account
C Holding a teleconference
Business Continuity Plan (Version 2.0)
Page 26 of 48
5.8 Incident stand down
The Chief Accountable Officer or, in his/her absence, an appointed deputy will be
responsible for standing down the CCG’s formal incident response. As a minimum,
stand down should include communicating to interested parties, via an appropriate
channel, the following messages:
• the end or resolution of the disruption
• an outline of the impacts experienced
• an outline of any follow up actions or ongoing issues
• an expression of gratitude for any support, understanding and/or patience
demonstrated during the period of disruption
Following a significant disruption, consideration should be given at incident stand
down to the need for a post incident review. Whether or not a formal post incident
review (a ‘cold debrief’) is undertaken, the Incident Management Team Lead(s)
should seek to assess soon after incident stand down (‘hot debrief’) any learning
points from the disruption. The Incident Management Team lead(s) should collate
observations and comments relating to the incident and, if necessary, take
appropriate follow up action.
A template for a post incident review is included within Appendix 7.8.
When undertaking a debrief the following considerations should be kept in mind:
• the debrief(s) should be conducted in an open and honest manner;
• the purpose of the debrief(s) will be to assess aspects of the incident response
with a view to capturing examples of good practice and requirements for
improvement;
• expectations relating to follow up actions should be clearly defined and
documented with an appropriate date set for review of progress.
Business Continuity Plan (Version 2.0)
Page 27 of 48
6 Incident Recovery
6.1 Incident recovery group
The core responsibilities of a CCG incident recovery group are not dissimilar to those
of the CCG Incident Management Team. However, whereas the CCG Incident
Management Team is focused on handling the immediate incident impacts and ‘quick
time’ actions needed to address an unfolding situation affecting all or most of the
CCG, the CCG incident recovery group takes as its focus the longer term
consequences and the ‘slow time’ requirements for resumption and restoration of
acceptable levels of CCG activity following a major impact.
The Manchester CCG incident recovery group will take responsibility for the
following:
• Staff welfare
• Mobilising CCG staff
• Activating CCG plans
• Devising strategic objectives for the recovery from the incident impacts
• Monitoring the overall recovery
• Resolving conflicts in the recovery process
• Invoking resources
• Communicating to interested parties
• Approving external CCG statements to interested parties and the media and
monitoring and adjusting as necessary any communications strategy
• Staff welfare
• Communicating decisions within the CCG
• Approving significant expenditure and delegation limits
• Ensuring the financial health of the CCG
• Changing priorities as the situation evolves
6.2 Incident recovery group membership
The extent and duration of the impacts of a disruption will influence the membership
of the CCG’s incident recovery group. Nonetheless, the group’s core membership
Business Continuity Plan (Version 2.0)
Page 28 of 48
should take into account the identified roles and functions/interests described in
Table 10.
Table 10: Incident recovery group roles and representation
Role
(role fulfilled by)
Function/Interest/Areas Represented
IRG Lead
(CCG CAO or deputy)
• CCG Executive Management Team
IRG Admin Support
(CCG admin staff)
• Administrative support
Table 10: Incident recovery group roles and representation
Role
(role fulfilled by)
Function/Interest/Areas Represented
IRG Member
(relevant CCG managers)
• Finance
• Corporate Services
IRG Participant
(partner or
stakeholder rep.)
• People and welfare
• Communications
• Technical support
• Estates and facilities
• Staff side representation
• Legal representation
The above list is not prescriptive and it is for the group lead or senior CCG manager
to determine an appropriate membership of a CCG incident recovery group.
As the CCG incident recovery group is concerned with the high level, strategic
recovery priorities, it is important that nominated members of the group have
sufficient authority to commit resources and to make decisions on behalf of the
functions they represent.
Business Continuity Plan (Version 2.0)
Page 30 of 48
7.1 Manchester CCG Contacts Directory
Refer to the current contacts directory (appendix A) of the Manchester Health
Economy Incident Response Plan which can be found on under the policies
section of the MHCC website.
7.2 PREMISES: Maps, directions and instructions
This appendix includes maps and/or instructions relevant to the CCG’s business
continuity and directions to any alternative locations.
Maps showing: Parkway Business Centre, Princess Road, Manchester, M14 7HR
Business Continuity Plan (Version 2.0)
Page 32 of 48
7.3 Incident Detection/Notification Sheet
This sheet is intended to act as an aide memoire should staff from the CCG discover
or receive notification of a disruptive incident.
Incident detection/notification sheet
Date completed
(dd-mmm-yyyy)
Time completed
(hh:mm)
Sheet completed
by (Name, Title)
Detection by /
notification from
(Name, org, title,
contact details)
Nature of incident
in a few words
(e.g. CCG office
fire)
Further information about the incident (e.g. staff or activities affected, resources lost,
warnings received):
Action taken, if any, prior to discovery or notification (by whom, when):
Business Continuity Plan (Version 2.0)
Page 33 of 48
Incident detection/notification sheet
Action required following discovery or notification (by whom, when):
Comments/additional information:
Business Continuity Plan (Version 2.0)
Page 34 of 48
7.4 Incident Impact Assessment Form
This form can be used to assess the impacts of a disruptive incident. It may form a
stand-alone assessment, or may be used during incidents that cause wider disruptive
impacts upon Manchester CCG. The criteria should not be seen as restrictive or
exhaustive.
BEST incident outcome
Impact
expectations:
WORST incident outcome
Low Med. High
STAFF/PERSONNEL
Illness or injuries minor or non-
existent
Serious illness or injuries and/or
fatalities
No impact on staff morale Severe impact on staff morale
FINANCIAL LOSS
Key assets unaffected One or more key assets out-of-action
or destroyed
No contract penalties Substantial contract penalties
No additional operating costs Substantial uninsured additional
operating costs
No loss of income Substantial loss of Income
FAILURE OF PRIORITY ACTIVITIES
Single event Multiple events
No prioritised activities affected One or more prioritised activities
affected
Site/building access not affected Access to site/building denied for a
week or more
Impact will be for a short time
only
Impact will be for weeks
Staff and management continuing
normal duties
Staff and management attention
diverted for an extended period
All site business functions are
working/continuing
Full off-site re-location necessary
No impact on low priority Severe impact on low priority
Business Continuity Plan (Version 2.0)
Page 35 of 48
business operations business operations
REPUTATIONAL DAMAGE
No impact on reputation Severe impact on reputation
No impact on local community Severe impact on local community
No media interest in the
event/impact
Media interest certain
No single interest group
involvement
Single interest group involvement
certain
No pollution/environmental
impact
Severe impact on environment
REGULATORY/LEGAL NON-COMPLIANCE
No Health &Safety impact Significant Health & Safety impact
No legal or regulatory
implications
Inevitable legal and regulatory
implications
No external agencies involved External agencies must be notified
CURRENT IMPACT
Incident impact: 1:
Low
2: Moderate
3: Significant 4: Major
Current
assessment
undertaken:
Date: Next
review
:
Date:
Time: Time:
Assessor (name,
title):
Service/team:
This form is OFFICIAL - SENSITIVE COMMERCIAL when in use
Business Continuity Plan (Version 2.0)
Page 36 of 48
7.5 Action Checklists
This appendix includes instructions, procedures and guidelines to support the
business continuity priorities identified in the Manchester CCG Business Continuity
Plan.
Based upon analysis of the CCG’s activities, essential requirements and business
continuity priorities, Actions Checklists have been developed for the following
procedures:
List of CCG Procedures with an Action Checklist
Checklist CCG Procedure (add/delete rows as required)
A Reporting IT/computer network issues
B Accessing the CCG generic NHSmail email account
C Holding a teleconference
D <space for additional procedure>
A Reporting IT /computer network issues
To call IT Service Desk (open 8am-6pm Monday to Friday) dial 0161-765-6688
Before calling the Service Desk gather the following information: location of the
equipment; availability of the equipment; urgency of the fault; impact on other users
To report a fault or make a request to the IT Self-Service Portal (24/7 from any
internet enabled device, including smartphones) login to https://nwcsu.service-
now.com/csu/main
When using the IT Self-Service Portal, you will need your Username (usually your
NHS.net
email address) and your Password
B Accessing the CCG Generic NHSmail email account
Using your own NHSmail Username and Password, login to the web version of NHSmail
via
www.nhs.net (Internet Explorer officers optimal ease of access)
Business Continuity Plan (Version 2.0)
Page 37 of 48
Step by step instructions for accessing the mailbox are provided in Appendix 7.6
C Holding a teleconference
Agree the date and time of the teleconference
Notify participants of the relevant date and time as well as the dial in details
Dial in details: 1. Dial 0800-032-8069 2. Enter Passcodes as appropriate:
o Chairperson: 97617746 then # or Participant: 28549517 then #
D <space for additional procedure>
<insert actions or steps>
<insert actions or steps>
<insert actions or steps>
Business Continuity Plan (Version 2.0)
Page 38 of 48
7.6 Accessing the CCG Generic NHSmail Email Account
An NHSmail generic mailbox has been set up for shared use during an incident. Staff
with an NHSmail account and who have been given the appropriate permissions can
access this mailbox. As NHSmail is web-based, it offers the benefit of being
accessible over any internet connection to those who have an NHSmail account and
it can be viewed by multiple users.
The CCG’s generic mailbox address is:[email protected]
How to access the CCG NHSmail Generic Mailbox through Outlook Web
1 Log in to your NHSmail account via the Outlook Web App at www.nhs.net
2 In the top right corner beside your name, click on the symbol to bring up
a box similar to the example below that offers an option to Open another
mailbox…
3 Click on Open another mailbox… to bring up a box similar to the one below
4 Enter cmccg.manchester-ccgs-eprr in the text field and click Search
contacts and directory to bring up a box similar to the one below
Business Continuity Plan (Version 2.0)
Page 39 of 48
5 Click Open and the mailbox should open in a separate window
How to add the Generic Mailbox to Outlook
1 Go into File > Account Settings. Choose Account Settings…
2 The Account Settings window should appear. Select the Change… button
Business Continuity Plan (Version 2.0)
Page 40 of 48
3 Click on More Settings…
4 Click the Advanced tab then choose Add…
5 Enter the name of the mailbox i.e. [email protected] and
click OK
Business Continuity Plan (Version 2.0)
Page 41 of 48
6
Once the mailbox is listed in the additional mailboxes section on the
Advanced tab, click on OK. Click on Next. Click on Finish. The mailbox will
now be listed on the left- hand side in Outlook
Business Continuity Plan (Version 2.0)
Page 42 of 48
7.7 Meeting Agenda for Incident Management Team Incident
Management Team Meeting Details
Agenda
1. Introductions
2. Current situation report
3. Impact of the incident upon the CCG
4. Communications
a. Internal CCG communications
b. External communications (providers, suppliers, contractors)
c. Public information and media implications
5. Resource implications and expenditure (e.g. staffing, equipment, supplies)
6. Horizon scanning (i.e. ongoing issues, risks posed, potential further impacts)
7. Agreed decisions and actions
8. Next discussion /meeting
CCG: Manchester CCG Chair: add name
Date: dd-mmm-yyyy Start: hh:mm Format: Teleconference / Meeting / Combined
Access:
meeting venue, including postcode Teleconference Dial-in number: 0800-032-8069
• Participant Passcode: 28549517 then #
Incident: add brief description of incident
Business Continuity Plan (Version 2.0)
Page 43 of 48
7.8 Post Incident Review
Embedded below is a report template for a post incident review. Responding to
incidents provides an invaluable opportunity to identify learning and areas for
improvement in relation to the CCG’s business continuity arrangements.
The focus of the post incident review should be:
1. what went well during the incident;
2. what, as a result of the incident, needs to be improved; and
3. the actions required to address any identified gaps, issues or areas for
improvement.
Please read the Manchester CCG Incident Debrief Summary.
7.9 Overview of Directorates and Teams
DIRECTORATE TEAMS
Clinical
• Clinical Leads
• Medicines Optimisation
• Primary Care
Strategic
Commissioning
• Adult Social Care
• Community Health
• Continuing Healthcare
• Integrated Commissioning, Single Hospital Service
• Market Development & Management
Business Continuity Plan (Version 2.0)
Page 44 of 48
Finance
• Adult Social Care, Quality Performance & Compliance
Team
• Business Intelligence
• Finance & Contracting
• Finance Projects
• Improvements
• Operational Finance
• Strategic Planning & Integration
Nursing &
Safeguarding
• Children & Young People Commissioning
• Mental Health Commissioning
• Specialised Commissioning
Performance, Quality &
Improvement
Planning & Operations
• Business Support Team
• Corporate Affairs
• LCO Procurement
• Information Management & Technology
• Planning & Policy
• Workforce & Organisational Development
Business Continuity Plan (Version 2.0)
Page 45 of 48
8 Equality Analysis Establishing Relevance to Equality
1. Name of the
proposal being
analysed
NHS
Manchester
CCG BCP
2. Officer/s
responsible
for the
analysis
Andrew
Bidolak
3. Senior
responsible
officer/s
Nick
Gomm
4. Date
analysis
started
20-11-2017
5. Date
analysis
completed
22-12-2017
6. Date of
approval
28-11-
2017
Please state if the proposal being analysed is:
(please tick which one is applicable)
1. Strategy 2. Policy 3. New service
4 Service
redesign
5 Service
review
6. Decommissioned
services
Please state organisation this proposal relates to:
(please tick which ones are applicable)
MHCC MCCG
MCC Other please state:
The purpose of the Analysis
The purpose of this relevance assessment is to analyse the information gathered on
(proposed or existing function name here) to test it for potential relevance to equality.
A relevance ranking of high medium or low will be applied.
1. About the Service
Please use this section to provide a concise overview of your service, its key delivery
objectives and its desired outcomes.
This business continuity plan relates the operations and key activities of Manchester CCG as
commissioning body.
2. General Questions
Please complete the questions below in support of the relevance test assessment
Que
stio
Answer
Business Continuity Plan (Version 2.0)
Page 46 of 48
n
Does the service affect service users,
employees or the wider community &
potentially have a significant effect in
terms of
equality?
No
Is it a major Service change
that will significantly affect how
functions are
delivered in terms of equality?
No
Will it have a significant effect on how
other
organisations operate in terms of
equality?
No
Does the Service relate to functions
that previous engagement has
identified as being
important to particular protected groups?
No
Does or could the policy affect different No
protected groups differently?
Does it relate to an area with known
inequalities e.g. access to public
transport for disabled people.
No
Does it relate to an area where
equality objectives have been set
by your
organisation?
No
Please provide any evidence of
engagement that you have considered
to assess the service for its relevance
to equality include any data, research,
engagement etc.:
Business Continuity Plan (Version 2.0)
Page 47 of 48
3. Relevance Assessment Findings
If your assessment has identified a relevance to equality you will be required to
undertake an Equality Analysis, please complete the following table:
The analysis has demonstrated relevance to equality with regard to:
Protected Groups – Please tick
relevant groups
Aims of the Equality Duty – Please tick
relevant aim
• Age
• Disability
• Race
• Gender
• Gender reassignment
• Marriage and Civil Partnership
• Pregnancy and Maternity
• Sexual Orientation
• Relief or Belief
Eliminate unlawful discrimination, harassment
and victimisation (i.e. the function removes or
minimises disadvantages suffered by people due
to their protected group)
Advance equality of opportunity between those
who share a protected group and those who do
not (the service takes steps to meet the needs
of people from protected groups where these
are different from the need of other people)
Foster good relations between people who share
a protected groups and those who do not (i.e. the
service encourages people from protected
groups to participate in public life or in other
activities where their participation is
disproportionately low)
If the assessment has identified NO relevance to equality please detail below your
rationale and how the information you have used supports this conclusion.
4. Conclusions
Relevance Ranking – Please identify in this section the degree to which the function
has been assessed as relevant to equality. (Please mark the applicable box):
No Ranking description X
1
High – The function shows a high degree of relevance to one or more
protected groups and/or one or more aim of the general equality duty
Business Continuity Plan (Version 2.0)
Page 48 of 48
2
Moderate – The function shows a moderate degree of relevance to one
or more protected groups and/or one or
main aim of the general equality duty
x
3 None – The function is not relevant to any protected group and/or any of
the aims of the general equality duty
5. Outcome – Please identify here whether your analysis demonstrates the need for
the completion of an Equality Analysis (please mark the applicable box):
No Outcome Description
1 The relevance assessment has identified a high or medium
relevance ranking and a Equality Analysis is required
2
The relevance assessment has identified a low relevance ranking and in
consideration of the evidence above a Equality Analysis process is not
required
x
Sign off and Approval Process Line
Management sign off
Name: Line
Manager
Signature:
Date: Service:
Director Level sign off
Name: Director
Signature:
Date: Directorate:
Once completed please send to [email protected]
Thank you.
Top Related