The first task associated with mitigation efforts is the identification of potential emergency events that can reasonably be expected to occur within a given community or hospital facility. All-hazards planning begins with the creation of a comprehensive list of all possible disasters. Potential hazards may be grouped into three categories: natural events, technological failures, and human threats. Natural hazards are defined by the location of the community. Examples include hurricanes, tornadoes, severe thunderstorms, earthquakes, tidal waves, temperature extremes, drought, flood, wildfire, landslide, volcano, and seasonal or sporadic disease spread. Technological hazards are disruptions in public service and determined by the population density and socioeconomic conditions of the surrounding community. Examples include utility failure, such as water, sewer, electricity, natural gas, steam, fuel, communications, and information systems; transportation failure, such as rail, subway, airplane, shipping, and trucking; and structural disruption, such as buildings, roadways, and bridges. The age of the municipality, its rate of growth, and its geographical location help identify these hazards. Human hazards can include both intentional and unintentional acts. Examples include civil disturbances, hostage situations, bomb threats, VIP situations, hazardous materials spills, mass casualty incidents, and explosive, chemical, biological, and radiological threats.

The JCAHO requires that response plans identify “direct and indirect” effects that hazards may have on the hospital. Hazard vulnerability analysis (HVA) is the second step in mitigation efforts. Based on the probability and magnitude of hazards, resource allocations may need to address prevention activities. When assessing the probability of an event, issues to consider may include geography, weather variations, disaster patterns, demographics, migration patterns, topography, endemic and seasonal disease patterns, local businesses, national landmarks, and high-profile events. The magnitude of an event may be determined by considering the human impact, the property impact, and the business impact.

The assessment of resources for handling the event involves an estimate of the hospital’s capacity such as numbers of beds, number of respiratory ventilators, number of decontamination suits, and capability such as the service acuity level and sophistication of personnel, advanced technological resources, and advanced training. Resources can be internal, such as bed capacity, workforce capability, currency of training status, insurance, and availability of backup systems, and external, including health care facilities, private business, mutual aid, vendor supply agreements, and so on. Most HVA templates focus on “common” hazards to establish priorities for protective countermeasures. Each category of vulnerability—probability, magnitude and resources—is described in semiquantitative terms: low, moderate, high, or not applicable (7,8).

Hospitals themselves may become terrorist targets. Contemporary ethical standards dictate that institutions of health and rescue be protected against attack. Precisely because it is considered unethical to attack such a facility, they are at high risk for becoming a target of terrorism. Hospital preparedness efforts must take this grim reality into account and search for vulnerabilities. Potential interventions include target hardening (distance, physical barriers, firewalls); security visibility (signage, security patrols, surveillance cameras); controlled vehicular and pedestrian access (traffic separation, selective searches, use of passkeys, “smart” entry portals, video monitors); and employee awareness (education, training, drills).

Several hospital questionnaires exist. One example is the AHRQ-HRSA Bioterrorism Emergency Planning and Preparedness Questionnaire for Healthcare Facilities, which is currently for bioterrorism only but is likely to be expanded to include other major forms of terrorism preparedness (33). The Hospital Emergency Analysis Tool (HEAT) is used by the Navy Medicine Office of Homeland Security and documents the status of 100 critical preparedness factors (32). These tools help not only in assessing the status of a health care facility but also can provide direction to administrators and physician and nursing leaders.

The final step in mitigation involves the emergency operations plan (EOP). This document describes how the hospital intends to behave during an event, bringing hospital services and departments into one incident-focused organization. The EOP requires annual revision based on changes in the local community, newly identified vulnerabilities, and on the lessons learned from exercises and drills. Many templates for EOPs exist in health care (11,12). The EOP must take into account the requirements of regulatory and accreditation agencies, professional standards, and current best practices of emergency planning. This plan addresses four key issues: (a) life safety refers to the protection of personnel, patients, visitors, and the public from injury and life threats; (b) property protection refers to the prevention or limitation of structural damage; (c) continuity of operations refers to protection of critical hospital functions; and (d) environmental protection refers to the prevention or limitation of adverse effects on vegetation, animals, land, air, and water.

The basic EOP defines command and control, lines of communications, life safety, property protection, community outreach, recovery and restoration, and administration and logistics. Departments should be assigned roles that closely
mimic their typical operations. During a disaster event, operations may be limited to only mission-critical activities.

Based on the HVA, all high-risk events will have an hazard-specific appendix in the EOP that defines the relevant mitigation, preparedness, response, and recovery activities. Standard operating procedures delineate the major activities common to all emergency responses. These include command and control, communications, personnel, supply procurement, and mutual aid.

The incident command system (ICS) is that portion of the EOP that relates to the authority structure and control of personnel, facilities, equipment, and communications during an event. The ICS remains operational until the requirements for its operation no longer exist. It unfolds in a modular fashion and is scalable, depending on the type and size of an incident.

Five management sectors are described for ICS: Command, Operations, Planning, Logistics, and Finance. Command responsibilities are an executive function designed to develop, direct, and maintain a viable organization and to coordinate with other entities. The highest level of authority rests with the incident commander (IC), who, in turn, is supported by the public information officer, the safety officer, and the liaison officer. These individuals assist and advise the IC relative to issues concerning the media, safety, and external agencies. Policy, objectives, and priorities are set by Command. Operations identifies the doers in the organization, where the real work of incident control is accomplished. Operations carry out directions of the Command sector. The Planning sector provides past, present, and future information about the incident. Real-time incident reports are utilized to support the Command and Operations sectors. The Operations and Planning sectors work together to meet established incident objectives. The Logistics sector identifies and obtains all personnel, equipment, supplies, and services required for the incident. Operations and Planning sectors then manage these resources. Finally, the Finance sector is a staff function responsible for the financial management and accountability of the incident. Extensive resources are available to assist in preparing a hospital ICS (17,18,19).

The Hospital Emergency Incident Command System (HEICS) is a preexisting plan that can be adapted to individual hospitals. HEICS is free of charge and has been adapted by many U.S. hospitals. Many of the components are available on the Internet, and conferences exist to orient new users and assist them in adapting the system to their health care facility (19). It provides an authority structure and job descriptions designed for hospitals, incorporating many of the principles already discussed. HEICS provides for an incident commander who is supported by at least four chiefs, operating over sections: Logistics, Planning, Finance, and Operations. The program has a preformatted organizational chart and job descriptions that can be applied to an individual hospital. A glossary of terms is provided so all participants communicate with a common language.

Hospitals are key participants in the response to terrorist events and so must work seamlessly with local government officials, emergency managers, law enforcement, fire/rescue services, emergency medical services, public health officials, and other health care providers.

Interagency coordination may be seen as occurring along three simultaneous axes (15). One axis involves the sequential response that is conducted in the region where the threat occurs, from event identification, law enforcement, hazardous materials response, on-scene triage, prehospital care and transportation, hospital services, and ultimately recovery. A second axis, which is often forgotten in planning and response, involves the parallel coordination of other organizations, facilities, or providers that offer similar services as the hospital, such as other hospitals, outpatient clinics, and physician offices. The third axis involves the coordination of remote resources separated from the incident either in time or distance. Mutual aid agreements that delineate the role and responsibility for each agency will assure a consistent, coordinated, graduated response.

Response begins with event recognition. The rapidity of recognition depends on the type of weapon utilized, the event location, and the method of dispersal. Explosive and incendiary events become manifest immediately, chemical events typically unfold over minutes or hours, and biological
events will usually become evident only after an incubation period of days, weeks, or even months. Biological attacks, in particular, require regionwide surveillance, unusual event reporting, laboratory analyses, and sentinel case investigation.

The first priority in a terrorism attack is to secure the hospital physical plant and to protect personnel, current patients, and visitors. Another priority is to establish sites for victim reception and identification. Simple, rapid identification processes that facilitate ongoing and continuous patient tracking are most desirable. Use of encoded wrist bands, such as those widely used in industry (bar codes, infrared, radio frequency) are under evaluation for use in mass population settings. If victims are contaminated, decontamination and securing of valuables will be necessary.

The participants in the regional health care community should agree on a simple, unified system for patient classification and a way to standardize the initial treatment irrespective of which hospital receives the patient. The equitable and rational distribution of all patients dictates the use of all capable treatment facilities. Medical protocols consistent with current medical standards are utilized for each case. The various chapters in this book provide a solid foundation for such preparation.

Treatment logistics involve placing patients with similar levels of exposure and symptomatology in the appropriate treatment setting. Predesignated locations within or near the hospital may be utilized if bed capacity is limited or absent. Military models for alternative health care facilities may provide ideas for the civilian medical community (20). The accessibility of regional and federal resources for additional hospital bed capacity should be determined early in the event. Community assets, such as sports arenas, school gymnasiums, hotels, or places of religious worship, may serve as holding or observation areas. Such facilities are especially appropriate for those who require minimal care. The public should be informed of the purpose of these treatment sites and where to find them. All treatment sites must provide a safe environment as well as privacy and hygiene. Self-care within individuals’ private dwellings, such as homes, apartments, and hotels, is sometimes an option.

Health care facilities must possess a decontamination area, supplies, and adequately trained personnel (Chapter 29). The location of the decontamination unit may be internal or external to the hospital; however, it should be readily available and not disrupt routine operations. Internal decontamination facilities have the advantage of providing protection from inclement weather. Disadvantages include the risk of allowing contaminated patients to enter the hospital, the need for specialized vapor and ventilating systems, and a limitation in the numbers of patients it may accommodate. External decontamination facilities prevent contaminated patients from entering the hospital and allow for large patient volumes. Disadvantages include difficulty in controlling weather extremes and lighting conditions and inherent delay in setup.

The management of decontamination effluent is a difficult issue because most hospitals do not possess the ability to store contaminated wastewater. Although the discharge of contaminated water into sewer systems is technically in violation of the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA), there are indications that the inspector general of the Environmental Protection Agency (EPA) may not pursue legal action against response agencies that violate this act during disaster response.

The EPA and Occupational Safety and Health Administration (OSHA) both have regulations that help protect personnel dealing with hazardous substances and emergency response operations. Hospital planners are encouraged to review pertinent EPA, OSHA, and JCAHO requirements. Recent documents and articles in the medical literature discuss pertinent regulations, training requirements, and team selection, as well as decontamination equipment and evidence collection (21,22,23).

Disasters have the potential to produce catastrophic numbers of fatalities (24). Management of mass fatalities is discussed in greater detail in Chapter 43. If the incident involves criminal intent and victim contamination, this poses additional layers of complexity for pathologists, medical examiners, coroners, and morgue personnel. Effective planning and response must address these key issues:

Epidemiology identifies, defines, and tracks an incident. Surveillance is discussed in greater detail in Chapter 30.