Planning for the worst

Business Continuity Management is becoming a hot topic in the NHS, especially in light of the current influenza pandemic. While commercial businesses may be contending with the impact of reduced staff and lower customer demand with the influenza pandemic, the NHS has to contend with an increasing demand for its services and fewer people available to deliver those critical services.  
    
Indeed, the spectrum of disruptive challenges facing the NHS is quite daunting these days. Alongside dealing with traditional major incidents, new threats such as chemical, radiological, and nuclear attack are also on the planning agenda. Extreme weather conditions, biological incidents and pandemic influenza have joined the list as well. In addition, there are the potential internal causes of disruption namely failure of power, telecom, and water supplies, industrial action, and vulnerabilities in the supply chain exposed by the economic downturn.

Backing from above
There is consequently no shortage of encouragement from government for the NHS to adopt Business Continuity Management (BCM) practices to deliver greater resilience. The Civil Contingencies Act 2004 places an obligation on Category One responders such as hospital trusts to implement BCM and the NHS Operating Framework identifies emergency preparedness as one of the five priority areas for NHS organisations. The Health Commission’s Core Standard 24 requires evidence of resilience planning and has defined BCM for the NHS as the management process that enables the NHS organisation to:

• Identify key services which, if interrupted for any reason, would have the greatest impact upon the community, the health economy and the organisation
• Identify and reduce the risks and threats to the continuation of these key services 
• Develop plans which enable the organisation to recover and/or maintain core services in the shortest possible time

At the end of 2007, the Department of Health launched the NHS Resilience Programme, whose goal over three years is to “pump prime” the understanding, acceptance and implementation of BCM across the health care system. The NHS will be guided by the methods outlined in British Standards Institution standard for BCM, BS25999, and in the guidance contained in Emergency Preparedness Guidance on Part 1 of the Civil Contingencies Act 2004.
    
However, it has already been acknowledged that BCM has a different complexion in the NHS versus much of industry. For example, one of the key differences is that the physical site is critical for continuation of service delivery, so it is not possible to move staff and equipment to recovery centres as is common practice elsewhere. According to Hilary Estall, business continuity consultant at Blackmores, the Department of Health is keen to take best practices from BS25999 and implement them in a way that is appropriate to the NHS. These differences have now led to the development of an NHS addition to the British Standard BS25999, namely Publicly Available Specification (PAS) 2015.

What is the reality on the ground?
A government requirement on the NHS to meet influenza preparedness requirements by the end of 2008 has meant that hospital trusts have developed pandemic plans. While seed funding was made available to help trusts meet this deadline, there has been no funding drive to support the implementation of a broader BCM programme within the NHS and so adoption comes down to the importance and priority placed on resilience by individual trusts. The resulting lack of progress has forced the Department of Health to recently run a new series of seminars targeting chief executives in each of the ten Strategic Health Authority areas. These seminars have recapped on the importance of BCM, the British Standard, BS25999 for BCM and the Publicly Available Specification (PAS) 2015.

What lessons are being learned?
Tony Hallett, assistant director of resilience at Guy’s & St Thomas’ NHS Foundation Trust, believes that it is impossible to write a single Business Continuity Plan for a whole trust. He feels it is best to agree how you want to do business continuity and then write a policy on how every element of the trust will do it. The process at his hospital took some twelve months but the approach was heavily loaded at the front end in order to get an effective structure in place and thereby save time later on.
    
“The plans themselves need to be built from the bottom up with clinical and support services conducting their own Business Impact Analysis (a phase of the BCM process). Critical dependencies will vary from department to department, for example renal patients have different needs for water in their treatment than cardiac patients,” he said.
    
While many hospital trusts consider going down the compliance route around BS25999, a dozen hospital trusts are reported to be going through certification to BS25999. The first certifications are expected in early 2010. Advocates of certification feel that it provides stronger benefits as it shows that a system is being used and is not just a plan sitting on the shelf.

Service first
Sphere Health managing director, Andrew Michaelson, said his organisation, a provider of BCM consultancy services to the NHS, reviews a lot of Business Continuity Plans but notes that these plans will often look at threats first and then work on the response. Michaelson sees a weakness in taking this approach: namely, an organisation may fail to look at what makes the service deliverable.
    
He advocates putting the service first and understanding the activities, resources and dependencies underpinning continuity of service delivery. He also feels that Business Continuity Plans should not be set up around emergencies, as not all disruptions are necessarily emergencies, and organisations may find there is a gap in terms of effective response in such situations.  
    
The principal advice, however, is not to boil the ocean whether you are taking the compliance or certification route. It makes much more sense to apply BCM to a small area of the organisation first and demonstrate tangible benefits. Learn from the mistakes made before proceeding further.
    
For example, one trust has actually decided to certify its finance department first. Another has sought compliance to BS25999 for ambulance, accident and emergency and pharmacy services. Another hospital piloted BCM in mortuary services before moving on to accident and emergency. In this latter case IT was identified as a common dependency across service areas and was therefore included in the pilot phase as well.

Don’t forget the supply chain
Supply chain disruption is an important consideration in BCM and the NHS clearly has a large number of independent sector providers, outsource partners and product suppliers to manage. The need for greater resilience has led one trust to hold more stock and bring in an agent to manage suppliers to manage the risk of a failure among one of any of the key suppliers. From a business continuity perspective, a common mistake is to think that outsourcing means that the problem is taken care of. For example, with the Buncefield explosion at Maylands Business Park in Hemel Hempstead, Addenbrooke’s hospital in Cambridge lost access to its IT systems as these had been outsourced to a company with facilities at Buncefield.
    
Even if suppliers have a Business Continuity Plan, the key is to understand how they will support your own plan’s requirements and where you fit in their priorities. Understanding how quickly they will restore service to your organisation if they are affected by any disruption is essential.
    
Implementing an effective BCM programme can be made easier with the use of software tools. In fact the complexity and interdependencies between large numbers of plans within trusts make this mandatory in the minds of some of those who have already started with their programme. This has raised a number of questions in its own right: should each trust buy its own software product or should there be some uniform approach or even an in-house developed version? Currently, NHS trusts may be contracting for the same service provider and yet they might not be aware of this fact and if that supplier failed for whatever reason, then the effects could be dramatic. A process for better oversight of what each trust is doing is therefore seen as a key requirement to get in place before trusts go too far down their own paths.
    
There is one other aspect of the NHS supply-chain that has raised some concerns and that is the resilience of GP practices. As independent small businesses they do not have to have Business Continuity Plans under existing legislation. In the absence of this driver it will fall to Primary Care Trusts to work with GPs to develop a business continuity capability.

Who should be responsible?
It is important to have one person within each business unit or directorate who is responsible for co-ordinating BCM. They should be charged with establishing what the critical functions are for that particular unit. Once these have been established all of the representatives should come together to construct a joined-up plan under the ownership of a senior director who should have access to the organisation’s board.
    
Typically, BCM will be promoted by practitioners in resilience or emergency planning functions. However, those who have experience in implementing BCM place less importance on this organisational detail but rather emphasise the need for a director-level champion.
    
Sphere Health’s Michaelson feels that the BCM programme needs to tackle the complexity and distinctiveness of each service through a bottom up approach, however, the driver needs to come down from the board in order to ensure that resources are prioritised to deliver the programme.

Conclusions
Although the adoption of BCM across the NHS is still in its relative infancy outside of influenza pandemic planning, a body of experience is building up within the NHS, and there is some level of consensus around the critical success factors to adoption:

• If you are going to do it make sure you have the resources properly allocated. The up-front investment of time should not be under-estimated given other competing priorities.
• You need full support from the Board with a director-level champion. Achieving this requires link to be made between BCM and good corporate governance.
• No hospital trust should take the big bang approach. It makes sense to pilot the process in discrete areas. In spite of the challenges there is also a strong consensus that implementing a BCM programme is worth the effort and investment of time and resources.

About the BCI
The Business Continuity Institute is the international professional body for BCM practitioners and provides not only a potential forum for NHS professionals to learn from each other’s experiences but also the opportunity to see what is happening outside of the sector and indeed outside of the UK. Find out more at www.thebci.org