Business continuity: strategic guidance for NHS health boards

Section 3: Roles and Responsibilities

3.1 An effective business continuity plan is dependent upon the identification of clearly defined roles and responsibilities, and the authorities to manage the policy. Roles and responsibilities should be assigned to competent individuals who have the appropriate authority for the role they have been assigned.

Scottish Government Health and Social Care Directorate

3.2 The SG: Health and Social Care Directorate (SGHSCD) has a key role in promoting and the supporting the implementation of BCM arrangements across NHS Health Boards in Scotland, including any Category 1 Responders in terms of the Civil Contingencies Act 2004. SGHSCD also has a responsibility to maintain the currency of BCM guidance for Health Boards in Scotland to ensure strategic guidance reflects up to date best practice.

NHS Boards/Health Service Providers

3.3 The Civil Contingencies Act 2004 requires that Health Boards listed as a Category 1 responder shall “maintain plans for the purpose of ensuring, so far as is reasonably practicable, that if an emergency occurs the person or body is able to continue to perform its functions.”

3.4 Category 2 responders have a lesser set of duties, and they will be less involved at the core of the planning, but they will be heavily involved in providing the expertise or specialist resource of their sector during incidents through cooperation in response and/or the sharing of information. Within NHS Scotland, they included NHS National Services Scotland (NSS).

3.5 Where an NHS Board contracts services to a third party, in keeping with their statutory duty, they must ensure these services conform with local Business Planning/Continuity arrangements due to responsibility remaining with the Category 1 or 2 Responders.

3.6 For organisations not designated as Category 1 or 2 Responders under the Civil Contingencies Act 2004, it is considered good practice to have similar arrangements in place as part of its governance and risk management arrangements.

3.7 It should also be noted that after a Scottish Government public consultation which took place between 12 October and 22 November 2020, it was decided that Integration Joint Boards (IJBs) would be designated as Category 1 responders under the Civil Contingencies Act 2004.^[12]

NHS Boards Senior Management/Leadership

3.8 The organisation’s Senior Management should regard BCM arrangements as essential, and their support provides essential leadership, as set out in the NHS Scotland Organisational Resilience Standards.^[13]

• An Executive-level Director is appointed as the Corporate Lead and has overall accountability for the Resilience i.e. BCM and emergency preparedness (standard 2.1)
• The same Corporate Lead, supported by a Resilience Lead, ensures that the Health Board has up to date (BC, Major Incident and Resilience) plans and appropriate capability (standard 2.4).
• Effective measures are in place for monitoring the effectiveness of plans and maintaining an overview of the Health Boards’ resilience (standard 2.5).
• A duty of the Corporate Lead, as a part of governance arrangements, must report annually on progress in relation to the Health Board’s organisational resilience/BCM plans including (as a minimum) (standard 2.6):
• Risks and Mitigation;
• BC challenges;
• lessons identified (and learned) from disruptive events and major incidents;
• Emergency preparedness, resourcing, and gaps in capability or capacity;
• Training, Testing and Exercising undertaken.

Oversight Responsibilities

3.9 As set out in the NHS Scotland Organisational Resilience Standards each NHS Scotland organisation must:

• Formally appoint or nominate a person with appropriate seniority and authority (e.g. Chief Executive or Board Level Director) to be accountable for all aspects of BCM.
• Appoint or nominate one or more individuals to implement, maintain and regularly review BCM arrangements. These individuals should represent all areas of the organisation, and associated threats and risk.

3.10 Each individual has responsibility to support BCM within the organisation. These responsibilities include:

• The Chief Executive (or nominated person) has overall accountability for the successful implementation and maintenance of BCM for the organisation.
• The BCM Lead Director has overall responsibility for the successful implementation and maintenance of BCM for the organisation.
• Health Board Directors have responsibility for the successful implementation and maintenance of BCM for the critical services within their area.
• Heads of Divisions/Teams/Business units/others have responsibility for oversight of the BCM implementation and maintenance within their area of responsibility.
• Local Managers are responsible for successful implementation and maintenance of BCM within their areas of responsibility.
• Each individual employee is responsible for ensuring that they are familiar with relevant BCM plans and their role within these.

3.11 This ensures the profile of BCM issues is appropriate and decisions are made at a suitable level or escalated accordingly, with an escalation process forming a key part of an organisation’s BCM programme. BCM is an ongoing process, and it is important to gain the support and endorsement of the organisation at each stage. It is the responsibility of senior management to provide the assurance that BCM arrangements are robust, including approval of an overall BCM strategy.

3.12 To develop and maintain a successful BCM culture in the organisation with positive outcomes for the communities it serves, the organisation must ensure that BCM governance, awareness and training are embedded at all levels, alongside routine activities such as business impact analyses and risk management. BCM principles should also form part of engagement with stakeholders to ensure that they have appropriate measures in place to effectively respond to an incident.

Contracted Service Providers

3.13 Service providers contracted by NHS Boards should be able to demonstrate adequate BCM arrangements are in place and, where appropriate, provide evidence to ensure continuity of an acceptable level of service during any period of disruption. NHS organisations and providers of NHS funded care will, therefore, need to recognise how their services depend on each other, and to align their business plans with all relevant partner organisations. An Executive-level Director within the Health Board has overall accountability for Business Continuity (BC) management and emergency preparedness.