Operational Directive - Business Continuity Management...Business Continuity Management Program The overarching management system that establishes, implements, operates, tests, maintains,

Operational Directive Enquiries to: Senior Policy Officer, DPMU OD number: OD 0595/15

Phone number: (08) 9222 2368 Date: 22 April 2015

Supersedes: File No: F-AA-26945

Subject: Business Continuity Management

Purpose

WA Health is required by the Public Sector Commissioner and the Treasurer to practice Business Continuity Management (BCM) and ensure Business Continuity Plans (BCPs) are established, maintained, tested, reviewed and updated on a regular basis.

WA Health provides a range of health services to the public, some of which are considered critical services for the protection of lives. BCM ensures those critical services can continue to operate following a disruptive event or incident that would otherwise impair or stop them. BCM comprises both preparation and crisis management.

Policy Statement

All WA Health entities and shared services are required to practice BCM, and establish a BCP to ensure the continuity of critical business functions in the event of a disruption. BCPs are to integrate with the health service’s emergency procedure and risk management programs and align with the whole-of-health BCM policy outlined and attached to this Operational Directive.

BCM Scope and Principles

A BCM program is to ensure the organisation’s BCP:

reflects the service’s vision, mission and key organisational objectives

is site-specific and interconnects with key interdependencies

integrates with the service’s emergency procedure and risk management programs using an “all hazards” approach

is regularly maintained, tested and approved by an appropriate governance structure.

This document can be made available in alternative formats on request for a person with a disability.

© Department of Health 2015

Copyright to this material is vested in the State of Western Australia unless otherwise indicated. Apart from any fair dealing for the purposes of private study, research, criticism or review, as permitted under the provisions of the Copyright Act 1968, no part may be reproduced or re-used for any purposes whatsoever without written permission of the State of Western Australia.

Compliance Divisions and Health Services are to be compliant with the requirements listed in this Operational Directive. Professor Bryant Stokes A/DIRECTOR GENERAL DEPARTMENT OF HEALTH WA

This information is available in alternative formats for a person with a disability.

http://www.healthywa.wa.gov.au/

health.wa.gov.au

Business Continuity Management Policy

1

Effective: March 2016

Title: Business Continuity Management Policy

1. Background

In accordance with Public Sector Commissioner’s Circular 2015-03 - Risk Management and Business Continuity Planning, all public sector bodies “are required to have continuity plans in place to ensure they can respond to, and recover from, any business disruption”.

2. Scope

This policy applies to all WA Health entities and shared services.

3. Policy statement

All WA Health entities and shared services are required to practice Business Continuity Management (BCM), and establish Business Continuity Plans (BCP) to ensure the continuity of critical business activities in the event of a disruption.

4. Definitions

Business Activity An activity, process, or function that is undertaken by a business area of an organisation that produces or supports the delivery of products or services

Business Continuity Management

A holistic management process that allows organisations to recover and re-establish the delivery of services or products at acceptable predefined levels following a disruptive event

Business Continuity Management Program

The overarching management system that establishes, implements, operates, tests, maintains, improves, and updates business continuity for the health service.

Business Continuity Plan A documented procedure that outlines the strategies and resources required for the recovery & re-establishment of business activities (according to pre-determined priorities) following a disruptive event

Business Impact Analysis A systematic process that analyses activities undertaken by a business area and estimates the effects a disruption may have upon them. It includes assessing dependencies and preparing strategies to respond and recover and to determine the priorities for those processes

Disruption An event that results in an interruption to business activities

https://publicsector.wa.gov.au/sites/default/files/documents/2015-03_risk_management_and_business_continuity_planning_0.pdf


2

5. Roles and responsibilities

Director General and State Health Coordinator

The Director General is the Accountable Officer and has overall responsibility for risk management and business continuity in WA Health. The Director General has delegated responsibility of State-level BCM to the Director, Disaster Management, Regulation and Planning Directorate, as the delegated State Health Coordinator. The State Health Coordinator, as the Chair of the WA Health Emergency Management Committee, performs the system manager role for BCM reporting and assurance.

Chief Executives and Area Health Services

Chief Executives and Area Health Services are responsible for providing assurance to the State Health Coordinator, via the Health Emergency Management Committee, that BCM is being practiced at hospitals within the area health service, as per to BCM reporting and assurance requirements attached to this policy.

Executive sponsors

The executive sponsor is ultimately responsible for governance over the BCM program and should be a member of the health service’s executive team. The executive sponsor’s role includes:

overall responsibility for the health service’s BCM program

chairing the committee with responsibility for the health service’s BCM program

approving the health service’s BCP

ensuring the BCM program is adequately resourced.

BCM program managers

The BCM program manager is responsible for the ongoing management of BCM for the health service. The BCM program manager’s role includes:

leading the implementation of BCM program

engaging senior managers to participate in planning process.

facilitating a Business Impact Analysis (BIA) for each business area

aggregating, consolidating and documenting the BCP

ongoing maintenance of the plan, including exercising and updating

facilitating the training of staff in the health service’s BCM arrangements.

Senior managers

Senior managers are to ensure BCM has been embedded and actively managed in their areas of responsibility. This includes:

management of the BCM planning processes for activities under control

ensuring staff have undertaken training in the organisation’s BCM arrangements

documenting and endorsing the BCM strategies for activities under control

leadership when plan is activated.

All Staff

All staff members should undertake appropriate training in the BCM arrangements for the organisation.

http://www.health.wa.gov.au/circularsnew/circular.cfm?Circ_ID=13206


3

6. Scope of planning The scope of the BCM program should be based on a localised single function or departmental-wide disruption. This should include identification of critical business activities through a BIA, identification of continuity strategies and resources, development of the BCP, and on-going training, exercising, and maintenance of the BCP, as per the attached BCM principles and requirements.

7. Compliance

Compliance with this policy is mandatory for all health services. Whilst there is no requirement to standardise the format of the BIA and BCP, BCM program managers are strongly encouraged to utilise the tools and templates attached to this policy.

Area Health Services are responsible for reporting and assurance to the State Health Coordinator, as per the attached reporting and assurance requirements.

The BCP should be tested and reviewed annually. The BIA for each business area should be reviewed every three years, or after any substantial organisational change or restructure.

8. References

Public Sector Commissioner’s Circular 2015 – 03 – Risk Management and Business Continuity Planning.

9. Relevant legislation

Financial Management Act 2006

Public Sector Management Act 1994

10. Related documents

Business Continuity Management – requirements and principles for WA Health

Whole of Health Business Impact Analysis Template

Business Impact Analysis Handbook

Business Continuity Plan template







Title: Business Continuity Management Policy

Contact: Senior Policy Officer, Disaster Preparedness and Management Unit – (08) 9222 2368

Directorate: Disaster Management, Regulation and Planning Directorate

Version: 2.0 Date Published: 16/03/2016

Date of Last Review: 19/02/2016 Date Next Review: 16/03/2018

http://www.health.wa.gov.au/

health.wa.gov.au


Requirements and principles for WA Health

1

Introduction

This document outlines the requirements and principles of Business Continuity Management (BCM) within WA Health. It details the step-by-step process for undertaking BCM within a hospital or health service and links the process into the specific tools and templates for undertaking BCM within WA Health.

What is business continuity management? BCM is a holistic management process that allows organisations to continue the delivery of critical services and / or products at acceptable predefined levels following a disruptive event.

The key objectives of BCM are to:

Minimise the impact of a disruption

Resume priority services within pre-defined timeframes

Restore full business capabilities as quickly as possible.

The below diagram highlights the relationship between business continuity, emergency response, and recovery.

The response continuum

2

Why do we practice business continuity management?

WA Health provides many critical services to the public of Western Australia. Hospitals and health services are resource-intensive services susceptible to many natural and man-made risks. When these risks materialise into a disruptive event the effects of the disruption may impede WA Health’s ability to continue providing these critical services leading to unacceptable outcomes.

BCM allows decision-makers to delineate between essential business activities that must be re-established within set pre-defined timeframes, and less critical business activities which may be temporarily suspended and its resources redirected to higher priority areas.

WA Health has an obligation to practice BCM and is regularly audited to ascertain it’s compliance to best-practice standards. This requirement is reinforced by Public Sector Commissioner’s Circular 2015 – 03 – Risk Management and Business Continuity Planning.

Elements of the business continuity management process

There are five main elements of BCM:

1. BCM program management

Executive leadership is required to establish governance over the BCM program and entrench an organisational culture that is proactive to organisational resilience. The key outputs from BCM program management are the establishment of a BCM Committee (however titled), the development of a BCM Policy, and endorsement of a BCM implementation schedule.

A BCM Committee should be established that is charged with responsibility for the ongoing maintenance, governance, education and training for BCM. This committee can be absorbed into pre-existing emergency or risk management committees, or established as a separate BCM-focused committee. The committee should be chaired by the executive sponsor.

Planning scope and assumptions

The scope of the BCM program should determine the extent of planning. For hospitals and health services, the scope is to be based on a localised single function or departmental-wide disruption.



3

Assumptions should also be documented and include considerations, suppositions and inferences on which the BCM planning is based.

The scope and planning assumptions should be approved by the executive sponsor.

Communication and consultation

A stakeholder analysis should be performed prior to the commencement of the BCM planning process. Communication and consultation with internal and external stakeholders is essential in ensuring that staff, relevant stakeholders and interdependencies have input to the BCP and are aware of their role when the BCP is activated. A communication plan should be formulated to ensure all relevant parties are identified and actively involved in the BCP development, implementation and maintenance process.

2. Business impact analysis

A Business Impact Analysis (BIA) should be performed for each business unit within the health service. The BIA is the systematic process of analysing activities and the effect a disruption may have upon them. The BIA assesses two key elements:

1. The impact of a disruption to a business activity; and

2. The resources (people, systems, equipment, premises and services) the business activity depends upon to successfully function.

A BIA template and handbook have been developed to guide BCM program managers through the process. The template and handbook are available in Operational Directive 0595/15.

The key output from the BIA is the determination of the Maximum Tolerable Period of Disruption (MTPD) for each business activity. The MTPD is a prioritisation indicator that determines the length of time a business activity can be disrupted before the consequences of not performing that activity become unacceptable to the organisation. Business activities with a MTPD of two weeks or less are considered time-critical, whereas business activities with a MTPD of greater than two week are considered non-critical for business continuity purposes.

3. Business continuity strategy

Once the MTPDs and dependencies have been determined, the next step is to identify Business Continuity (BC) response strategies to support the business functions. The strategies should take into consideration the resource for people, systems, infrastructure, premises, information and work processes.

BC strategies don’t necessarily imply the resumption of full service activities. A reduced, but tolerable, activity level may be enough to ensure critical elements of the activity are fulfilled. Strategies should include a minimum acceptable level and sustainable level of activity.

Examples of BC response strategy include:

temporarily suspending the business activity

workarounds

transferring the activity to another health facility (eg: going onto bypass/diversion)

transferring staff and resources to an another facility, department, or health service


4

working from home (generally non-clinical activities)

relocating the service and/or resources to a back-up location.

Unless previous agreements or Memorandum of Understandings have been formalised between health services, relocation strategies should be generalised rather than specific to allow for flexible arrangements to be implemented. For example: relocate to alternative tertiary facility.

Once the strategies have been determined, the resources required to implement the strategies need to be mapped. Resources include people, systems, specialist equipment, key consumables, premises and services.

In some clinical settings, the list of key consumables may be extensive. Rather than detail an exhaustive list, the consumables may be referred to as ‘supply’ or ‘pharmaceutical imprest’ lists.

4. Documentation of the plan

The Business Continuity Plan (BCP) is simply the documentation of the outputs from the BIA, and the listing of business continuity strategies, resources and interdependencies. A series of BIAs for different service streams may feed into one BCP for the health service. The plan should detail how it communicates with internal and external stakeholders, and outline the roles and responsibilities of key responders. A sample BCP template is available under Attachments in Operational Directive 0595/15.

The BCP is to be endorsed by the health service executive and dovetail with existing emergency response, contingency, and recovery arrangements and plans. A BCP is an iterative document that should be tested, maintained and updated to reflect changes in the organisation. The plan should be readily available on HealthPoint and in hard copy.

5. Training and exercising

Once the BCP has been endorsed by the organisation’s executive, training should be provided to staff members. This may vary from awareness training for new staff, to response training to those with a pre-identified role when a BC response is required.

BC training should include an annual exercise which tests the arrangements detailed in the health service’s BCP. An exercise may include:

A discussion exercise

A simulation exercise

A walkthrough or familiarisation exercise

A live test.

Regular reviews and maintenance

Health services are to ensure the maintenance over the BCM program. This includes ensuring the BCP remains current and relevant. Maintenance should be undertaken:

When new business activities are undertaken or existing business activities are discontinued


5

Following a restructure or change in governance arrangements

Where there are major changes to the health service’s location and / or technology

Following an exercise or real event

Following an internal or external audit where gaps have been identified

Periodically, in accordance with BCM Policy.

More information

More information on BCM can be found on the Community of Best Practice for BCM HealthPoint page.

Definitions

Business Activity An activity, process, or function that is undertaken by a business area of an organisation that produces or supports the delivery of products or services


A holistic management process that allows organisations to recover and re-establish the delivery of services or products at acceptable predefined levels following a disruptive event

Business Continuity Plan

A documented procedure that outlines the strategies and resources required for the recovery & re-establishment of business activities (according to pre-determined priorities) following a disruptive event

Business Impact Analysis

A systematic analytical process that analyses activities undertaken by a business area and estimates the effects a disruption may have upon them. It includes assessing dependencies and preparing strategies to respond and recover and to determine the priorities for those processes

Dependency A process, service, supplier, or resource which is essential in order for a business activity to successfully function.

Disruption An event that results in an interruption to business activities

Impact The consequences that result from an adverse event or disruption

Maximum Tolerable Data Loss

The maximum period of time that data can be lost before the impact becomes intolerable or unacceptable to the organisation

Maximum Tolerable Period of Disruption

The period of time it would take for adverse impacts, which arise from not providing a service or activity, to become intolerable or unacceptable to the organisation

Strategy (business continuity)

A response option, based on the business impact analysis, for how an organisation will respond to a disruption to a business activity





health.wa.gov.au

Business Impact Analysis handbook

November 2015

2

Contents

What is a Business Impact Analysis 3

Process 3

Templates and tools 5

Carrying out the BIA 6

Step 1 Preparation and set-up 6

Step 2 Dependencies Assessment 7

Consolidated dependencies profile 9

Step 3 Impact assessment 10

Consolidated BIA profile and priorities 12

Step 4 Business continuity strategies and resource requirements 13

Attachment 1 Impact Reference Table 16

Attachment 2 Dependency Rating Table 17

Attachment 3 Consolidated Dependencies Assessment – People and Infrastructure 18

Attachment 4 Consolidated Dependencies Assessment – Systems and Applications 19

Attachment 5 Consolidated BIA Profile 20

BIA Handbook November 2015

3

Purpose

The purpose of this handbook is to provide guidance on how to undertake a

Business Impact Analysis (BIA) using the templates and tools that have been

developed for healthcare facilities in the Department of Health. There is, however, no

requirement to standardise the BIA – health services and divisions are free to use

other BIA methodologies and tools that are deemed appropriate so long as the

objectives of the BIA are met. These objectives are described in the sections below.

What is a Business Impact Analysis The BIA is a structured and formal process for determining the priorities for the

resumption and continuity of services / business activities following a disruption.

Whilst all the daily activities1 carried out in a healthcare facility are important, not all

these activities are “time critical”. In the event of a major disruption, some of these

activities could temporarily be suspended with little or no negative consequences on

patient care or the broader health system. On the other hand, some activities have

very low tolerances for disruption because the consequences of disruption on the

organisation are unacceptable, even for a few minutes or hours. The BIA allows you

to prioritise the activities from a time perspective, separating those that are time

critical from those that are not.

The BIA is an important process as it allows the organisation to determine the scope

that will form the cornerstone for the development of business continuity strategies

and response plans.

Process The BIA is a 4-step process as illustrated in Figure 1 below:

1 The term ‘activities’ is used broadly to include services, functions and processes that are

undertaken in a business area


4

Figure 1 Business Impact Analysis Process

Step 1 Preparation and set-up

Identify the activities that are undertaken by each unit / business

area

Step 2 Dependencies assessment

Identify the resources that are used by each of the activities under

normal operations, and assess the level of dependency that the

activity has on a given resource.

Step 3 Impact assessment

Assess the potential business impact of a disruption to business

activities, determine the maximum amount of time that the activities

may be disrupted for before the business impact becomes

intolerable, and prioritise the activities for recovery

Step 4 Business continuity strategies and resource requirements

Identify the strategies, interdependencies and resource

requirements for the continuity of priority activities


5

Approach

The BIA should be conducted with managers who have overall responsibility for a

department, unit, or business area. They must be able to “stand back” and provide

an organisation-wide perspective when assessing the impacts of disruption, and

have the authority to make an educated determination of the recovery priorities for

activities within their department or unit.

Inputs should be sought from multiple participants so that the analysis is balanced

and not based on the opinions of a single person. For this reason, the BIA is best

conducted in a facilitated workshop setting with department and unit managers.

BIA workshops should be conducted for each directorate. Depending on the size of

the directorate, you may need to have separate workshops for each department /

unit to keep it manageable. The BIA is conducted bottom-up – i.e. information is

collected at the unit / business area level, and then rolled-up and consolidated at the

department / directorate and organisation-wide level.

Templates and tools The templates and tools for conducting the BIA are:

Impact Reference Table2 (see Attachment 1)

Dependency Rating Table (see Attachment 2)

BIA template, consisting of the 7 worksheets

o WS1 Listing of activities

o WS2A Dependencies assessment – people and infrastructure

o WS2B Dependencies assessment – systems and applications

o WS3 Impact assessment

o WS4A Business continuity strategies

o WS4B Resource requirements

o WS4C Interdependencies

2 The Impact Reference Table is a subset of the Consequence Description Table found in

the RiskBase (version 3) DoH Data Definitions document. The table has been simplified by

removing the impact categories that are not relevant for business continuity. Note that

RiskBase will be discontinued from March 2016.


6

Carrying out the BIA The following tables describe the process for carrying out each step of the BIA. This

is to be used with the BIA template.

Step 1 Preparation and set-up

Template /

tool:

WS1 Listing of Activities

Objectives: To identify the activities that are undertaken by each business

area

Who should

provide inputs:

Unit / business area managers

Key tasks:

1. Identify the directorates and units / Business Areas in the

organisation, and the managers responsible for these areas.

2. Identify the sub-units (if appropriate) under each Unit /

Business Area.

3. Identify the activities that are performed in each Sub-unit (or

Unit / Business Area if Sub-units are not applicable).

Additional

notes

When identify activities that are performed in each Sub-unit,

care should be taken to ensure that they are not listed at too

high or too low a level. The following are some general

guidelines:

Identify what is done or what service is provided, not how it

is carried out

If you start to going into a process or procedural breakdown,

you have gone too far

If a set of tasks must be carried out in sequence in order to

meet an objective, complete a job or deliver a service, you

can probably group these into one activity rather than listing

them as several activities

A sample list of activities is presented in Attachment 5.


7

Step 2 Dependencies Assessment

Template /

tool:

WS2A Dependencies Assessment – People and

Infrastructure

WS2B Dependencies Assessment – Systems and

Applications

Dependencies Rating Table

Objectives: To Identify the resources that are used by each of the activities

(identified in Step 1) under normal operations, and assess the

level of dependency that the activity has on a given resource

Who should

provide inputs:

Senior staff members with good operational knowledge. Results

are to be reviewed by the respective Unit / Business Area

managers

Approach: One-on-one / small group interview with facilitator

Key tasks:

WS2A Dependencies Assessment – People and Infrastructure

1. Identify the dependencies (people, utilities / essential

services, office equipment and telecommunications, medical

equipment, specialised equipment and key consumables)

that are used by each activity

2. For each activity, rate the level of dependency (using the

dropdown menu) that it has on each of the resources listed.

Refer to the Dependency Rating Table for the definitions of

the ratings

WS2B Dependencies Assessment – Systems and Applications

1. Identify the systems / applications that are used by each

activity

2. For each activity, rate the level of dependency (using the

dropdown menu) that it has on each of the system /

application listed. The Dependency Rating Table is to be

used with this worksheet

3. When all the activities have been assessed, return to the list

of systems / applications. For each system / application:

4. Determine the “system off-line duration”– the maximum

duration that a system / application may be unavailable

before the impact becomes unacceptable using the

dropdown menu

5. Determine the “data loss duration” – the maximum data loss

that can be tolerated before it becomes unacceptable using

the dropdown menu.


8

Additional

notes:

Upon completion of the assessment, the ratings will provide

an indication of what the critical dependencies for each Unit /

Business Area are, and a separate exercise may be

undertaken to risk assess these dependencies and to

implement further preventative controls or contingency

measures where necessary


9

Consolidated dependencies profile

Template /

tool:

None

Objectives: To present a consolidated view of the resource dependencies

across the healthcare facility

Who should

provide inputs:

The person who is coordinating business continuity across the

healthcare facility will consolidate the information when all the

units / business areas have completed Step 1.

Key tasks:

WS2A Dependencies Assessment – People and Infrastructure

1. For smaller healthcare facilities, the assessments conducted

for each unit / business unit on WS2A may be simply be

merged into a single worksheet

2. For larger healthcare facilities, the assessments at the

activity level may be rolled up to a unit / business area level

by selecting the highest dependency rating for each

resource as being representative of the overall rating for the

unit / business area

A sample output is presented in Attachment 3

WS2B Dependencies Assessment – Systems and Applications

1. Similar to WS2A, the assessments at the activity level may

be rolled up to a unit / business area level by selecting the

highest dependency rating for each system / application as

being representative of the overall rating for the unit /

business area

A sample output is presented in Attachment 4


10

Step 3 Impact assessment

Template /

tool:

WS3 Impact Assessment

Impact Reference Table

Objectives: To assess the potential business impact of a disruption to

activities, determine the maximum amount of time that the

activities may be disrupted for before the impact becomes

intolerable, and prioritise the activities for recovery

Who should

provide

inputs:

Managers for the respective Units / Business Areas. Results to be

reviewed and endorsed by the Director

Approach: Facilitated workshop

Key tasks:

For each service / activity identified:

1. Discuss how a disruption could impact the organisation, using

the impact categories in the Impact Reference Table as a

guide (not all the impact categories would be relevant for every

activity). Use column C, “Impact of disruption”, to make notes

of key points discussed and note the relevant impact

categories in column D.

2. Score the impact over various timeframes (i.e. minutes, hours,

days, weeks) using the severity level rating 1 to 5 (dropdown

menu) as defined in the Impact Reference Table, taking into

consideration the impact categories discussed earlier. Answer

the question, “What would the severity level rating be if this

activity was disrupted for minutes, hours, days and weeks?”

3. Determine the Maximum Tolerable Period of Disruption

(MTPD)3 in column I by selecting the appropriate timeframe (2

hours, 4 hours, 8 hours, 1 day, 3 days, 1 week, 2 weeks and 1

month+) in the dropdown menu. The MPTD should be guided

by the severity level ratings in the previous task - a score of 4

or 5 indicates an unacceptable level of impact (this is the “cut-

off” score). The MPTD should therefore fall within the

timeframes where the score is a 4 or 5 in the time columns

(see examples and table below).

Example 1 - the cut-off score of 4 appears in the ‘Days’ column,

hence the MTPD fall within 1 to 7 days. The specific MTPD is

arrived at based on discussion and agreement with the workshop

3 MTPD refers to the maximum amount of time that an activity can tolerate a disruption

before the impact on the organisation becomes unacceptable


11

participants

Example 2 – the cut-off score of 4 appears in the ‘Weeks’ column,

hence the MTPD should fall within 1 week to a month. The specific

MTPD is arrived at based on discussion and agreement with the

workshop participants

Example 3 – the cut-off score of 4 does not appear in any of the

time columns. This indicates that this activity could be stopped for

weeks with little impact on the organisation, and the MTPD will be

more than a month. The specific MTPD is arrived at based on

discussion and agreement with the workshop participants

Examples: Impact ratings

Mins Hrs Days Wks MTPD

Example 1 2 3 4 5 3 days

Example 2 1 2 3 4 2

weeks

Example 3 1 1 1 2 3

months

4. Repeat the assessment for each service / activity listed.

5. Upon conclusion of all the assessments, every activity in the

Unit / Business Area should have an associated MTPD. The

MPTDs thus provide the basis for you to prioritise recovery of

these activities following a disruption.

Additional

notes:

The following ground rules should be observed when performing

the assessment:

Assess the impact from an organisation-wide perspective, i.e.

how would a disruption impact the organisation, rather than on

the individual Unit / Business Area

The cause of the disruption is immaterial – it may be a power

outage, roof collapse, fire, etc. – the focus is on the impact of a

disruption, rather than the cause of the disruption

Do not take into consideration any contingency arrangements

that may already be in place or measures that could be

implemented to mitigate the impact – these will be addressed

in the strategy phase of the BCM process


12

Consolidated BIA profile and priorities

Template /

tool:

None

Objectives: To present the consolidated findings of the impact assessment

for Executive management endorsement

Who should

provide inputs:

The Business Continuity Coordinator for the healthcare facility is

responsible for consolidating the information when all the units /

business areas have completed Step 3.

Key tasks:

1. Upon completing the impact assessments for all the

Directorates, the results (from WS3) should be consolidated

and presented to the Executive for endorsement.

2. As a general guideline, all activities with MTPDs of 2 weeks

or less are considered as “priority activities” and must fall

within the scope of the organisation’s business continuity

strategies and response plans

A sample output is presented in Attachment 5.

Additional

notes:

It is important that Executive endorsement is obtained before

proceeding to Step 4.


13

Step 4 Business continuity strategies and resource requirements

Template /

tool:

WS4A Business continuity strategies

WS4B Resource requirements

WS4C Interdependencies

Objectives: To identify the strategies, interdependencies and resource

requirements for the continuity of priority activities

Who should

provide inputs:

Managers for the respective Units / Business Areas. Results to

be reviewed and endorsed by the Director

Approach: Facilitated workshop

Key tasks:

WS4A Business continuity strategies

The purpose of WS4A is to document the high level strategies

for the continuity of priority activities (i.e. those with MTPD of 2

weeks or less as identified in Step 3)

For each priority service / activity:

1. Identify the Immediate Continuity Strategy (column E) for

responding to a disruption and the duration that this strategy

can be maintained for (column F). This is a short term

strategy designed to provide a bare minimum or basic level

of service in order to contain or minimise the impact of the

disruption on stakeholders until a more sustainable level of

service can be provided.

2. Identify the Sustainable Continuity Strategy (column G) that

will provide a higher level of service that can be sustained

beyond the Immediate Continuity Strategy, and the duration

that this strategy can be maintained for (column H)

Note:

There may be instances where the Immediate and

Sustainable continuity strategies are the same

Examples of strategies include (not exhaustive)

o Temporary suspension of an activity

o Redirecting the activity to another facility

o Transferring resources to another facility

o Redirecting patients to alternate care options

o Using alternate procedures / workarounds

o Stopping altogether until full recovery can be

achieved, etc.


14

WS4B Resource requirements

The purpose of WS4B is to capture the minimum levels of

resources required by a sub-unit / unit over various timeframes

(8 hours, 1 day, 3 days, 1 week, 2 weeks and 1 month or

greater) to implement the business continuity strategies

identified in WS4A.

The information is collected at an overall sub-unit / unit /

business area level rather than activity level as the same

resources are likely to be shared or deployed across a number

of services / activities. The resource information collected in

Step 2 on WS2A will automatically be transferred to this

worksheet.

You may or may not need to create multiple copies of this

template, depending on the number of sub-units you have and

how resources are deployed. As a general guide:

If the sub-units are fairly autonomous and have their own

pool of personnel, each sub-unit will require its own

worksheet.

If the sub-units are largely dependent on the same pool of

personnel who share duties and responsibilities across sub-

units, you can combine the sub-units and have a single

worksheet for the unit / business area.

In the example within the spreadsheet, Operation Theatre

Services, Central Sterilisation Services and Day Stay Unit are 3

autonomous sub-units. Each of them will require its own

worksheet.

People

1. For each category / position (e.g. Manager, Medical Officer,

Nurse, etc.) that are in the sub-unit / unit / business area,

identify the number of staff that you have under normal, day-

to-day, conditions (column B)

2. For each timeframe (i.e. 8 hours, 1 day, 3 days, etc.) in

column B, identify the minimum number of staff in each of

the categories / positions that will be required to support the

continuity strategies of priority activities identified in WS4

Office equipment and telecommunications, medical equipment,

specialized equipment and key consumables, systems /

applications and utilities / essential services


15

1. For each type of resource listed, identify the normal quantity

that are in use, and the minimum quantities that are required

over time (i.e. 8 hours, 1 day, 3 days, etc.) to support the

continuity strategies of priority activities identified in WS4

2. If a resource that is required is not quantifiable, use ‘Y’ (for

yes) to indicate that it is needed

WS4C Interdependencies

The purpose of WS4C is to capture the internal and external

dependencies of a sub-unit / unit / business area in relation to

the priority activities. Like WS4B, the information is collected at

an overall sub-unit / branch / business are level rather than

activity level as multiple activities are likely to have the same

interdependencies.

The same guidelines from WS4B on the need for multiple

copies apply for this worksheet.

1. Internal Interdependencies - identify the internal parties /

stakeholders (outside the branch / business area) within the

organisation with whom you have interdependencies with.

Upstream – are parties whom you are dependent on to

perform your activities

Downstream – are parties who are dependent on you to

perform their activities

2. External Interdependencies - identify the external parties /

stakeholders (outside the health facility, such as other

agencies, suppliers, service providers, etc.) with whom the

branch / business area have interdependencies with.

Upstream – are parties whom you are dependent on to

perform your activities

Downstream – are parties who are dependent on you to

perform their activities

16

Attachment 1 Impact Reference Table SEVERITY LEVEL 1 2 3 4 5

CONSEQUENCE CATEGORIES Insignificant Minor Moderate Major Catastrophic

FL FINANCIAL LOSS

(Destruction, Theft, or Litigation / penalties)

Less than $5,000. $5,000 to less than $100,000.

$100,000 to less than $3M. $3M to less than $20M. $20M +.

RI REPUTATION AND IMAGE

Non-headline exposure. Not at fault. Settled quickly. No impact.

Non-headline exposure. Clear fault. Settled quickly by Departmental response. Negligible impact.

Repeated non-headline exposure. Slow resolution. Ministerial enquiry / briefing. Qualified Accreditation.

Headline profile. Repeated exposure. At fault or unresolved complexities impacting public or key groups. Ministerial involvement. High priority recommendation to preserve accreditation.

Maximum multiple high-level exposure. Ministerial censure. Direct intervention. Loss of credibility and public / key stakeholder support. Accreditation withdrawn.

NC NON-COMPLIANCE

Innocent procedural breach. Evidence of good faith by degree of care / diligence. One off minor legal matter. Little impact.

Breach, objection/complaint lodged. Minor harm with investigation. Evidence of good faith arguable.

Breach of contractual or statutory obligations, or probity infringements. Lack of good faith evident. Non-compliance results in performance review.

Major breach of contractual or statutory obligations. Non-compliance results in termination of process or imposed penalties, formal investigation or disciplinary action. Ministerial involvement.

Serious breach of contractual or statutory obligations. Non-compliance results in loss of accreditation, litigation or prosecution with significant penalty. Dismissal. Ministerial censure. Public enquiry

HP HEALTH IMPACT ON PATIENT(S) / STAKEHOLDERS

Increased level of care (minimal). No increase in length of stay. Not disabling. Little or no noticeable impact on patient care**.

Increased level of care (minimal). Increased length of stay (up to 72 hours). Recovery without complication or permanent disability. Inconvenience & minor delays to individuals but little or no impact on overall service delivery**

Increased level of care (moderate). Extended length of stay (72 hours to one week). Recovery without significant complication or significant permanent disability. Moderate impacts on a number of individuals, resulting in noticeable impact on overall service delivery**

Increased level of care (significant). Extended length of stay (greater than one week). Significant complication and/or significant permanent disability. ALL SAC 1 EVENTS Serious impacts on significant numbers of individuals, resulting in noticeable impact on overall service delivery**

Death, permanent total disability. ALL SAC 1 EVENTS. Major / debilitating and long term impacts on individuals and overall delivery of services**

OO ORGANISATIONAL OBJECTIVES

Little impact. Inconvenient delays. Material delays. Marginal under achievement of target performance.

Significant delays. Performance significantly under target.

Non-achievement of objective / outcome. Total performance failure.

*Note: Table is a subset of the Consequence description table in the Riskbase DOH Data Definition. Text in italics added to provide clearer contextual reference for the purpose of the BCM Business Impact Analysis

17

Attachment 2 Dependency Rating Table

Level Description

1 Minimal

dependency

There is minimal dependency on this resource. Resource is nice to have; successful delivery of critical services or completion of a task is possible without this resource

2 Low

dependency

There is low dependency on this resource for the successful provision of critical services or completion of a task; an outage will have minimal material impact; the task can still be successfully completed using manual workarounds or alternative resources as a stop gap measure until the resource is available again.

3 Occasional dependency

Successful delivery of critical services or completion of a task is occasionally dependant on this resource; an outage may cause some inconvenient delays in completion of a task but parts of the task can be successfully completed using manual procedures or alternative resources for a period of time.

4 High

dependency

Successful delivery of a critical service is fully dependant on this resource; resource is used regularly for processing; an outage may result in significant knock on effects; there is low tolerance of an outage before the impact becomes unacceptable; limited manual workaround or alternative resource may be used for a short period of time as a stop gap measure.

5 Critical

dependency

Successful delivery of a critical service is fully dependant on this resource; resource is used continuously for processing or to provide real time feedback/information; resource must be operational 24 x 7; an outage may result in serious knock on effects; there is close to zero tolerance of an outage before it becomes unacceptable; there are no or very limited manual workaround or alternative resources.

18

Attachment 3 Consolidated Dependencies Assessment – People and Infrastructure (Sample)

People Utilities / Essential services Office equipment and telecommunications Medical equipment Specialised equipment Key consumables

Service Area C

linic

al sta

ff

Nurs

ing s

taff

Ord

erlie

s

Adm

inis

tratio

n s

taff

Te

chnic

ians

Pow

er

Wate

r

Natu

ral gas

Liq

uid

petr

ole

um

gas

(LP

G)

Me

dic

al oxygen

Me

dic

al N

itro

us O

xid

e

Me

dic

al carb

on d

ioxid

e

Me

dic

al air

Me

dic

al suctio

n

Ventila

tio

n

Air-c

onditio

nin

g / H

eatin

g

Pers

onal com

pute

r

Lapto

p c

om

pute

r

Ta

ble

t

Prin

ter

(bla

ck a

nd w

hite)

Prin

ter

(colo

ur)

Photo

copie

r

Fa

x m

achin

e

Docum

ent scanner

Desk p

hone

Mo

bile

phone

DE

CT

Phones

Pager

Inte

rnet

access

Operation Theatre services 5 5 4 2 4 5 5 5 5 5 5 5 5 5 4 2 5 5 3

Central Sterilisation Services Dept

5 5 5

Day Stay Unit services 5 4 5

Administration and Medical Records

5 2 5 3 5 4 3 3 3 5 3 3 5

Nursing 5 3

Allied Health 5 5 3 3 5 4

Aged Care Services 5 4 4 4 4 5

Community Mental Health 5 3

Emergency Department 5 5 4 2 3 5 5 5 5 5 5 5 5 5 5 4 3 3 3 5 5 5 5

Inpatient Medical & Nursing Care

5 5 5

Maternity 5 5 3 2 2 5 4 5 5 5 5

Hospital Management 5 3

Home Nursing Discharge Services

5 3

Pharmacy and Supply 5 3 5

Food Services 5 5 5 5

Laundry Services 5 5 5 3

19

Attachment 4 Consolidated Dependencies Assessment – Systems and Applications (Sample)

Applications

# Services using this application

Level of dependency

System offline

duration

Data loss

duration

Business areas

Op

era

tion

The

atr

e s

erv

ices

Cen

tral S

terilis

atio

n S

erv

ice

s

Dep

t

Day S

tay U

nit s

erv

ice

s

Ad

min

istr

ation a

nd

Med

ical

Reco

rds

Nurs

ing

Alli

ed

He

alth

Ag

ed C

are

Se

rvic

es

Com

mu

nity M

en

tal H

ea

lth

Em

erg

en

cy D

ep

art

men

t

Inp

atie

nt M

ed

ical &

Nurs

ing

Ca

re

Ma

tern

ity

Hosp

ita

l M

ana

ge

me

nt

Hom

e N

urs

ing

Dis

ch

arg

e

Se

rvic

es

Ph

arm

acy a

nd

Su

pp

ly

Foo

d S

erv

ice

s

La

un

dry

Se

rvic

es

Health Records Management + Scanning and eForms (eHRM)

9 5 30 mi 0 3 4 4 2 5 5 4 3 1

WebPAS 13 5 30 mi 0 2 2 2 4 5 5 5 3 2 1 1 4 5

Clinical Pathology (Ultra/LIS) 0 5 1 h 0

Theatre Management System (TMS) 14 5 3 h 0 3 3 2 2 4 5 5 5 3 2 1 1 4 5

Internet 15 5 1 h N/A 1 1 2 4 5 5 5 3 2 1 1 4 5 2 4

eReferrals 13 4 6 h 0 2 2 4 5 5 5 3 2 1 1 4 5 5

Cardiobase 0 4 4 h 1 h

Enterprise Bed Management (EBM) 13 4 4 h 1 d 1 3 3 2 2 4 5 5 5 3 2 1 1

Diet Management 10 4 1 d 0 2 4 5 5 5 3 2 1 1 4

HealthPoint (Sharepoint Intranet) 14 3 6 h 1 d 5 5 5 3 2 1 1 5 5 5 3 2 1 1

Haematology & Oncology Protocols & Prescriptions (HOPP)

9 3 1 d 0 2 5 5 5 3 2 1 1

MS Exchange 9 3 1 d 0 5 5 5 3 2 1 1 4 2

WA Nephrology Database (WAND) 0 3 1 d 0

Journeyboard 11 3 3 d N/A 3 2 1 1 4 2 4 2 1 1 5

Allied Health System (AHS) 1 2 3 d 2 d 4

Quality of Care Registry (QoCR) 2 2 5 d 1 d 3 5

Transition Care (TCP) 7 2 5 d 1 d 5 5 5 3 1 1

MS Office 11 2 1 d N/A 5 5 5 3 2 1 1 5 2 1 4

ScriptTracker2 8 2 3 d N/A 5 5 5 3 2 1 1 5

Nursing Hours per Patient Days (NHpPD)

8 2 1 w 1 w 5 5 5 3 2 1 1 5

health.wa.gov.au

Business Continuity Plan

(Insert health service)

BCP template 20151113 V1 approved

Approved: (Insert approval date)

Version: (insert version control)

DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 1

This page has been left intentionally blank


Contents

1. Introduction 6

1.1 Purpose of plan 6

1.2 Objectives 6

1.3 Scope of plan 6

1.4 Assumptions of plan 7

1.5 Ownership 7

1.6 Plan Availability 7

1.7 Associated documents 8

2. Organisation background 9

2.1 Description of health service 9

2.2 Organisational aim 9

2.3 Key organisational objectives 9

2.4 Organisational structure 9

3. BCM Governance and Policy 10

3.1 Policy statement 10

3.2 Roles and responsibilities 10

3.3 Governance 10

4. Plan review and maintenance 10

5. Training and exercising 11

5.1 Training 11

5.2 Exercising 11

6. Business Continuity Priorities and Strategies 13

6.1 Critical business functions 13

6.2 Business continuity strategies 14

7. Plan activation 16

7.1 Activation criteria 16

7.2 Authority to activate 16

7.3 Escalation 16

7.4 Mobilisation of Business Continuity Team 16

7.5 Incident Control Point 16

7.6 Activation process 17

7.7 Standing down 17

8. Response organisation 18


9. Communication strategy 19

10. Functional Annexes 20

Annex 1 Business Continuity Team 21

Roles and responsibilities 21

Team members 21

Incident Control Point 21

Response Actions 22

Contact List 23

Reference information 24

Consolidated Business Impact Profile and Priorities 24

Consolidated Interdependencies 25

Consolidated Dependencies – Resources 26

Consolidated System / Application Requirements 27

Annex 2 Perioperative Unit 28

Roles and responsibilities 28

Team members 28

Critical Functions 28

Business Continuity Strategies 28

Response Actions 29

Annex 3 ……etc 32

(update field when document finalised)


Authorisation

This business continuity plan outlines the critical business functions of (insert health service) and the strategies, dependencies and resources required to continue the identified critical business functions following a disruption.

This document is endorsed as the approved plan for (insert health service) to be followed in the event of such a disruption.

Approved

________________________________________

<Title First Name Last Name> INSERT POSITION INSERT HEALTH SERVICE

Date authorised: (DD MONTH YYYY)


Amendment Certificate

Amendment Details Amended by

No. Date


1. Introduction

1.1 Purpose of plan

This should section outline the purpose of the BCP.

For example:

This Business Continuity Plan (BCP) sets out the principles to be followed, actions to be taken and resources to be used when responding to a critical incident that results in, or has the potential to result in, disruption to critical business functions at (insert health service)

1.2 Objectives

Describe the objectives of the business continuity plan and processes that are being implemented

For example:

The objectives of the BCP are:

Prevent the loss of life, minimise property damage and lessen any negative consequences on (insert health service) and the Department of Health

To establish and implement a structured process that will enable (insert health service) to effectively manage and respond to any anticipated or unanticipated disruptions in a timely manner

To minimise disruption to critical business functions and the resultant impacts on patients, visitors, employees and other stakeholders

Etc.

1.3 Scope of plan

Describe areas covered by the plan and areas that are excluded from the plan.

For example:

This plan is used in the event of a disruption resulting from a prolonged loss or denial of access to infrastructure and premises at (insert health service). It applies to all the activities and resources necessary to ensure the continuity of (insert health service) critical functions in the event normal operations are disrupted or threatened with disruption.

Critical functions are those with a Maximum Tolerable Period of Disruption (MTPD) of 2 weeks or less as determined in the business impact analysis. Functions with


MTPD greater than 2 weeks will temporarily be suspended and appropriate arrangements will be made at the time of incident for the recovery of these functions.

This plan cross references (insert health service)’s Emergency Management Plan and the supporting emergency response procedures.

This plan does not address day to day operational problems or procedure for dealing with emergencies (such as bomb threat, fire or building evacuation). These are addressed in the appropriate standing operations procedures and emergency response plans.

Contingency arrangements for internal infrastructure disruptions are detailed in Emergency Procedure Manual, Code Yellow – Infrastructure and other internal emergencies. These arrangements may be activated in parallel with this plan.

1.4 Assumptions of plan

The following assumptions have been made as a part of the planning process:

List in dot point form the considerations, suppositions and inferences on which the BCM planning process is based upon.

Assumptions may relate to accommodation, resource requirements, interdependencies and cost justification or response or recovery strategies.

Assumptions should be communicated and agreed to by all stakeholders. Where assumptions relate to response and recovery strategies, they should be tested as part of the BCP exercise schedule.

For example: The contingency arrangements for emergencies relating to infrastructure failures are detailed in the code yellow section of the emergency procedures.

1.5 Ownership

Describe who is owns and is accountable for this plan

1.6 Plan Availability

Describe who has copies of this plan, how it is stored and accessed


1.7 Associated documents

Describe how this plan is related to other response plans in the organisation. This may include emergency procedures manuals, surge plans, ICT disaster recovery plan, etc.


2. Organisation background

2.1 Description of health service

Insert description of health service, its history and future plans, and the community it service

2.2 Organisational aim

Insert aim(s) of health service.

This should be a high level statement about the reason the health service exists.

For example:

Provide high quality health care to the local community.

Hint: Organisational aims and objectives may be ascertained from the organisation’s strategic plan.

2.3 Key organisational objectives

Insert the key organisational objectives of the organisation.

This area should provide some more detail about how the health service will meet its aim. If any of these objectives are not met, this will seriously jeopardise the viability of the service.

For example:

Provision of emergency department services.

2.4 Organisational structure

The (insert health service) incorporates (insert organisational elements).


3. BCM Governance and Policy

3.1 Policy statement

Describe the health service’s BCM and Department of Health policy related to BCM

3.2 Roles and responsibilities

Insert details of who is accountable for business continuity, the committee responsible for drafting, testing and reviewing the BCP, and executive responsible for approving the BCP.

3.3 Governance

Describe how will governance oversight of business continuity be carried out and how will compliance with the policy and requirements be monitored and reported.

4. Plan review and maintenance

Describe how often and under what circumstances should plan review and maintenance be carried out, and who has responsibility for them. Describe also how will continuous improvements and updates be carried out post testing or after an actual incident

Example:

This BCP will be reviewed annually to ensure call trees, positions and structures remain accurate. Business impact analyses should be reviewed every three years to ensure critical business functions reflect the aims and objectives of the organisation.

This BCP may be audited to ascertain its adherence to Operational Directive 0595/15 – Business Continuity Management.

http://www.health.wa.gov.au/circularsnew/attachments/1028.pdf

http://www.health.wa.gov.au/circularsnew/attachments/1028.pdf


5. Training and exercising

5.1 Training

Describe the training objectives, how often and the type of training to be conducted, who should be in attendance, and who has overall responsibility to develop and implement the training programme.

For example:

A BCM Awareness Briefing is conducted for all (insert health service) personnel

once a year. For new joiners, this briefing will be conducted as part of their induction

programme.

Training for those in the business continuity teams will be incorporated into the

exercising programme. If necessary, briefing sessions will be conducted prior to

exercises to provide background and contextual information but participation in the

exercise itself has the added benefit of training the staff at the same time.

Personnel with specific responsibilities for developing, implementing, exercising and

maintain the BCP are provided with additional training and other opportunities to

enhance their BCM technical competencies and professional standing. This may be

in the form of a formal professional development programme, professional

certification, membership with professional bodies and participation in industry

forums.

The {identify who} is responsible for identifying the BCM skills and competencies

required, developing an appropriate BCM training programme to meet the needs of

(insert health service) personnel, and coordinating the delivery of the training

programme.

5.2 Exercising

Describe the exercising objectives, how often and the type of exercises to be conducted, who should be in attendance, and who has overall responsibility to develop and implement the exercising programme

Example:

Exercises help to verify the effectiveness of all aspects of (insert health service)’s

business continuity arrangements. The aims are to:


Ensure that plans are current, proven and maintained by the people needing to

use them when an incident occurs.

Provide an opportunity for (insert health service) personnel to rehearse the plans

in order to build familiarity with the response actions, develop effective team

work, and instil confidence

Assess and validate (insert health service) business continuity capability in

responding to an actual incident

Identify shortcomings in (insert health service) business continuity strategies and

plans so that corrective actions can be taken

At minimum, an exercise is to be conducted annually. This may be carried out

notionally, such as a scenario-based walkthrough of the plans or a tabletop exercise,

or in practice involving the actual mobilisation of resources to carry out business

continuity activities.

The {identify who} is responsible for developing an exercise programme and

coordinating the conduct of exercises.


6. Business Continuity Priorities and Strategies

Provide an overview of the health service’s business continuity priorities and strategies. The information in this section can be extracted from the consolidate business impact profile and strategies identified during the Business Impact Analysis.

Example:

6.1 Critical business functions

A Business Impact Analysis (BIA) was conducted to assess the potential impact on

(insert health service) of a disruption to services and to prioritise the business

activities and services for the recovery. Details of the BIA can be found in the

document “name of BIA report”.

Findings of the BIA were subsequent updated and ratified by the Executive on (date)

with the following list of critical business functions:

Figure 1 Critical Business Functions

Branch / Business

Area

Sub Unit Service / activity2 hrs 4 hrs 8 hrs 1 day 3 days 1 wk 2 wks 1 mth+

Perioperative Unit Operation theatre services Perioperative care x

Central sterilisation services Decontamination of surgical and

medical equipmentx

Sterilisation of surgical and medical

equipmentx

Storage of sterile non-disposable

equipmentx

Day Stay Unit services Elective day surgery procedures x

Emergency bed response x

Day infusion procedures x

General Ward Inpatient medical and

nursing care

Acute surgicalx

Acute medical x

Paediatrics x

Education and training for staff x

Liaising with aged care facilities x

Maternity Acute antenatal care x

Birthing including emergency care x

Post natal care x

Hospice Palliative care - terminal illness x

Palliative care specialists clinics x

Referral to consultancy and allied

servicesx

MTPD


Maximum Tolerable Period of Disruption (MTPD) refers to the time within which a

business activity or service must be resumed following a disruption. It is measured

from the time a disruption occurs to the time when the activity or service becomes

operational again.

Other activities that are not listed in the above table (i.e. Those with MTPD of more

than 2 weeks) will temporarily be deferred in the event of BCP invocation. Although

these deferred activities may be important for the day to day operations, they are not

deemed to be time critical under business continuity situations. Deferred activities

will be restored during the long term recovery phase – the level of effort, allocation of

resources and actions needed would be dependent on the nature of the incident.

6.2 Business continuity strategies

Describe the broad business continuity strategies of the health service as a whole. It is not necessary to describe each business unit’s strategy here – there are contained in the respective business unit’s business continuity action plans.

Example:

The broad business continuity strategies for responding to a major incident and

disruption to (insert health service) are as follows:

In the event of an ICT or building service (such as power, water, air conditioning,

etc.) outage that does not impact the safe operations of the (insert health service)

facility, the facility will remain opened and affected areas may continue to operate

using alternate / work around procedures until the outage is resolved. The

Emergency Management Plan and facilities related contingency plans may be

activated as required.

In the event that an incident renders the (insert health service) building unsafe or

inaccessible, all services will be suspended and the (insert health service) will be

closed. The BCP will be activated and plans for the continuity of critical business

functions will be enacted within the specified MTPDs.

Depending on the nature and expected duration of the disruption, a separate plan

for the recovery of non-critical activities and services will be developed in parallel

to the BCP activation, if necessary.

(insert health service) will remain closed until such a time when the building is

made safe for occupation and services are returned to normal.

A summary of the broad business continuity strategies of each business area is outlined in Figure 2. Detailed response actions and resource requirements for the recovery of critical business functions are documented in the respective business area’s Business Continuity Action Cards.


Sub-unit Service / activity MTPD Immediate continuity strategy Maintainable

duration Sustainable continuity strategy Maintainable

duration

Operation Theatre (OT) Services

Perioperative care 2 weeks

- Temporarily suspend new admissions and elective surgery - Redirect emergency surgery to next nearest hospital

1 week - Transfer elective lists to other hospitals in the region - Relocate resources to other hospitals to carry out elective surgeries

4 weeks

Central Sterilisation Services Department (CSSD)

Decontamination of surgical and medical equipment

3 days - Transfer decontamination of 3rd party equipment to the CSSD of a regional hospital - Transfer surgical and medical equipment to the CSSD of next nearest hospital

1 shift - Relocate resources to CSSD at other hospitals to carry out function

1 week

Sterilisation of surgical and medical equipment

1 day - Transfer surgical and medical equipment to the CSSD of next nearest hospital


1 week

Storage of sterile non-disposable equipment

3 days - Transfer surgical and medical equipment to the CSSD of next nearest hospital


1 week

Day Stay Unit (DSU) Elective day surgery procedures

2 weeks

-Temporarily suspend the activity 2 weeks - Transfer day surgery procedures to other hospitals in the region

Indefinite

Emergency bed response 1 week -Transfer patients to other hospitals

4 weeks -Transfer patients to other hospitals

Indefinite

Day infusion procedures 1 Month

+

-Temporarily suspend the activity - Redirect patients back to GPs or surgeries

2 weeks - Redirect patients to next nearest hospital

Indefinite

Figure 2 Summary of business continuity strategies


7. Plan activation

7.1 Activation criteria

This plan is activated when a disruption occurs, and where a pre-identified critical business function (CBF) has, or is predicted to, exceed its maximum tolerable period of disruption (MTPD).

Where applicable, delineate between emergency response and business continuity response and the arrangements for transitioning between the two responses.

7.2 Authority to activate

Authority to activate this plan rests with the (insert relevant position).

7.3 Escalation

Upon implementation of a business continuity strategy that is anticipated to affect other health services, system-level coordination may be required. In these cases, the On Call Duty Officer at the Department of Health is to be notified on (08) 9328 0553 (24 hours) at the earliest convenience. NB: WA Country Health Service (WACHS) hospitals should escalate through their respective Regional Directors.

7.4 Mobilisation of Business Continuity Team

On activation of this plan, the Business Continuity Team (BCT) is to mobilise at (insert location). Members of the BCT include:

Insert BCT team members

Stipulate which team member has overall authority / responsibility.

Ideally BCT members should represent a division / service area of the organisation.

Team members should be listed by position.

Add detail about how team is mobilised. For example: through 55 call, paging group or contact list in the appendices.

7.5 Incident Control Point

An Incident Control Point (ICP) is a pre-designated location from which the response

teams would coordinate on-site activities when the BCP is activated. Depending on

the nature of the incident, the ICP will established at one of three locations, if

possible:

Primary location –

1st alternate location -

2nd alternate location -


If any of the above location is not available or suitable, the person in charge will have

the discretion to decide on the best alternative place to meet, taking into considering

safety issues and proximity to the impacted site.

7.6 Activation process

The following algorithm (sample) outlines the response continuum from the occurrence of a disruption, right through to the stand down.

(adjust this to suit the health service’s processes).

Update

Disruption occurs

Emergency?

Stand down

Emergency response

arrangements activated

Incident Management

Team mobilised

A Critical Business Function

(CBF) has, or is forecast to exceed, the Maximum

Tolerable Period of Disruption

(MTPD)?

N O

Executive authorises activation of Business

Continuity Plan

Mobilisation of Business Continuity

Team (BCT)

YES

Ongoing monitoring &

review of situation

YES

N O

BCT coordinates Business

Continuity Response

Incident resolves +/-recovery complete

Return to business-as-usual

Recovery efforts undertaken

On Call Duty Officer, Department of Health (WA)

(08) 9328 0553

WACHS sites to notify Regional Director

Notify

Review, update & continually

improve

Situation escalates

SAMPLE

7.7 Standing down

This plan can be stood down by the (insert position) when the following criteria are met:

Business-as-usual procedures have been resumed for CBFs; and

Recovery efforts have been completed; or

The disruption has been resolved.

Once normal business processes have resumed, the (insert health service) should notify all relevant stakeholders, as per the communication strategy in section 9.


8. Response organisation Describe the organisation that will be established when the BCP is activated, and the roles and responsibilities of the various teams. This will need to dovetail with the existing emergency management team structure. Provide org chart.

Example:

The Business Continuity Team (BCT) is responsible for coordinating on-site tactical and operational response when the BCP is activated in response to a disruption. The key responsibilities of the team are:

Gather details and assess the impact of the incident Oversee the resumption of critical business functions Liaise with local emergency services, other healthcare facilities and support

agencies Coordinate deployment of internal and external resources required to support

service resumption and recovery Keep the Executive appraised of the incident and status of recovery Carry out post-incident review and long term recovery (return to normal)

Role Responsibilities Reports to


9. Communication strategy In the event of a disruption, it is critical that stakeholders are effectively engaged and made aware of the disruption and the relevant business continuity strategies in place.

The (insert role) is responsible for implementing the communication strategy.

A stakeholder analysis should be conducted to identify relevant parties, the preferred method of communication and frequency of communication.

Communication templates can be added into the appendices.

Stakeholder Method of communication

Frequency Notes

Internal staff members

Internal emails

Staff forums

Twice daily

Daily

After one week, consider daily internal emails and twice daily staff forums

Suppliers Phone Call Email

Initial Daily

Notify supplier of initial disruption by phone call.

Subsequent updates can be sent by email

Media Press conference Initial, final and as required

The nominate speaker should be the executive sponsor.

On resolution of the disruption, the (insert position) is responsible for notifying the above stakeholders of the resumption of normal business processes.


10. Functional Annexes Functional annexes contain the specific actions cards and references that are

required for responding to a disruption and continuing critical business functions.

Example:

The functional annexes describe the specific roles and responsibilities, actions to be

taken, business continuity strategies and resources requirements by each of the

business units when the BCP is activated. While the main body of the BCP provides

overarching information relevant to the continuity of (insert health service) as a

whole, these annexes focus on specific responsibilities, tasks and operational

actions that pertain to the elements of a viable business continuity plan for each

team.

Annex 1 Business Continuity Team

Annex 2 Perioperative Unit

Annex 3 General Wards

Annex 4 …

Annex 5 …

Annex 6 …

Annex 7 …

Annex 8 …


Annex 1 Business Continuity Team

BUSINESS CONTINUITY TEAM

Roles and responsibilities

Gather details and assess the impact of the incident Oversee the resumption of critical business functions Liaise with local emergency services, other healthcare facilities and support

agencies Coordinate deployment of internal and external resources required to support

service resumption and recovery Keep the Executive appraised of the incident and status of recovery Carry out post-incident review and long term recovery (return to normal)

Team members

Role Primary Alternate

Team Leader

Logistics and Admin

Buildings and Facilities

Human Resources

Incident Control Point

Primary location

1st alternate location

2nd alternate location


Response Actions

Immediate

Action

Who Reference

Initiate Incident Log Obtain general situation report from the

notifier

Notify other members of the team as required

Determine the nature of the incident What has happened? Is anyone hurt? What services / areas are affected? What is the impact on critical

business activities / services? What has been done? How long is the disruption likely to

last?

On-going

Action

Who Reference

Post-incident

Action

Who Reference


Contact List

Internal contacts

Role Name Work Tel # After hours # Email

External Contacts

Organisation Contact 1 Contact 2

Name

Position

E-mail

Office hours #

After hours #

Name

Position

E-mail

Office hours #

After hours #

Name

Position

E-mail

Office hours #

After hours #


Reference information

Consolidated Business Impact Profile and Priorities

Branch / Business

Area




medical equipmentx


equipmentx


equipmentx





nursing care

Acute surgicalx

Acute medical x

Paediatrics x





Post natal care x




servicesx

Emergency

Department

Emergency Department Triage and registrationx

Resuscitation including trauma x

Acute care x

Fast track x

Short stay observation x

Pharmacy Pharmacy Clinical pharmacy services x

Pharmacy technical services x

Outpatients Outpatients Community child health x

School health x

Continence x

Enuresis x

Immunisation x

Dietetics (In patient) x

Occupational therapy (In patient) x

Physiotherapy (In patient) x

Speech pathology (In patient) x

Podiatry x

Social work x

Community Mental Health x

Administration Administration Initiating patient flows (way

finding)x

Telephone

switchboard/communicationsx x

Receive incoming deliveries x

Medical record data entry and other

medical records functions

x

Account payments x

MTPD


Consolidated Interdependencies

Internal Interdependencies

External Interdependencies

Ad

min

istr

atio

n a

nd

M

edic

al R

eco

rds

Nu

rsin

g

Alli

ed H

ealt

h

Age

d C

are

Serv

ices

Co

mm

un

ity

Men

tal

Hea

lth

Emer

gen

cy D

epar

tmen

t

Inp

atie

nt

Med

ical

&

Nu

rsin

g C

are

Mat

ern

ity

Ho

spit

al M

anag

emen

t

Ho

me

Nu

rsin

g D

isch

arge

Se

rvic

es

Ph

arm

acy

and

Su

pp

ly

Op

erat

ion

Th

eatr

e se

rvic

es

Cen

tral

Ste

rilis

atio

n

Serv

ices

Dep

t

Day

Sta

y U

nit

ser

vice

s

Foo

d S

ervi

ces

Lau

nd

ry S

ervi

ces

SJO

G R

enal

Pat

hw

est

Glo

bal

Dia

gno

stic

s

Dis

tric

t Si

tes

Tert

iary

Sit

es

BO

C M

edic

al G

ases

Alin

ta N

atu

ral G

as

Wat

er C

orp

Service Area

Administration and Medical Records

U B U B B U B B U U

D U U B B U U U

Nursing B B D B U

U U D D U U U

Allied Health B B D B U U U D D U U U

Aged Care Services B D

U B U

Community Mental Health D D D D D D D D D D D D D D D

D D D D

Emergency Department B B B B U B U D U D U U

D U U B B U U

Inpatient Medical & Nursing Care U B U B B U B B U U

D U U B B U U U

Maternity U B U B B B U U B U U U U B U U U

Hospital Management U U U U D B U U U U

U U D D U U U

Home Nursing Discharge Services B

B U U U

Pharmacy and Supply U B D

U B U

Operation Theatre services U D D D D D

U

Central Sterilisation Services Dept B D D D D D D U D D D D

D U

Day Stay Unit services B B D B U U B

U U D U U U

Food Services B B D B U B

U U D U U U

Laundry Services B B D B U U

U U D U U U

D Downstream dependency

U Upstream dependency

B Up and downstream dependency


Consolidated Dependencies – Resources

People Utilities / Essential services Office equipment and telecommunications Medical equipment Specialised equipment Key consumables

Service Area

Clin

ical sta

ff

Nurs

ing s

taff

Ord

erlie

s

Adm

inis

tratio

n s

taff

Tech

nic

ian

s

Pow

er

Wate

r

Natu

ral gas

Liq

uid

petr

ole

um

gas

(LP

G)

Me

dic

al oxygen

Me

dic

al N

itro

us O

xid

e

Me

dic

al carb

on d

ioxid

e

Me

dic

al air

Me

dic

al suctio

n

Ventila

tio

n

Air-c

onditio

nin

g / H

eatin

g

Pers

onal com

pute

r

Lapto

p c

om

pute

r

Ta

ble

t

Prin

ter

(bla

ck a

nd w

hite)

Prin

ter

(colo

ur)

Photo

copie

r

Fa

x m

achin

e

Docum

ent scanner

Desk p

hone

Mo

bile

phone

DE

CT

Phones

Pager

Inte

rnet

access

Operation Theatre services

5 5 4 2

4

5 5 5 5 5 5 5 5 5 4 2 5 5 3

Central Sterilisation Services Dept 5 5 5

Day Stay Unit services 5 4 5

Administration and Medical Records 5 2 5 3 5 4 3 3 3 5 3 3 5

Nursing 5 3

Allied Health 5 5 3 3 5 4

Aged Care Services 5 4 4 4 4 5

Community Mental Health 5 3

Emergency Department 5 5 4 2 3 5 5 5 5 5 5 5 5 5 5 4 3 3 3 5 5 5 5

Inpatient Medical & Nursing Care 5 5 5

Maternity 5 5 3 2 2 5 4 5 5 5 5

Hospital Management 5 3

Home Nursing Discharge Services 5 3

Pharmacy and Supply 5 3 5

Food Services 5 5 5 5

Laundry Services 5 5 5 3


Consolidated System / Application Requirements

Applications

# Services using this

application

Level of dependency

System offline

duration

Data loss duration

Business areas

Op

erat

ion

Th

eatr

e se

rvic

es

Cen

tral

Ste

rilis

atio

n S

ervi

ces

Dep

t

Day

Sta

y U

nit

ser

vice

s

Ad

min

istr

atio

n a

nd

Med

ical

Re

cord

s

Nu

rsin

g

Alli

ed H

ealt

h

Age

d C

are

Serv

ices

Co

mm

un

ity

Men

tal H

ealt

h

Emer

gen

cy D

epar

tmen

t

Inp

atie

nt

Med

ical

& N

urs

ing

Car

e

Mat

ern

ity

Ho

spit

al M

anag

emen

t

Ho

me

Nu

rsin

g D

isch

arge

Ser

vice

s

Ph

arm

acy

and

Su

pp

ly

Foo

d S

ervi

ces

Lau

nd

ry S

ervi

ces

Health Records Management + Scanning and eForms (eHRM)

9 5 30 mi 0 3 4 4 2 5 5 4 3 1

WebPas 13 5 30 mi 0 2 2 2 4 5 5 5 3 2 1 1 4 5

Clinical Pathology (Ultra/LIS) 0 5 1 h 0

Theatre Management System (TMS) 14 5 3 h 0 3 3 2 2 4 5 5 5 3 2 1 1 4 5

Internet 15 5 1 h

N/A 1 1 2 4 5 5 5 3 2 1 1 4 5 2 4

eReferrals 13 4 6 h 0 2 2 4 5 5 5 3 2 1 1 4 5 5

Cardiobase 0 4 4 h 1 h

Enterprise Bed Management (EBM) 13 4 4 h 1 d 1 3 3 2 2 4 5 5 5 3 2 1 1

Diet Management 10 4 1 d 0 2 4 5 5 5 3 2 1 1 4

HealthPoint (Sharepoint Intranet) 14 3 6 h 1 d 5 5 5 3 2 1 1 5 5 5 3 2 1 1

Haematology & Oncology Protocols & Prescriptions (HOPP)

9 3 1 d 0 2 5 5 5 3 2 1 1

MS Exchange 9 3 1 d 0 5 5 5 3 2 1 1 4 2

WA Nephrology Database (WAND) 0 3 1 d 0

Journeyboard 11 3 3 d N/A 3 2 1 1 4 2 4 2 1 1 5

Allied Health System (AHS) 1 2 3 d 2 d 4

Quality of Care Registry (QoCR) 2 2 5 d 1 d 3 5

Transition Care (TCP) 7 2 5 d 1 d 5 5 5 3 1 1

MS Office 11 2 1 d N/A 5 5 5 3 2 1 1 5 2 1 4

ScriptTracker2 8 2 3 d N/A 5 5 5 3 2 1 1 5

Nursing Hours per Patient Days (NHpPD) 8 2 1 w 1 w 5 5 5 3 2 1 1 5

Capacity Planning System (CapPlan) 0 2 1 w N/A


Annex 2 Perioperative Unit

PERIOPERATIVE UNIT

Roles and responsibilities

Team members

Roles Primary Alternate

Team Leader

Critical Functions

Business unit Activity / function Maximum Tolerable Period of Disruption (MTPD)

8 hrs 1 day 3 days 1 wk 2 wks >=1 mth

Business Continuity Strategies

Activity / function Immediate

continuity strategy Maintainable

duration Sustainable

continuity strategy Maintainable

duration


Response Actions

Immediate

Action

Who Reference

Initiate Incident Log Obtain general situation report from the

notifier

Notify other members of the team as required

Determine the nature of the incident What has happened? Is anyone hurt? What services / areas are affected? What is the impact on critical

business activities / services? What has been done? How long is the disruption likely to

last?

Formulate plan for carrying out immediate continuity strategy for critical business functions

Decide if staff should remain where they are, go home or relocate to the alternate site

On-going

Action

Who Reference

Coordinate on-going communications with stakeholders

Ensure safety and wellbeing of all personnel Set up roster for rotation of team members

if incident is prolonged

Liaise with EMT for deployment of additional resources to support recovery

Provide regular updates to the EMT Formulate plan for implementing

sustainable continuity strategy for critical business functions, if necessary


Post-incident

Action

Who Reference

Prepare plan for standing down the team Liaise with EMT on standing down the team Collect Incident Logs and submit to EMT Conduct de-brief with team Assign staff to participate in Long Team

Recovery Team, if necessary

Formulate plan for resuming non-critical business functions

Resource Requirements People

Position Current

Cumulative quantity required


Total

Office equipment and telecommunications

Type Current



Medical equipment

Type Current




Specialised equipment

Type Current



Key consumables

Type Current



Systems / applications

Name of system / application System / application required by ….


Interdependencies

Upstream interdependencies

Internal Nature of interaction

External Nature of interaction

Downstream interdependencies

Internal Nature of interaction

External Nature of interaction


Annex 3 ……etc






20

Attachment 5 Consolidated BIA Profile (Sample)

Branch / Business

Area




medical equipmentx


equipmentx


equipmentx





nursing care

Acute surgicalx

Acute medical x

Paediatrics x





Post natal care x




servicesx

Emergency

Department

Emergency Department Triage and registrationx

Resuscitation including trauma x

Acute care x

Fast track x

Short stay observation x

Pharmacy Pharmacy Clinical pharmacy services x

Pharmacy technical services x

Outpatients Outpatients Community child health x

School health x

Continence x

Enuresis x

Immunisation x

Dietetics (In patient) x

Occupational therapy (In patient) x

Physiotherapy (In patient) x

Speech pathology (In patient) x

Podiatry x

Social work x

Community Mental Health x

Administration Administration Initiating patient flows (way x

Telephone

switchboard/communicationsx x

Receive incoming deliveries x

Medical record data entry and other

medical records functions

x

Account payments x

MTPD

This document can be made available in alternative formats on request for a person with a disability. © Department of Health 2015



Documents

Operational Directive - Business Continuity Management...Business Continuity Management Program The overarching management system that establishes, implements, operates, tests, maintains,