Opportunity Among Disaster: Reflecting on 2 Disaster Scenarios During the COVID-19 Pandemic

Abstract

Maintaining a public health emergency response for a sustained period of time requires availability of resources, physical and information technology infrastructure, and human capital. What perhaps is unprecedented is a medical center experiencing multiple disasters simultaneously. In this case study, the authors describe 2 separate disaster events experienced during the ongoing COVID-19 pandemic: (1) a cyberattack at Nebraska Medicine in Omaha, Nebraska, and (2) civil unrest following the murder of George Floyd in Minneapolis, Minnesota. Although these settings were very different, the following common themes can inform future disaster planning: the benefit of an already active incident command system, the prescient need for continuity of operations, and the anticipation of workforce fatigue. These dual-disaster experiences provide an opportunity to identify lessons learned that will drive improvements in emergency management through preparedness and mitigation measures and response innovations for future simultaneous disasters.

Introduction

For nearly 2 years, healthcare emergency management and incident command systems (ICS) have been engaged to address the dynamic demands of the COVID-19 pandemic. Maintaining a public health emergency response for a sustained period of time has a substantial impact on the availability of resources, physical and information technology (IT) infrastructure, and human capital. Experiencing a disaster within a disaster, unsurprisingly, results in additional resource strains. A dual-disaster setting requires quick and critical thinking, experienced command staff, strong previous operational continuity planning, and sustained mental and physical endurance. It also offers an opportunity for innovation in systems management and creative adaptation to changing environments.

In this case study, we describe 2 dual-disaster experiences set within the ongoing COVID-19 pandemic: (1) a cyberattack at Nebraska Medicine in Omaha, Nebraska, ¹ and (2) civil unrest following the murder of George Floyd in Minneapolis, Minnesota. ² Although these settings were very different, the following common themes can inform future disaster planning: the benefit of an already active ICS, the prescient need for continuity of operations, and the anticipation of workforce fatigue. Reflecting on these scenarios and identifying lessons learned from these dual-disaster experiences may better prepare healthcare leaders for future crises.

Case Studies

The Nebraska Medicine Cyberattack

In September 2020, Nebraska Medicine fell victim to a ransomware cyberattack. ¹ Our IT infrastructure was compromised for 4 days, and the hospital had to quickly divert to analog processes, including manual dose calculations and the use of paper forms to complete order sets and maintain patient records. Because of the ongoing COVID-19 pandemic, many command system structures were already in place. COVID-19 had forced Nebraska Medicine to become operational while under duress, and while the addition of the cyberattack added another layer of mitigation effort, the necessary emergency communication routes were already active.

At Nebraska Medicine, we quickly integrated the cyberattack response with the COVID-19 response; we addressed issues in a daily internal communications safety huddle and had tools in place to assess and prioritize the functionality of certain systems critical to continuity of business. External communications were expanded to include not only the patient, but also the entire family of inpatients and the surrounding community for situational awareness. COVID-19 dashboards already in place to monitor the number of open beds, emergency department volumes, and stock of personal protective equipment were also used to handle the cyberattack.

Throughout the duration of the cyberattack, we were able to pool labor and assign staff where needed to prevent shortages and maintain daily operations, such as monitoring workforce availability given the nuanced positions needed to support the response (eg, staff to organize paper charts, safety resources deployed to frontlines). Leaders were also assigned on a departmental level to identify ownership and accountability for providing critical communication pieces, such as paper incident reporting.

As the cyberattack incident came to an end, Nebraska Medicine took a “dimmer switch” approach to resuming standard online activities. By having a structured scoring strategy that prioritized systems to restore in sequence with their impact to patient safety, the dimmer switch approach enabled everyone to ease in and validate system safety at every step and to observe any secondary impacts to other systems. Ultimately, an after-action report was developed using a decentralized approach, where department leaders identified specific lessons learned from this experience and the defined mitigation and response activities associated with each learning.

From this cyberattack experience, Nebraska Medicine has been able to identify critical areas of business continuity to add to our already robust preparedness strategies. Plans for business continuity have proven to be a vital prevention and mitigation tool for cyberattacks, by identifying critical business infrastructure should power or connectivity of any sort fail. Continuous reevaluation of these plans should be implemented to remain prepared. In addition to business continuity, the cyberattack highlighted the importance of ensuring the on-duty team has the authority to shut down IT systems in the event of a cyberattack. Having this frontline permission structure in place likely limited the overall negative impact to many Nebraska Medicine systems during the event.

Because cyberattacks are considered the top threat to healthcare systems, the Office of the Assistant Secretary for Preparedness and Response, within the US Department of Health and Human Services, developed the Technical Resources, Assistance Center, and Information Exchange (TRACIE) in 2015. ³ TRACIE is an information gateway for health and emergency management professionals to ensure they can access critical information and resources. In February 2021, the TRACIE team, in collaboration with Nebraska Medicine and MedStar Health, published Healthcare System Cybersecurity: Readiness and Response Considerations, ⁴ a resource for identifying best practices and mitigation efforts for cyber incidents in a healthcare setting, such as the incident endured by Nebraska Medicine.

Civil Unrest in Minneapolis

The night following the in-custody murder of George Floyd on May 25, 2020, ² the city of Minneapolis and its emergency medical services (EMS) crews experienced pockets of sporadic violence. On subsequent days, we saw increasing numbers of protesters and casualties as generally well-organized, peaceful daytime demonstrations gave way to nighttime arson and violence. Most of our hospitals in the area had an active ICS for COVID-19 and rapidly pivoted to incorporate new objectives and positions regarding the unrest.

Concern about the spread of COVID-19 during protests led to enhanced public health efforts to urge protesters to wear masks. Public health monitors reported that mask use at many of the major protests was widespread, with no notable uptick in COVID-19 cases in the weeks following. ⁵ This was likely due to the outdoor nature of the protests, combined with mask wearing.

During the time of the protests, COVID-19 cases in Minneapolis were high, with disproportionate effects on the major urban hospitals and particularly the trauma centers. Trauma casualties increased significantly at our medical center, Hennepin Healthcare, a Level I adult and pediatric trauma center and safety net hospital in Minneapolis. For example, on the night of May 28, we admitted 26 patients to our trauma service in 12 hours, including a large number of patients with burns, shooting or stabbing injuries, and injuries from rubber bullets, such as skull fractures and eye injuries. Many more patients were seen and discharged with less serious injuries. Limited numbers of patients presented with riot control agent (ie, tear gas) exposure and our emergency department volumes were stable due to a decrease in usual cases.

Hennepin Healthcare's Critical Care Coordination Center, developed for COVID-19, was used to facilitate this patient movement. This center operated out of the M Health Fairview System Operations Center under contract from the Minnesota Department of Health. The Critical Care Coordination Center receives direct phone calls for patient transfer assistance and coordinates daily phone calls that can be used to broker transfers and request assistance. At Hennepin Healthcare, as a Level 1 trauma center, we were overloaded by trauma patients related to the civil unrest as well as COVID-19 patients; other hospitals agreed to accept transfers from our center so we could maintain safe operational capacity.

Damage to pharmacies and clinics from looting and fires caused lasting issues in access to care and medication. These closures further exacerbated disparities already worsened by the pandemic.

Three days into the unrest, use of Minnesota National Guard troops was approved to protect our vulnerable EMS responders and hospital facilities in the areas of the unrest. These troops accompanied EMS crews that had been unable to respond in several unsafe areas of the city. EMS leadership for Hennepin Healthcare created task forces using National Guard and EMS personnel (including physicians) to rapidly get EMS personnel into and out of potential danger areas to facilitate victim evaluation and extraction. EMS personnel did not enter areas that were clearly unsafe, such as areas undergoing crowd dispersal or areas that were inaccessible due to fires in the street. Callers in unsafe areas were advised to bring patients to a safer area and call 911 again. National Guard personnel rules of engagement, weapons, and body armor were supplied by the state. The EMS chief instructed EMS crews to wear body armor and helmets whenever outside in uncontrolled environments. The National Guard also provided augmented security for several hospitals, including providing security at selected hospital entrances and guarding fixed oxygen supplies due to concern for these systems based on a prior attack. National Guard personnel were trained on infection control precautions but did not ride in ambulances with patients experiencing COVID-19 symptoms.

Freeway closures and the shutdown of Metro Transit created substantial challenges for our evening and night shift hospital and EMS personnel. Staff had to maintain awareness of areas experiencing disruption and EMS providers were encouraged to commute in plain clothes—not in uniform—after violent threats were made. Flight operations into major downtown hospitals were curtailed nightly until the unrest subsided due to frequent targeting of the helicopters with laser pointers. Fortunately, ground ambulances had sufficient access to the major hospitals. However, some hospitals in close proximity to the unrest, including a children's hospital, experienced far lower than usual volumes during these nights, likely due to perceived and actual safety issues for private vehicles and pedestrians attempting to reach the hospital (Jim Leste, MS, FACHE, CHSP, email communication, January 11, 2022). Children's Minnesota hospital was close enough to the fires that the ventilation system was shut down to prevent smoke from entering the facility. ⁶

Response mechanisms established for COVID-19 including full activation of Minnesota's State Emergency Operations Center ⁷ and the statewide healthcare coordination center were leveraged to provide resources and information. Using National Guard personnel deployed for activities related to COVID-19 to support the security of our EMS crews played a critical role in safely carrying out a response to the unrest. The law enforcement Multi-Agency Command Center ⁸ was initiated, including EMS personnel, to ensure integration with current plans and information. The EMS personnel at the Multi-Agency Command Center relayed hospital-relevant information to the healthcare coalition members in the metro area and to the Statewide Healthcare Coordination Center.

Despite many threats, we had no reports of any major physical injuries sustained by healthcare personnel. However, the mental health impacts were considerable due to the combined sustained stress of the COVID-19 response and the immediate safety issues generated by the unrest. Even more difficult is the perception that EMS and fire personnel were being targeted with violence despite their sacrifices made to provide timely and effective 911 response not only during the unrest but throughout the pandemic.

Lessons Learned

The lessons learned from these dual-incident experiences will enable improvements in emergency management through preparedness measures and developing flexible protocols should future simultaneous disasters occur.

Operations

In both dual-disaster scenarios, the implementation of ICS for COVID-19 before the event provided structure and assured some resources were already in place to respond to the additional disaster. With the Nebraska Medicine cyberattack, the health system was able to use the COVID-19 communication plans and ICS structure to streamline both COVID-19 and cyberattack responses. During the civil unrest in Minneapolis, the ICS operating in response to COVID-19 was able to rapidly adjust when the scenario shifted to civil unrest; for example, the ICS used the Critical Care Coordination Center to coordinate movement of patients to relieve the major trauma centers that were disproportionately overloaded due to COVID-19 and trauma admissions.

These experiences highlight the importance of adaptiveness and flexibility when a secondary incident occurs. The ICS framework enables entities to respond to a disaster by providing clear organizational structure and leadership; however, entities are often challenged by simultaneous events. Subject matter experts must be integrated into the decisionmaking processes to ensure that relevant threats are addressed and resources requested. ⁹ Command structures and emergency management can practically tailor dual-purpose response with preexisting resources, ultimately maximizing operational efficiency despite the added burden of an additional crisis. Whether the ongoing incident action plan addresses the second event objectives or a separate plan is developed, the operational tempo, staffing, and positions must be adjusted to ensure that the demands of the second event are addressed without confusion or conflict with the ongoing response.

Safety

The implications of dual-disaster settings on safety are twofold. During the Nebraska Medicine cyberattack, it was imperative to have a seamless manual mechanism for monitoring patient safety, as the usual mechanisms were unavailable. By having many contingency plans in place and leadership identified, Nebraska Medicine was able to accomplish this. Incorporating operations continuity plans for manual patient monitoring and recordkeeping, and backup plans for medical devices that rely on IT infrastructure or power, should be at the forefront of hospital preparedness plans should future cyberattacks occur.

In addition to patient safety, EMS and provider safety plans should be accounted for. Most hospitals do not have specific job action sheets or staff expectations for civil unrest that threatens the ambulances, hospital, or commuting staff; safety plans should be developed in a collaborative manner with the hospital, EMS, and local or state stakeholders. As seen in the civil unrest in Minneapolis, volatile situations call for rapid management decisionmaking and require added security, such as that provided by the National Guard, which was critical to maintaining EMS responses in many areas of the city. The implications of having EMS or hospital personnel injured during a heightened response period are immeasurable, given the already strained workforce in an ongoing public health emergency. In addition to checklists and considerations for management and incident command, it is important to emphasize that staff should put their own safety first. For example, giving EMS personnel discretion about continuing a response in dangerous conditions and allowing hospital staff to stay onsite if desired were important opportunities for staff to interpret current conditions and use their best judgement about their safety, rather than following a blanket policy.

Human Capital

Each scenario described in this case study has implications for human capital. Although secondary and surge response systems were already operationalized via the ongoing COVID-19 responses, the workforce supporting these systems continued to be fatigued. Developing a flexible workforce plan to mitigate the overall burden on personnel should be made a high priority when addressing gaps and weaknesses in system preparedness.

As seen in the Nebraska Medicine cyberattack, implementing labor pools of positions that had been remote due to the pandemic, to ensure coverage was maintained in key new roles that became manual, helped mitigate the impact of the disaster on the system. Recognizing when additional human capital and security are necessary is another piece of navigating the workforce pool available to commit to emergency response, as seen in the civil unrest in Minneapolis, when the National Guard was brought in for added security. The heightened presence of the National Guard provided additional personnel to contribute to the response, as well as an added sense of security and safety for those involved in the response system.

Conclusion

Reflecting on these scenarios provides insight for future disasters. As the COVID-19 pandemic continues, the potential for encountering more dual-disaster scenarios looms. The valuable lessons learned from the Nebraska Medicine cyberattack and civil unrest in Minneapolis highlight the importance of adaptability and creativity across the system. Integrating dual-disaster responses requires close command and logistical coordination. To this end, emergency management should focus preparedness efforts on (1) identifying gaps and weaknesses in security of both the physical and IT systems, (2) improving the ability to redeploy staff, and (3) ensuring that experienced command staff and subject matter experts are prepared to address a range of dynamic challenges.