F2 – Response planning

The practice could adopt an all-hazards risk-based approach to response planning, based on its location and what it considers to be unexpected events. Such events may include:

• clinical emergencies
• infrastructure issues
• interruptions to information technology
• equipment and power failures
• cyber attacks
• public health emergencies
• natural disasters, such as fires, floods, and cyclones
• interruptions to communications
• loss of access to the practice
• staff shortages.

Rather than creating detailed plans for every scenario, practices need to focus on building core capabilities and systems that improve their readiness for everyday disruptions as well as larger emergencies.

Governance refers to how a practice oversees and is accountable for its operations, decisions, and responsibilities, including clinical, organisational, financial, and ethical aspects. The practice could have a formal governance framework or a more informal process depending on its size.

Responsibility for the practice’s governance could rest with practice owners, management teams, clinical leads, or other designated roles.

The practice could:

• maintain a documented governance process, or a summary of the process, in the strategic plan or operational plan
• include governance responsibilities in role descriptions
• include governance review in team meetings
• periodically review the extent to which its governance arrangements are in line with F1.D to confirm that they are effective, fit for purpose, and aligned with the practice’s needs and externally imposed requirements.

Emergencies may include natural disasters, health crises, patient emergencies, and critical incidents. Examples include fire, floods, pandemics, anaphylaxis, death of a team member. Each practice needs to tailor its planning to its local environment and risks.

For detailed guidance on preparing an emergency response plan, refer to Part B – Emergency planning and response, in Managing emergencies in general practice.

The practice needs to regularly test its plans for effectiveness. Testing is proportionate to the practice’s context and identified risks.

This could involve:

• running mock scenarios (for example, ICT outages, pandemics)
• conducting emergency drills (for example, fire, clinical emergencies)
• testing ICT resilience (for example, simulating cyberattacks or access issues)
• reviewing responses to real disruptions in order to identify strengths and areas for improvement.

As practices can only test their own systems, not public infrastructure, some unexpected events, such as widespread telecommunications outages, may exceed the scope of internal testing. In such cases, documenting the event, as well as lessons learned and any system improvements made, is considered a valid form of testing and review.