SPECIAL REPORT

Planning for Resilience in Hospital Internal

Disaster

Ernest Sternberg

University at Buffalo, The State University of
New York, Buffalo, New York USA
Correspondence:
Ernest Sternberg, Professor
Department of Urban and Regional
Planning
Hayes Hall
University at Buffalo, The State University
of New York
Buffalo, NY 14214 USA
E-mail: ezs@buffalo.edu
Supported by a grant from the Earthquake
Education Research Centers Program of
the National Science Foundation to the
Multidisciplinary Center for Earthquake
Engineering Research (Grant EEC-
9701471).
Keywords: contingencies; crisis; disas-
ter; event; hazards; hospital; incident
command system; internal disaster;
planning; preparedness; resilience;
resource management; risk; strategies;
uncertainties; versatility
Abstract
This article seeks to clarify the terminology and methods of planning to
avert hospital internal disaster. It differentiates "crisis" from "disaster" in the
in-hospital setting. Preparedness, as contrasted with mitigation, is meant to
reduce the likelihood that a crisis will turn into a disaster. Though there are
some recurring features of crises, allowing for preparedness through the
identification of a few high-likelihood contingencies, crises are subject to
numerous, overwhelming uncertainties. These include hazard uncertainty,
incident uncertainty, sequential uncertainty, informational uncertainty, con-
sequential uncertainty, cascade uncertainty, organizational uncertainty, and
background uncertainty. In view of the uncertainties, the primary aim of
planners should not be to try to create plans for ever more contingencies,
since contingencies are far too numerous and perhaps approach infinity, but
rather to create capabilities (through proper preparedness) for resilience dur-
ing crisis. Resilience can be cultivated through improvements in information
acquisition and dissemination, communication systems, resource manage-
ment, mobility management, design for resilience, incident command, and
staff versatility.
Sternberg E: Planning for resilience in hospital internal disaster. Prehosp
Disast Med 2003;18(4):291-300.

Abbreviations:
ICS = incident command system
US = United States of America
Received: 26 June 2003
Accepted: 30 June 2003
Revisions received: 13 October 2003
Web publication: 11 June 2004
Introduction
For reasons of prudent stewardship,
and because of the requirements of
accreditation and licensure, hospitals
must prepare for the possibility of
disaster within the facility.
Healthcare professionals have long
been aware that they should make
preparations for external disasters
causing a surge in the number of
patients. They have been less inclined
to confront the possibility that dis-
ruption may occur within the facility
itself and undermine their ability to
provide care. Yet, these internal dis-
ruptions appear to be more common
events in hospitals than are patient
surges from external disasters.1 In
especially troubling cases, hospitals
must respond to the simultaneous
occurrence of both external disaster
and internal disruption. In recogni-
tion of the dangers, national accredi-
tation in the United States of
America (US) requires hospitals to
prepare internal disaster plans.
This article offers conceptual
clarification of hospital internal dis-
aster planning by: (1) proposing a
distinction between crisis and disas-
ter; (2) explaining the limitations of
checklists as a mode of preparedness;
(3) describing the many uncertain-
ties in our foreknowledge of crisis;
and (4) offering a series of options to
improve resilience during crisis.
Such clarification is needed
because the reliance on traditional
planning documents can have serious

October - December 2003 http://pdm.medicine.wisc.edu Prehospital and Disaster Medicine

Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
 292
shortcomings. Auf der Heide has referred to one of these
shortcomings as the "paper-plan syndrome", the belief that
disaster preparedness can be achieved simply through the
filing of a written plan.2 He strongly cautions that such
plans prove more useful in practice when they are relied
upon not as documents to be suddenly consulted in an
emergency, but as forms of training complemented with
additional forms of preparedness.
The "paper-plan syndrome" also has an additional short-
coming, on which this article elaborates. Often organized as
checklists, the documents may give the impression that dis-
aster plans can sufficiently anticipate, perhaps even predict,
the contingencies accompanying an extreme event. As this
article will argue, anticipatory planning of this kind has value
under limited conditions, but also tends to underestimate the
enormity of the possibility space. Each facility's susceptibili-
ty to any of a number of hazards, the incidental variations in
any particular event's impact on the facility, variations in
sequence of occurrences during crisis, inadequacies of real-
time knowledge, dangers of cascading failure, imponderables
of organizational and multi-organizational response, and
uncertainties of the community and environmental back-
ground to disaster—each of these are highly uncertain before
the event. Those who plan for disaster, therefore, face severe
problems of foreknowledge.
This problem of foreknowledge cannot be remedied
through longer checklists of what to do. The longer the list,
the more unmanageable it becomes. The key to better hos-
pital disaster preparedness is to recognize the uncertainties
limiting our foreknowledge, and derive a clearer framework
for building capacities for resilient decision-making from
them.
Problem of Hospital Internal Crisis
The hazards to which a hospital is susceptible include fire,
utility failure, armed intruder, and hazmat release (occur-
ring within the facility); and hurricane, earthquake, land-
slide, external fire, flood, tornado, other severe storm,
external hazmat release, and civil disturbance (originating
outside the facility, but disrupting it internally).3 For con-
ditions in which a hazardous event disrupts hospital oper-
ations, the accepted term is "internal disaster." However,
for reasons explained below, this article will adhere to a dis-
tinction not normally made between an internal disaster
and an internal crisis. Disasters are a subset of crises. The
broader category is far more common and much more like-
ly to be encountered by healthcare professionals.
The seriousness with which a hospital plans for crisis
depends, in part, on how likely its managers believe it will
face one. However, information by which a facility could
make this assessment is barely available. Taking "evacua-
tion" as an indicator of crisis, Stemberg, Lee, and Huard
inventoried published accounts of partial and full evacua-
tions from hospitals.3 They found reports of an average of
23 partial and full evacuations (evacuations are one
response to internal crisis) per year in the 1990s, but
expressed the opinion that this as a severe undercount.
Data just on fires assembled by the National Fire
Protection Association for the years 1994-1998 show an
annual average of 1,900 fires in US hospitals and "hospital-
Prehospital and Disaster Medicine
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
Planning for Resilience in Hospital Internal Disaster
type" infirmaries, though this data set includes minor fires
that do not constitute crises.4 By comparing these data to
the number of hospitals in the United States in the 1990s,
as reported by the American Hospital Association (the
number declined to the low 6,000s over that decade), one
can estimate the annual likelihoods of a hospital crisis.
It appears from these disparate sources that the annual
likelihood of at least one crisis in a hospital (assuming that
all hospitals are equally likely to face crisis and that crises
are mutually exclusive—that having one does not increase
or decrease the likelihood of having another) may lie some-
where between 0.33% and 31%. As the results differ by two
orders of magnitude, it is safe to say that hospitals do not
have reliable data by which to assess risk.
Even without reliable data, it is possible to surmise that
the hospital (as compared to other kinds of facilities) is
especially vulnerable to disruption because the mere inter-
ruption of its service can be harmful. Containing complex
combinations of utilities, surgical and diagnostic equip-
ment, and hazardous materials, along with ever-changing
visitors and patients of varied conditions of physical and
mental health, a hospital also is more susceptible than are
other kinds of facilities to hazardous events.5 The US
healthcare restructuring that has been enlarging the sizes
and complexity of hospitals may be increasing this suscep-
tibility. Sternberg, Lee, and Huard found that more than
half of evacuations in published reports were caused by
hazards originating within the facility (rather than from
external events, such as a natural disaster).3 Furthermore,
they found that where natural hazards such as earthquake
and hurricane were the causes of evacuation, problems were
further intensified because several hospitals within a region
may be disrupted simultaneously. This condition would be
especially dangerous when associated with a terrorist attack
that caused a massive number of casualties.6 Such vulnera-
bility is countered, however, by the high capacity found
among professional hospital personnel for making difficult
decisions in life-threatening emergencies.
Concerns about healthcare facilities are multiplied in
the current period as the numbers of hazards may have
increased because of the extreme weather conditions
thought to arise from global climate change, the increasing
urban concentration of population, the use of more types of
hazardous materials in industrial production, new possibil-
ities for civil unrest, and the emergence of new infectious
agents, as well as threats from radiological, chemical, and
biological weapons.7 As of the first years of the 21st centu-
ry in the US, despite the consternation about potential ter-
rorist use of weapons of mass destruction, preparedness in
healthcare facilities has been uneven.8 In view of increasing
threats, healthcare organizations must be increasingly con-
cerned about how to plan for internal crisis.
Important Distinctions
Crisis and Disaster
When smoke spreads through a corridor, blaring alarms
sound, tremors shake the building, an armed intruder threat-
ens the staff, flood waters approach the facility, medical gas
systems stop functioning, or there is a spill of a hazardous
substance, the hospital enters a period of crisis during which
http://pdm.medicine.wisc.edu Vol.18, No. 4
 Sternberg
operations are disrupted. Actions must be taken to minimize
the disruption, counter human threats, reduce danger to
occupants, move patients to safer locations, and/or take
other actions that maintain patient care. When these
actions are insufficient, or when there is not enough time
for them, the results may be casualties, property damage,
and suspension of patient care, which, in turn, may result in
casualties—the crisis then turns into a disaster.
Therefore, the internal crisis may be defined, as a sud-
den-onset event that disrupts the functioning of the facili-
ty (similar definitions appear in Aghababian et aP and
Milsten1 with respect to "internal disaster") endangering
patients, staff, and visitors, and undermining the integrity
of the facility as a steward of public safety. By contrast, an
internal disaster is a crisis that has gone out of control,
leading to multiple casualties, severe destruction, or both.
"Sudden-onset" needs to be in the definition of crisis
because it is the suddenness that imposes the need for
emergency response. Though a financial breakdown also
may undermine a facility, and informally may be referred to
as a "crisis," such events usually occur slowly enough or
with enough early warning that they can be dealt with
through normal planning horizons, so they are not crises in
the sense understood here. That said, it should be clear that
"sudden-onset" can vary from no time at all, as in an explo-
sion; to seconds, as in the time between the arrival of an
earthquake's primary waves and the more destructive sec-
ondary waves; to a few days, as in the case of a hurricane
warning or a flood of progressive severity.
This distinction between crisis and disaster, though not
usually made in the disaster planning literature, is impor-
tant. Healthcare practitioners and hospital administrators
are much more likely to face a crisis than a disaster.
Moreover, the crisis offers the critical last opportunity to
avert or ameliorate full-blown disaster. The eventual retro-
spective assessment of the event depends, in large part, on
how well the crisis was managed.
Mitigation and Preparedness
In keeping with the general literature on disaster planning,
this article holds to the distinction between "mitigation" and
"preparedness." Through the former, planners seek to avoid
crisis by reducing the intensity or likelihood of the event or
making the facility less vulnerable to it. Against earthquake,
mitigation may require the selection of building sites on soils
less susceptible to liquefaction, construction that adheres to
seismic codes, and protection of sensitive equipment from
shaking. For hazardous materials, it may include the proper
training of handlers to prevent spills and leaks, and safely
designed storage rooms and cabinets. Against attacks with
firearms or explosives, mitigating actions can include site
perimeter controls, security checkpoints, and internal sur-
veillance. Mitigation ameliorates the preconditions of disas-
trous events, making such events less likely to occur or less
destructive.
Despite best attempts, mitigation never can fully secure a
facility; crises occur. Preparedness, as understood here, seeks
to provide capabilities by which to manage crisis and prevent
it from turning into disaster. Note that both mitigation and
preparedness take place in the normal, pre-crisis period.
October - December 2003 http://pdm.medicine.wisc.edu
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
293
However, mitigation and preparedness pose rather differ-
ent problems of foreknowledge.
As a planning problem, mitigation is relatively tractable.
Upon risk assessment to estimate the relative likelihoods of
various hazards becoming a destructive event, high priori-
ty hazards can be selected for attention. Through compar-
isons of costs and relative benefits, fairly reliable choices
can be made among investments in mitigating actions. By
contrast to mitigation, preparedness is the planning and
carrying out of activities before crisis that improve the
absorbing capacity, buffering capacity, and/or response to
an event. The challenge for preparedness is that the specif-
ic conditions to be faced in crisis cannot be known reliably
ahead of time.
The Bipartite Strategy
Though most crisis events are in some part unknowable
ahead of time, they are not fully unpredictable: they also
have recurrent features that increase predictability. In
recognition of this known division in our understanding of
crisis, Auf der Heide has introduced the term "bipartite
strategy". The strategy is based on the observations that:
(1) "although each disaster is different, there are certain
patterns and problems that occur with such regularity that
they are virtually predictable;" and (2) "disasters invariably
produce unexpected challenges that call for flexibility and
that require innovation."10 This distinction corresponds to
a debate in the field of risk management between propo-
nents of "anticipation" and "resilience." Broadly expressed
(there are several variations on the arguments), proponents
of anticipation seek effective responses through evidence
about likely courses of forecasted events, while proponents
of resilience find extreme events to be so complex and
uncertain that the most effective actions occur through
real-time learning, adaptation, andflexibility.11The bipar-
tite strategy is based on observation that planners must
prepare through both anticipation and resilience.
The relatively predictable features of crisis (hence, the
applicability of the anticipatory part of the bipartite strate-
gy) stem from three sources, of which Auf der Heide
stresses the second. The first and most consistent feature of
crisis is that it poses new challenges to which staff must
respond by contacting persons (personnel designated to
have authority in varied shifts, janitors with certain keys),
acquiring specific kinds of information (as from a hazmat
information center), or obtaining emergency supplies
(flashlights, insulated gloves, etc.)—actions they do not
routinely take. It can be reliably be anticipated, therefore,
that during crisis, we will need a simple, updated, reference
manual on responsible personnel, contact numbers, and
supply locations.
Crises also reveal a second kind of relative predictability:
certain patterns of human and organizational behavior fre-
quently are found during disasters. Auf der Heide obtains his
evidence for this from the extensive record of empirical soci-
ological research on disaster. Recently, such findings have
been brought together and summarized by Tierney, Lindell,
and Perry.12 One observation from such research is that dis-
asters cut across functional and jurisdictional boundaries,
and therefore, require multi-organizational cooperation in
Prehospital and Disaster Medicine
 294
response.2 Researchers also find that those affected by dis-
aster rarely panic, frequently take personal risks to help vic-
tims, and are more likely to stay in dangerous areas than to
flee. Moreover, there is intense media interest in disasters.
Partly as a result, a phenomenon of convergence occurs
during a crisis: responders from numerous agencies, friends
and relatives of those endangered, extra staff, volunteers,
and idle onlookers all can appear on the scene, and actual-
ly hamper relief efforts.13 From such observations, planners
should be able to anticipate that multi-organizational
training, incident command, public information sharing,
and traffic control are essential in most crises.
There is a third basis on which to be able to anticipate
occurrences in a crisis. It is conditional anticipation: if we
can take it as given that an event from a certain hazard will
affect the facility, our capacity to anticipate increases—our
uncertainty is reduced. So, for example, if risk assessment
shows internal fire to be a high-priority danger, then plan-
ners should invest more focused forms of preparedness, as
in collaborative exercises with fire fighters, installation of
fire elevators, drills in evacuation and sheltering, and staff
training in use of fire extinguishers.
Though crises exhibit these three forms of predictabili-
ty, they also invariably include occurrences about which we
are highly uncertain beforehand. The capacity for resilience
is essential because our foreknowledge of these occurrences
is profoundly limited. Facilities must prepare for crisis not
just through anticipation of contingencies, but also by build-
ing resilience. However, conventional disaster planning
guidelines and actual hospital disaster planning documents
often overlook, or fail to sufficiently meet, the special chal-
lenge of resilience. This may be observed most clearly in the
phenomenon of the checklist.
Checklists and the Proliferation of Contingencies
A number of documents5'13'14 on hospital disaster pre-
paredness (both internal and external) provide extensive
checklists of what to do to prepare for various contingen-
cies. Further, disaster preparedness checklists are provided
by the Joint Commission on Accreditation of Health Care
Organizations, under accreditation standards for maintain-
ing a proper "Environment of Care".15 Indeed, hospital-
written disaster plans typically take the form of long lists.
Further, long lists may be provided as parts of disaster plans
for specific wards, whether perianesthesia,16 intensive care
nursery,17 or any other medical function.
An especially thorough and well-organized checklist
on mass-casualty disasters has been prepared for the
Association for Professionals in Infectious Control and
Epidemiology.18 It contains 25 major categories of pre-
paredness, each with 4-10 questions or sub-steps, some
further divided into as many as 20 items. For example, cat-
egory 16, "Relocation of Patients and Staff," includes
question I: "Are procedures established for the orderly dis-
position of patients to their homes, if applicable?" This
item has no further divisions, but a complete plan for such
a contingency would have to consider communication
with homes to notify relatives that patients are coming
home, transportation to homes, short-term supplies of
medication, and special arrangements for patients with no
Prehospital and Disaster Medicine
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
Planning for Resilience in Hospital Internal Disaster
home caregiver or inadequate home resources. To be thor-
ough, further attention would have to be paid to the con-
tingency that communication lines or transportation may
be disrupted. Therefore, if a hospital were to prepare thor-
oughly for this particular concatenation of contingencies, it
would need to invest significant resources and time, even
though this particular set of events only would occur under
very rare circumstances.
Consider an item recommended in earthquake-prone
areas: contracting for back-up water supplies (i.e., to be
trucked in by soft drink bottlers who would fill their bot-
tles with water) in case of water system failure. However,
preparedness for such an event must consider various sub-
contingencies: (1) Should additional arrangements be
made in case transportation to the hospital is blocked, as
from a fallen highway overpass, or if one of the bottling
plants is damaged?; (2) How would limited water be allo-
cated among hospital functions? and; (3) Should plans be
made to prioritize certain water consuming activities, such
as sterilization or infection control? Again, as any particu-
lar contingency is investigated, the possibility space grows,
and as ever more contingencies are prepared for (not just by
listing them in a document, but by investigating and exer-
cising programmatic options), so does the cost of pre-
paredness.
To be sure, checklists have straightforward value as
reminders to staff about what should be considered in disas-
ter planning. However, the lists suggest an enormous and
unwieldy possibility space. Pursued to their logical conclu-
sion, they imply an inordinate proliferation of detailed pro-
cedures covering a progressively larger range of increasingly
more specific and remote eventualities. The listings prolifer-
ate in part because of accreditation requirements that try to
spell out more and and more contingencies. The problem
may be compounded by fears of liability: mentions of a con-
tingency in a paper plan, and the filing of some procedure for
dealing with it, may be thought to give some legal protec-
tion. However, these very procedures may have an unintend-
ed and pernicious side effect. Faced with a multiplication of
rules and lists, healthcare facilities face either an enormous
administrative burden of anticipating a multitude of low-
probability contingencies (of which only one or two present-
ly unknown contingencies actually will be faced in a decade)
or resort to perfunctory, bureaucratic conformity. It is such
perfunctory planning that leads to the paper-plan syndrome.
The external pressures for bureaucratizing disaster plan-
ning require an institutional solution are beyond the scope of
this paper. But misdirected planning also can be ameliorated
through education: through a fuller understanding of the
bipartite distinction between anticipatory preparedness for
what is likely and resilient preparedness for complexes of
uncertain possibilities. The burden of the rest of this article
is to build a fuller understanding of the sources of crisis
uncertainty and resilient means of preparing for them.
Varieties of Uncertainty
The crisis is perceived as crisis in large part because it vio-
lates day-to-day expectations of a secure environment for
human affairs. By its very definition, crisis is characterized
by threatening uncertainties. The fields of risk analysis and
http://pdm.medicine.wisc.edu Vol.18, No. 4
 Sternberg
artificial intelligence have developed extensive taxonomies
of uncertainty, but these are quite generic; they discuss, for
example, the uncertainties in measurement and computa-
tion that accompany all intelligent activity.19 The section
below has a less encompassing, more specific intent: to pro-
vide initial labels for the kinds of uncertainties to which
complex facilities, like hospitals, are subject during crisis.
Hazard Uncertainty
The uncertainty of facility crises arises most obviously from
the variety of hazards that can cause them, anything from an
emergent infection to a tornado. This hazard uncertainty can
be reduced by hazard assessment. Such an assessment in
itself is a difficult task, since the risk depends on a combina-
tion of hazard frequency, hazard intensity, and facility vul-
nerability, and data on all three for multiple hazard types
rarely are available. Moreover, there is an inherent dilemma
to the identification of high-priority hazards. Such prepara-
tion would reduce the frequency of anticipated crises (or
speed up the rate of resolution or reduce their disruptive-
ness), but also would increase the likelihood that a rare event
that does turn out to be disruptive, would be the one that
was unanticipated. For a hospital that is prepared for high-
visibility hazards, such as terrorism, this outcome can be par-
ticularly disconcerting, as it was in a Seattle area hospital in
1997. The crisis encountered in Seattle was a sewer blockage
that backed up the effluent from toilets and sinks and spread
sewage on the floor, contaminating, among other things, the
hospital's sterilization unit. 20
Incidental Uncertainty
Even if we restrict attention to a particular type of haz-
ardous event, such as a hazmat incident, the occurrences
during the event are subject to incidental uncertainties,
such as initiating cause, time of day, and location within the
facility. In one 1994 event in a 100-bed, St. Louis area hos-
pital, a leaking sterilizer caused nausea and breathing diffi-
culties on patient floors, prompting a full evacuation.21 In
other facilities, spilled X-ray chemicals led to the evacua-
tion of a radiology room; 2 a basement sterilization leak
caused fumes that disrupted an operating room; 23 and
combined cleaning fluids caused fumes that spread through
ventilation systems and the elevator shaft, prompting the
removal of patients from an infectious diseases ward. 24
These occurrences must be resolved through on-the-spot
decision-making.
Sequential Uncertainty
Crises also are subject to unpredictable chains of occur-
rences, which may be referred to as sequential uncertainty.
Examples can be taken from cases of malevolent human
intruders. In one 1993 incident in Los Angeles, a gunman
entered a large urban medical center's emergency depart-
ment and opened fire on doctors, critically injuring three,
spurring spontaneous flight by everyone who was mobile,
and then, took two hostages and barricaded himself and
the hostages in an X-ray room for five hours until his sur-
render.2 However, in a suburban Utah hospital in 1991, a
gunman claiming to have dynamite in his possession killed
one nurse, then barricaded himself in a maternity ward
October - December 2003 bttp://pdm.medicine.wisc.edu
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
295
with several staff members and patients, including
infants. 26 The sequence of occurrences could not have been
. predicted before the crisis.
The movement of fire also exhibits sequential uncer-
tainty. It is a complex, fast-changing event, which may start
slowly, but then spreads in complex patterns depending on
adjoining materials and equipment. The smoke can spread
along ceilings, through doors (the very doors through
which emergency workers may be entering), along elevator
shafts, and through ventilations systems, yielding difficult,
on-the-spot decision problems. 27 Though staff would ben-
efit from training on what their options are during such
events, they still must respond through real-time decisions.
Informational Uncertainty
On-the-spot decisions about any of the events mentioned so
far, are muddled further when there is informational uncer-
tainty. Where is the intruder, and how is he armed? What is
that acrid smell from the spilled vials? Is the nearby truck
explosion an accident of a hazmat transporter, or is it the ini-
tial event in a terrorist attack? The crack in the wall from the
moderate earthquake: is it a trivial cosmetic problem or a
serious threat to the building's structural integrity? Is the
smoke coming from an overheated frying pan and confined
to a kitchen, or is it originating from a patient's bed and
spreading? During crises, the information for answering
such questions simply may be unavailable, may be incorrect,
may be excessive and contradictory, or may be of otherwise
dubious reliability. In preparing before the event, planners
have little foreknowledge to the adequacy of information
that will be available during crisis.
Consequential Uncertainty
Crises also produce unexpected consequences, along with
the unexpected tasks that result from them. An electrical
outage and elevator malfunction left patients in one New
York City hospital without access to food delivery. Staff
had to line up at stairwells during mealtimes to pass up the
meal trays hand-to-hand. 28 After the Northridge earth-
quake of 1994 prompted the complete evacuation of the
Sepulveda Veterans Administration Medical Center, staff
used the buddy system to search the wrecked building for
stragglers and charge nurses decided to safeguard narcotics
in the trunks of their cars. 29
Cascade Uncertainty
Sequences of events become even more unpredictable when
they are characterized by cascade uncertainty. This occurs
when failure in one system subverts other systems. A power
outage combined with failure of the back-up generator is a
particularly notorious cause of cascading failures. Such an
event occurred at the University of Massachusetts Medical
Center in Worcester, Massachusetts. Though power was
restored within 19 minutes, for that brief period, staff still
had to operate ventilators manually, operate heart-lung
machines using batteries, and manually monitor patients
undergoing surgery. As it was daylight, some areas retained
enough light, but other parts of the facility did not receive
auxiliary-powered lighting, causing total darkness in some
corridors, stairwells, laboratories, and outpatient areas.
Prehospital and Disaster Medicine
 296
Investigators concluded that a much longer interruption
could have harmed critical-care equipment and communica-
tions.9
Cascade uncertainty is quite common after an earth-
quake. The shaking caused by earthquake may sever elec-
trical and gas lines, dislodge emergency generators, damage
surgical equipment, and throw furniture over, in turn,
spilling chemicals (causing hazmat events) or blocking
exits. Even if the facility remains structurally sound, the
cascading failures in utilities and equipment can throw the
facility into turmoil. Though much can be done in the mit-
igation phase to reduce the fragility of these non-structur-
al systems,30 the intensity, direction, and frequency of
shaking are highly uncertain before any event, so that, if
mitigation is inadequate (it always is inadequate above
some hazard intensity threshold), the patterns of cascading
failures during crisis are quite uncertain.31'32
Organizational Uncertainty
The difficulties of contending with crisis are intensified
further by organizational uncertainties. These may arise
from personal characteristics and administrative features
within the hospital: a person's uncertain capability to do his
or her duty, vagaries of staffing and vacations, stress reac-
tions among staff, and uncertainties of leadership and
responsibility. Furthermore, they may arise from the multi-
agency and multi-organizational capacities on which the
hospital may have to draw during the crisis. The particular
combinations of organizations to be called upon, ranging
from SWAT teams and firefighters to electrical utilities
and transportation agencies, depend on events that are sub-
ject to hazard uncertainty. And, in a natural disaster or ter-
rorist attack, the hospital's capacity to draw on other
healthcare institutions depends upon the extent to which
they too are affected by the event.
Background Uncertainty
An especially insidious challenge is the uncertainty about
the background of external conditions and community
resources on which the facility hopes to be able to depend
during crisis. Examples can be taken from cases of hospital
disruption by flooding.33'34 Note that these illustrate back-
ground uncertainty in combination with other kinds, such
as cascade and consequential uncertainties.
Iowa Methodist Medical Center in Des Moines experi-
enced floods during the heat of July 1993, when it lost
municipal power for almost three weeks, and lost water for
shorter periods, while transportation access was impeded by
flood waters. The 710-bed medical center restored partial
electrical service through activation of stand-by generators,
though some of them were rendered out-of-service because
of a shortage of water required for cooling the generators.
Communications suffered when telephone service was lost
and cellular telephones were incapacitated from peak use.
Water was trucked in by contingency-plan suppliers, but this
source was insufficient for operation of the laundry and toi-
lets. The staff found rapid and ingenious methods of dealing
with the crisis. For example, until the National Guard per-
sonnel installed an emergency purification system and
restored water supply, staff resorted to patrolling the building
Prehospital and Disaster Medicine
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
Planning for Resilience in Hospital Internal Disaster
with buckets to flush toilets. After the event (as reported in
the professional healthcare press), the hospital considered
revising its plans to "take into account the possibility of los-
ing multiple major systems and utilities" and "the possibility
of outages for a full month, rather than the previous two to
three days."35 The proposed remedy, in effect, was to plan for
more contingencies.
Bridges Medical Services, a combined hospital and
nursing home in Ada, Minnesota, faced a rather different
scenario: a flood not in summer heat, but during a 1997
blizzard, with many roads blocked by ice and snow. After
flood waters knocked out its electrical generator, the deci-
sion was made to evacuate the hospital. However, the three
receiving locations identified in the facility's disaster plan
were flooded. Patients and residents had to be distributed
among six states and a Canadian province. As the example
illustrates, the background assumption—that transporta-
tion access, weather conditions, and external facility avail-
ability will be normal—turned out to be untenable. As
reported, the Ada staff nonetheless, managed the evacua-
tion well. Staff members demonstrated versatile responses
to the chaotic conditions, cooperated effectively with exter-
nal agencies, and communicated effectively. If, however,
plans for the crisis are understood as ever more detailed
statements of what should be done, then the conclusion for
internal disaster plans "might be that they must consider
{all contingencies) [emphasis added] in order to work".36
A more reasonable conclusion is that, as the contingen-
cies proliferate, the possibility space becomes so large that,
if the hospital were to take programmatic actions to pre-
pare for all, its investments would begin to overwhelm the
hospital's day-to-day functions. The large possibility space
emerges from the multiple uncertainties: each path has
many branches, each with many further branches.
Moreover, the very metaphor of a tree is misleading, since
there can be uncertain coincidental, supplementary, and
accelerating interactions among the various branches—
indeed, logic tree analysis may be quite inappropriate.
In view of the uncertainties, anticipatory preparedness
(the first part of the bipartite strategy) only is feasible with
respect to a limited selection of possibilities. For all other
possibilities, preparedness should focus on the second part
of the strategy, namely resilience.
Modes of Resilience
Intelligence Acquisition and Dissemination
In view of multiple uncertainties in our foreknowledge, the
unfolding crisis envelops responders in a kind of informa-
tion fog. One reasonable way of preparing is to set up
arrangements before the event that assist in improving
information quality during the event: arrangements for the
real-time acquisition and dissemination of intelligence.
Within the facility, intelligence acquisition leads from staff
distributed within the facility (reconnaissance inspectors,
observers on various floors and patient-care units), special-
ly commissioned experts (earthquake engineers, air quality
testers, emergency physicians), and monitoring devices
(security cameras, sensors indicating building structural
integrity, detectors of various contaminants) to incident
command. At the same time, the hospital may have to seek
http://pdm.medicine.wisc.edu Vol.18, No. 4
 Sternberg
information on conditions outside the facility: disaster vic-
tims heading to the hospital, viability of utilities serving the
hospital, or availability of outside assistance. External intel-
ligence may be acquired from paramedics, security briefin-
gs, city or county emergency management, weather radio,
and media reports, among other sources. After an earth-
quake, for example, hospital managers should conduct a
rapid damage reconnaissance,32 but in a wing where the
quake has set off a suspected hazmat spill, they may need
to ensure that the reconnaissance is conducted using appro-
priate personal protective equipment.
Intelligence dissemination (alerts, warnings, and advisory
updates) goes from incident command to subordinate
responders and building occupants, and to various response
organizations outside the facility. To be sure, coordinated
media relations through a designated Public Information
Officer are essential during crises. The point, however, is not
that a public information designee is needed per se, but rather
that, for proper decision-making, incident responders first
must ascertain what is happening and what to do about it.
Overall, the system must be able to turn information (which
may be limited, ambiguous, contradictory, or excessive) into
intelligence. Though many disaster exercises begin with die
definition of a scenario in order to elicit rapid decisions, it is
important to have some exercises in which the nature of the
event is kept ambiguous, forcing staff and responders to dis-
pel the fog of crisis by acquiring intelligence.
Communication
Whereas the "intelligence" function focuses on the social
capability of turning information into usable intelligence,
"communication"—as used here—focuses on the technical
means through which information is transmitted and made
available for discussion. In accounts of past crises, com-
plaints about communication problems are found almost
universally (nearly every source referenced). A critical value
of the Emergency Operations Center is to ensure that the
decision-makers are immediately accessible to each other
for easy communication. For that preponderance of com-
munication for which direct proximity is not feasible, the
essential lesson is that any communication system can fail,
because of blackout, equipment damage, and congestion.
Technically functional systems are subject to problems of
interoperability, as between helicopter rescue and police, or
fire fighters and utility workers, or any of them and the
hospital. Work on resolving these technical problems has
accelerated since 11 September 2001. A fundamental
aspect of all preparedness measures is to have back-up sys-
tems, including the last resort of assigning runners to carry
messages. Not least, personnel must be trained to use unfa-
miliar systems, a capability best developed through drills
and exercises.
Resource Management
Crises impose stresses on a hospital that most likely already
is challenged by financial exigencies and the rigors of patient
care. In response, administrators may (1) adjust patient load,
e.g., curtail admissions, cancel elective procedures, order
early discharge, dismiss ambulatory patients, and/or transfer
patients to other institutions; (2) complementarity, they may
October - December 2003 http://pdm.medicine.wisc.edu
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
297
adjust staff resources, e.g., elongate shifts, call in staff, call in
volunteers, or bring-in added staff through mutual-aid
arrangements; or (3) they may adjust productivity or quality
of care by providing intensified service under constrained
conditions, triaging patients, reducing the frequency or dura-
tion of care (increasing productivity and speed of care), com-
promising standards, and accepting the concomitant risks
of error.
During the pre-crisis period, administrators have no
foreknowledge about the particular balancing of allocation
choices (1), (2), and (3) appropriate to a future event.
When the time comes, they can make those choices more
resiliently if they are prepared with a coherent framework
for emergency resource allocation. Their capacities are all
the greater when this resilience resides not just in the facil-
ity itself, but in the larger healthcare system allowing for
efficient reassignment of staff, transfer of records, recogni-
tion of credentials, and transportation of patients and staff
among facilities.
Mobility Management
In many crises, facility occupants must move from their
usual locations to new locations or sometimes refrain from
moving as they normally would. Though evacuation to the
building's immediate exterior is the best known option, it is
by no means the only one; in severe weather, risks of stay-
ing may have to be weighted against risks of exiting the
building. In contained fires and hazmat spills, or human
threats confined to part of the facility, evacuees may be kept
within the building, but directed to another wing, another
floor, or a cafeteria or assembly room. The appropriateness
of evacuation also depends on patients' condition and the
mobility of life-sustaining equipment. For patients in
intensive care, the informed judgment may have to be
made that the patient is less endangered by staying than by
being moved.
There are many crises in which sheltering-in-place is
the preferred option over evacuation,12 subject to many
contingencies. Following an earthquake, sheltering may
need to take place in a designated corner of the room or
under furniture; during hurricane, in a corridor; and against
human intruders, in the ward under lock-down conditions.
These mobility choices should lead hospitals to divide pre-
paredness between drills (routine procedures for well-
defined hazards, such as hurricane) and exercises, where
the latter are meant to force participants to make real-time
decisions on movement destinations (or sheltering-in-
place) in response to information acquired during the
event. The purpose of the exercises would be to provide
experience in resilience for crisis mobility.
Design for Resilience
The capacity for mobility or sheltering depends upon the
built form of the hospital. Though such physical design
sometimes is classified as "mitigation", it is useful to distin-
guish between mitigation design (i.e., use of fire-resistant
materials to avert fire) and preparedness design (fire stairs,
in case mitigation fails). In view of multiple hazards (not
just fire) and the uncertainty of their impact in various
parts of the facility, preparedness design should aim, in
Prehospital and Disaster Medicine
 298
part, to facilitate resilience. Elements of such design
include corridor space, compartmentalization, vertical
access (stairs, ramps, emergency elevators), and emergency
egress; emergency lighting, way-finding, and advisory sys-
tems; and varied sheltering arrangements designated for
fire, hazmat, intruder, dangerous wind, or ground shaking,
as locally indicated. Outside the building, site designers
should take into account evacuation, transport, emergency
vehicle placement, and the possibility of the occurrence of
the disaster convergence phenomenon. The capacity to
move adaptively in crisis depends, in part, upon spatial sys-
tems allowing for real-time choices on where to move or
where to take shelter.
Incident Command
For the many decisions that must be made in real time,
hospitals must be prepared with an appropriate decision-
making structure. The unfolding crisis may be concentrat-
ed in particular patient-care unit for which its immediate
supervisor may have best knowledge of the event. Or, it
may turn out that the event demands specialized knowl-
edge, such as pipe-fitting, air sampling, or psychological
counseling. Or, it may require standard, outside, first
response, such as firefighting. The hospital's chief operat-
ing officer is not necessarily placed best to manage the inci-
dent. An advantage of the incident command system
(ICS), now widely used in the world, is that it divides
responsibility between the Incident Commander, who is in
charge overall, and the Operations Chief, who works on
the spot. The Operations Chief, whether it is a SWAT
team member,firefighter,or head nurse, should be the one
best skilled in the particulars of the problem at hand.37
Many healthcare organizations have adapted a version of
ICS known as Hospital Health Emergency Incident
Command System that provides a more elaborate designa-
tion of medical responsibility under the authority of the
Operations Chief. It should be noted, however, that for a
hospital internal disaster, the crisis may hinge more on fire-
suppression, police action, transportation decisions, or
other matters, than on medical ones, so that a convention-
al ICS may be sufficient.
Through prudent delegation by the incident comman-
der and operations chief, the ICS is flexible enough to
decentralize decision-making, while retaining overall coor-
dinating capacity for communication, intelligence acquisi-
tion, and intelligence dissemination. Now that the ICS is
adopted widely for emergency management, it has further
value in that personnel from various functional agencies
can interact through a common command structure and a
common vocabulary, facilitating inter-organizational coor-
dination. If training is made widely available to hospital
personnel, the ICS can be mobilized on any shift, without
dependence on specific persons. Properly implemented, the
system's greatest value is that it is adaptable; its effective
functioning does not depend on particular individuals nor
does it presume foreknowledge about the specific crisis.
Suchflexibilityarises not merely from the formal adoption
of the system, but from repeated training and exercising
under varied scenarios to imbue the organization with
resilience.
Prehospital and Disaster Medicine
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
Planning for Resilience in Hospital Internal Disaster
Staff Versatility
A few themes cut across the modes of resilience described
so far: the need for cooperative arrangements between the
facility and external organizations, for technological sys-
tems that support human decisions, and for personnel who
have versatility. Indeed, resilience (in organizations)
depends upon the versatility (of individuals). An individual
is more versatile to the extent that he or she can compe-
tently pursue a greater variety of courses of action and
effectively make real-time decisions among these courses of
action. Among types of training that instill versatility, exer-
cises appear to be especially important.
As distinguished from a drill, meant to train for a par-
ticular type of anticipated event, an exercise should aim at
posing choices in realistic scenarios, including unexpected
contingencies and informational ambiguities.38 When
properly designed, the exercise has its primary value not in
the details of the particular scenario (the scenario may
reflect a rare combination of contingencies), but rather in
forcing participants to be versatile, thereby contributing to
organizational resilience.
Conclusion: Reforming the Internal Disaster Plan
Internal disaster planning encompasses mitigation and pre-
paredness (plus long-term recovery planning, which is not
discussed in this article). Of these, preparedness is more
intellectually challenging because it sets the stage for
actions carried out during the uncertainties of crisis.
To disaster planners working in the pre-crisis period,
the particulars of any eventual crisis are subject to numer-
ous uncertainties. Though there are some recurrent features
of crisis that can be foreseen, these uncertainties, and the
enormous possibility spaces they generate, make crises
partly intractable for traditional planning approaches.
Within limits, two kinds of traditional anticipatory
planning do have continuing value. One is the emergency
reference tool. Paper and digital reference tools should be
made available with names of responsible personnel, con-
tact information, locations of supplies, procedure for
declaring alerts and emergencies, and other predictable
tasks. Such documents are meant to be consulted during
crisis; they should be restricted to convenient pamphlet
size. The other is the contingency plan for high-likelihood
events: In flood-prone areas, for example, special flood-
based, emergency reference materials should be made avail-
able, and flood-related exercises should be conducted.
Otherwise, preparedness plans should aim to develop
institutional capacities for resilience. The resilience plan
should: (1) reduce uncertainties in real time (intelligence
acquisition and dissemination); (2) conceptualize courses of
actions (for complex resource management and mobility
management); (3) invest in facilities and equipment that
facilitateflexibility(design for spatial mobility, interoperable
communications systems); (4) manage multi-organizational
participants in ambiguous conditions (incident command);
and (5) educate personnel for crisis versatility (especially
through exercises).
While short reference handbooks and selected contin-
gency plans have continuing value, the hospital prepared-
ness plan for internal disasters primarily should aim to
http://pdm.medicine.wisc.edu Vol.18, No. 4
 Sternberg
instill capacities before the crisis for resilient response dur-
ing the crisis. The ideal plan is one that does not have to be
consulted during the event.
References
1. Milsten A: Hospital responses to acute-onset disasters: A review. Prehosp
D«aj/Afe</2OOO:1S(1):32-S3.
2. Auf der Hcide E: Disaster Response: Principles of Preparation and
Coordination. St. Louis, MO: CV Mosby, 1989, pp 34-35.
3. Sternberg E, Lee GC, Huard D: "Counting crises: U.S. hospital evacuations
1971-1999," Buffalo, NY: Multidisciplinary Center for Earthquake
Engineering Research, 2003 (manuscript).
4. Ahrens M: Selections from the US fire problem overview report: Leading
causes and other patterns and trends, facilities that care for the sick. National
Fire Protection Association, June 2001.
5. Pan American Health Organization: Principles of Disaster Mitigation in
Health Facilities 2000: Washington, DC: Pan American Health
Organization, pp 14-17.
6. Barbera JA, Macintyre AG, De Atley CA: Ambulances to nowhere:
America's critical shortfall in medical preparedness for catastrophic terror-
ism. Journal of Homeland Security. 2002 (March): Available at www.home-
landsecurity.org/journal/articlcs. Accessed 12 June 2003.
7. Arnold, JL: Disaster medicine in the 21st century: Future hazards, vulnera-
bilities, and risk. Prehosp Disast Med 2002;17(l):3-ll.
8. Treat, KN, Williams JM, Furbee PM, et al: Hospital preparedness for
weapons of mass destruction incidents: An initial assessment. Ann Emerg
Afc</2001;38:562-565.
9. Aghababian RC, Lewis P, Gans L, and Curley FJ: Disasters within hospitals.
Ann Emerg Med 1994:23(4):771-777.
10. Auf der Heide E: Disaster planning, Part II: Disaster problems, issues, and
challenges identified in the research literature. Emerg Med Clin N Amer.
1996;14(2):453-480.
11. Hood C, Jones DKC: Accident and Design: Contemporary Debates in Risk
Management. London: UCL Press. 1996.
12. Tierney KJ, Lindell MK, Perry RW: Facing the Unexpected: Disaster
Preparedness and Response in the United States. Washington, DC: Joseph
Henry Press, 2001.
13. Siders C, Jacobson R: Flood disaster preparedness: A retrospect from Grand
Forks, North Dakota. Journal of Healthcare Risk Management 1998 (Spring):
33-40.
14. Buchanan D, Freeman C: Statewide Disaster Medical Standards
Development Project: Final Report. Modesto, CA: Mountain Valley
Emergency Services Agency, 21 August, 2000. Available at
www.mvemsa.com. Accessed 12 June 2003.
15. Special Issue: Emergency management in the new millenium. Joint
Commission Perspectives 2001;21(12);4-23.
16. Sullivan E: Life safety in the perianesthesia care environment: Planning for
internal disasters. Journal of Perianesthesia Nursing 2000;15(3);177-179.
17. Franck L, Epstein B, Adams S: Disaster preparedness for the ICN:
Evolution and testing of one unit's plan. Pediatric Nursing
1993;19(2):122-127.
October - December 2003 http://pdm.medicine.wisc.edu
Downloaded from http:/www.cambridge.org/core. University of Connecticut, on 24 Dec 2016 at 20:12:28, subject to the Cambridge Core terms of use, available at
http:/www.cambridge.org/core/terms. http://dx.doi.org/10.1017/S1049023X00001230
299
Acknowledgment
The author thanks George C. Lee for his advice and
encouragement.
18. Association for Professionals in Infection Control and Epidemiology and
Center for the Study of Bioterrorism and Emerging Infections: Mass
Casualty Disaster Plan Checklist: A Template for Healthcare Facilities. Revised
Draft. St Louis, MO: Center for the Study of Bioterrorism and Emerging
Infections. 01 October 2001. Available at www.apic.org. Accessed 12 June
2003.
19. Parsons S: Qualitative Methods for Reasoning under Uncertainty. Cambridge,
MA: MIT Press, 2001, pp 7-29.
20. Sewer Backup Closes, Contaminates Hospital. The Seattle Times 02 May
1997, B2.
21. English N: St. Louis Post-Dispatch. 22 September 1994, p IB.
22. Chemical Spill Causes Hospital Evacuation. Los Angeles Times 05 January
1989, p 2.
23. Sullivan KN: Toxic Gas Leak Causes Hospital Evacuation. Forth Worth
Start-Telegram. 13 February 1991, p 1.
24. Borondy K: Chemical Spill Forces Newark Hospital Evacuation. Star-Ledger
(Newark, NJ) 13 May 1999, p 25.
25. White M: The Arizona Republic 09 February 1993, p Al.
26.Gun Terror at Hospital in Utah City. San Diego Union-Tribune. 21
September 1991, p Al.
27. Blumhagen DW: Evacuation of patients during a fire at a general hospital.
Ann Emerg Med 1987;16(2):209-215.
28. Lippman H: When the disaster drill is for real. RN 1992;9.
29. Personett JD: Earthquake! Nursing Management 1994;25(8):58-62.
30. Shinozuka M, Grigoriu M, Ingraffea AR, et al: Development of fragility
information for structures and nonstructural components. Research Progress
and Accomplishments 1999-2000. Buffalo, NY: Multidisciplinary Center for
Earthquake Engineering Research, 2000, pp 15-32.
31. Seismic Safety Commission: Northridge Earthquake, January 17, 1994: The
Hospital Response. Sacramento, CA: Seismic Safety Commission (SSC 94-
11). 1994.
32. Reitherman R: How to prepare a hospital for an earthquake. / Emerg Med
1986:4;119-131.
33.Reed M: Disaster preparedness pays off'. Journal of Nursing Administration
1998;28(6):25-31.
34. Cloutier RJ, Greenwood J, Malawski JR, Tremblay KP: Disaster planning:
St. Boniface General Hospital, A case study of the flood of the Century.
Hospital Quarterly 1997/98;l(2):32-37.
35. Weisman E: Disaster preparedness. Health Facilities Management.
1994(May);18-25.
36.
Sheley E: The 1997 floods: Evacuation and recovery. Balance [American
College of Health Care Administrators] 1998;(June):12-15.
37.National Interagency Fire Center: Incident Command System. National
Training Curriculum Module 1: ICS Orientation. Boise, Idaho: National
Interagency Fire Center, October 1994.
38. Crichton M, Flin R: Training for emergency management: Tactical decision
games. Journal of Hazardous Materials 2001;88(2-3):255-266.
Prehospital and Disaster Medicine