NHS England » Annual emergency preparedness, resilience and response (EPRR) assurance report

Organisation objective

Statutory Item
Governance

Action required

The Board is asked to:

note key activities and response to incidents as defined by the NHS EPRR Framework during 2024/25
receive assurance that NHS England and the NHS in England are prepared to respond to emergencies and are resilient in providing continued safe patient care

Background

1. Emergency preparedness, resilience, and response (EPRR) is a core function of the NHS and is a statutory requirement of the Civil Contingencies Act (CCA) 2004, the NHS Act 2006 and the Health and Care Act 2022. As such, NHS England, along with all providers and commissioners of NHS-funded services, must demonstrate its ability to respond effectively to a wide range of incidents and emergencies while maintaining services to patients. These can range from extreme weather conditions to infectious disease outbreaks, a major transport accident, or a terrorist incident.

2. NHS England’s EPRR role involves addressing potentially disruptive threats outlined in the National Security Risk Assessment through its preparedness activities and coordinating and leading the NHS response when required.

3. This paper updates the Board on NHS EPRR statutory requirements placed upon NHS England, including:

summary of key activities and publications
update on incidents and events which occurred during 2024/25
outcome of the annual EPRR assurance process and related actions
priorities for the 2025/26 work programme

Key activities in 2024/25

4. During 2024/25, NHS England’s oversight of EPRR was provided by Dr Dame Emily Lawson as the Accountable Emergency Officer. Additional oversight has been provided by Sarah-Jane Marsh, Deputy Chief Operating Officer, and Dr Mike Prentice, National Director for NHS Resilience.

5. Under NHS Resilience Team’s leadership, the annual work programme has delivered key outputs during this period, but project delivery has been impacted by resource constraints, operational pressures, and incident response priorities. These challenges are expected to remain, especially with future changes in the NHS operating model and an evolving threat landscape. However, NHS England is committed to strengthening NHS preparedness through its work plan, which includes providing guidance and frameworks, building response capability, running training and exercises, and collaborating with partners to ensure whole system planning.

6. A number of key documents in the work programme have been developed and published in the past 12 months:

7. Other EPRR products that are due to be delivered and published within the next 3-6 months include:

updated MACA Guidance – this document summarises the requirements and process for requesting Military Aid to the Civil Authorities (MACA) within the NHS in England
NHS guidance for the management of self-presenters from incidents involving hazardous materials. This document will outline the pathway for managing contaminated persons at NHS facilities, including initial and specialist operational response, and support the implementation of standards for Ambulance Services CBRN support to acute trusts
a Lessons Identification and Management Framework which will support NHS organisations to develop arrangements for identifying, recording, and sharing lessons to improve standards and consistency. It aims to address local practice variations, promote learning, contributing to continuous improvement and resilience planning. It aligns with Cabinet Office’s Best Practice Guidance.

8. Additional significant projects currently in progress and/or nearing completion:

The Tri-annual review of NHS Core Standards for EPRR.
A review and update of the Concept of Operations for managing Mass Casualties.
NHS England National Framework for managing Industrial Action.
The Event Healthcare Standard to provide high-level guidance for event healthcare providers to meet required standards, ensuring safety, and consistency to mitigate the health risks. It aims to fulfil the Manchester Arena Inquiry’s (MAI) recommendation (R132) and support mass casualty preparedness. The standard will apply to England.

9. Separately, items for internal use that have also been developed and approved include:

Framework for responding to a National Power Outage (NPO) – assisting national and regional teams in planning, responding to, and recovering from an NPO, guiding local decision-making.

10. Due to pressures, other items such as updating NHS England’s Incident Response Plan (National) and Countermeasures Guidance remain outstanding and will be carried forward into next year.

Incident response

11. In 2024/25, incident response arrangements have been implemented for several incidents requiring notification to NHS England. These have been managed with regional and/or national oversight, and set out by theme below:

Major Incidents

12. On 29 July 2024 a major incident was declared in Southport following a knife attack at a dance studio. This tragic incident resulted in three fatalities with several other children and adults critically injured. Alongside the North West Ambulance Service, a number of NHS organisations from Cheshire and Merseyside and Greater Manchester systems were involved in the response.

13. In December, Southern Water declared a major incident due to a technical fault causing low water pressure in Southampton and surrounding areas. University Hospitals Southampton declared a business continuity incident, receiving water from tankers and bottled water deliveries during the incident.

Cyber

14. In April, a cyber-attack impacted the ordering and delivery process of a company supplying mobility aids to local authorities, causing slower discharges in London. Another supplier faced a separate cyber issue affecting their HR system.

15. In June, a pathology lab which processes blood tests on behalf of several NHS organisations in South East London was the victim of a ransomware attack, leading to data theft and publication. NHS England London declared a regional incident to coordinate work across affected services and NHS England Cyber Operations led the technical response with an Incident Management Team stood up to support the region and affected organisations. Over 10,000 outpatients and 1700 elective procedures were deferred, but effective response and mutual aid arrangements minimised the impact and avoided any transplant organs from being wasted. The incident was stood down in October 2024 and a full review and lessons identified process is taking place.

16. In November, a cyber incident affected Alder Hey Children’s Hospital Trust, Liverpool Heart and Chest Hospital, and Liverpool University Hospitals. The North West managed this as a level 3 regional incident with support from NHS England Cyber Operations team, along with National Cyber Security Centre (NCSC) and the National Crime Agency (NCA), with cyber investigative teams supporting the Trusts technical response.

IT outage

17. In July, a global IT outage of Crowdstrike software affected Microsoft Windows systems. The NHS experienced an outage of EMIS Web, used by 60% of General Practices for appointments, prescriptions, and information sharing across primary care. The Lorenzo electronic patient record system was also impacted, prompting the activation of business continuity plans.

Supply disruptions

18. In April, a major supplier of handwash and hand sanitiser products to the NHS and other providers went into administration. This led to the NHS Resilience team coordinating with NHS Supply Chain and the National Supply Disruption Response team to transition to new suppliers and provide guidance on stock management and infection control.

19. In November, a European shortage of generators for radiopharmaceuticals affected various diagnostic and imaging services, including cancer and cardiac procedures. An incident management team was established to monitor and mitigate impacts, and the British Nuclear Medicine Society advised prioritising patients using a ‘traffic light’ system.

Public health

20. In mid-August 2024, the World Health Organization declared a Public Health Emergency of International Concern due to mpox (clade 1) cases in East and Central Africa. This clade is different from the one that caused the 2022 outbreak, with cases of clade 1b mpox reported outside Africa, including eight in England between October 2024 and January 2025, all of which had travel or contact history.

21. In January 2025, a human case of H5N1 (avian flu) was confirmed in the West Midlands. The individual, a farmer, became exposed while handling diseased birds. For both mpox and avian flu, the NHS Resilience team has collaborated with the HCID (A) Network to manage these cases.

22. There has also been ongoing support in response to Measles and Pertussis outbreaks.

Other incidents of note

23. A power outage at Bristol Royal Infirmary led to a fire in the Children’s Hospital imaging department. No injuries occurred, but some patients were relocated within the hospital, and the adult Emergency Department was fully diverted. The trust declared a critical incident, with South Western Ambulance Service dynamically redirecting patients to appropriate hospitals.

24. In July NHS Blood and Transplant (NHSBT) declared an amber alert due to O negative red blood stock levels falling below the two-day threshold. This was as a direct result of the cyber-attack on a pathology lab in June (see para 15), which demonstrates the broad nature of cascading impacts. The NHS England National Operations Centre supported NHSBT in communicating the alert and required actions to NHS Trusts. A further amber alert due to low stock of platelets was issued on 27 December and removed on 9 January 2025.

25. Several ambulance services have declared incidents between November 2024 and January 2025 due to a software issue affecting the control room solution providing communications between Emergency Operations Centres and operational crews. NHS Resilience and Urgent and Emergency Care teams have been working with the Ambulance Radio Programme to mitigate the impact of the incident and ensure business continuity measures are in place.

Incidents in stats

26. The information below are those incidents that have been reported by NHS organisations to NHS England.

27. During 2024, there were a total of 217 declarations:

19 major incidents
198 critical incidents

28. The NHS experienced a busier year in incident response (declared incidents) to the previous year, with 217 incidents in 2024 versus 131 incidents in 2023. The average incident duration in 2024 was 4.58 days, compared to 3.11 days in 2023.

Industrial action

29. Industrial action by health professionals continued into 2024/25, with junior doctors and hospital consultants taking strike action in both June and July. NHS England led the national response, co-ordinating with trusts and ICBs to manage disruptions and maintain patient safety and quality of care.

30. National disputes with Resident (previously Junior) Doctors, Specialty and Specialist Doctors (SAS), and Consultants were later resolved, enabling incident response to be stood down. Work has continued to capture learning and legacy materials have been developed in the event of future strikes. Additionally, data from the strikes has informed elective and workforce recovery.

31. Preparations for GP Collective Action were also made, but variable participation led to EPRR oversight being stood down. Localised industrial action due to pay or conditions disputes have been ongoing and managed by trusts and ICBs, with many resolved in the last six months.

Governance

32. To ensure the continued effectiveness and integrity of the EPRR function, NHS Resilience has undertaken a comprehensive review of its governance arrangements. As a result, risk management processes have been streamlined, including reporting. Additionally, other changes have been implemented such as ensuring a greater focus on risk exposure (addressing key capability gaps), mapping of interdependencies and associated themes in collaboration with other directorates to address potential vulnerabilities from multiple angles, enhancing resilience, and leading to more informed and strategic decision-making.

EPRR annual assurance 2024/25

33. While the annual assurance process for 2024/25 remained largely unchanged, the need to promote inclusive, open and transparent dialogue; be supportive and encouraging; and enable the sharing of good practice and continual improvement was reinforced. Regional teams were also reminded that local assurance needs to be led by ICBs as local health system leaders.

34. Following recent incidents and common health risks identified as part of last year’s assurance process, a deep dive was also undertaken focusing on Cyber security and IT related incidents. The outcome of the deep dive will be used to identify areas of both good practice and further development and guide organisations in the development of local arrangements.

35. The 2024/25 annual assurance process was undertaken through a local self-assessment of providers against the Core Standards. ICBs were asked to work with their commissioned organisations and LHRP partners to obtain organisational level assurance ratings, agree a process to gain confidence with organisational ratings, and provide an environment to promote the sharing of good practice.

36. Regional Deputy Directors of EPRR and their teams collaborated with ICBs to obtain and submit organisation-level assurance ratings and descriptions of their regional processes and findings to national EPRR. The NHS Resilience team reviewed these submissions in one-to-one assurance meetings. Subsequently, the Deputy Director of EPRR for London reviewed the NHS Resilience self-assessment.

37. This year’s assurance exercise identified development areas and challenges to be considered and incorporated into the NHS Resilience business plan and work plan from 2025/26:

A pandemic and new and emerging infectious disease remain the highest risks on the national risk register. Despite national progress in developing a disease agnostic response framework, organisations report challenges in updating local plans, ensuring sufficient resource for a unified response, and providing regular training and exercising in this area.
The prolonged NHS response to industrial action and operational pressures has diverted EPRR resources from preparedness activities, therefore impacting local organisational resilience.
While most Boards and Executive Teams report sufficient and appropriate resource to discharge EPRR duties, a lack of EPRR resources is a recurring factor in non-compliance with the NHS Core Standards for EPRR, indicating a disconnect between operational teams and senior leadership.
Staffing pressures and the challenge of releasing staff from operational duties for EPRR training and exercising is also frequently raised.
NHS Resilience continues to monitor issues with ageing specialist CBRN equipment and lack of financial investment amidst conflicting cost pressures and competing operational priorities, in the absence of any protected central funding.
NHS England’s Corporate Business Continuity team continues to review and align legacy BC arrangements and implement new BCMS software. As completion timeframes don’t align with the annual assurance process, this has impacted core standard compliance, but a robust work plan to address areas of non-compliance is in place.

38. The deep dive investigation in to Cyber Security & IT related incidents identified:

Increasing engagement between operational EPRR and technical Cyber security/IT teams in light of recent cyber incidents.
A number of regions reported good levels of testing of cyber security and IT related incident arrangements, either in response to live incidents and/or regional exercises lead by regional digital transformation leads.
Need to ensure organisational BC arrangements and threat specific response plans are aligned to ensure that critical functions and dependencies on core IT systems/infrastructure are identified (i.e. IT Disaster recovery plans must accommodate the Maximum Period of Tolerable Disruption and Recovery Time Objectives of critical services)
Limited evidence of Training Needs Analysis for those roles identified in Cyber Security and IT Teams incident response plans although the risk posed by such incidents were often referenced in EPRR training.

39. Overall, assurance was gained that NHS England and the NHS in England are prepared to respond to emergencies and are resilient in providing continued safe patient care.

40. NHS Resilience has committed to reviewing the EPRR annual assurance process, which has historically been based on compliance with the NHS Core Standards for EPRR and implemented by regional EPRR teams. The ambition is to move towards a single national process which provides year-round assurance and supports continuous development and improvement, in line with NHS England’s roles and responsibilities and the latest NHS Operating Framework. This aim is to support the launch of next year’s process with an ICB AEO event.

NHS Resilience Interoperable Capabilities Team

41. The contract to host and provide the NHS Resilience Interoperable Capabilities Team (NRICT), which replaces the National Ambulance Resilience Unit contract, was awarded to London Ambulance Service NHS Trust for a period of five years from 01 April 2024.

42. The aim of the service is to support the delivery of patient care and improved outcomes in a range of challenging environments in response to major and highly complex incidents. The service provides specialist advice and guidance on capabilities, sets standards, and establishes safe systems of work. It also delivers training to NHS ambulance staff to ensure interoperability across England.

43. The NHS Resilience Interoperable Capabilities Team is currently conducting a strategic review of interoperable capabilities. In parallel, during 2024/25 London Ambulance Service NHS Trust, working with NHS England, has been engaging with a wide range of stakeholders to review the draft strategy and priorities for the future before finalising.

Emergency Preparedness, Resilience and Response Clinical Reference Group

44. The EPRR Clinical Reference Group (CRG) evaluates the clinical appropriateness of emergency preparedness arrangements being developed by NHS England for the NHS. The CRG meets quarterly, with broad representation from key clinical groups and specialties, including Royal Colleges, the Ministry of Defence, and the NHS provider sector.

45. As part of its remit, the group is overseeing the implementation of health recommendations from the MAI report, including the ongoing Clinical Response to Major Incidents programme. A conference to launch the programme was attended by approximately 150 people in April 2024 to support and share some of the initial outcomes of this work. The workstreams will incorporate psychosocial aspects and involve patient and public representatives.

46. An additional CRG has been established to consider Chemical, Biological, Radiological and Nuclear (CBRN) aspects of planning and response. The group is working with UKHSA colleagues to support revisions to the CBRN Handbook.

Training and exercising

47. EPRR training and exercising are essential components in ensuring the readiness and effectiveness of the NHS to respond to incidents or emergencies.

48. Following last year’s assurance training deep dive findings, the national EPRR Training and Exercising Working Group has developed key products for the NHS that will be launched in spring. This includes a Loggist training package, a standardised national CBRN awareness e-learning package, and updated Principles of Health Command (PoHC) for strategic leaders, and a new tactical course. In 2024, PoHC was delivered to over 1,600 individuals, consistent with last year’s provision. Key training priorities for the forthcoming year include CBRN response packages and meeting internal training requirements.

49. NHS Resilience and regional EPRR teams have also conducted and participated in various exercises with government and local resilience partners to validate resilience planning. These have covered a range of topics including burns mass casualty, high secure facility incidents, HCID, national power outages, overseas casualty reception, measles, and cyber incidents. Additionally, NHS Resilience designed and delivered two communications systems exercises to test its communications arrangements in line with legal requirements. Ongoing work aims to embed lessons from previous exercises.

50. In October 2024, NHS England also launched a seven-year exercising programme for the NHS to routinely exercise and share learning on common themes aligned to the Core Standards. NHS England plans to support several exercises in the upcoming financial year, covering a chemical incident to adult social care provider failure, and will participate in ‘Exercise PEGASUS,’ a national pandemic preparedness exercise in Autumn 2025.

Priorities for 2025/26

51. The EPRR work programme for 2025/26 will include:

Progressing areas of development that have been identified through EPRR assurance 2024/25.
Continuing to support CBRN, pandemic preparedness, Pillar 3 which explores and remediates cross-cutting capability gaps, and developing standardised training packages.
Implementing health recommendations from the Manchester Arena Inquiry report.
Supporting the national pandemic exercise which is the first of its kind in nearly a decade and is set to be the biggest in UK history. It will aim to test our ability to respond to a pandemic, involving all regions and nations of the UK and thousands of participants across government, local responders and the NHS. The exercise is due to extend over several months from the Autumn, and assess the UK’s preparedness, capabilities, and response arrangements in the context of a pandemic arising from a novel infectious disease.
Safeguarding expertise during the NHSE/DHSC change programme to ensure delivery of this statutory function through the transition.

52. The Board is asked to note the report content and annual assurance, acknowledge the identified priorities for 2025/26, and to support the NHS Resilience team in achieving them.

Publication reference: Public Board paper (BM/25/13(Pu)

Cookies on the NHS England website