[BCM] [JHA] [E3] [BIA] [P6] [CBF] [1] Vital Records

Vital Records for CBF-1 Personal Care and 24-Hour Supervision

Introduction

Vital records are the small share of Jamiyah Home for the Aged's (JHA) information without which residents cannot be cared for safely during a disruption.

This Part of the Business Impact Analysis (BIA) identifies those records for each of the 14 sub-functions of CBF-1 Personal Care and 24-Hour Supervision, together with their media, location and custodian.

Why Vital Records Belong in the Business Impact Analysis

Earlier Parts of the BIA established which CBF-1 activities must continue, how quickly, and with which people, premises, equipment, and suppliers. Information is a less visible dependency, but it is just as decisive.

A care assistant who reports for duty at a temporary location still cannot safely turn a bedbound resident, serve the correct diet texture, or recognise a change in behaviour without that resident's care plan.

For this BIA, a vital record is any record, in any format, that JHA needs to:

• continue a prioritised activity within its maximum tolerable period of disruption;
• protect the safety, rights and dignity of residents and staff; or
• re-establish its legal, regulatory and financial position after the event.

Most records JHA holds are not vital. They support efficiency, history or routine reporting, and can wait until normal operations resume. This assessment separates the few that cannot wait from the many that can, so protection efforts and budget go where they matter.

Identifying vital records inside the BIA, rather than as a separate records exercise, brings three benefits:

• Each record is tied to a named sub-function and its recovery time objective, so you know the required speed of access.
• Single points of failure become visible, such as a care plan held on one terminal or in one paper file at one nursing station.
• The Business Continuity Plan inherits a ready list of what must be carried, copied or restored first.

Vital Records and Continuity of Care

In a residential home, losing a record has immediate clinical consequences, not merely administrative ones. JHA's residents are frail older persons, many living with dementia, limited mobility or several long-term conditions.

Many have no family able to supply information on their behalf, so the home's records are often the only reliable account of their history, preferences and risks.

Consider three plausible scenarios: evacuation to a partner facility after a fire, a prolonged outage of the care documentation system, or an outbreak that removes most of a shift's regular staff. In each, agency or redeployed staff must care for residents they have never met.

They will rely on records to answer basic questions. Who is this person? Which medicines are due, and when? Can they swallow thin fluids? Are they at risk of wandering? Whom do we call if they deteriorate?

Where those answers are not to hand, the risk of harm rises sharply: missed or duplicated medication, aspiration, falls and unwitnessed absconding.

Vital records also carry the home's duties outward. During the disruption, incident and safeguarding records under the MSF Code of Practice for Social Residential Homes, notifications to MSF, and outbreak information for MOH must continue to be produced. Regulators, families, and investigators examine the gaps created in that period most closely afterwards.

Records Management, Information Governance and BCM

Three disciplines meet in this assessment, and each depends on the others:

• Records management, guided by ISO 15489-1:2016, ensures records are created, captured and kept so that they remain authentic, reliable, complete and usable.
• Information governance sets the rules for access, retention, confidentiality and the protection of personal data under the Personal Data Protection Act 2012 and the Social Residential Homes Act 2025 framework.
• Business Continuity Management, under ISO 22301:2019 and its 2024 amendment, asks what happens to those records when the normal operating environment fails.

A continuity plan that calls for "the resident list" fails if that list is out of date, uncontrolled or held in only one place. A retention schedule that is sound in normal times fails if the only copy of a vital register sits in an unprotected cabinet beside the pantry.

ISO 22301 requires the BIA to identify the resources, including information and data, on which prioritised activities depend (clauses 8.2.2 and 8.3.2).

It also requires documented information to be available where and when needed and adequately protected (clause 7.5.3). This register serves both requirements.

At JHA, the Home and Jamiyah Singapore share these responsibilities, with Jamiyah Singapore as the managing agent. Jamiyah Singapore is assumed to provide ICT, human resources and finance services, while the Superintendent and the nursing team own resident care information.

That split must be written down. In a disruption, each party may otherwise assume the other is protecting the records.

Protecting Physical and Electronic Records

JHA, like most welfare homes, runs on a hybrid information system. Some records live in electronic systems.

Others remain on paper because staff sign them at the bedside, they arrive from hospitals and polyclinics, or they are kept as registers and signed statements. Each medium fails differently.

• Paper records are exposed to fire, sprinkler and flood water, loss during evacuation and physical deterioration. They are usually single copies and cannot be reached remotely.
• Electronic records are exposed to power and network failure, ransomware, vendor outage and accidental deletion. When the system is unavailable, every user loses access at once, even if the data itself is safe.

A resilient approach uses each medium to cover the other's weakness. Print or export critical electronic data at set intervals for use during outages. Critical paper is scanned into the electronic record.

Both are copied to a separate location, whether off-site or in the cloud, and the access path (devices, credentials and connectivity) is protected alongside the data.

The table below applies this thinking to each CBF-1 sub-function and forms the basis for the protection and recovery steps in the Business Continuity Plan.

Vital Records Register for CBF-1

Every CBF-1 sub-function depends on resident-specific information that agency or redeployed staff must be able to reach within one shift of a disruption. The table identifies those records, their primary media, where they are normally held and who is accountable for them.

Table BIA Part 6: Vital Records for CBF-1 Personal Care and 24-Hour Supervision

System names, such as the Resident Care Management System (RCMS), and some custodian titles are assumptions based on typical welfare home practice.

Replace them with JHA's actual systems and post holders once the Superintendent validates this register.

The register shows that continuity of care at JHA rests on a short list of resident-specific records, held largely in one care system and a handful of paper files. Protecting that list is one of the Home's most cost-effective resilience measures.

How Identifying Vital Records Supports Business Continuity Planning

The register turns a general intention to "protect records" into specific, testable requirements. Each sub-function's recovery time objective now has a matching information requirement.

If CBF-1.8 Medication Administration Support must resume within the next medication round, the MAR and current prescriptions must be reachable within that time, whatever has failed.

The register also feeds directly into the Business Continuity Plan in three ways:

1. Grab-and-go content. It defines what goes into the Emergency Grab-and-Go Folder: the census, evacuation register, Emergency Resident Summary, wandering risk register and hospital transfer summaries.
2. Outage procedures. It specifies the printed extracts and paper forms that staff switch to when RCMS is unavailable, and how entries are reconciled once the system returns.
3. Restoration order. It tells Jamiyah Singapore ICT which data to restore first after a cyber incident or system failure, starting with care plans, medication and census data.

Recovery point objectives also follow from the register. Records that change every shift, such as the census and handover report, need printed or exported copies refreshed at least once per shift. Records that change monthly, such as care plans, can be refreshed on review.

Regulatory Compliance and Operational Continuity

Under the Social Residential Homes Act 2025 and the MSF Code of Practice, JHA must keep accurate resident records and manage and report incidents properly. Those obligations do not pause during an emergency.

Disruptions often occur when they matter most: a fall during evacuation, an absconding during a power failure, or a cluster of infections during an outbreak must each be documented and, where required, reported to MSF or MOH.

The Personal Data Protection Act 2012 adds a further duty. Resident and staff data must remain protected even when printed, carried off-site, or shared with a receiving facility. Vital records arrangements therefore need controls such as sealed folders, sign-out logs and secure return or destruction once normal operations resume.

For the Board, the register provides evidence, under the Code of Governance for Charities and IPCs (2023), that information risk is understood and managed. It also gives MSF and MOH reviewers a clear view of how the Home would continue to meet its duties of care in a crisis.

How Records Management Contributes to Successful Recovery

Recovery is only as good as the information it starts from. Well-managed records are complete, current and correctly identified to the right resident, so staff can rely on them without delay.

Poorly managed records slow recovery because staff must stop to verify, reconcile or rebuild information while caring for residents.

Good records practice also speeds the return to normal operations and makes it safer. Staff must enter paper notes made during an outage into RCMS, sign them, and reconcile them against the MAR and incident register.

Clear version control, dated entries and a defined reconciliation step prevent duplicate, missing or conflicting entries that otherwise surface in later audits and investigations.

Assigning Custodians and Maintaining Secure Storage

Every vital record needs a named custodian, because records without owners are rarely protected. The custodian is accountable for three things:

• keeping the record accurate and current;
• ensuring a protected copy exists in a second location or medium; and
• making sure the right people can reach it during a disruption.

Custodianship must be clear across the JHA-Jamiyah Singapore boundary. The Nursing Manager owns the content of care records, while Jamiyah Singapore ICT is responsible for the system, its backups and its restoration.

Where contractors hold vital records, as the pharmacy provider and security contractor do, contracts should require access to those records during an emergency and set out how quickly they will be provided.

Storage choices should match the risk to each medium. Store paper vital records in locked, fire-resistant cabinets, away from kitchens, plant rooms, and flood-prone ground-floor areas, with scanned copies in RCMS.

Electronic vital records need tested backups stored separately from the live system, ransomware protection, and a printed contingency for the most time-critical data. Store grab-and-go material where it can be reached during an evacuation, such as the guardhouse, and check it on a fixed schedule.

Strengthening Resilience and Long-Term Information Governance

Vital records management is not a one-off exercise. Residents are admitted and discharged, care needs change, and systems and suppliers are replaced.

Review the register at least annually as part of the BIA cycle, and whenever JHA adopts a new system, changes a key contractor, or experiences a significant incident.

Its value should also be proven through exercises. A simulated RCMS outage, a night-time evacuation drill using only the Grab-and-Go Folder, or a test restoration of care plan data will show whether the records can actually be reached and used under pressure. Each exercise should produce findings that update this register and the Business Continuity Plan.

Over time, this discipline strengthens JHA's wider information governance. It encourages consistent record creation, clear ownership, sensible retention and secure handling across the Home.

Most importantly, it ensures that if the building, systems, or usual staff are lost, the knowledge needed to care for each resident safely remains.

 

eBook 3: Starting Your BCM Implementation
MBCO	P&S	RAR T1	RAR T2	RAR T3	BCS T1	CBF
CBF-1 Strategic Procurement and Sourcing
DP	BIAQ P1	BIAQ P2	BIAQ P3	BIAQ P4	BIAQ P5	BIAQ P6
		BCS T2	BCS T3	PD

 

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the  BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].

	Please feel free to send us a note if you have any questions.