​WHEN TWO BOMBS WERE DETONATED near the finish line of the Boston Marathon on the afternoon of April 15, 2013, the response of Boston area hospitals was critical. Bonnie Michelman, CPP, director of police, security, and outside services at Massachusetts General Hospital (MGH) and security consultant at Partners Healthcare, Inc., was there. Michelman shared her story with Security Management.

Immediate Aftermath

The Boston Marathon is one of the most exciting events of the year in the Boston area. It’s held annually on Patriots’ Day, the third Monday in April, and it’s regarded as the world’s longest-running annual marathon. It’s an extremely emotional and poignant event for the Boston area and attracts hundreds of thousands of spectators. The finish line of any marathon is a place where families and friends reunite and celebrate a loved one’s major accomplishment. But this year, two Chechen brothers devised pressure-cooker bombs that they set at the marathon’s finish line, turning it from a place of elation to one of horror. The bombs detonated and the area was thrown into chaos. There were hundreds of people who needed immediate medical care; some people were critically injured and three people died.

MGH is less than two miles from the Boston Marathon finish line, so Michelman and staff members knew right away that they’d be receiving many of the bombing victims as well as family and friends. Luckily, there were several other trauma hospitals nearby as well, and Boston Emergency Medical Services divided patients among available facilities in such a way as to ensure that no hospital received too many of the nearly 300 people who needed medical attention after the bombings. MGH received about 36 of the injured.

On a normal day, 50,000 to 60,000 people are in the hospital, according to Michelman. On any given Monday, dozens of surgical procedures are scheduled. On the day of the bombings, regularly scheduled operations had to be put on hold so that five critical patients could be operated on when they arrived at the hospital. These five critical patients were all in surgery within 27 minutes, which is an unbelievable timeframe, says Michelman.

Overloaded, inundated. The bombing’s aftermath presented major challenges right away. Michelman says security operations dispatchers were overloaded with calls from people who wanted to know if friends or family had been sent to that hospital. There were also callers seeking reassurance that patients who had already been at the hospital prior to the bombings were okay. Eventually, the city set up a centralized place for people to obtain information about family and friends, but until then, the hospitals bore the brunt of the calls.

In addition, hundreds showed up in person to check on relatives or friends. There were also runners and spectators who were not critically hurt but who were still coming in to be checked out.

Threat uncertainty. It was difficult early on to communicate with law enforcement regarding the threat. In addition to all of the chaos from the bombings, JFK Library was on fire and there was speculation that that was a bomb as well (the fire turned out to be unrelated). Cell phone networks weren’t working for some time after the bombings, and that added to the communication problems.

Getting the right information out was important for MGH, says Michelman, because many people were receiving inaccurate information from Twitter, Facebook, and even television news.

The hospital was using an e-mail notification system at the time of the bombings, but since then, it has begun implementing a full-scale mass notification system to quickly transmit critical information to employees in a timely way. The new system provides more ways to reach employees and provide real time accurate information during emergencies.

Ongoing Issues

As the days progressed, a number of issues arose and had to be addressed.

Access control. In case of any threat to the hospital, Michelman says, security needed to create a secure environment, but they could not lock down the entire hospital right away because people still needed to come in. There were many more people overall in this incident trying to access the facility than had ever been assumed as a reasonable amount in any of the emergency practice drills. Security chose to lock down the Emergency Department and then set up a visible security presence outside. This included having officers checking out people or vehicles trying to enter the hospital.

They locked down the whole hospital on Monday evening once all of the most seriously injured patients were in, and it was the end of the day past normal visiting hours. Michelman says the lockdown made the situation more controllable. “At that point in time, we felt it was prudent,” she says.

Michelman also deployed security personnel to the Emergency Department. They served both as a deterrent in case there was anyone looking to do harm and also as a visible sign of safety to calm and comfort people who were frightened in this extremely tense situation.

Most of the security staff are special police officers, says Michelman, but she adds that the hospital has different types of officers responsible for different functions. This meant that people may have been at a different location or in a different function than they were used to.

The staff had also undergone Israeli-style behavioral training. Staff members were using what they had learned in this training to help identify whether anyone in the hospital was acting suspiciously and might be a potential threat.

Incident command system. After the news came in about the bombing and the victims were on their way to MGH, the hospital immediately implemented its incident command system (ICS). The ICS is a set of procedures used to coordinate emergency response, and it is part of the National Incident Management System. MGH had implemented its ICS periodically in other situations, such as weather emergencies, information systems going down, and severe violence or threats, Michelman says. The security team had experience implementing the system, but there are always new lessons.

One of the takeaways for future events like this, says Michelman, is that instead of having just one person in command, MGH will likely deploy one commander for the inside areas and one commander for the outside areas to assist the hospital in dealing with the overwhelming number of people who have to be managed. No one person can be in both places addressing all of the issues that arise.

Another lesson learned is to ensure that the dispatchers know who the incident response team is so that they can dispatch people to the right call. Because the magnitude of this event required the hospital to find additional dispatchers, this became a challenge to overcome.

Hazmat tent. Among the decisions that the security team was tasked with early on was whether or not to deploy the hospital’s hazmat tent, which would have been an extensive undertaking. It would have been necessary if the bombs had contained chemical or biological agents. There are employees who are trained to deploy the tent, and MGH would have had to have everyone in and around the tent working in hazmat suits. After discussions with Boston Fire and Police Departments, Michelman says the hospital was told that there was no chemical or biological threat, so they chose not to deploy the tent.

Law enforcement. There was a major law enforcement presence in the hospital, particularly in the Emergency Department and near the operating rooms. Officers from the Boston Police Department and the Massachusetts State Police, as well as SWAT team members, were on site protecting bomb victims and others in the hospital.

In addition, the FBI was working with an investigative team in the Emergency Department. They were collecting evidence from victims, such as shrapnel, metal, and nails. This evidence helped them determine the types of devices the perpetrators had used, which ultimately aided law enforcement agents in apprehending them. Michelman says that the security personnel worked very well with the FBI and other law enforcement officers who were at the hospital.

Suspicious package. At one point, the hospital, already on high alert, had to deal with a suspicious package left in a parking garage. It was a bag and next to the bag was a framed photo of what appeared to be a king. Michelman’s staff called the Boston Bomb Squad but the unit was so busy that she says they ultimately had to wait until the Rhode Island Bomb Squad could come and check it out. People could not leave to go to their cars in that garage, and they couldn’t walk through the main entrance during the wait, so they had to use other entrances. Security had to take care of redirecting people while ensuring that everyone remained calm. It was ultimately determined that the package did not contain an explosive device and was not dangerous.

Media. A main part of dealing with this crisis was interacting with media members who were at the hospital and demanding information continuously. Michelman says it was important to put them where they had access to information but such that people and patients could still get in and out of the hospital when they needed to. “You have to find the place that they can assemble, and you have to make sure that they’re getting information on a timely basis,” she says. MGH put them outside in a designated area.

She added that the hospital also made sure to have press conferences out there every few hours or as the news changed so that the press was continuously updated on what was happening.

Emotions and comfort. On a normal day, hospital staff members must be equipped to deal with heightened emotions of patients and visitors. On the week of the marathon bombings, those emotions were running even higher; they ranged from fear to anger to terror. One MGH employee was threatened by hospital visitors (who assumed he was the same ethnicity as the bombers), and the security staff had to address the situation. MGH also had people who thought the suspect was at the hospital and “wanted a piece of him.” Having additional security present for extra-tense times like these and having additional staff members who are trained in how to defuse these situations is integral to mitigating the threat and preventing violence.

It’s also important to set the tone. “We did our best to make sure there was a place for everyone to go, that we were communicating as much as possible, [and] that we had an appearance and attitude of confidence and safety,” Michelman says. Security also made sure that they had a highly visible officer presence so that it was clear that there were people available to answer questions, especially outside and inside the main lobbies. “All of that helped a lot,” she says.

President’s visit. On Wednesday about 3:00 p.m., Michelman received word that President Obama would be visiting the next day. Normally, an organization would have had five to seven days to prepare for a presidential visit. However, this situation allowed about 18 hours of notice. Michelman says her department pulled an all-nighter with the U.S. Secret Service to get ready for the visit. They needed Social Security numbers and birthdays (so that they could do security checks) for about 800 employees.

“We were asked to see if [the bombing] patients wanted to meet with the President but asked not to tell other people he was coming,” Michelman says. Not only would the President be there but also the mayor and governor, and the new director of the Secret Service.

Michelman says her staff were also tasked with devising the most covert way to get the President into the hospital. The entrance he would have to use, at the loading dock, was not the most attractive part of the hospital. So Michelman says that the staff fixed that by washing and painting the outside before he arrived. They also painted rooms and put up partitions inside the hospital to make things as attractive as possible while keeping him safe and out of public view.

They had a joint command center set up and had plenty of cameras to keep an eye out, but the Secret Service asked the hospital to disconnect the security cameras from the networked server to eliminate any potential risk of hacking.

Another precaution was to commandeer the elevator bank he was using so that no one could get near the President unless they were authorized to. Ultimately, everything went very well. “It was probably the most protected the hospital’s ever been,” Michelman says.

She adds that the look on those families’ faces when the President walked in was priceless. The President insisted on taking pictures with members of the staff as well, and Michelman says it was an enormous morale boost for all MGH employees that he visited at the hospital.

Lockdown. On Thursday night, Michelman says MGH received a page about MIT Police Officer Sean Collier, who’d been shot. He was brought to the Emergency Department, but was unfortunately already deceased. The world would learn later that he was shot by one of the bombing suspects. That event, in which one of the two suspected bombers had also been killed, led authorities to lock down the city as they embarked on a manhunt for the remaining suspect.

Transportation throughout the city was halted. Schools were closed. Residents were being advised to shelter in place. Areas of this city of more than 600,000 were likened to ghost towns. Officials went door to door in nearby Watertown looking for the suspect who would eventually be found hiding in a boat in an area backyard.

A locked-down city has an array of implications for a hospital. While many establishments throughout the city were able to take the day off, a hospital can never take time off or close.

Almost 8,000 employees take public transportation to get to work at the hospital. Many people who were home when the lockdown was initiated could not get to work. The hospital enlisted some employees to help with transporting staff, but it also had to reallocate the people who remained in the building in order to get certain jobs done; for example, it wasn’t unusual that day to see engineers and plumbers washing dishes.

The hospital itself was also locked down. Michelman says that when the lockdown went into effect, anyone at the hospital at that time was encouraged not to leave. The hospital set up places for them to stay, and made Social Service resources available. Those people who insisted on leaving were allowed to do so. “Some people just wanted to go home,” Michelman explains.

Road closings made for other consequences of the citywide lockdown. The hospital needed to get deliveries of critical items, such as drugs, blood, linens, food, and water. The hospital worked with the state police to ensure that hospital suppliers could get through any blocked roadways they encountered.

Still, as difficult as the lockdown was, “we believe that if the Boston Police had not made that choice, they might not have caught the suspect,” Michelman says.

Additional Takeaways 

As much stress as the hospital was under and as tense as the situation was, there were also many heartwarming moments. There was an outpouring of support for the security team from the staff members in the hospital. People brought security staff members baked goods and even sent thank-you notes. The security staff also received gifts of support from other hospitals. “There was a lot of compassion and empathy and support from a lot of people. That was enormous for our energy and morale” Michelman says.

In the months following the event, the hospital completed multiple post-mortem assessments of the bombing aftermath. Michelman says that the staff has developed a plan of action to improve any area they felt might have been stronger. Changes include even small modifications in where cameras are placed and in access control capabilities, for example. Michelman says the assessments have also led to a rethinking of how to use the labor pool and mobilize staff during an event like this.

A key lesson from the incident is the importance of drills, says Michelman. It is especially important that the organization choose scenarios that are incredibly difficult and complex—even seemingly unrealistic—so that when something happens, the hospital will be as prepared as possible.

Hospitals should also drill for events that are longer term, says Michelman. Oftentimes, organizations drill for events that are three, four, or five hours. But the Boston bombing situation in many ways lasted a whole week, she notes. At a minimum, hospitals and other businesses should probably drill for a disruption that would affect operations for several days. That way, says Michelman, the team will get a true sense of how they will have to deal with diminishing resources, for example, if supply lines are cut off for days, or how they will accommodate staff needs if they cannot leave the facility for an extended period. They should look at how the situation will have evolved 10 hours into the event, 24 hours, and 48 hours, she says.

The intangibles also matter, especially during extended events. “I always feel my job is to put people on the right place in the continuum of fear,” explains Michelman. “On one end of that continuum is complacency and on the other end is overreaction, and I feel like it’s my job and the job of my staff to help people find the right place between those two ends.”

Laura Spadanuta is a senior associate editor at Security Management.