When disaster strikes: Risk management and business continuity

Hospitals confront extraordinary challenges in the aftermath of a natural disaster. Not only are patients and staff threatened by the event, but new patient volumes typically swell during a catastrophe. Aside from hurricanes, tornadoes and earthquakes, man-made disasters like a terrorist attack or hacking incidents can also shut down hospital operations, temporarily or entirely.
These risks seem to have enlarged in recent years. Consequently, many hospitals have upgraded their business continuity planning. Such is the case at Susquehanna Health, a four-hospital integrated health system based in Williamsport, Pa. In upgrading its emergency preparedness plans, the health system took an enterprise risk management approach to disaster planning. “We evaluated the threat on a risk by risk basis,” explained Charles Santangelo, Susquehanna Health’s chief financial officer.

Risk analysis in action
Susquehanna Health began by identifying what were considered to be the key risks to its operations, equipment, staff, patients and technology systems. “Then we assessed and prioritized these risks for resource allocation purposes, based on an enterprise risk management formula developed by Kaiser Permanente that we altered a bit to stress the likelihood of the event occurring,” said James W. Slotterback, Susquehanna Health emergency preparedness coordinator. “For each risk, we plug in a number from zero to three to describe the potential risk likelihood and severity.”
As the lead person on the health system’s multi-functional emergency response planning group, Slotterback is the de facto head of the four hospitals’ 24/7 incidence response efforts.  These measures include regular drills in which a particular type of disaster is imagined as the real thing. Slotterback defines a disaster as “anything that taxes our resources or affects our ability to deliver uninterrupted services.” This could be a bus accident involving 30 injured people or it could be a hurricane.
“We have pre-defined plans and a reporting structure already in place that address different types of disasters, and have designated proper procedures that are kicked into gear on the fly during the drill,” he said.

[See also: Reforecast: Can clinical analytics generate financial returns?.]
So far, Susquehanna Health has evaded a major disaster, but events around the country and the world nonetheless have persuaded a more penetrating analysis of its business continuity plans. Following several shootings at schools, public buildings and corporate worksites, the company conducted an active shooting drill with the local police and fire departments. “Even though a study by Johns Hopkins in 2012 indicates that hospital shootings are extremely rare, less than the chance of getting struck by lightning, we wanted to upgrade our response just in case,” CFO Santangelo said.
More alarming is the possibility of a bombing along the lines of that which occurred at the 2013 Boston Marathon. The city of Williamsport, a 45-minute drive from two of Susquehanna Health’s four hospitals, hosts the annual Little League World Series. Over a three-week period, more than 30,000 people from outside the region flock to this city of about 120,000 individuals to participate and watch the games. The threat of a major disaster involving the event popped up on the system’s enterprise risk management matrix.
Like many healthcare institutions, Susquehanna Health’s emergency preparedness plans are governed by regulations mandated by OSHA (Occupational Safety and Health Administration), the US Department of Health and FEMA (Federal Emergency Management Agency). To receive federal subsidies set aside for national emergency preparedness, the health system undertakes a hazard vulnerability analysis identifying key threats to its operations, property and patients. This process reveals areas needing resources for continuous improvement or potential risks that require greater evaluation— such as the situation with the Little League World Series.

[See also: Reforecast: Organizational culture key to successful hospital mergers.]
“We conduct the analysis with our external partners at FEMA and the Health Department, as well as with local fire, police and other agencies,” Slotterback said. “Together we look at what could possibly happen in our area, especially the biggest threats, and then we reflect these possibilities in our continuity planning.”
Leveraging a federal grant administered by the Pennsylvania State Department of Health, Susquehanna Health is conducting an emergency preparedness drill focused on the risks associated with the Little League World Series. They are partnering with organizations like FEMA, the state’s health department and the FBO, among others. “We are using the exact patient mix that had occurred in the Boston bombing, and will conduct a full-scale exercise with actual live people this June,” Slotterback said. “Our biggest concern is that unlike Boston, which had eight trauma centers within three miles of the bomb site, our closest hospital is 45 minutes by ground transport outside Williamsport.”
He believes such drills will become more important to all healthcare institutions in future. “A large scale disaster guarantees a huge number of patients,” Slotterback says. “Our goal is to have plans in place to react to this possibility, hoping, of course, that we never have to.”
This is the first article in a two-part series.