Policies & Procedures

Business Continuity Plan v2.0

Purpose

This plan sets out the arrangements VCare Consultancy Services Limited will follow to maintain safe service delivery, protect staff and service users, and recover critical operations during disruption.

Scope

The plan applies to all care staffing and support services delivered by VCare, including office-based functions, recruitment and compliance activity, rota coordination, communication systems, records management and incident response.

This plan is designed to create resilience across the service by reducing single points of failure and ensuring that critical functions can continue during disruption. This is achieved through:

• clear incident leadership and named management cover arrangements;
• cross-cover for critical tasks such as rota management, safeguarding escalation and stakeholder communication;
• access to alternative working arrangements, mobile communications and secure backup records;
• manual contingency processes where systems or premises are unavailable;
• prioritisation of critical service delivery, with non-essential activity deferred where necessary; and
• regular review, testing and lessons-learned actions following incidents or exercises.

Objectives

• Protect life, wellbeing, dignity and safety of service users, staff and visitors.
• Maintain continuity of critical care and staffing services during disruption.
• Restore essential business functions as quickly as possible and minimise avoidable harm.
• Meet legal, contractual, safeguarding, information governance and regulatory obligations.
• Provide clear lines of communication with staff, service users, families, customers and commissioners.

Critical activities and functions

VCare will prioritise the following critical activities and functions in the order set out below during any significant disruption.

Incident types covered by this plan

• Serious staff shortage, widespread sickness absence or inability to fill shifts.
• Loss of office premises, utility failure or inability to access the usual workplace.
• Telephony, internet, email or IT system outage.
• Cyber incident, suspected data breach or ransomware event.
• Severe weather, transport disruption or fuel shortage affecting staff travel.
• Loss of access to records, scheduling information or contact details.
• Subcontractor, agency or supplier failure affecting service continuity.
• Major safeguarding concern, serious incident, outbreak or other emergency affecting operations.

Known risks, mitigations, and impact reduction measures:

Command structure and escalation

Response arrangements

Immediate actions in the first 0–2 hours

• Confirm the nature and scale of the incident and appoint an Incident Lead.
• Identify any immediate risks to service users, staff or service delivery.
• Check live rotas, open shifts and priority placements that could be affected.
• Contact key service locations, service users or representatives as needed.
• Introduce temporary control measures such as manual records, telephone cascade or alternative working arrangements.
• Escalate to relevant commissioners, care homes, customers or emergency services where required.

Staffing contingency

• Use on-call arrangements and management cover to coordinate emergency staffing decisions.
• Redeploy suitably trained staff to the highest-risk or most time-critical services first.
• Contact available bank, agency or relief staff already subject to compliance checks.
• Adjust non-critical office activity to release management capacity for service continuity.
• Escalate unresolved staffing risks promptly to the relevant customer, care home or commissioner.
• Keep a written log of all shortages, actions taken and agreed mitigations.

Loss of premises or office access

• Switch to remote working where possible using secure devices and mobile communications.
• Use alternative locations for management coordination if the normal office cannot be accessed.
• Retain access to critical contact lists, rotas and incident logs through secure backup arrangements.
• Divert calls to mobile numbers or alternative line managers as required.

IT, cyber and records disruption

• Isolate affected devices or systems immediately where a cyber incident is suspected.
• Move to approved manual workarounds for rostering, contacts and incident logging if systems are unavailable.
• Restrict access to personal data to authorised staff only and maintain confidentiality throughout the disruption.
• Assess whether the incident creates a personal data breach and report internally without delay.
• Restore systems from secure backups or alternative records once safe to do so.

Communications

Communication will be timely, factual and proportionate. During any major disruption VCare will, as appropriate, communicate with:

• staff and workers affected by the incident;
• service users, families or representatives where continuity of support may be affected;
• care homes, customers, commissioners or placement teams;
• regulators, emergency services or insurers where required; and
• the Information Commissioner’s Office where a reportable personal data breach is identified.

Information governance and records

• Confidential records will be stored securely and accessed only by authorised persons on a need-to-know basis.
• Manual contingency records created during a disruption will be dated, attributable and transferred to the main system once normal service is restored.
• Any loss, unauthorised access or suspected compromise of personal data will be escalated immediately and managed under the data breach procedure.
• Backups, contact lists and essential documents will be maintained so that critical operations can continue where systems are unavailable.

Recovery and stand-down

• Confirm that critical services are stable and immediate risks are controlled.
• Restore normal systems, reporting lines and business processes in a phased way.
• Reconcile temporary paper or manual records into the primary systems.
• Review outstanding incidents, staffing gaps, customer concerns or safeguarding matters.
• Document lessons learned, required improvements and ownership of follow-up actions.

Training, testing and review

• This plan will be issued to relevant managers and reviewed as part of business governance arrangements.
• A desktop test or scenario review will be undertaken at least annually, or sooner where there has been a material incident or change in service delivery.
• Staff will receive induction and refresher guidance relevant to their role, including emergency escalation, safeguarding, confidentiality and incident reporting.
• Any actions arising from tests or real incidents will be recorded and completed within agreed timescales.

Plan distribution, training, testing and review

• The current approved version of this plan will be shared with managers, coordinators and other relevant staff through the company policy folder or secure shared system, with access controlled on a need-to-know basis.
• Key elements of the plan will be covered during staff induction and refreshed through supervision, team communication or formal refresher activity where relevant to role.
• Where an incident affects service delivery, relevant customers, care homes, commissioners, service users or representatives will be updated on the operational position and any temporary arrangements in place.
• A desktop test or scenario review will be undertaken at least annually, or sooner where there has been a material incident or change in service delivery.
• Any actions arising from tests, reviews or real incidents will be recorded, assigned and completed within agreed timescales.

Appendix A – Emergency contact list

To be completed and maintained by management and updated whenever key contacts change.

Appendix B – Critical systems and document register