Planning and Partnerships: Coordinating Rural Resources for Emergency Preparedness and Response

by Tami Lichtenberg

Earthquakes, hurricanes, floods, tornadoes, fires, and ice storms continually test the mettle and preparation of rural healthcare providers. According to the United Nations Office for Disaster Risk Reduction, the United States ranks second only to China of countries with natural disasters. And those are just the natural ones. Equally damaging in their own way are the man-made disasters, such as cyber-attacks, active shooters, and bioterrorism events.

With limited resources and increasing financial and regulatory pressures, preparation for even one of these potential disasters can be overwhelming, but the key to surviving one of these events as a rural healthcare organization is planning, preparation, and the ability to adapt, be flexible, and expect the unexpected.

New Requirements for Rural Facilities for Disaster Planning

In response to a patchwork of disaster preparedness resources, along with disasters that tested the fragile web of providers and saw unnecessary losses of life, the Centers for Medicare and Medicaid (CMS) enacted a disaster planning rule to ensure that providers were better prepared for emergencies. CMS Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers, which went into effect in November 2016, required covered agencies to be compliant by November 15, 2017.

The rule consists of four main components: all-hazards assessment and planning, training drills and testing, a communication plan, and policies and procedures. CMS defines an all-hazard assessment as one that examines, "but is not limited to, care-related emergencies, equipment and power failures, interruptions in communications, including cyber-attacks, loss of a portion or all of a facility, and interruptions in the normal supply of essentials such as water and food."

Planning to Failure

While the rule is designed to ensure proper training and planning so that facilities, especially those in remote, rural areas, can properly respond to emergencies, many times it is only after studying disasters and the actual activation of emergency response systems that one can identify what works and what doesn't quite go as planned.

The Missouri Hospital Association produced a white paper, Preparedness and Partnerships: Lessons Learned from the Missouri Disasters of 2011: A Focus on Joplin, encapsulating lessons learned from the Joplin tornado and other disasters in Missouri that year. It encourages organizations to "Plan for failure! Test to failure! Identify break points. Revise and correct the plan. Retest to failure!"

Last summer I witnessed the need for planning to failure firsthand while running a healthcare agency in Iowa. An EF-3 tornado cut a wide swath down Main Street of my community, destroying the heart of downtown as well as many small businesses, residences, over 800 cars, and a large plant that employed over 1,000 people. We had finished disaster planning only months before. All the pieces were there, and we had done both our tabletop exercise and participated in an active drill at another local healthcare provider, but some parts of our disaster planning worked well and some were tested. When the tornado had passed, our office had managed to escape without any damage.

In the aftermath, I found the most helpful part of our plan was an idea borrowed from a peer provider — all of the patients had been classified as an A, B, or C according to their potential needs.

The A's needed immediate help and possible evacuation due to their frailty, oxygen dependence, or lack of a caregiver. The B's would be able to sustain in place for up to 72 hours if their homes were not affected. The C's were patients who resided in facilities or were in the inpatient unit and would have access to caregivers and a generator. This list would also have been helpful had we needed to send help to a specific patient's home or in an extended power outage.

What didn't work as well were our secondary communication plans. Communication became the biggest, immediate obstacle. The phones, both cellular and landline, were so jammed and spotty immediately after the tornado that a calling tree was useless. I picked up the phone to call the radio station and then realized at least one of them was off the air, having sustained a direct hit. We resorted to putting our messaging out on social media. In fact, the internet became a powerful communication tool for compiling resources and providing information for many organizations during the recovery.

In all our planning, I had not thought about the possibility that the phone lines, while still working, would be jammed or that the disaster might take down the radio station.

In all our planning, I had not thought about the possibility that the phone lines, while still working, would be jammed or that the disaster might take down the radio station.

The Earth Began to Shake

On November 30, 2018, at 8:29 a.m., a 7.0-magnitude earthquake occurred near Alaska's Matanuska-Susitna (Mat-Su) Borough and Anchorage, with some impacts to the Kenai Peninsula as well. The first quake and strong aftershock caused damage to roads, businesses, and homes.

Sondra LeClair, manager, Health Emergency Response Operations at the Alaska Department of Health and Social Services, talked about some of the issues that rural hospitals and other healthcare providers faced immediately after the quake. LeClair stated that "the Department of Health and Social Services Emergency Operations Center (DHSS EOC) activated immediately and began gathering information from hospitals and other healthcare system partners in the affected areas to provide a centralized repository of verified health situational awareness."

She also described statewide teleconferences that "provided this situational awareness and offered a venue for detailed infrastructure information from the Municipality of Anchorage as well as questions from the healthcare facilities." LeClair said it was extremely important, due to the rural nature of the state, that the rural hospitals and clinics were aware of what was happening in Anchorage and the Mat-Su facilities.

The consistent communication that we maintain, as well as the integrated nature of our training and exercises, ensured that the partnerships existed to support this response.

When asked about planning for disasters, LeClair stated, "Planning for disasters and incidents that impact the healthcare system occurs every day. Due to our extremely rural nature and lack of infrastructure in many parts of the state, Alaska has one statewide healthcare coalition. This coalition has significant involvement from the State of Alaska, as well as individual healthcare facilities and tribal health representation. The consistent communication that we maintain, as well as the integrated nature of our training and exercises, ensured that the partnerships existed to support this response."

When the Emergency is Not a Natural Disaster

For Redfield Community Memorial Hospital administrator Michael O'Keefe, planning and yearly drills payed off, allowing O'Keefe and his staff to react swiftly to an armed hostage situation in their hospital last summer. Caught also in the standoff was a ten-year-old hostage.

In an interview with South Dakota television station KELO two weeks after the incident, O'Keefe recounted having the gun in his face: "Obviously never experienced that or hope to again, but it does kind of set a different tone. I need to get him out of the open area, I need to get him contained…. My whole purpose at the time was really just to get the individual into an area that was away from the patients and staff and new patients." The standoff ended after more than 10 hours with the hostage released and the suspect surrendering without firing a shot.

In the interview, O'Keefe also credited drills and training for helping with the outcome. "We really kicked it into action. A real situation is vastly different than the drills are but that's what happens when you practice these trainings over and over and you go through these trainings. When the situation arises, you jump into that mode and that's what we did that day," O'Keefe said.

O'Keefe added in a recent interview that there wasn't one particular thing from drilling that helped them during the event, but the practice of continually drilling for different scenarios that helped the employees deal with real situations. He also said it was important that drills were as realistic and random as possible. However, despite the fact that the staff continues to drill, O'Keefe acknowledged that they must do things differently due to the changed environment the facility operates in after experiencing a live event. Despite debriefing with multiple agencies, as well as setting up resources and opportunities for employees to continue to talk about and work through what they experienced, healing is an ongoing process.

The incident was significant, yet the following hours, days, and months were far more difficult than the ten hours of the actual event.

"To this day we still have situations and drills that require me to pull certain individuals out of the exercise due to the dramatic events of June 25th. I continue to work with those employees most affected to get them more comfortable. It hasn't been easy nor is that part of the normal drill process. We are all living in a 'New Normal' since the event.  Adapting to this has taken time and will continue to be a focus for me," O'Keefe candidly explained. "The incident was significant, yet the following hours, days, and months were far more difficult than the ten hours of the actual event. To be visible with staff who are struggling to go back into that area or are easily frightened by a closing door or a trauma code overhead, to not being comfortable being in the building. That was by far the most difficult part of the ordeal."

O'Keefe emphasized how the experience will change the hospital's preparedness efforts. "More time, thought, and efforts going forward with drills will focus on when the drill is over — how do we adapt or go back to the norm?"

Cybersecurity: An Ever-Increasing Threat

As the healthcare industry continues to move to an ever-digitized environment and strive to provide patients with their data and information at the touch of a button, hackers are also lurking in the shadows trying to get their hands on the same valuable information.

According to the report Cybersecurity Toolkit for Rural Hospitals and Clinics, prepared for the Medicare Rural Hospital Flexibility Program (Flex) and the National Rural Health Resource Center by Joe Wivoda of The Analysts, "From December 30, 2015 to December 15, 2017, there have been 392 data breach incidents reported to the US Department of Health and Human Services (HHS). These breach incidents that have affected 17,215,903 patients, and these are only the data breaches of unsecured protected health information affecting 500 or more individuals."

While any breach of significant size must be reported, all rural healthcare organizations big and small should take precautions to protect their data and information.

Training of staff can prevent these sorts of attacks, and building awareness for staff is critical as well.

Wivoda says some of the least expected ways to incur a breach are lack of staff education and poor processes. "For example, 'phishing' attacks use social engineering and realistic-looking emails to trick staff into clicking on links in the email, entering logins and passwords, or providing other useful information to hackers," said Wivoda. He pointed out, "Training of staff can prevent these sorts of attacks, and building awareness for staff is critical as well." Wivoda also pointed to poor communication between departments in situations such as employee termination as a risk. "I have performed risk assessments at many rural hospitals where the HR department will send a list of terminated employees to IT on a monthly basis. This gives a disgruntled former employee quite a bit of time to hack back in to the hospital's systems," said Wivoda. "All of these organizations have communication to payroll to stop their pay as well as processes for collecting keys, pagers, and other property prior to them being escorted out! We need to do better."

Wivoda pointed to a realistic and complete risk assessment, which is a HIPAA requirement, as one of the most important things a rural facility can do to protect itself.

"It is always best to have someone from the outside perform the risk assessment, and I encourage rural hospitals to utilize their peers or their networks to make the process as painless and useful as possible," said Wivoda. "There are a lot of tools, such as the ONC Security Risk Assessment (SRA), that can help. The risk assessment will identify whether processes are in place for such things as checking system logs, employee termination, destruction of PHI (protected health information), PHI access by subcontractors, and other important areas."

Unexpected Issues of Disasters

Sometimes when planning for disasters, healthcare providers think of the initial injuries and problems that are a direct result of what happened, but often those aren't the only issues they see, as one Georgia hospital found out. In an article about their experience with Hurricane Michael in 2018, the pharmacy manager of a Critical Access Hospital (CAH) in Georgia pointed out that, while the hospital emergency room expected to see injuries from the destruction, what they actually saw were more common illnesses like sore throats and earaches because people were unable to get to their doctors and the pharmacies were closed.

On the evening of the tornado in Iowa, after knowing that my family was safe, the first responder in me kicked in and I hiked a mile or so into the worst damaged area to see if I could help. The streets were so badly blocked by debris that I had to hitch a ride with a police officer to make it the last half-mile and then walked in to the medical shelter location in order to volunteer. I spent the night volunteering with the staff of the facility, taking care of individuals from the community that were oxygen-dependent and had been forced out of their homes by either damage or lack of power. They arrived without supplies, without medications, and with very little information. As I helped the wonderful night staff at the facility take care of these visitors, while they also took care of their own residents, I was struck by the thought of these fragile individuals living in our community every day and how it took an emergency like a tornado for me to see how vulnerable some rural residents are when disaster strikes.

When asked if the Alaska earthquake had any lessons for the rest of the country, LeClair summed up what it is about rural healthcare organizations that makes them uniquely adaptable to disaster recovery.

Whether 'that day' involves an earthquake, massive wildfire, flooding, or other event, the fact that all resources in the community already know each other and can come together quickly to coordinate is a strength that is prominent in rural communities.

"Rural healthcare providers know that there are difficulties and obstacles to providing services to their population daily. The impacts and disruptions caused by a disaster certainly do not make this provision of services any easier. However, rural providers also know how important it is to use every resource within their communities in order to overcome challenges and meet the needs of patients. This constant partnership, the inclusion of local emergency management and law enforcement, EMS and air medical transport, pharmacies and primary care providers, is essential to being ready for 'that day.' Whether 'that day' involves an earthquake, massive wildfire, flooding, or other event, the fact that all resources in the community already know each other and can come together quickly to coordinate is a strength that is prominent in rural communities."