HAZARD VULNERABILTY ANALYSIS: ISSUES WITH THE CURRENT MODEL This stuff is boring, but important- we base all of our planning on this stuff. Scot Phelps, JD, MPH, Paramedic, CEM/CBCP/MEP Associate Professor of Emergency Management

Betamax

Probability or chance, is a way of expressing knowledge or belief that an event will occur or has occurred. Divided by…. Three Aspects

Human Impact, times Three Aspects

Property Impact, times Three Aspects

Business Impact, times the mitigating factors of Three Aspects

Preparedness Three Aspects

Internal response Three Aspects

And external response Three Aspects

( ) /18) PROBABILITY X HUMAN IMPACT X PROPERTY IMPACT X BUSINESS IMPACT X PREPAREDNESS X INTERNAL RESPONSE X EXTERNAL RESPONSE Three Aspects

PROBABILITY=1 HUMAN IMPACT=1 PROPERTY IMPACT=2 BUSINESS IMPACT=2 PREPAREDNESS=2 INTERNAL RESPONSE=1 EXTERNAL RESPONSE=2 RELATIVE THREAT=.165 Math for a internal fire Scale of 1-3 where: 3 is high for probability and impacts 3 is low for mitigating factors Example: Fire

Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis. THE KAISER HVA ASKS “HOW DOES THIS HAZARD AFFECT THE HOSPITAL?” THE CORRECT QUESTIONS IS “HOW ARE THE HOSPITAL’S BUSINESS PROCESSES EFFECTED BY A HAZARD?” Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.

Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis. Our Mission is to Care for the Sick and Injured “serving the sick” view of clinicians Hospital as a business view of business people Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.

Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis. Our Mission is to Manage the Business of Caring for the Sick and Injured “serving the sick” view of clinicians Hospital as a business view of business people Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.

HOW DOES THIS BUSINESS UNIT SERVE THE HOSPITAL? Business Impact Analysis.

Business Impact Analysis. HOW IS IT EFFECTED BY CRISIS “X”? CAN IT STOP AND FOR HOW LONG? WHAT HAPPENS IF IT “BREAKS”? Business Impact Analysis.

WHAT OTHER UNITS OF THE HOSPITAL DEPEND ON IT TO FUNCTION? Unseen interdependencies Business Impact Analysis.

Business Impact Analysis. HOW MANY OF YOU KNOW: HOW LONG YOUR BILLING OFFICE CAN HAVE NO INTERNET ACCESS UNTIL YOUR HOSPITAL IS BANKRUPT? HAVE AUTHORIZED THE PAYROLL COORDINATOR AS “ESSENTIAL PERSONNEL”? BCP BIA is process-focused, and this is more valid because we can’t control the hazard, we can implement strategies to limit the impact on aspects of our business. No global answer how a hazard impacts “the hospital”- need to look at impact on all business unit and their critically to the mission. How many of you know how long you billing office can lose internet capability before your hospital is bankrupt? IT IS NOT JUST ABOUT TAKING CARE OF PATIENTS. Payday example. Medicare Business Impact Analysis.

HUMAN IMPACT IS UNDERVALUED “Our most important asset is our people.” Issue #2: People are Important

Issue #2: People are MORE Important…. These are NOT equivalent... Issue #2: People are MORE Important….

Flood had property impact of 3, Hazmat has human impact of 3, both ranked at .20

Issue #3: Mitigation Can Hide Magnitude MAGNITUDE OF IMPACTS CAN BE “OUTWEIGHED” BY MITIGATION, EVEN IF MITIGATION DOES NOT ADDRESS THAT PARTICULAR FACTOR Issue #3: Mitigation Can Hide Magnitude

High impact/high preparedness is equal to low impact/low preparedness @ .27 The comparison is not particularly valid, since the stakes are so much higher.

PROBABILITY CAN “BURY” IMPACT AND DISTORT RELATIVE RISK Issue #4: Probability Can Hide Impact

Low probability/High Impact/Highly mitigated event has a risk of .22 High probability/Low impact/Highly mitigated event has a risk of .33

Risk IS About Frequency…. Snowstorms in New York are a high frequency/low impact/highly prepared event. Risk IS About Frequency….

Risk IS About Frequency… February 1st and 2nd, 2009, 8 (4 + 4) inches of snow Snowstorms in London are a low frequency/high impact/low prepared event. Risk IS About Frequency…

WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS? Pb/3((Hu+Py+Bz+Pr+IP+EP)/18) NY 3/3(1+1+2+1+2+1)/18)= 1 x .44 = .44 LN 1/3(1+1+3+3+3+3)/18)= .33 x ,77 = .43 Risk IS About Frequency….

WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS? New York’s Relative Risk=.44 WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS? NY 3/3(1+1+2+1+2+1)/18)= 1 x .44 = .44 Risk IS About Frequency….

WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS? London’s Relative Risk=.43 WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS? LN 1/3(1+1+3+3+3+3)/18)= .33 x ,77 = .43 Risk IS About Frequency….

Risk IS About Frequency…. “BLIZZARD OF ANGER FOLLOWS LONDON SNOWSTORM”-ASSOCIATED PRESS "ONE OF THE WORLD'S BIGGEST ECONOMIES SHOULD NOT BE GRINDING TO A HALT…” $4.3 BILLION COST IN LOST PRODUCTIVITY I know this model is designed for INTERNAL, RELATIVE comparison only, But it illustrates that it isn’t the agent/event, it is the impact and goes to illustrate the point that….. Risk IS About Frequency….

What We Should Worry About…. Low Frequency/High Impact High Frequency/Low Impact (Kaiser Model) High Frequency/High Impact Low Frequency/Low Impact Experience=Competency for the yellow Gordon Graham

Inside the Low Frequency/High Impact Box…. Fast Decision Required Slow Decision Required

Inside the Low Frequency/High Impact Box…. Fast Decision Required Fast Decision Required Slow Decision Required Gunmen in the hospital (Code Silver) Hazmat events (Code Orange)

“Red Flag” Sentinel Risks Red Flag Risk Any Human Impact which may seriously injure (7 or above) is a sentinel risk which MUST be controlled for.

“Red Flag” Sentinel Risks Yellow Flag Risk Any Risk type where adequate controls to protect high-value assets are not in place

WHAT WE DO: CRITICAL FUNCTIONS Where & How We Do It. Revised Model

ADMINISTRATION ENGINEERING SUPPLY CHAIN DATA CENTER/IT EMS EMERGENCY DEPARTMENT SURGERY CLINIC/OUTPATIENT OPERATIONS INPATIENT OPERATIONS SECURITY FOOD SERVICE HOUSEKEEPING LABORATORY PHARMACY What we DO Where & How We Do It. Critical Functions

WHAT WE NEED TO DO IT: CRITICAL INFRASTRUCTURE What we DO Where & How We Do It. Revised Model

Critical Infrastructure SITE ARCHITECTURAL STRUCTURAL SYSTEMS BUILDING ENVELOPE UTILITY SYSTEMS MECHANICAL SYSTEMS PLUMBING & GAS SYSTEMS ELECTRICAL SYSTEMS FIRE ALARM SYSTEMS COMMUNICATION & IT SYSTEMS EQUIPMENT OPERATIONS & MAINTENANCE SECURITY SYSTEMS EMERGENCY MANAGEMENT What we DO Where & How We Do It. Critical Infrastructure

Asset Value Revised Model

Threat Revised Model

Vulnerability Revised Model

Human Impact Factor Revised Model

Asset Value-How Critical Is It to the Mission? Asset Value (Payroll as Example) Very High 10 Critical asset for all aspects of business High 8-9 Key asset for all aspects of business Med High 7 Key asset for some aspects of business Medium 5-6 Important asset for all aspects of business Med Low 4 Important asset for some aspects of business Low 2-3 Useful asset for all aspects of business Very Low 1 Useful asset for some aspects of business Asset Value-How Critical Is It to the Mission?

Threat (cumulative)-What Can Happen? Existence 2 Capability 2 History 2 Intentions 2 Targeting 2 Existence and Capability are precursors to probability (in probability, the agent has to be able to cause the harm) History, Intentions, and Targeting are related to probability. This model DOES include probability, but gives it MUCH less weight than the Kaiser Model. Threat (cumulative)-What Can Happen?

Vulnerability-How Protected is the Asset? Very High 10 One of more major weaknesses, extremely susceptible High 8-9 One of more significant weaknesses, highly susceptible Med High 7 One of more important weaknesses, very susceptible Medium 5-6 One of more weaknesses, fairly susceptible Med Low 4 One of more weaknesses, somewhat susceptible Low 2-3 One of more minor weaknesses, slightly susceptible Very Low 1 No weaknesses exist Vulnerability-How Protected is the Asset?

Human Impact Factor Human Impact Factor Very High 10 Humans will be killed High 8-9 Humans may be killed Med High 7 Humans will be seriously injured Medium 5-6 Humans may be seriously injured Med Low 4 Humans will face direct economic injury Low 2-3 Humans will face indirect economic injury Very Low 1 Humans will face minor injuries Human Impact Factor

“Red Flag” Sentinel Risks Red Flag Risk Any Human Impact which may seriously injure (7 or above) is a sentinel risk which MUST be controlled for.

“Red Flag” Sentinel Risks Yellow Flag Risk Any Risk type where adequate controls to protect high-value assets are not in place

For Each Agent/Hazard Critical Functions Critical Infrastructure Value Threat Vulnerability Human Value Threat Vulnerability Human Critical Infrastructure What we DO Where & How We Do It. For Each Agent/Hazard

Identifies Human Impact rated 7 or greater and marks them in RED Identifies situations where Assets valued over 7 and average of Threat + Vulnerability greater than Asset Value=YELLOW Risks ranked by number and colored: 1-6000=GREEN 6001-9000=YELLOW 9001-100000=RED

For Each Agent/Hazard What we DO Where & How We Do It. CF-Natural Hazards CI-Natural Hazards CF-Technological Hazards CI-Technological Hazards CF-Human Hazards CI-Human Hazards CF-Hazardous Materials CI-Hazardous Materials What we DO Where & How We Do It. For Each Agent/Hazard

NEED TO UNDERSTAND IMPACT ON BUSINESS UNITS HUMAN IMPACT IS MOST IMPORTANT FACTOR NEED TO LOOK FOR OUTLIERS IN HIGH VALUE/HIGH THREAT /HIGH VULNERABILITY ASSETS KAISER MODEL CAN BURY HUMAN IMPACT IN IMPACTS, MITIGATION, OR PROBABILITY Blizzard of anger follows London snowstorm CONCLUSION

SCOT PHELPS, JD, MPH, PARAMEDIC, CEM/CBCP/MEP ASSOCIATE PROFESSOR OF EMERGENCY MANAGEMENT SOUTHERN CONNECTICUT STATE UNIVERSITY 144 FARNHAM AVENUE NEW HAVEN, CT 06515 PHELPSS1@SOUTHERNCT.EDU QUESTIONS?