Topic 3.10 — Emergency Preparedness, Resilience & Response

Emergency Preparedness, Resilience and Response (EPRR) is a statutory duty, not a nice-to-have, and in a modern health system the digital and data dimension is now part of the front line — so you must plan, train, exercise and command your technology alongside your clinicians.

Why this matters in health and care#

When a major incident happens — a terrorist attack, a chemical spill, a heatwave, a flu surge, or a cyber-attack that locks every clinician out of the electronic patient record — the health and care system is expected to keep functioning while everyone around it is disrupted. That expectation is written into law. Under the Civil Contingencies Act 2004, NHS bodies and their partners have specific duties to assess risks, maintain plans, and be able to respond. Emergency Preparedness, Resilience and Response is the umbrella term the NHS uses for how it meets those duties. It is not the same as ordinary service management, and it is broader than the IT-focused disaster recovery covered in Topic 3.9 — Business Continuity & Disaster Recovery.

The reason this matters more in health and care than almost anywhere else is that failure has an immediate human cost. If a supermarket's till system fails, sales stop; if a hospital's clinical system fails during a mass-casualty event, people may die who would otherwise have lived. Digital services are now so deeply woven into clinical work — ordering tests, prescribing, checking allergies, viewing images, discharging patients — that a technology outage is a clinical-safety event, and it must be treated with the same seriousness as any other threat to life. This is why the "how you work" thesis of this book is sharpest here: your preparedness is a clinical-safety, equity and public-trust issue.

Emergencies also expose inequality. The people least able to cope when normal services fail — those without transport, without English, without money, without carers, with long-term conditions — are exactly the people your emergency plans must protect first. A response that quietly leaves them behind is not a successful response, however slick the command structure looks. Preparing well, and rehearsing honestly, is how you earn the public trust that a real crisis will test to destruction.

Core concepts#

Emergency management is the discipline of reducing a community's vulnerability to hazards and coordinating the response when they occur. It is conventionally described as a cycle — anticipate, assess, prevent, prepare, respond, recover — and health systems run that cycle continuously, not just during a crisis. EPRR is the NHS's expression of it.

The Civil Contingencies Act 2004 is the legal backbone. It divides responders into two groups. Category 1 responders are those at the core of the response — emergency services, NHS trusts and boards, integrated care boards, UK Health Security Agency, and local authorities — and they carry the full set of duties: risk assessment, emergency planning, business continuity, information sharing, and warning the public. Category 2 responders — utilities, transport operators, telecommunications firms and others — are "co-operating bodies" with a lighter duty, mainly to share information and co-operate with Category 1 responders. Knowing which you are, and which duties attach, is the starting point for everything else.

Responders coordinate through a Local Resilience Forum (LRF), a multi-agency partnership built around each police area. The LRF is where the NHS, councils, police, fire, ambulance and others plan together, and it maintains a community risk register — a shared, published assessment of the local hazards most likely to require a coordinated response, from pandemic influenza to flooding to industrial accidents. The register is a worked example of risk assessment: identifying hazards, judging likelihood and impact, and deciding what to plan for.

Incidents are classified so that everyone shares a language for scale. A business-continuity incident disrupts your ability to deliver services but is, in principle, manageable with your own plans. A critical incident is more serious: the level of disruption threatens the organization's ability to deliver safe care and requires special measures. A major incident is one whose scale or nature demands special arrangements by one or more emergency services and usually the wider system — a mass-casualty event being the archetype. The thresholds matter because declaring an incident unlocks resources, authority and mutual aid.

Command runs through the gold–silver–bronze command structure, also called strategic–tactical–operational. Gold (strategic) sets objectives and owns the big decisions; silver (tactical) decides how resources are deployed to meet them; bronze (operational) delivers the hands-on tasks. The structure is deliberately generic so that agencies who have never worked together can slot into a single command system on the day.

Three more concepts complete the picture. Surge is the ability to expand capacity — beds, staff, oxygen, compute — rapidly and temporarily beyond normal limits. Triage is the process of prioritizing casualties when need exceeds capacity, and mass-casualty triage systems exist precisely for the worst days. Mutual aid is the agreement to lend staff, equipment or capacity across organizational boundaries when one responder is overwhelmed. And a pandemic — an infectious-disease outbreak spreading across a large region — is the standing worst-case that most health systems now plan against explicitly, informed hard by the COVID-19 pandemic in the United Kingdom.

Best practices#

1. Treat major technology outages and cyber-attacks as major incidents in their own right. A ransomware attack that disables clinical systems is not merely an "IT problem" to be handled quietly by a service desk; it is a threat to patient safety across a whole organization. Wire your cyber and digital incident response into the same gold–silver–bronze command structure your organization uses for a coach crash, with a defined trigger for when a digital incident is escalated to a formal critical or major incident. The WannaCry attack of 2017 showed how a single piece of malware could ripple across dozens of trusts within hours — see Topic 1.7 — Information Governance, Data Protection & Cyber Security for the controls that prevent it, and this topic for how you command the response when they fail.

2. Run the plan–train–exercise cycle relentlessly, and mean it. A plan that has never been tested is a hypothesis. NHS EPRR requires a rolling program of exercises — communications tests, table-top exercises and full live exercises — and you should schedule them, resource them, and treat non-attendance by senior leaders as the red flag it is. Crucially, include your digital and data teams: rehearse losing the electronic patient record, losing the network, and losing your primary data center, not just a fire in a ward.

3. Design and rehearse your paper-and-downtime fallback deliberately. Every critical clinical system needs a documented, practiced way of working when it is unavailable — downtime forms, printed drug charts, read-only "business continuity" copies of records, and a known process for reconciling data once systems return. These fallbacks decay silently; forms go out of date, staff who knew the drill leave, and the printer has no toner on the day you need it. Audit them as carefully as you audit the live system, and connect this work explicitly to the recovery-time objectives in Topic 3.9 — Business Continuity & Disaster Recovery.

4. Keep command-and-control communications working when everything else fails. In a real incident, your ordinary email and telephony may be part of what has failed, especially in a cyber-attack. Maintain out-of-band communications — a way to convene gold command that does not depend on the network being attacked — along with up-to-date, offline call-out lists and a resilient method for reaching frontline staff. Test these channels during exercises; discovering that your incident bridge relies on the same single sign-on that ransomware just encrypted is a discovery you want to make in rehearsal, not at 3 a.m.

5. Pre-agree the information-governance rules for a crisis before the crisis. In an emergency you will need to share data quickly — between hospitals, with public health, with mutual-aid partners — and staff must know they are allowed to. Work with your Data Protection Officer and Caldicott Guardian to establish, in advance, the lawful bases and standing information-sharing agreements that apply in an emergency, so that clinicians share what is needed to save life without freezing in uncertainty. Keeping a record of emergency data-sharing decisions protects both patients and staff afterwards (see Topic 1.8 — Data Ethics, Consent & Public Trust).

6. Build surge into your digital services, not just your wards. Population-facing digital services — booking, triage, symptom checkers, vaccination systems — can be hit by demand spikes of ten or a hundred times normal during an emergency, exactly when they matter most. Load-test against realistic surge scenarios, agree how you will scale cloud capacity quickly, and decide in advance what to gracefully degrade so the core function survives. A queue that holds is better than a website that collapses under the weight of a frightened public.

7. Feed digital and data expertise into risk assessment and the community risk register. Your organization's contribution to the Local Resilience Forum should include a clear-eyed view of digital and cyber risk, single points of failure, and dependencies on national systems and suppliers. Too often the risk register treats "IT failure" as a single vague line; break it down, quantify it, and make sure the LRF understands that a regional network or cloud outage is now a credible mass-disruption event. This is part of the governance and assurance loop described in Topic 6.4 — Governance & Assurance.

8. Learn openly from every exercise and every real incident. The value of an exercise is the debrief, and the value of a real incident is the structured lessons that follow it. Capture what happened without blame, track the actions to completion, and — the hard part — actually close them before the next incident finds the same gap. Share learning across the system through your LRF and national channels, because the point of a resilient network is that no organization has to learn the same painful lesson twice.

9. Look after your people through and after the response. Resilience is not only technical; a workforce that is exhausted, frightened or morally injured cannot sustain a long emergency. Plan for shift patterns, rest, psychological first aid and welfare during protracted incidents such as a pandemic, and make it legitimate to ask for help. The organizations that recovered best from COVID-19 were often those that protected their staff's wellbeing deliberately rather than treating stamina as infinite.

Questions to discuss with your team#

1. When exactly does a digital or cyber problem stop being a "service incident" and become a declared critical or major incident — and who has the authority to make that call at 2 a.m. on a Sunday? This question forces you to test the seam between the everyday service management of Topic 3.8 — Service Management & Live Operations and the statutory EPRR machinery. The tension is between over-escalating (crying wolf, exhausting your command structure) and under-escalating (letting a ransomware attack spread for hours while people debate whether it counts). A good answer names explicit, observable triggers — for example, loss of the electronic patient record across multiple sites, or confirmed malware on clinical systems — and names the on-call roles empowered to declare, without waiting for office hours. Discuss who is on that rota, whether they have been trained, and whether they can convene gold command when the normal network is down. Consider walking through a recent near-miss and asking honestly whether you would have escalated in time. The best answers also cover de-escalation: how you decide the emergency is over and return to business as usual.

2. If our primary clinical systems went dark for 72 hours, what would we actually do — and have we ever proved it, or do we only believe it? This is a question about the gap between the plan on the shelf and the reality on the ward. The trade-off to surface is investment: maintaining and rehearsing downtime procedures costs money and clinical time that could go elsewhere, and it is easy to let them quietly rot. A strong answer distinguishes what is genuinely rehearsed from what is merely written down, and is specific about the first hour, the first shift and the second day, because the problems change over time — reconciling three days of paper records back into the system is its own major task. Probe whether frontline staff, not just managers, know the fallback, and whether recent joiners have ever seen it. Look for honesty about single points of failure, including dependencies on national infrastructure and suppliers you do not control. The most mature teams can point to a real exercise or a real outage where the fallback held, and to the lessons they closed afterwards.

3. How do we make sure our emergency response protects the people who are hardest to reach, rather than quietly leaving them behind? Emergencies amplify existing inequality, and digital responses can make it worse: an online-only booking system, an English-only alert, or an app that assumes a smartphone and data can exclude the very people most at risk. The tension is between the speed and scale that digital channels offer and the coverage that equity demands, and there is no free lunch — you will need non-digital routes running in parallel, which cost more. A good answer connects to the community risk register and asks which vulnerable groups a given hazard threatens, then checks the response reaches them. Consider assisted digital routes, translated materials, and how you reach people who are housebound, digitally excluded or without support (see Topic 1.9 — Digital Inclusion & Accessibility). Discuss how you would know if you were failing them during an incident, not months later in a review. Honest answers admit where current plans are weakest and commit to testing them with the communities involved.

4. Which of our critical digital dependencies do we not actually control — and what is our plan when the failure is upstream of us? Modern health and care runs on national systems, cloud regions, connectivity providers and a handful of dominant suppliers, and a great deal of your resilience is therefore in someone else's hands. The uncomfortable tension is that you carry the statutory duty and the clinical-safety consequences, yet the single point of failure may be a supplier's data center or a shared national service you cannot inspect. A strong answer maps these dependencies explicitly — which systems are hosted where, which suppliers underpin which clinical functions, and where concentration risk means one outage takes out several services at once — rather than leaving "IT failure" as a single vague line on the risk register. It asks hard questions about contractual recovery commitments, what happens when a supplier is itself the victim of the attack, and whether a regional cloud outage is treated as the credible mass-disruption event it now is. Probe whether these upstream risks are surfaced to your Local Resilience Forum and board, and whether you have any mutual-aid or manual fallback for the dependencies you cannot influence. The honest answer usually admits that some risks can only be mitigated, not removed, and is explicit about which ones you are consciously accepting.

5. Do our exercises tell us the truth, and do the lessons we learn actually change anything before the next incident? An exercise program can become theater — a scripted table-top that everyone knows will succeed, attended by juniors while senior leaders send apologies, producing a tidy report and a list of actions no one closes. The tension is between exercises that are comfortable and reassuring and exercises that are realistic enough to fail safely, which is the only kind that teaches you anything. A good answer looks at whether you rehearse genuinely hard scenarios — losing the EPR, losing the network, a supplier ransomware attack — with the people who would really be on shift, and whether senior attendance is treated as mandatory rather than optional. It is candid about the debrief culture: are lessons captured without blame, tracked to completion, and verified as closed, or do the same gaps recur incident after incident? Look for evidence that a lesson from one exercise or real event demonstrably changed a plan, a rota or a control. The most mature teams can name a failure they surfaced deliberately in rehearsal and fixed before it could hurt a patient.

6. How will we sustain and protect our people through a response that lasts weeks, not hours? Much emergency planning implicitly assumes a sharp, short shock, but the events that test a health system hardest — a pandemic, a protracted cyber recovery, a long cold-weather surge — grind on for weeks or months, and human stamina is not infinite. The trade-off is real: rotating people for rest and welfare reduces the raw hours available at exactly the moment demand peaks, and it is tempting to lean on the willing until they break. A strong answer plans for shift patterns, hand-overs, rest, psychological first aid and welfare from the outset, and makes it legitimate for staff to ask for help rather than treating exhaustion as commitment. It considers the digital and data teams too, who often carry a recovery for days with no relief because they are few and specialized. Discuss how you would spot burnout, moral injury and attrition during a long incident, and who owns workforce welfare in your command structure. The organizations that came through COVID-19 best were frequently those that protected their people deliberately, and honest answers admit whether your plans currently do that or merely hope for heroics.

In practice: a health & care example#

Meadowford is a fictional integrated care system covering a mid-sized city and its rural hinterland. On a wet February morning, its acute trust's electronic patient record — hosted by a national supplier and shared with two neighboring trusts — begins throwing errors, then fails entirely. Within twenty minutes the supplier confirms a ransomware attack. Clinicians can no longer see medications, allergies, results or care plans across three hospitals and their linked community services.

The trust's on-call director declares a critical incident using a pre-agreed trigger — "loss of the EPR across multiple sites" — and, as the scale becomes clear, escalates to a major incident. Gold command convenes not by the usual Teams call, which runs through the affected single sign-on, but via a rehearsed out-of-band bridge on a separate platform, using a printed call-out list. Silver command activates downtime procedures: paper drug charts, downtime request forms, and read-only "break-glass" copies of records that were replicated to a segregated environment for exactly this scenario, as designed under the recovery objectives in Topic 3.9.

The cyber and clinical-safety leads run in parallel. The chief clinical information officer opens a clinical-safety case, treating the outage as a hazard and tracking the specific risks — missed allergies, duplicated doses, lost results — with mitigations for each (see Topic 1.6 — Clinical Safety & Risk Management). The Caldicott Guardian and Data Protection Officer confirm the pre-agreed emergency information-sharing position so that clinicians can phone neighboring sites for critical patient details without hesitating over lawfulness, and every such decision is logged.

Meanwhile the Local Resilience Forum is informed, and mutual aid flows: a neighboring ICS lends pharmacy staff to help manage paper prescribing, and the regional NHS England EPRR team coordinates with the National Cyber Security Centre. Elective activity is stood down to create surge capacity; the community risk register had already flagged a regional clinical-systems outage as a credible scenario, so the playbook existed. Systems are restored from clean backups over four days. The hardest work comes afterwards: reconciling four days of paper back into the record, and a blameless structured debrief whose actions — a weak segmentation boundary, an out-of-date call-out list, and staff who had never seen the downtime forms — are tracked to closure before the next exercise.

Sector lenses#

Startup#

A small digital-health company will not run gold–silver–bronze command, but it is a critical dependency for the customers who do. Your resilience story — where data is hosted, how fast you recover, what your incident process is, how you would communicate during an outage — is something enterprise buyers will and should interrogate. Be honest about single points of failure, including your reliance on one cloud region or one key engineer. The disciplined move is to write a lightweight incident-response plan early, rehearse it once, and be able to show customers you take their continuity seriously; it is both good practice and a sales advantage.

Small business#

An established small provider — a GP practice, a community pharmacy, a care home or a domiciliary-care service — carries the same duty to keep people safe when systems fail, but with none of an NHS trust's dedicated EPRR machinery. You will not have an accountable emergency officer or a 24/7 command rota; resilience has to be baked into how a handful of people already work. The pragmatic focus is a short, genuinely rehearsed downtime plan for the systems you depend on — the clinical system, the phones, the internet link — with paper fallbacks that your actual staff have used at least once, and an offline list of who to call, including your supplier and your commissioner. Because you rely almost entirely on suppliers and national services you cannot control, know their recovery commitments and your own manual work-arounds for the first hours. Engage with the wider system rather than facing an emergency alone: your integrated care board and Local Resilience Forum exist partly to help organizations your size, and mutual aid with neighboring providers can be the difference between coping and closing.

Enterprise#

A large NHS trust or ICS carries the full weight of Category 1 responder duties: an accountable emergency officer, a rolling exercise program, 24/7 on-call command, and a seat at the Local Resilience Forum. The challenge is integration — making sure cyber, clinical, operational and communications responses converge into one command structure rather than three parallel ones, and that digital teams are genuinely part of EPRR rather than an afterthought called in once things are on fire. Scale also brings complexity: many systems, many suppliers, and dependencies on national infrastructure you do not control. Maturity looks like rehearsed downtime working across every critical service and a debrief culture that actually closes its actions.

Government#

National and regional bodies — NHS England, the UK Health Security Agency, the Department of Health and Social Care, devolved governments — set the framework, hold the standards, and coordinate the response above the level any single organization can manage. Their EPRR job is to write and assure the core standards, run national exercises, maintain reserves and mutual-aid arrangements, and provide command coordination during system-wide events such as a pandemic. They also own the national digital infrastructure whose failure would be a mass-disruption event in itself, so their own resilience is a public duty. Working effectively with them, and understanding the strategic–tactical–operational chain up to national level, is the subject of Topic 9.1 — Working with Local & National Governments.

Common failure modes#

• Plans on a shelf. A thick binder written to pass an assurance check, never exercised, and unknown to the staff who would have to use it. Rehearsal, not documentation, is the test of readiness.
• Treating cyber as an IT problem. Leaving a ransomware attack to the service desk while it spreads, instead of escalating it to major-incident command with clinical-safety leadership. Speed of escalation is everything.
• Untested downtime procedures. Fallback forms that are out of date, staff who have never seen them, and no rehearsed plan for reconciling data afterwards. The fallback decays silently unless you audit it.
• Command channels that share the failure. Convening gold command on the very platform the attack has encrypted. Out-of-band communications must be genuinely independent.
• Learning that never lands. Debriefs that produce a report and a list of actions no one closes, so the next incident finds the same gap. Track lessons to completion.
• Equity as an afterthought. Digital-only responses that exclude the vulnerable, discovered only in a post-incident review. Design non-digital routes in from the start.
• Heroics as a strategy. Assuming staff stamina is infinite and neglecting welfare, rest and psychological support during a long incident. Burnout is a resilience failure.

Maturity model#

Checklist#

• Confirm your organization's status (Category 1 or 2 responder) and the statutory duties that attach to it.
• Define explicit, observable triggers for escalating a digital or cyber problem to a critical or major incident, and name who can declare, 24/7.
• Ensure cyber and digital incident response is wired into your gold–silver–bronze command structure.
• Maintain out-of-band command communications and offline call-out lists, and test them in exercises.
• Document, audit and rehearse downtime/fallback procedures for every critical clinical system, including data reconciliation.
• Pre-agree emergency information-sharing lawful bases and agreements with your Caldicott Guardian and Data Protection Officer.
• Load-test population-facing digital services against realistic surge scenarios and agree what degrades gracefully.
• Contribute a clear digital and cyber risk view to your Local Resilience Forum and community risk register.
• Run a rolling plan–train–exercise program that includes losing your EPR, network and primary data center.
• Hold blameless debriefs after exercises and real incidents, and track every action to closure.
• Plan for staff welfare, rest and psychological support during protracted incidents.
• Check that your emergency response reaches digitally excluded and vulnerable groups through non-digital routes.

Key sources#

• NHS England — NHS Emergency Preparedness, Resilience and Response (EPRR) Framework and the EPRR Core Standards.
• Cabinet Office — Civil Contingencies Act 2004 and Emergency Preparedness / Emergency Response and Recovery statutory guidance.
• Cabinet Office / GOV.UK — National Risk Register and guidance on Local Resilience Forums and community risk registers.
• National Cyber Security Centre (NCSC) — guidance on ransomware, incident management, and treating cyber incidents as major incidents.
• UK Health Security Agency (UKHSA) — pandemic and infectious-disease preparedness guidance.
• UK Covid-19 Inquiry — published modules and reports on pandemic preparedness and response.
• Joint Emergency Services Interoperability Principles (JESIP) — command, coordination and the strategic–tactical–operational model.
• National Audit Office — Investigation: WannaCry cyber attack and the NHS (2018).

References#

1. Civil Contingencies Act 2004 — Wikipedia — https://en.wikipedia.org/wiki/Civil_Contingencies_Act_2004
2. Emergency management — Wikipedia — https://en.wikipedia.org/wiki/Emergency_management
3. Local resilience forum — Wikipedia — https://en.wikipedia.org/wiki/Local_resilience_forum
4. Gold–silver–bronze command structure — Wikipedia — https://en.wikipedia.org/wiki/Gold%E2%80%93silver%E2%80%93bronze_command_structure
5. Risk assessment — Wikipedia — https://en.wikipedia.org/wiki/Risk_assessment
6. Triage — Wikipedia — https://en.wikipedia.org/wiki/Triage
7. Mutual aid (emergency services) — Wikipedia — https://en.wikipedia.org/wiki/Mutual_aid_(emergency_services)
8. Pandemic — Wikipedia — https://en.wikipedia.org/wiki/Pandemic
9. COVID-19 pandemic in the United Kingdom — Wikipedia — https://en.wikipedia.org/wiki/COVID-19_pandemic_in_the_United_Kingdom
10. WannaCry ransomware attack — Wikipedia — https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
11. NHS Emergency Preparedness, Resilience and Response (EPRR) — NHS England — https://www.england.nhs.uk/ourwork/eprr/
12. Civil Contingencies Act 2004 (legislation) — UK Government / The National Archives — https://www.legislation.gov.uk/ukpga/2004/36/contents
13. Preparation and planning for emergencies: responsibilities of responder agencies and others — Cabinet Office, GOV.UK — https://www.gov.uk/guidance/preparation-and-planning-for-emergencies-responsibilities-of-responder-agencies-and-others
14. Mitigating malware and ransomware attacks — National Cyber Security Centre — https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks
15. Investigation: WannaCry cyber attack and the NHS — National Audit Office — https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/
16. UK Covid-19 Inquiry — https://covid19.public-inquiry.uk/