NHS organisations are putting vulnerable people at risk by failing to plan for cyber attacks and extreme weather, research suggests.

A survey by the Chartered Management Institute and the Cabinet Office shows more than a third of organisations do not have a business continuity plan setting out how services will be delivered in the event of an emergency.

Of 100 hospital trusts and primary care trusts surveyed, 62 per cent said that they had a business continuity plan.

This compared with 83 per cent of central and local government organisations and 86 per cent of finance and insurance companies.

Just 28 per cent said boards took responsibility for ensuring business continuity plans were in place.

In the East Midlands, this was 7 per cent, while in Scotland it was 30 per cent.

Chartered Management Institute director of policy research Petra Wilton said: “You’d expect health organisations dealing with vulnerable people to have plans in place to keep things running.

“If this is not being driven by the board or being seen as important by the senior managers it is very worrying.”

She said that organisations risked having their insurance invalidated if services had to close for periods of time. Failing to prepare for disasters could also undermine their health and safety responsibilities.

Nearly half of organisations in the survey said they were worried about electronic attacks but only 46 per cent had plans in place to cater for a loss of IT.

Last November, a computer virus attacked thousands of PCs at Barts and the London trust, causing serious disruption.

Severe weather was a worry for 62 per cent of organisations surveyed, yet only 37 per cent were prepared for such a scenario.

The figures follow unusual levels of snowfall last month, when services across the country struggled with high levels of staff absence and some hospitals were forced to cancel operations.

The proportion of trusts that were prepared to cope with enforced staff absence was 43 per cent.

However, this was higher than in the manufacturing and production industries, for which the figure was 13 per cent.


Percentage of trusts with plans

  • Business continuity: 62 per cent
  • IT loss: 46 per cent
  • Severe weather: 37 per cent
  • Enforced staff absence: 43 per cent