Business continuity: strategic guidance for NHS health boards

Section 1: Introduction

1.1 This document highlights the need for business continuity management within NHS Boards and organisations and promotes joint working and collaboration with other Health Boards and partner organisations and when planning for and responding to an incident.^[1] This guidance was developed by a national working group established by the Scottish Government’s Health Emergency Preparedness Resilience and Response (EPRR) division and included members from across NHSScotland.

1.2 Business Continuity Management (BCM) is about identifying those parts of the organisation, no matter how big or small, that the organisation cannot afford to lose. This can include information, stock, premises, catering, laundry, and staff to name but a few. BCM is about planning to maintain these services if an incident occurs whether its natural, accidental or deliberate. Having a pre-planned response to disruptive challenges will enable NHS organisations to ensure critical services are maintained and the organisation’s reputation is protected.

1.3 The Civil Contingencies Act (2004) and the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 require NHS Boards designated as Category 1 to demonstrate that they can respond to a range of incidents while maintaining our critical services to patients at predefined levels.

1.4 These incidents may vary in scale and complexity, and range from dealing with severe weather, infectious diseases outbreaks and/or major no-notice incidents such as acts of terrorism or transport accidents. The NHS must plan for, and be prepared to respond and adapt to the short and long-term consequences of these various disruptive challenges.

1.5 Health Boards should use this strategic guidance, and the associated ‘Preparing for Emergencies: Guidance for Health Boards in Scotland^[2] , in alignment with the most up to date relevant business standards (for example ISO 22301) to develop and maintain a resilient healthcare system.

1.6 BCM gives organisations a framework for identifying and managing risks that could disrupt or halt day to day services. Therefore BCM is an essential tool in establishing any organisation’s resilience. An organisation’s BCM System will help the organisation to anticipate, prepare for, prevent, respond to and recover from a range of disruptive events, regardless of the cause or which part of the business is impacted.

1.7 The Civil Contingencies Act (CCA) 2004^[3] established legislative framework for civil protection within the UK. The Civil Contingencies Act (Contingency Planning) (Scotland) Regulations 2005^[4] describes how the provisions of the Act apply in Scotland. Both place clear obligations on Category 1 listed responder organisations, in relation to assessing, preparing and responding to disruptive challenges.^[5] The duties placed on Category 2 responders primarily relate to cooperating and sharing information with other responders.

1.8 There is a need to ensure that all Health Boards in Scotland, together with those providers who supply a critical service (e.g., GP Practices, Dental Practices, Pharmacies, etc), are sufficiently resilient to respond to any disruption to normal services.^[6] Consequently, there needs to be a robust system in place within all organisations to plan, test and exercise, and review their response against a range of disruptive challenges.^[7] BCM is an essential component of organisational resilience and a requirement of the Civil Contingencies Act 2004.

1.9 This guidance is built on current good practice and shared knowledge and is intended to^[8]

• Improve BCM organisational resilience within each Health Board.
• Help ensure as far as is reasonably practicable through the adoption of resilience principles that we have continuous operational delivery of critical healthcare services when faced with a range of disruptive challenges e.g. staff shortages, denial of access, failures in technology, loss of utility services, or failure of key suppliers.
• Help drive NHS Scotland’s compliance with the Civil Contingencies Act 2004.
• Promote a unified and cohesive approach to BCM which replicates the most up-to-date standards such as ISO 22301 and ISO 22313

1.10 This guidance will support the Chief Executive of each NHS Board^[9] with their responsibility for ensuring that their organisation has an effective and robust BCM process in place.

1.11 This document focuses on planning, preparing and responding within the NHS in Scotland. However, business continuity must apply across the complex networks that make up healthcare provision in Scotland. There is therefore a need for a high level of engagement with service providers, including health and social care partners in Scotland and other parts of the United Kingdom, in order to support mutual aid arrangements.^[10]