INTEGRATING INTERNAL PREPARATIONS

Although integrated planning requires involvement of the external community in your facility plans, healthcare facilities must first be internally integrated. Without a seamless team response, the facility will be unable to assist the outside community.

Response requirements are not always predictable and smooth. Disasters may damage the physical structure of a healthcare facility, as has happened in previous earthquake and flooding events, and the damage must be addressed while staff are responding to the external community disaster (O’Toole, Mair, and Inglesby 2002). In addition, the healthcare facility may be compromised because of failures to the infrastructure, such as the loss of electrical power, water systems, and communication lines. A thorough internal disaster plan should address contingency “work arounds” for all possible damage to the facility.

Communications

Adequate disaster response requires instant and multifaceted communications networks that are reliable and flexible. However, a mere forecast of a disaster can overwhelm vital communication services, and in most disasters, the communication lines are the first to overload or fail. Redundant phone systems, broadcast fax capability, and the ability to increase the number of dedicated wireless phones within the healthcare system should rank high on the facility’s communication to-do list.

A hospital’s first alert or notification of an event may be via public television or radio broadcasts, requiring that hospitals mobilize for an event of which they have little knowledge. As with any community, warnings provide critical information that empowers people at risk to take action to save lives, reduce losses, and speed recovery. The extra time from an early warning allows improved preparedness and activation of services. Unfortunately, our national warning system—the Emergency Alert System—does not reach all people at risk, and the warning capability for many natural disasters is inadequate or may go unheeded.

Testing Capabilities

The U.S. GAO (2003a) reports that less than half of the hospitals surveyed for bioterrorism preparedness in early 2003 had conducted drills or exercises simulating a bioterrorism incident. Although staff training in biological agents was widespread, hospital participation in drills was less common.

The drills, training, and exercises that test plans and abilities and spearhead organizational improvement are among the most important aspects of disaster preparedness. The primary benefit of exercises is to reveal areas needing improvement. When disasters are not threatening, drills and exercises allow participants to make corrective actions to ensure all systems are ready when needed.

Mental Health Preparedness

For every one physical casualty caused by a terrorism incident, there are an estimated 4 to 20 psychological victims (Warwick 2002). In the aftermath of the 9/11 attacks, the psychiatric department at St. Vincent’s Catholic Medical Center—just one of the many healthcare facilities in the affected New York area—provided counseling and support to more than 7,000 people and received more than 10,000 calls to their help line during the first two weeks following the disaster (Rosuck 2002).

Hospitals and healthcare services should make provisions for accommodating and managing the substantial acute mental health needs of the community when a natural disaster or terrorist event occurs (JCAHO 2003). Psychological casualties often include those who are treating the physically affected—healthcare providers. For this reason, departments such as nursing, human resources, and social work as well as the chaplaincy, organizational development, and mission staff should be included in mental health planning sessions. Specifically, your organization plan should address the provision of nutritional, housing, spiritual, psychological, and other psychosocial needs and integrate these with the community plan. A triage system for behavioral health must consider the following people:

• Survivors, those who lost a loved one, rescue workers, and people who witnessed the events

• Those who lost a home, business, or job as a result of the event

• Anyone else who was deeply affected

Benchmarking Organization Preparedness

Healthcare facilities can internally assess and broadly “eyeball” levels of preparedness based on assessment data, plans, human resources information, equipment, training, and performance during exercises and actual incidents. Self-assessments, exercises, and procedures for comparison with other facilities are important tools (IAEM 2003). To get accurate data, however, readiness must be evaluated by objective parties against prospectively established standards. A thorough assessment includes evidence of readiness maintained over time.

Readiness is not defined by the creation of a plan or by its periodic testing. To improve preparedness efforts, actions must be documented and efforts made to learn from mistakes and strengthen weaknesses. The current lack of standardized methodologies to compare the events of one facility to those of another, to compare activities among different types of disaster events, or to compare those taking place in different locations hampers the best assessment efforts.

Yet despite the lack of a standardized assessment tool, much is still to be learned from the experiences of hospitals that have implemented emergency management plans in real-world situations.

Automated Tools for Assistance

A plethora of new tools and models is emerging to assist communities in preparing their healthcare sector for response. Two such tools are listed below.

The National Guard Bureau’s Automated Exercise and Assessment System, a free software program, is easily deployed on personal computers and can be used to test community readiness for incidents involving weapons of mass destruction. Communities receive immediate feedback on command decisions, observe the consequences of those decisions, and receive response assessments on multiple levels. Using their actual resources, a participating community can survey and enter those resources into the software’s database and for the next 12 to 14 hours work through one of 11 different scenarios with up to 41 different roles for participants.

Sidebar 1.1. The Utstein Template: A Research Solution

The ability to measure readiness and improvement in preparedness efforts or response has been stifled from a lack of a universally accepted, organized methodology for standardized, objective evaluations of the interventions applied in dealing with disasters. Without these, the conversion of data into important information that promotes the prevention of future events or mitigation of the effects, should they occur, will not be forthcoming—making it impossible to learn from our experiences.

The Utstein Template and Guidelines is a research methodology designed by the Task Force on Quality Control of Disaster Management, the World Association of Disaster and Emergency Medicine (WADEM), and the Nordic Society for Disaster Medicine (TFQCDM/WADEM 2003). Edited for publication by Drs. K.O.Sundnes and M.L.Birnbaum, this work is supported by six collaborating organizations, including the World Health Organization and the United Nations Department of Humanitarian Affairs. The template introduces a structural framework for investigating the medical and public health aspects of disasters, ensuring appropriate design, conduct, and reporting for evaluation and research.

“This structural framework includes (1) a standardized, universal set of definitions; (2) a conceptual model for disasters; (3) indicators and standards; (4) descriptions of 14 basic societal functions bound together by a coordination and control function; and (5) a disaster response template and two research templates. The templates are to be used in the design, conduct, analysis, and reporting of research and/or evaluations of interventions directed at preventing hazards from becoming a disaster-producing event, mitigating the effects of such an event on the affected society, and/or responses to a disaster.”

The Weill/Cornell Mass Prophylaxis/Vaccination Campaign Staffing Model, created in 2003 by Hupert and Cuomo of the Department of Public Health at Weill Medical College of Cornell University, is described as an interactive planning tool designed to “estimate the number and type of staff required to operate [mass prophylaxis] clinics” to provide a community with critical medical supplies in an efficient and timely fashion. The model will provide as output the number of sites and types of staff required to complete an inoculation campaign in a selected time frame. It allows planners to formulate realistic mass prophylaxis contingency plans for their target populations. Healthcare organizations can access this tool at www.ahrq.gov/research/biomodel.htm (Hupert and Cuomo 2003).

Sidebar 1.2. Case Examples: Hospital and Healthcare Lessons Learned

We benefit from real events. By examining the experiences of other healthcare organizations and the actions taken, valuable lessons are learned. The following reports summarize some of the lessons learned from healthcare facilities in recent disasters.

Hurricanes Dennis and Floyd, Eastern Seaboard, summer 1999. Pitt County Memorial Hospital (North Carolina) was completely isolated, lost electrical power intermittently, lacked water, and experienced failure of the pressurized water system. It established an external connection to its water supply, and tankers from 18 fire departments provided water. An on-site well provided an alternate water source. Having adequate fuel filters on hand to keep rental generators going and an extra fuel oil truck were important (Carpenter 2001).

Northridge earthquake, Los Angeles, January 1994. Granada Hills Community Hospital flooded when a 2,500-gallon reserve water tank ruptured on the roof. Departing from its disaster plan, the facility was required to take a spontaneous approach to quickly evacuate and salvage equipment and supplies. “Have some very basic task assignments drawn up so that when you do have community volunteers, you don’t turn them away,” said Richard Colon, director of environmental services and food services at Granada Hills. “It frees up your staff to do other things” (Carpenter 2001).

Murrah Federal Building bombing; Oklahoma City, Oklahoma; April 1995. A huge influx of victims, overeager volunteers, and the media created problems for local hospitals. The local hospital representatives interviewed for the article warn others to “be watchful of the media—they arrived inside ambulances or in cars carrying patients. One crew purchased lab coats and stethoscopes and snuck in to film interviews” (Carpenter 2001). This infiltration of the media led to a total facility lockdown. Based on experiences at the Murrah Federal Building, a preauthorized visitors list is recommended, and it is suggested that media and volunteers be escorted to their designated areas and kept there (Carpenter 2001). A citywide medical disaster plan with standardized communications and terminology should be fully integrated and include every emergency medical service agency, emergency department, hospital, pharmacy, and supplier. After the Oklahoma City bombing, unsolicited donations came by the truckloads, including medical supplies. The Oklahoma Hospital Association estimated that wasted medical supplies totaled more than $1.5 million. It is thus recommended that such offerings be anticipated and planned for (O’Toole, Mair, and Inglesby 2002).

Ice storm, Maine, January 1998. Inches of ice placed the VA Medical Center (Togus) on emergency generators for 90 hours. Barrels of oil were shuttled in, and emergency generators were trucked in and rotated among outbuildings. Electricity needs were paramount, and with only one electrical outlet per room and in key spots throughout the facility, those needs were not met. The lesson is to prepare for long, sustained power outages that can force the organization into an entirely new routine (Carpenter 2001). Powerless for four weeks, the staff of St. Mary’s Regional Medical Center (Lewiston) used empty hallways to house the elderly with medical needs, home care patients, and those on oxygen tanks or dialysis. Staff also provided care at shelters. The Maine Hospital Association created a storm clearinghouse to heip members deal with personnel, supply, and equipment shortages (Weinstock 1998).

Taking care of little details ahead of time pays off. Jeannie Cross, assistant vice president of the Healthcare Association of New York State, recommends stocking up on D-cell batteries for flashlights and making sure the hospital association has cell-phone numbers of its members. “A regular phone number [landline system] does no good if the phone lines are down,” stated Cross.

Red River flooding; Grand Forks, North Dakota; April 1997. Staff ripped up the parking lot at Altru Health System, dug up the dirt, and piled it up to keep the water out as long as possible. Staff shared that “laying the groundwork for evacuation, thinking innovatively and remembering to keep in contact with the city emergency operations center and other agencies might be all a hospital facility manager could do to prepare for such a huge disaster” (Carpenter 2001).

Midair collision; Zion, Illinois; February 2001. A plane crash into the roof of a five-story cancer treatment facility forced the evacuation of 54 patients. “I don’t think anybody across the country knows that the fire department takes over your building in case of disaster,” stated Michael White, vice president in charge of the facilities and security departments, “you’re somewhat at their mercy.” Local fire officials set up command posts to guard against a fire outbreak and to control access (Carpenter 2001).

Wildfires; Flagler County, Florida; summer 1998. Four huge fires forced evacuation of all 43,000 residents of Flagler County, including Florida’s Memorial Hospital, which evacuated patients to two other facilities in its system. Hospital officials reported that “In a crisis, there’s no such thing as being over prepared.

Ambulances from all over the state responded.” Two lessons were learned from this experience: (1) cell and regular phone lines jam quickly and (2) employees are willing to work, even without knowing the status of their family members or houses (Gibson 1998).

Massive flooding; Houston, Texas; June 2001. Flooding from Tropical Storm Allison knocked out emergency power, water, and telecommunications to portions of the Texas Medical Center campus. All Texas Medical Center hospitals experienced flooding and reduction in services to varying degrees, with Memorial Hermann Hospital and Memorial Hermann Children’s Hospital forced to evacuate 540 patients over a 36-hour period. When patients are transferred, the sending hospital is responsible for providing staff for their care. Nearly 4,000 employees were deployed by bus to help care for patients (Carpenter 2001).

Auditing for the Masses

In summary terms, risk management identifies, prioritizes, and safeguards critical assets, while policies, procedures, and standards address employee conduct. Auditing is the process of assessing whether employees and business operations are in compliance with the organization's policies and procedures as well as applicable laws and regulations. Auditing is the investigation and measurement of employee behavior and business operations based on collected evidence. Counted together, risk management, policies and procedures, and auditing form the first three integrated steps in proactively addressing critical incident management.

Auditing is the compliance extension of your risk management program where operations, policies, and procedures are examined to determine whether operations are lawful, effective, efficient, and profitable. Auditing will determine that the organization's critical assets are accounted for, prioritized with adequate safeguards, and whether recovery and restoration procedures are implemented and tested. Fundamentally, auditing is also a comparison and analytical process comprised of collecting and evaluating evidence regarding management assertions and the actual state of the organization's operations. In fact, the most-critical part of auditing is the degree of separation between an organization's assertions and established system-addressed risk criteria. Any differences between assertions and the actual-state falls into a category called the "gap."

Information technology auditing is a carefully planned and executed business process involving the collection and evaluation of evidence to ascertain if a computer system safeguards critical assets and facilitates organizational goals being achieved.

Auditor Responsibilities
In the sense of their function, auditors must not have any direct responsibility or authority over any of the activities that they examine or could examine in the future. Operational assessments and employee performance appraisals do not, in any way, relieve employees of their professional responsibilities. Auditors must be authorized to have full and unrestricted access to relevant equipment and information including computer files, documents, records, property and employees. They must have a high degree of freedom in all audit-applicable business areas with the exception of specific restrictions imposed by law.

Internal Controls
Managing critical assets, their safeguards, controlling potential frauds and improving effectiveness and efficiency can best be achieved if senior managers establish a structure of internal controls. There really is not a great deal of universal details in this area as all organizations are different in their mission and function. Let's define internal controls here in the context of formal systems that prevent, detect, and correct policy violations, unlawful and abusive events. These are the three most important levels of general controls: prevention, detection, and correction.

General Controls
General controls are those internal controls having wide application to most areas of business operations. For the most part, they include but are not limited to specific system applications:

Planning and organization controls

Physical and logical access controls

Human resources

Risk management

Communications controls

System development controls

Specific Controls
In broad terms these are controls with application to specific applications:

Access controls

Data input controls (these include all system data inputs)

Processing controls

Output controls

The overarching governing structure for specific and general controls is that of CIA, confidentiality, integrity, and availability. In current auditing views, there are many components where internal controls apply for example, separation of duties and least privilege, clear lines of authority and responsibility, adequate documentation, access control, management supervision, individual accountability, performance checks, and audit trails to name a few.

Separation of Duties and Least Privilege
Separation of duties basically means that separate employees should be responsible for initiating transactions, processing transactions, recording those transactions, and maintaining custody of critical assets. Least privilege means that employees have the knowledge and authority to perform their jobs and nothing more. For example, in a small organization an accounts payable clerk has the responsibility of preparing billing payments. She reviews the billing for its correctness and prepares wire transfer documents. By observing the concepts of separation of duties and least privilege, she does not have the authority or the ability to release funds. So, she prepares a voucher with the attached billing documentation and submits these materials to the finance vice-president who authorizes the transfer of funds. In the event the payment amounts are over $10,000, the organization's policies and procedures mandate that two vice-presidents approve the electronic wire transfer. Once the payment is approved, the transaction information flows to another employee that is responsible for posting the transaction to the organization's financial records.

Authority and Responsibility
Clear and well-defined lines of authority and responsibility are essential in controlling systems. In today's business environment, the distinctions between authority and responsibility may not be clear. It is frequently difficult as many resources are shared among many users. For example, database use is common among many users in a business organization. When several authorized users have simultaneous access and, through some unknown means, the data becomes corrupted, it is not always easy to fix responsibility.

Documentation
Documents and records are essential in providing an audit trail of activities within any system. Electronic and paper-based documents are used to support the initiation, execution, payment, and recording of transactions. Documentation is intended to provide an accurate record of events and acts. Documents should provide a tangible record in which events can be reconstructed from their content. In a well-designed system, audit trails document the actions and events occurring during business operations as well as those documents required to administratively run the business.

Performance Checks and Accountability
Checks of performance and accountability are done by auditors because employees are likely to forget policies and procedures, make genuine mistakes, become careless and negligent, or intentionally fail to follow procedures. Individual employee accountability is tied to performance and competence as well as continuing responsibility.