1. HAZARD VULNERABILTY ANALYSIS: ISSUES WITH THE CURRENT MODEL
This stuff is boring, but important- we base all of our planning on this stuff.
Scot Phelps, JD, MPH, Paramedic, CEM/CBCP/MEP
Associate Professor of Emergency Management

2. Betamax

3. Probability or chance, is a way of expressing knowledge or belief that an event will occur or has occurred.
Divided by….
Three Aspects

4. Human Impact, times
Three Aspects

5. Property Impact, times
Three Aspects

6. Business Impact, times the mitigating factors of
Three Aspects

7. Preparedness
Three Aspects

8. Internal response
Three Aspects

9. And external response
Three Aspects

10. (
) /18)
PROBABILITY X HUMAN IMPACT X PROPERTY IMPACT X BUSINESS IMPACT X PREPAREDNESS X INTERNAL RESPONSE X EXTERNAL RESPONSE
Three Aspects

11. PROBABILITY=1 HUMAN IMPACT=1 PROPERTY IMPACT=2 BUSINESS IMPACT=2 PREPAREDNESS=2 INTERNAL RESPONSE=1 EXTERNAL RESPONSE=2 RELATIVE THREAT=.165
Math for a internal fire
Scale of 1-3 where:
3 is high for probability and impacts
3 is low for mitigating factors
Example: Fire

12. Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.
THE KAISER HVA ASKS “HOW DOES THIS HAZARD AFFECT THE HOSPITAL?” THE CORRECT QUESTIONS IS “HOW ARE THE HOSPITAL’S BUSINESS PROCESSES EFFECTED BY A HAZARD?”
Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.

13. Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.
Our Mission is to Care for the Sick and Injured
“serving the sick” view of clinicians
Hospital as a business view of business people
Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.

14. Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.
Our Mission is to Manage the Business of Caring for the Sick and Injured
“serving the sick” view of clinicians
Hospital as a business view of business people
Issue #1: Hospitals are a BUSINESS- Need a Business Impact Analysis.

15. HOW DOES THIS BUSINESS UNIT SERVE THE HOSPITAL?
Business Impact Analysis.

16. Business Impact Analysis.
HOW IS IT EFFECTED BY CRISIS “X”? CAN IT STOP AND FOR HOW LONG? WHAT HAPPENS IF IT “BREAKS”?
Business Impact Analysis.

17. WHAT OTHER UNITS OF THE HOSPITAL DEPEND ON IT TO FUNCTION?
Unseen interdependencies
Business Impact Analysis.

18. Business Impact Analysis.
HOW MANY OF YOU KNOW: HOW LONG YOUR BILLING OFFICE CAN HAVE NO INTERNET ACCESS UNTIL YOUR HOSPITAL IS BANKRUPT? HAVE AUTHORIZED THE PAYROLL COORDINATOR AS “ESSENTIAL PERSONNEL”?
BCP BIA is process-focused, and this is more valid because we can’t control the hazard, we can implement strategies to limit the impact on aspects of our business.
No global answer how a hazard impacts “the hospital”- need to look at impact on all business unit and their critically to the mission. How many of you know how long you billing office can lose internet capability before your hospital is bankrupt? IT IS NOT JUST ABOUT TAKING CARE OF PATIENTS.
Payday example.
Medicare
Business Impact Analysis.

19. HUMAN IMPACT IS UNDERVALUED
“Our most important asset is our people.”
Issue #2: People are Important

20. Issue #2: People are MORE Important….
These are NOT equivalent...
Issue #2: People are MORE Important….

21. Flood had property impact of 3, Hazmat has human impact of 3, both ranked at .20

22. Issue #3: Mitigation Can Hide Magnitude
MAGNITUDE OF IMPACTS CAN BE “OUTWEIGHED” BY MITIGATION, EVEN IF MITIGATION DOES NOT ADDRESS THAT PARTICULAR FACTOR
Issue #3: Mitigation Can Hide Magnitude

23. High impact/high preparedness is equal to low impact/low preparedness @ .27
The comparison is not particularly valid, since the stakes are so much higher.

24. PROBABILITY CAN “BURY” IMPACT AND DISTORT RELATIVE RISK
Issue #4: Probability Can Hide Impact

25. Low probability/High Impact/Highly mitigated event has a risk of .22
High probability/Low impact/Highly mitigated event has a risk of .33

26. Risk IS About Frequency….
Snowstorms in New York are a high frequency/low impact/highly prepared event.
Risk IS About Frequency….

27. Risk IS About Frequency…
February 1st and 2nd, 2009, 8 (4 + 4) inches of snow
Snowstorms in London are a low frequency/high impact/low prepared event.
Risk IS About Frequency…

28. WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS?
Pb/3((Hu+Py+Bz+Pr+IP+EP)/18) NY
3/3( )/18)= 1 x .44 = .44 LN
1/3( )/18)= .33 x ,77 = .43
Risk IS About Frequency….

29. WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS?
New York’s Relative Risk=.44
WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS? NY
3/3( )/18)= 1 x .44 = .44
Risk IS About Frequency….

30. WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS?
London’s Relative Risk=.43
WHICH COMMUNITY HAS MORE “RISK” WHEN IT SNOWS? LN
1/3( )/18)= .33 x ,77 = .43
Risk IS About Frequency….

31. Risk IS About Frequency….
“BLIZZARD OF ANGER FOLLOWS LONDON SNOWSTORM”-ASSOCIATED PRESS "ONE OF THE WORLD'S BIGGEST ECONOMIES SHOULD NOT BE GRINDING TO A HALT…” $4.3 BILLION COST IN LOST PRODUCTIVITY
I know this model is designed for INTERNAL, RELATIVE comparison only, But it illustrates that it isn’t the agent/event, it is the impact and goes to illustrate the point that…..
Risk IS About Frequency….

32. What We Should Worry About….
Low Frequency/High Impact
High Frequency/Low Impact
(Kaiser Model)
High Frequency/High Impact
Low Frequency/Low Impact
Experience=Competency for the yellow
Gordon Graham

33. Inside the Low Frequency/High Impact Box….
Fast Decision Required
Slow Decision Required

34. Inside the Low Frequency/High Impact Box….
Fast Decision Required
Fast Decision Required
Slow Decision Required
Gunmen in the hospital (Code Silver)
Hazmat events (Code Orange)

35. “Red Flag” Sentinel Risks
Red Flag Risk
Any Human Impact which may seriously injure (7 or above) is a sentinel risk which MUST be controlled for.

36. “Red Flag” Sentinel Risks
Yellow Flag Risk
Any Risk type where adequate controls to protect high-value assets are not in place

37. WHAT WE DO: CRITICAL FUNCTIONS
Where & How We Do It.
Revised Model

38. ADMINISTRATION ENGINEERING SUPPLY CHAIN DATA CENTER/IT EMS EMERGENCY DEPARTMENT SURGERY CLINIC/OUTPATIENT OPERATIONS INPATIENT OPERATIONS SECURITY FOOD SERVICE HOUSEKEEPING LABORATORY PHARMACY
What we DO
Where & How We Do It.
Critical Functions

39. WHAT WE NEED TO DO IT: CRITICAL INFRASTRUCTURE
What we DO
Where & How We Do It.
Revised Model

40. Critical Infrastructure
SITE ARCHITECTURAL STRUCTURAL SYSTEMS BUILDING ENVELOPE UTILITY SYSTEMS MECHANICAL SYSTEMS PLUMBING & GAS SYSTEMS ELECTRICAL SYSTEMS FIRE ALARM SYSTEMS COMMUNICATION & IT SYSTEMS EQUIPMENT OPERATIONS & MAINTENANCE SECURITY SYSTEMS EMERGENCY MANAGEMENT
What we DO
Where & How We Do It.
Critical Infrastructure

41. Asset Value
Revised Model

42. Threat
Revised Model

43. Vulnerability
Revised Model

44. Human Impact Factor
Revised Model

45. Asset Value-How Critical Is It to the Mission?
Asset Value (Payroll as Example)
Very High 10 Critical asset for all aspects of business
High 8-9 Key asset for all aspects of business
Med High 7 Key asset for some aspects of business
Medium Important asset for all aspects of business
Med Low 4 Important asset for some aspects of business
Low 2-3 Useful asset for all aspects of business
Very Low 1 Useful asset for some aspects of business
Asset Value-How Critical Is It to the Mission?

46. Threat (cumulative)-What Can Happen?
Existence 2 Capability 2 History 2 Intentions 2 Targeting 2
Existence and Capability are precursors to probability (in probability, the agent has to be able to cause the harm)
History, Intentions, and Targeting are related to probability.
This model DOES include probability, but gives it MUCH less weight than the Kaiser Model.
Threat (cumulative)-What Can Happen?

47. Vulnerability-How Protected is the Asset?
Very High 10 One of more major weaknesses, extremely susceptible
High 8-9 One of more significant weaknesses, highly susceptible
Med High 7 One of more important weaknesses, very susceptible
Medium One of more weaknesses, fairly susceptible
Med Low 4 One of more weaknesses, somewhat susceptible
Low 2-3 One of more minor weaknesses, slightly susceptible
Very Low 1 No weaknesses exist
Vulnerability-How Protected is the Asset?

48. Human Impact Factor Human Impact Factor
Very High 10 Humans will be killed
High 8-9 Humans may be killed
Med High 7 Humans will be seriously injured
Medium Humans may be seriously injured
Med Low 4 Humans will face direct economic injury
Low 2-3 Humans will face indirect economic injury
Very Low 1 Humans will face minor injuries
Human Impact Factor

49. “Red Flag” Sentinel Risks
Red Flag Risk
Any Human Impact which may seriously injure (7 or above) is a sentinel risk which MUST be controlled for.

50. “Red Flag” Sentinel Risks
Yellow Flag Risk
Any Risk type where adequate controls to protect high-value assets are not in place

51. For Each Agent/Hazard Critical Functions Critical Infrastructure
Value
Threat
Vulnerability
Human
Value
Threat
Vulnerability
Human
Critical Infrastructure
What we DO
Where & How We Do It.
For Each Agent/Hazard

52. Identifies Human Impact rated 7 or greater and marks them in RED
Identifies situations where Assets valued over 7 and average of Threat + Vulnerability greater than Asset Value=YELLOW
Risks ranked by number and colored:
1-6000=GREEN =YELLOW =RED

53. For Each Agent/Hazard What we DO Where & How We Do It.
CF-Natural Hazards
CI-Natural Hazards
CF-Technological Hazards
CI-Technological Hazards
CF-Human Hazards
CI-Human Hazards
CF-Hazardous Materials
CI-Hazardous Materials
What we DO
Where & How We Do It.
For Each Agent/Hazard

54. NEED TO UNDERSTAND IMPACT ON BUSINESS UNITS HUMAN IMPACT IS MOST IMPORTANT FACTOR NEED TO LOOK FOR OUTLIERS IN HIGH VALUE/HIGH THREAT /HIGH VULNERABILITY ASSETS KAISER MODEL CAN BURY HUMAN IMPACT IN IMPACTS, MITIGATION, OR PROBABILITY
Blizzard of anger follows London snowstorm
CONCLUSION

55. SCOT PHELPS, JD, MPH, PARAMEDIC, CEM/CBCP/MEP ASSOCIATE PROFESSOR OF EMERGENCY MANAGEMENT SOUTHERN CONNECTICUT STATE UNIVERSITY 144 FARNHAM AVENUE NEW HAVEN, CT
QUESTIONS?