Business Continuity Management
Date: 16 Aug 2011
The following information was produced by the Resilience Manager at NHS Nottingham City and Nottinghamshire County...
Business Continuity Management Guidance For General Practice – Why It’s Important
What is Business Continuity Management (BCM) and why is it needed?
Business Continuity Management is the process adopted that assists in the identification of potential impacts that may threaten your practice. These might include loss of power affecting IT or telecoms, loss of water, fire, threats to staff and building security from outside etc. It provides the framework for building resilience and capability to enable you to provide an effective response. It safeguards the interests of your patients, commissioners and your reputation along with protecting the continued operation of the services you provide.
This process must be owned and fully integrated into practice procedures as an embedded management process.
Effective BCM arrangements should improve the resilience of the practice to withstand disruptions. This can be achieved by identifying, in advance, potential impacts to a variety of sudden disruptions. By completing this process the practice will possess the ability to maintain its essential patient services as well as achieving resilience in such areas as security, facilities management and IT.
With effective business continuity plans in place, a practice should be able to survive the loss of part or all of its operational capability. It should be able to demonstrate its ability to survive significant losses of resources such as staff or equipment. A robust plan depends on its management and operational staff as well as technology; this resilience must be developed throughout the practice from senior partners to reception staff.
The driver for practice resilience is the responsibility the senior management have for the long-term interests of its staff, patients, commissioners and others who depend on the practice in some way.
Whilst it may be possible to calculate the financial losses of disruption, the most significant impact is usually in damaged reputation or loss of trust that results from a mismanaged incident. Conversely a well-managed incident can enhance the reputation of the practice and its team.
A recent local example was the fire in Bulwell which affected the Bulwell Health Centre and two GP Practices.
Essential learning from this local incident demonstrated the importance of robust plans especially around:
- Buddy working arrangements across local practices
- Clear processes for contacting patients with outstanding appointments that need to be re-arranged due to the incident
- Management of incoming practice calls which need to be diverted to an alternative location or practice
The Case for Business Continuity Management
“It won’t happen to us”, “We will cope – we always do”, “We are too big to fail” and “We are not a terrorist target” are frequent responses by businesses when questioned about their lack of preparedness. Others believe their insurance company will pay for everything. Most think they haven’t got the time to prepare for something that will never happen. The catalogue of businesses that have failed following an incident suggests that these responses are based on false assumptions.
A good local example of “it cannot happen here” was demonstrated as far from the truth on Monday 8th and Tuesday 9th August 2011 when riots broke out in Nottingham following similar disruptions in many other major cities.
Concerns for the safety of staff and patients working in healthcare provision including general practice and pharmacies was paramount and the contingencies contained in local business continuity plans for loss of premises or loss of access to premises was essential. Guidance on how to lockdown your premises effectively should also be documented in local business continuity plans.
Whilst bombs, fires and floods capture the headlines almost 90% of business-threatening incidents are ‘quiet catastrophes’ which go unreported in the media but can have a devastating impact.
The successful outcome to a business continuity incident can be measured by both the technical response and the perceived competence of the practice management to respond to it. Research by Knight and Pretty of Oxford Metrica indicates that organisations affected by catastrophes fall into two distinct groups – “recoverers” and “non-recoverers”.
A key feature of successful BCM programmes is that ownership of the various responsibilities has been taken at an appropriate level.
How will it benefit my organisation?
The main purpose of BCM is to ensure that your practice has a response in place to deal with major disruptions that threaten its very survival. Whilst this must be worthwhile in itself, there are other benefits that can be gained by embracing BCM as a management discipline.
Some organisations - Cluster PCTs currently for example - have statutory and regulatory requirements for BCM under the Civil Contingencies Act 2004. However the primary driver for BCM should always be that it is undertaken because it adds value to an organisation and the services it provides rather than because of the regulatory considerations.
A thorough review of your business through the Business Impact Assessment processes, Plan development and BCM exercises can highlight business inefficiencies and focus on priorities that would not otherwise have come to light.
When I am asked to provide advice to contractors on how to manage business continuity issues, my answer is “Develop a simple, but effective, business continuity plan that works for you and is reviewed and tested regularly.”
Key elements for maintaining effective Plans
Exercising
Business Continuity Management (BCM) capability cannot be considered reliable until it has been exercised. A planned exercise programme is required to ensure that all aspects of the practice plan and personnel have been exercised over a period of time.
Exercising can take various forms, including technical tests, communication cascades, desktop tests, walk-throughs and full ‘live’ exercises. No matter how well designed and thought-out a BCM Strategy or Business Continuity Plan (BCP), a series of robust and realistic exercises will identify issues and assumptions that require attention.
Time and resources spent exercising BCPs are crucial parts of the overall process as they develop competence, instil confidence and impart knowledge that are essential at times of crisis.
Maintenance
Most organisations exist in a dynamic environment and are subject to change in people, processes, risk, environment and business strategy. To ensure that your BCM capability continues to reflect the nature, scale and complexity of your Practice , it must be current, accurate, complete, exercised and understood by all senior management, staff and commissioners. A Business Continuity Maintenance Programme must be established to ensure that all relevant stakeholders have the current and relevant parts of the BCP.
Review
There are several ways to review a BCM programme including:
- External assessment
- Self-assessment
The BCM review process can ensures that a practice has effective Business Continuity Plans in place.
Assessment has a number of key functions:
- To review the practice BCM solutions.
- To validate the practice Business Continuity Plans.
- To verify that appropriate exercising and maintenance activities are taking place.
- To highlight gaps in planning, response capability and ensure their resolution.
The process should be conducted annually or biannually. In the interim, self-assessment or internal ‘Performance Monitoring’ may be carried out more frequently, by the owners of the Business Continuity Plans.
Whilst much of the language used around business continuity might seem off putting at first, the processes business continuity planning offers will enhance the capability and resilience of your practice to respond to any disruptions to continue to care for its patients and protect its staff and buildings in an ever-changing, complex world.
Business Continuity Workshops to support GP Business Continuity Practioners responsible for developing, maintaining, reviewing and exercising Practice BCPs is planned for later in 2011. If you would be interested in attending one of these interactive events please register your interest by emailing debbie.brown@nottspct.nhs.uk or call 01623 673167.