1 Purpose and priorities
This policy protects people and maintains critical functions when premises, technology, personnel or suppliers are disrupted. Response priorities are life, then data, funds and services. The Association does not provide unlicensed emergency or care services; competent emergency services are requested when needed.(1)
2 Impact analysis and plans
Each process owner identifies critical services, dependence on people, data, banks and suppliers, and the impact of interruption over time. Maximum tolerable interruption, recovery-time and acceptable data-loss objectives are proposed and approved by the Director, and by the Board for material risks, before operational reliance. Assumed figures are not presented as tested capability.
Urgent-case communications, protection of pending transfers and regulatory deadlines take priority. Alternate personnel, communications, workplace and minimum resources are defined, with an updated contact list safely available during a system outage.
3 Activation and leadership
The Director activates the plan, replaced when unavailable by the delegate identified in the emergency register. Immediate safety action may precede activation, followed by notification. Event start, decisions, communications and impact are recorded. Safety, technology, finance and communications roles are assigned without combining payment approval and execution under emergency pressure.
4 Alternative operations
Temporary numbered forms, approved channels and secure access alternatives are used, recording each transaction for later entry and reconciliation. Outages do not justify personal bank accounts or personal email for patient files. Account-change requests are independently verified and mandatory dual signatures continue.
5 Recovery and testing
Systems are restored from a sound copy after containing the cause and checking permissions and data integrity. Owners reconcile outage-period transactions and sign acceptance of return. At least one annual exercise and risk-based periodic restoration tests measure actual times against objectives, recording gaps and responsibilities.
6 Closure and communication
Authorised communications consistently explain service effects and alternatives without exposing vulnerabilities or personal data. Full restoration is not announced before process-owner acceptance. Lessons, failures, data loss and notification obligations are reviewed; plans, contracts and training updated; exercise and incident evidence retained.
References in the approved document
- The Association’s approved 2026 Articles of Association, Article 20 and risk management; Cabinet Resolution No. 5 of 2025, Article 25 on premises safety. This document establishes internal implementation controls without changing higher legal powers or requirements.