Why your practice needs a business continuity plan

7 Sept 2010 · Originally published in GP magazine, Sept 2010

Originally published in GP magazine .

Written for GP magazine around 2010. This is the version I submitted - the published article may have been edited.

I doubt that business continuity planning is a phrase that gets most partnerships excited. However, much is made of the fact that GPs are entrepreneurs and small business owners, and if we want to survive in the brave new world we need to look at what other businesses do and copy best practice.

I’m sure at this point that some are thinking they don’t need one, and that the spirit of the Blitz will keep them going. When the faecal matter hits the fan, all hands will get on deck, pull their sleeves up and cope with any crisis. A lot of practices will rely on their practice manager to handle a water main burst or other disaster. But what if she’s on holiday?

I know of a nearby small practice whose practice manager was on ITU, and they came very close to not paying the payroll because no one knew the banking passwords or how the timesheets worked. You might think that the patients will put up with a poor service in times of crisis, but will your staff be happy not to be paid?

I love Dragons’ Den and recently read Deborah Meaden’s book, which initially seemed superficial and light compared to other business tomes I’ve tackled; however, she genuinely does just distil things down to common sense. She has a background in running leisure parks and devotes a section to BCP that should give an idea of how important it is.

Her leisure parks dealt with the general public, and all sorts of things could go wrong, from electricity cuts to an outbreak of E. coli. She was clear that her organisation worked up a BCP, that all management knew what was in it and how to access it, and that it was followed in times of crisis.

Time should be set aside to create a BCP, and there are several stages involved (see box 1). There are examples available from a range of sources to use as a template, e.g. CfH.

First, brainstorm or use suggested titles (box 2) for possible scenarios that might happen, from common to very rare ones.

Admin problems are the mainstay of BCP - things like power failures, blocked toilets, bodily fluid spills in public areas, computer crashes, printer failure, broken windows, break-ins and theft.

There may be some things specific to your business or location. For example, we had a real problem with our lift breaking or stopping between floors and have a great plan for what to do - but to be honest, we wrote the plan after it happened a few times, not before.

You might want to link to a local major disaster plan. All public bodies have to have one, and your PCT will. Do you know your role? Are you a site for casualties? Do you treat minor injuries?

Next you need to work through what you would do in these cases. Involve the relevant teams and people in this discussion - it might be a useful way of reviewing your systems and processes and developing a dialogue with your staff. You may even find they come up with better ways of doing everyday things.

A lot of what to do is about listing whom to contact, including phone numbers, policy numbers, names of suppliers etc.

This should all be drawn up into a document that is easily accessible by anyone who might need it. Key people should have a copy and, importantly, it should also be kept off site - the plan on what to do if your surgery burns down overnight is no good in the charred remains.

Some of the discussions you might have at this time include things like:

Do you know who is in your building if there is a fire?
Can your appointment system produce a list of everyone checked in or being consulted?
What happens if the power goes off - have you got a paper copy of who is due for which appointment this afternoon, and their contact details?
Have you put a UPS device on key machines to allow you to work?

At this stage you might find half the mobile phone numbers for your partners are out of date, as they haven’t bothered to tell you.

Once written and distributed, it should be reviewed every six months or on change of suppliers/contractors. New staff, particularly those in an authority role, should be recorded as having read it. If it’s used, then do a SEA to see if it worked and whether it can be improved.

BCP isn’t all about terrorist attacks - it’s about enabling a business to overcome any unexpected disaster to its premises, key personnel or any important systems that it relies upon in its day-to-day operations.

Box 1: The stages of developing a business continuity plan

Analysis - work out what risks your practice might face
Solution design - work out what to do for each of the problems
Implementation and distribution - make sure everyone has it and understands it
Testing - ideally set time aside to test it
Review - review the plan six-monthly and on change of contractor/suppliers

Box 2: Some suggested headings for your plan

Loss of main premises
Loss of computer system/essential data
Loss of telephone system
Loss of medical records
Incapacity of GPs
Incapacity of staff
Loss of electricity supply
Loss of gas supply/gas heating
Loss of water supply
Loss of premises security, e.g. break-ins