IT Services Change Management

Transcription

1 IT Services Change Management Page 1 of 9 Document Control Profile: Type of document: STANDARD OPERATING POLICY & PROCEDURE Document Number: ITS 1.09 Title: IT Services Change Management Division/Department: Information Technology Services Date of Original Issue: 23 July 2009 Date/Number of Revision and Approval: 2 October Effective Date: 2 October 2017 Next Review Date: 2 October 2020 Related Policy(s) & Form(s): HAP 1.23 Change Request for HIS System HAP 1.36 IT Service Request Support Standards: - Type of Standard/Chapter/Elements: ITIL Version 3 ITIL Service Transition Related Committee: Originated By/Name/Position: Nil Reviewed By/Name/Position: Approved By/Name/Position: (Mr. Krisanapong Eiumtrakul) Security Analyst (Mr. Paul Clarke) Division Director (Mr. Topong Sukhumsawad) Hospital Chief Information Officer

2 Page 2 of 9 Document History Version Revision and Effective Date Reason for change Approval Date 3 14 May May 2014 Amended ITS-related change in purpose. Amended details in Change Request topic. Added Type of Change, Change Advisory Board (CAB), Change Announcement, Change Completion, Change Management Standard Timeframe and added Quality Records. 4 1 September September 2014 Amended ITS Device Service in Change Request topic. 5 5 August August 2015 Amended the scope. Added the descriptions details. Added more examples for major change. Added and amended change and request submission, change approval, communication of change, change implementation, and change completion. Added a HAP 1.36 IT Service Request and added Appendix 1 Announcement Template December December 2016 Added The content of a change request must not be modified after it has been approved. If information needs to be added to or modified in a change request then it must be reapproved in Change approval. 7 5 May May 2017 Added Principal level to be part of approver. Added more detail of Change Record. Added change to Appendix 1 Announcement Template.

3 Page 3 of October October 2017 Added Major change detail in change implementation section.

4 Page 4 of 9 Table of Content Page 1. Purpose Scope Definition Description Reference Quality Record Appendices... 9

5 Page 5 of 9 PURPOSE 1. To define Bumrungrad standard practice governing all ITS-related Change Management process. 2. To ensure standardized methods and procedures are used for efficient and prompt handling of all changes in a controlled manner, in order to minimize the impact of change-related incidents upon service quality and maintain a repository of knowledge about the current configuration and status of the information systems environment. SCOPE All changes encompassing additions, modifications and deletions to any IT system in a production, test or development environment. DEFINITIONS Change Owner is the person who submits the change request and is typically an ITS Manager/ Department Manager or their designee. Change Advisory Board (CAB) assists in the assessment, prioritization, authorization, scheduling of all planned major changes. The CAB consists of the Change Owner and at least two representatives from ITS management: one Associate Division Director or above and one Department Manager or Principal level or above. Other staff and vendor personnel may be invited to join the CAB meeting to present and give an opinion for their responsible area. Emergency Change Advisory Board assesses and approves unplanned critical priority major changes. The Emergency CAB must consist of at least 2 members including 1 Department Manager or Principal level or higher. Business Hours are 8:00AM to 5:30PM Monday to Friday except public holidays. DESCRIPTION All changes to IT systems must follow the Change Management process to ensure these changes are managed in a controlled way.

6 Page 6 of 9 Types of Changes Change Management requires uniform processes regardless of who initiates the change. Types of changes classified by urgency and expected impact are as follows: Change Type Major Description Change that has a direct impact on user operations affecting more than one department/workgroup; or any change that could affect patient safety, even if it is only one patient, in any possible way; or adding a new IT business service or decommissioning an existing IT business service. Examples: Minor Standard Emergency A change to the font size of the OPD pharmacy labels (Patient Safety) Implement a new Lab analyzer interface Maintenance core switches, HIS Enterprise software major version upgrade / service pack upgrade Deploy patch to business-critical server that requires a reboot Deploy patch to PC; need user to leave PC on, aware of reboot Any other change that requires downtime or service disruption of a business-critical system or could affect patient safety Adding a new IT business service for an enterprise alarm and alerting system Minor Change is for medium or low impact changes that do not fall under the criteria of a Major Change or Standard Change. A pre-approved change that is low risk/impact, relatively common and follows the established procedure or work instruction (Refer to HAP 1.36). For example, password reset or provision of standard services to a new employee. A Service Request is used to log, track and implement a Standard Change. Emergency Change is used for urgent major changes that need to be implemented as soon as possible, such as a change to resolve a major incident or prevent the imminent

7 Page 7 of 9 loss of business-critical system availability; therefore, the change cannot follow the normal change management process. They should be approved by the Emergency Change Advisory Board and require a mandatory post-implementation review. 1. Change request submission: a. Every change request must be submitted by the Change Owner through the change management system. b. The change request must be documented including: i. Title: One sentence description of the change. ii. Description: Detailed description of the change. iii. Reason: Description of the problem that the change will solve. iv. Complete list of Configuration Items (IT business services, environments, builds, servers, desktop PCs and user accounts) that will be changed or impacted by the change. v. Planning: 1. Scheduled start date/time and end date/time. 2. Implementation plan: All steps to implement the change as well as the expected outage duration. The CAB meeting date/time and meeting participants must be recorded in this section. 3. Risk assessment plan: All risk assessment questions for a major change must be answered and documented in the change request ticket. 4. Test plan: The pre-implementation test plan and results and the post implementation testing and verification plan. 5. Back out plan: All steps that will need to be followed if the change needs to be rolled back. 6. Announcement message to affected users. 2. Change Approval: a. Major Change: Requires Change Advisory Board meeting (CAB) to review and approve the change at least 1 business day before the change is implemented. b. Minor Change: Requires approval by Department Manager or Principal level or above. c. Standard Change: Is pre-approved. Refer to HAP 1.36 IT Service Request. d. Emergency Change: Requires Emergency Change Advisory Board approval.

8 Page 8 of 9 The content of a change request must not be modified after it has been approved. If information needs to be added to or modified in a change request then it must be reapproved. 3. Communication of Change: a. Major Change: i. A draft announcement message in both Thai and English language will be written using the approved template. Refer to Appendix 1. ii. The draft announcement message will be attached to the change request ticket before the CAB meeting. iii. The announcement message will be approved during the CAB meeting. iv. The announcement message will be sent to the affected users: 1. By from itservicedesk@bumrungrad.com. 2. During business hours at least 1 business day before the change is planned to take effect. b. Minor Change and Standard Change: Only requires an announcement if there will be a direct impact to the affected users. c. Emergency Change: Requires an emergency announcement by to the affected users informing about the change. 4. Change implementation: a. Major Change: Will be implemented Monday-Thursday (but never immediately before a public holiday) during the approved maintenance window of the service that is being changed. b. Minor Change: Will be implemented during Business Hours. Exceptionally may be scheduled after Business Hours based on impact assessment, but only ever after proper authorization. c. Standard Change: Can be implemented at any time after approval. d. Emergency Change: Can be implemented at any time after approval by the Emergency CAB. For all change types, the approved implementation steps must be followed and all results documented in the Change Management System. 5. Change completion: After the change is implemented the implementer (assigned to person) or Change Owner will:

9 Page 9 of 9 a. record the result of the change in the change request ticket including the actual outage time and duration b. update in SCSM the configuration items (IT business services, environments, builds, servers, desktop PCs or user accounts) that have been changed or impacted by the change. c. close the change request ticket. If the change implementation fails, then the Change Owner will submit a new request for approval and rescheduling of the change. REFERENCES Nil QUALITY RECORDS No Records Name Location Filing Method Retention Period 1 Change Record (CR) System Center Service Electronic No less than 7 years Manager (SCSM) APPENDICES Appendix 1 Announcement Template