BUSINESS CONTINUITY PLANS
It is a plan for keeping your business running in the event of an emergency. Typically they focus on the people being cared for – how can we care for people if there was a power cut for example, local flooding, a pandemic.
However, having records of personal data available is also important for care and for staff – e.g. people’s medication records, staff rota etc
They should also cover data and cyber security e.g. how you would access your records if there was a a fire in the office, or the internet goes down or you are hacked for example.
WHERE TO START?
7.1.2 Does your organisation have a business continuity plan that covers data and cyber security?
7.2.1 How does your organisation test the data and cyber security aspects of its business continuity plan?
A BCP will need some time and consideration. You need to identify all IT systems, devices and paper files that are critical to your business, or what you need to be able to keep your service running on a daily basis. Think about what you rely on day-to-day e.g. do you use rostering, care planning or electronic medicine administration record (MAR) charts, person’s care file.
DEVICES
What devices hold or allow access to in terms of critical data? For example, in smaller organisations is there a laptop with everything on it. What could go wrong if you can’t access the data on it? Do the management team or other staff have smart phones with access to personal data via email or company systems?
We will look at more scenarios and what could potentially go wrong and what you need to plan for. Here are some typical things that might happen:
LOSS OF PHONE LINE/INTERNET
YOUR SUPPLIER’S SYSTEM IS DOWN
E.g. the rota system won’t work and it’s the supplier’s fault
LOST, STOLEN OR BROKEN COMPUTER OR SMART PHONE OFFICE UNAVAILABLE
E.g. through fire
YOU ARE HACKED
There may be others that might affect you
For your plan, you need to think about each scenario:
• Think about how it might affect your organisation – just how bad could it be?
• How likely is it to happen?
• What steps you would take if it did happen
• Is there anything you could do to prepare just in case
EXAMPLE SCENARIO 1
Phone line / internet goes down. Think about:
• What systems would you lose access to?
• Would you still be able to direct staff to where they need to be?
(E.g. You could print a hard copy of a rota once a week or download a copy to another device.)
• Which mobile/s could you use to make calls?
• Would numbers for your main contacts be easily accessible?
Much of this would also apply if there was a power cut. For a power cut you could use the battery on a laptop or invest in an Uninterruptible Power Supply (UPS) system that holds power, so your plugged-in devices remain powered for a few hours despite a black out. THINKING
• Is there a temporary alternative if you’ve lost the internet? (Eg, you could use a mobile phone to give an internet connection to a laptop by tethering.)
• Could office staff work from another place e.g. at home using their own Wi-fi?
You were hacked (a criminal uses their computer to break into your computer system)
Prevention is the key!
• Very Important! To minimise the possibility of being hacked make sure you have the right software and staff training in place to help prevent this happening
• If you suspect you are currently under attack, and your data is at risk, call Action Fraud 0300 123 2040 immediately. Action Fraud will guide you through what you need to do during and after the attack
• Follow your breach reporting procedure
• Change your passwords (passwords should only be changed if they have been compromised)
• Contact your IT supplier/IT support, if you have this (they can help to restore and repair if needed)
• Check that you have a backup (so you can restore you data without having to pay the attackers).
EXAMPLE SCENARIO 3
Your Supplier’s system has a fault
Major suppliers typically have arrangements in place to make sure their systems are not down for long. Eg Google Drive or Dropbox. It’s more important to check this for suppliers of sector specific software eg electronic MAR sheets or care planning software
