How to best create a plan for terrorism: Think of crowds of desperate people’

And don’t assume anything

The threat of terrorism should prompt risk managers to conduct a thorough review of emergency preparedness plans, making it very likely that you will find that you are not adequately prepared. That’s the alarming news from experts who say terrorism may strike directly at the nation’s hospitals and other health care facilities.

There is reason to be alarmed, says Lee Matthews, CHPA, CPP, interim executive director of the International Association for Healthcare Security and Safety in Lombard, IL. He has worked in health care security for 16 years. Since Sept. 11, risk managers and security managers have flooded his office with calls asking how they can strengthen their facilities’ preparations for terrorism. Matthews tells them they should get to work immediately.

"As I talk to people after the 11th, I keep emphasizing that you can’t assume anything about your plan. Read through it with a different set of eyes," he says. "Don’t say, That could never happen here.’ Everything is different now."

Matthews says he doesn’t expect health care facilities to be a primary target for terrorist attacks, but he does not discount that possibility altogether. He notes that in the Balkans and Northern Ireland, terrorists have targeted hospitals for both primary and secondary attacks. Hospital emergency rooms [ER] can be an attractive target for a secondary attack because the terrorists can be sure that they will be crowded with injured people and rescue workers.

"Everybody has to worry about terrorism in this country now, but we have to be especially concerned if we’re involved with protecting hospitals," he says. "Hospitals are going to be involved, one way or another."

The good news, Matthews says, is that health care providers are not starting from scratch. The Joint Commission on Accreditation of Healthcare Organizations already requires that providers have an emergency preparedness plan for responding to a wide range of in-house and community emergencies, and effective January 2001, the Joint Commission’s emergency preparedness plan (EC.1.4) was expanded and made more specific. It now requires providers to address four phases of emergency management activities: mitigation, preparedness, response, and recovery. The new rule calls for providers to conduct a "hazard vulnerability analysis" to determine how the facility might be affected by different threats. The new language in the rule also lays out specific requirements, such as identifying personnel during emergencies, but it is an all-purpose rule on emergency management that could apply to a range of disasters. Terrorism is not mentioned.

The standard lists essential elements of a plan, including an annual evaluation of its effectiveness. Matthews says risk managers should look to their existing emergency plans as the starting point when developing a response to terrorism. In fact, he doesn’t necessarily even suggest that you develop a plan with the word "terrorism" in the title.

"Most hospitals don’t have a specific policy on terrorism, and I’m not sure there’s any need to write one up from scratch," he says. "But everyone has a policy on bomb threats, evacuation, fires. You need to focus on components like that and make sure they’re the best they can be."

Many risk managers think they currently have no response plan for a terrorist attack, when in fact they have one that just needs to be improved, says Russell Colling, CHPA, CPPFM/LM/CM, a health care safety consultant in Salida, CO. Colling cautions risk managers that, even if they want to develop a very specific response plan for terrorism, they must first make sure they have covered the fundamentals of an overall, generic emergency preparedness plan.

"I’m telling my clients that for any kind of emergency, terrorism or anything else, you need to look and see if you have a strong day-to-day program," he says. "There’s no use in trying to throw something together quick if you don’t have that foundation in place."

Access control will be a key problem

The most likely problem to face hospitals is a sudden influx of patients from an attack somewhere else in the community, he says. In that situation, the hospital would respond largely in the same way that it would respond to any other mass-casualty incident. But there could be some differences if the attack is biological or chemical or even nuclear in nature. That creates a more difficult problem with contamination and patient isolation.

A biological attack is one of the biggest fears among the public right now, but Matthews says such an incident would not cause a sudden crisis in the health care facility. The crisis might come, but it would build as people in the community realize they are infected or at risk.

"No one’s going to run into your ER and throw an anthrax bomb," he says. "Instead, people are just going to start showing up with symptoms, more and more over days or weeks until you have a problem. Part of your problem could be people demanding that you give them a vaccine, whether you have it on hand or not, and even if it wouldn’t help them. Your pharmacy will be at risk just because it says pharmacy’ on it. Think of crowds of desperate people."

Colling agrees, saying about 50% of all security in a health care setting comes down to access control in one way or another. It might not be necessary to lock down the entire facility, but you will need to have a mechanism in place for reducing access points.

"It’s time to address again what we did in the late ’60s with all the civil unrest," he says. "The idea of auxiliary security staff should be revisited. Maintenance and housekeeping, materials management — a lot of those people should be trained to form an auxiliary security staff that could mobilize on a moment’s notice to man certain posts not ordinarily manned. That idea died out after the civil disobedience abated in the ’70s."

Colling says there is "not one dramatic thing you should do. It’s more like shoring up everything you should already have in place." He has one specific suggestion that most hospitals could implement right away: Start conducting more thorough background checks.

"This is a good opportunity to remind hospitals that the best money you can spend on security is to find out who you’re hiring," he says.

If your emergency preparedness plan already is thorough, Matthews says you might be able to just expand some of the categories to include terrorist attacks and look for details you might have overlooked before Sept. 11. But if your plan isn’t high quality, and most experts say that is common, now is the time to roll up your sleeves and get to work. He offers these tips for developing or reviewing your emergency response to terrorism:

  • Include virtually every department.

Too many emergency plans focus only on the medical care, overlooking how important support services can be. Facilities managers, for instance, can be critical — and overtaxed — in an emergency. Particularly when there are contamination issues, facilities management might be called on to alter ventilation systems or provide emergency water supplies for decontamination.

  • Use your drills to look for hidden problems.

Your disaster drills are crucial for spotting the weaknesses that you’ll never see on paper. For instance, your plan may call for setting up a decontamination site in the ER parking lot so patients can be washed before entering the facility. That’s good, but during the drill you might find that there is no water hookup in that area. And even if there is a water supply, will it be ice cold? Where does the contaminated waste water go?

  • Involve local authorities.

Your emergency plan and your drills should not be solitary affairs. Involve local police and fire departments and encourage them to provide feedback. Also be sure to solidify your relationship with these authorities because you will depend on them in a crisis.

"Go and talk to law enforcement," Matthews says. "Don’t assume that you know Bob the Deputy because he drives by every night and that’s your relationship with law enforcement. Reaffirm that connection and investigate what they will do if something serious happens. Can they come to help you protect the hospital or will they not have enough assets for that? Don’t make any assumptions."

For instance, one of the hospitals where Matthews used to work had an agreement with the local police that they would station a patrol car at the ER whenever the hospital enacted its emergency plan. The officer provided some security, but the main goal was to ensure that the hospital had communications if its own system went out.

  • Check with vendors and consider their own limitations.

Your emergency plan should include arrangements with vendors to expedite delivery of critical materials. But be realistic about what the vendors will actually be able to do in an emergency. Matthews tells of one hospital that had carefully arranged for a local vendor to deliver a tanker truck of diesel fuel for its emergency generator in an emergency. But when an earthquake struck, authorities declared diesel fuel an emergency provision and restricted its sale. The vendor could not deliver the fuel to the hospital without permission from state authorities despite the previous agreement.

One consultant cautions that you must not be too satisfied with your emergency preparedness plan just because it passed a Joint Commission survey. The Joint Commission requirements are rather general, and there are many ways to fulfill them, says Cameron Bruce, CSP, PE, a health care consultant in Orinda, CA. He says most hospitals are "woefully unprepared" for a disaster.

Hospitals and other health care organizations tended not to put much budget support behind emergency preparedness, but Bruce says that might change now that terrorism has gotten everyone’s attention. That’s good, because developing a good emergency plan can be expensive, especially if you use outside consultants.

"It can take you more than 1,000 hours of time to write a good emergency preparedness manual. That can cost you $30,000-$60,000 if you do it right," Bruce says. "You can slap something together in a few days before your Joint Commission survey and it might be enough to get by the surveyor. But that’s nothing I would rely on in an emergency."

On a nationwide level, the U.S. health care system is ready for terrorist attacks, according to Secretary of Health and Human Services (HHS) Tommy Thompson. He recently spoke before an audience of manufacturers and said the federal government has eight caches containing 50 tons of medical supplies distributed around the country, ready for immediate distribution, along with a network of 81 state laboratories connected to the Centers of Disease Control and Prevention (CDC) for monitoring of anything suspicious.

Thompson says the HHS could use that network to respond within seven hours to either conventional or biological attack, Thompson said. He says he is "very confident as Secretary of Health that if a terrorist attack hits us, we are able to respond very quickly." In addition, Thompson says HHS will be improving security at places such as the CDC and NIH as well as stocking additional supplies of pharmaceuticals and vaccines.

If one arm of the American Medical Association has its way, the Joint Commission will start evaluating health care providers for their emergency plans specifically regarding terrorism. The American Medical Association’s Council on Scientific Affairs issued a report in 2000 on "Medical Preparedness for Terrorism and Other Disasters," calling for substantial improvements. One of the key recommendations was to "encourage the Joint Commission on the Accreditation of Healthcare Organizations and state licensing authorities to include the evaluation of hospital plans for terrorism and other disasters as part of their periodic accreditation and licensure." The Joint Commission has not acted on that recommendation.

The Joint Commission has focused on terrorism, however. In 2001, several congressional committees explored the issue, and the Joint Commission actively participated.

Visit HRM, ED Legal Letter site

As an added value for Hospital Risk Management subscribers, we now offer free on-line access to The new site features current and back issues of HRM and ED Legal Letter, also from American Health Consultants.

Also included on the site and in its archives are links to every article published in HRM’s Legal Review & Commentary supplement from January 1999 to present.

There also are links to every article published in Healthcare Risk Management’s Patient Safety Quarterly and Patient Safety Alert supplements from January 1999 to present.

HRM’s 2000 salary survey also is available in its entirety. The 2001 salary survey will be available in November.

Find links to other web sites that are essential references for risk managers. There also is a guide to upcoming conferences and events of interest to risk managers.

Click on the User Login icon for instructions on accessing this site.

Disaster Planning Audio Conference

The unimaginable has happened in New York City. At Saint Vincents Hospital, less than three miles from the site of the World Trade Center attack, the disaster plan was put to the test as dedicated professionals rose to the unique challenge of responding to the attack. American Health Consultants, publisher of Healthcare Risk Management, invites you to learn from the firsthand experience of the professionals at Saint Vincents how to take a new look at your disaster plans so that you will be ready if the unimaginable happens in your community:

  • Responding to the Unimaginable: How Saint Vincents Coped with the World Trade Center Attack
  • Wednesday, Nov. 14, 2001
  • 2 to 3:40 p.m. EST
  • An audio conference educating you and your entire staff on how to respond effectively in a crisis situation.

The facility fee of $249 includes 1.5 free AMA Category 1 CME credits or approximately 2 free nursing contact hours. For details, visit, or call (800) 688-2421 to register today!