Lessons Healthcare Security Professionals Learned from Hurricane Harvey
Like many other monumental events that trigger change, 2017's Hurricane Harvey had a small beginning. What started out as a weak, typical August tropical storm, expected to dissipate over the central Caribbean Sea, ultimately evolved into a category 4 hurricane that would bring Houston, Texas, catastrophic flooding with more than 60 inches of rainfall centered on the Gulf Coast region of the state. Not only was Harvey the second most expensive hurricane in U.S. history, according to the U.S. National Oceanic and Atmospheric Administration (NOAA), it was also Texas's deadliest storm since 1919, directly responsible for 68 deaths.
Although hospitals in and around Houston were well-prepared to sustain their operations through natural disasters like hurricanes and tropical storms, Harvey's impacts forced healthcare security professionals along the Gulf Coast to consider a different perspective to emergency management.
Every year, from 1 June to 30 November, "hurricane season" is on Houstonians' minds, with residents watching weather reports for weather patterns in the Gulf of Mexico that could signal a hurricane event. Healthcare organizations within the greater Houston area—mandated to have an all hazards approach to emergency management—prepare for hurricanes as an eventuality. Residents rely on healthcare facilities to be open and available to meet the needs of the community 24/7, and these facilities are often the bedrock of the community. A hurricane does not diminish the need or expectation that the facility will meet its core responsibility to the community—to provide healing and comfort to those in need.
Despite established preparations, recent major hurricanes and tropical storms provided unique teaching moments, including Tropical Storm Allison, which significantly impacted hospital operations and initiated drastic changes to storm plans.
According NOAA's National Hurricane Center, Allison dropped approximately 37 inches of rain over a span of six days in June 2001, setting a new record for the worst urban flooding in U.S. history. The heavy rainfall led to devastating floods throughout the Texas Medical Center (TMC), a 2.1-square-mile Houston neighborhood that is home to more than 60 medical facilities. Most hospital basements in the TMC were inundated with water, resulting in the evacuation and closure of nine out of 13 district hospitals. The storm prompted TMC hospitals to form task forces and coordinate responses to potential flooding, including installing flood gates and initiating joint communications.
Houston area hospitals endured major weather-related disasters after Allison, but nothing as disruptive as Harvey. As the hurricane approached, hospitals across Houston braced for impact according to their Emergency Operation Plans (EOP), in addition to regularly scheduled preparations performed at the beginning of hurricane season every June. Healthcare security leaders operating in natural disaster-prone areas are keenly aware of threats to their respective organizations when disruptive events strike. These dynamic and trying situations can range from the control of an influx of displaced people into a medical facility, to caring for those injured from a mass casualty standpoint, to addressing criminal activity instigated by opportunity-seekers preying on people and property.
With physical security aspects in mind and appropriate control measures in place, many security leaders in Houston ensured that healthcare organizations could continue providing services to the community while simultaneously protecting people and property throughout Harvey. Successful security leaders established effective measures by adhering to the principles of preparedness, execution, and recovery. However, given the unprecedented flooding, Harvey chalked up more than $125 billion in damage and wreaked property destruction throughout 50 counties in Texas, according to NOAA. Only Hurricane Katrina was costlier.
Harvey also presented some unique challenges to the region's hospitals and their security leaders. Some healthcare facilities experienced forced evacuations, sending patients and staff to other facilities due to major flooding from nearby rivers or bayous. With proper preparations in place, healthcare organizations' security leaders, who were also able to execute those preparations, protected facilities' assets until buildings reopened.
Preparedness
From a physical security standpoint, adequate preparation for a hurricane or other significant weather event is of paramount necessity in providing a successful strategy to protect people and assets from disaster-associated loss events like criminal activity. As Harvey continued to intensify late on 23 August during its approach to Houston, area healthcare facilities continued preparations according to their respective EOP guidelines.
Most healthcare organizations in the Houston area use clearly articulated and documented polices designating a team that will be on duty when a hurricane makes landfall, commonly identified as a "ride-out team." A "clean up" or "relief" team fills supporting roles, such as prep work at a facility before the hurricane's landfall and relief for the ride-out team once the hurricane event ends. During preparations for Harvey, security leaders used internal policies to clearly identify the teams and had them ready to fulfill predefined tasks. Ride-out teams often care for patients' critical needs and assist other staff by ensuring facility operations run as smoothly as possible during a hurricane or other emergencies, according to the University of Texas, while relief teams provide services like transportation for staff after an event has passed.
Since there may be a significant uptick in people entering a facility and increased vehicular traffic after a hurricane, leaders should ensure that hospital security staff have necessary tools and resources prior to a hurricane's landfall. Before Harvey, well-prepared leaders ensured that their staff had access to enough portable radios and chargers to support the additional staff on duty, flashlights, rain weather gear, barricades for vehicular and/or pedestrian control, visitor identification mechanisms that could handle a large influx of people into the facility, and traffic cones.
Security team members should also have a predetermined plan to control access into the facility. Most healthcare organizations in Houston control facility access with monitored access points, screening people prior to entering. At hospitals with well-defined and appropriately exercised plans, this mitigated potential issues during Harvey when people attempted to enter a facility for nefarious purposes.
Another matter to consider is using an agency that provides off-duty law enforcement officers from outside the affected area for additional facility support. During a hurricane, any local off-duty law enforcement that typically support a medical facility may be unavailable since they will instead be required to provide police services for the city or county, and local security personnel may be unable to get to work. As a result, extraordinary or costly measures may have to be taken during a disaster, further stressing resources. Having an agreement in place well ahead of hurricane season with an agency that provides security officer services allows healthcare facilities to adequately arrange for security resources from other regions that can support clients dealing with severe weather-related events. Alternatively, having these security teams at the ready and on site before a hurricane's landfall could also mitigate any absences of security personnel that are due to extreme weather conditions. Such measures should be considered necessary to ensure adequate protection during hurricanes or similar events.
Extreme weather events prior to 2017 highlighted a need for improved communications support for both landlines and cell phones. Communication is always a challenge during disaster events, and during Harvey most organizations were able to address the issue with portable radios that could communicate across a facility, and for large organizations between facilities. Some organizations also had a backup communications system, ensuring communications between facilities and any security, clinical, and engineering specialists in the field.
Security professionals should also prepare with emergency management and facilities partners, given the intersection of duties during an extreme weather event like Harvey. All teams need to be ready for elevated emotional situations and people who may use the disaster to take advantage of organizations or persons. These teams should anticipate and determine under what conditions to assess damage and building security, especially if there are undamaged but coveted assets that withstand a major hurricane. Although there were no significant issues during Harvey with unoccupied hospital properties, teams should prepare for potential vandalism or other loss events.
Execution
Wind forces and property damages resulting from Harvey were not the biggest issues; those were the flooding, the structural damages, and the number of days the hurricane lasted. Hospitals' EOPs require facilities to have a 96-hour sustainability plan and an inventory of their assets, which include measures to be self-dependent through four days. These measures include, but are not limited to, having a plan to provide food, medical supplies, generator fuel, and other necessities.
While several Houston healthcare facilities maintained operations during Harvey due to adherence to their sustainability plans, the hurricane showed that while area hospitals are well prepared to survive hurricane seasons, there are dynamics that can challenge sustainability and business continuity.
After making landfall along the middle Texas coast, Harvey stalled over the greater Houston area, dumping rain for more than four days in an urban region with poor drainage—a byproduct of the city's recent housing boom—that in turn led to rapid ground saturation and overwhelmed local waterways. Beyond the damage to buildings and direct threat to lives, the subsequent flooding also rendered most roads inaccessible, further isolating some ride-out teams from their relief teams.
Most facilities with ride-out and relief teams, appropriately organized prior to hurricane season, were successful in keeping down impacts from fatigue or stress and provided sufficient support, essentially allowing one team to rest while the other was on duty. Previous storms and hurricanes taught area security leaders that in response to an anticipated landfall, following healthcare facility policies and properly staffing a facility with enough employees to outlast the storm is essential to success.
But Harvey's unpredictability and duration still stressed healthcare staffs, with employees forced to shelter inside and work through stress and deprivation for an extended period, without reprieve or news about their personal investments and connections—their families and homes. In one instance, a staff member was informed about a personal tragedy, but the inundated roadways and weather conditions Harvey created made leaving the facility impossible.
The protracted rainfall from the hurricane forced security leaders to reconsider disaster plans and response spectrums, altering them to respond to extreme weather events lasting over extended periods. With a need to expect longer storm durations, there should be plans to immediately and safely relieve ride-out teams through flooded streets if a storm lasts more than 96 hours. Hospitals in flood zones should invest in transportation that can maneuver through or around flooded areas that allow for patient movement in case of facility evacuations. Vehicles able to navigate through flood waters, such as high-water ambulance buses, could also provide an option to transporting essential staff to work, in accordance with internal policies. During Harvey, there were several instances where staff members with high-mounted trucks volunteered to transport other employees, especially ride-out and relief teams.
Proper execution of hurricane-related plans for the hospital facility's security team is vitally important. Those plans need to be flexible as conditions may drastically change. Thinking outside of the box is critical and ensures that the team maintains situational awareness and can respond to emerging situations, regardless of how unexpected and unusual they may be. For example, instead of transporting displaced persons to shelters that were set up to provide for those individuals' needs, sometimes emergency responders, rescue workers, or volunteers brought groups of displaced residents to hospitals. These persons were not left there because they needed medical attention, but because these facilities were considered places of shelter for the community. Hospitals were then faced with flooded facilities and patients with actual medical emergencies, in addition to supporting and managing persons who needed shelter, food, and in some instances clothing, but not medical treatment.
These unannounced and uncoordinated instances of people dropped off randomly at hospitals forced executive leadership teams and security leaders to revise plans in order to meet the needs and safety of the unexpected newcomers, while also arranging for and ensuring that government officials would transport these displaced persons to better-equipped shelters as soon as possible. Given the massive rescue operations needed after the storm, multiple agencies, such as the U.S. Coast Guard, National Guard, and others, performed rescue operations with no coordination with hospitals. Moving forward, healthcare organizations are reaching out to city officials and other leaders about improving coordination, allowing for transportation to shelters, and avoiding unnecessary confusion and stress of resources.
Recovery
After any hurricane, there is the huge task of recovery. Healthcare security teams play a vital role in helping the hospital or medical facility shift back into normal operations as soon as it is prudent, making established communications channels and procedures between departments once again vital.
Healthcare groups have learned to look after their own staff. Some organizations contract out with gasoline vendors and have their trucks travel to a fueling, which allows employees to avoid the likely long lines or shortages at gas stations.
Some employers also start a clock during a disaster, working within a specific time frame to ensure that staff who were home during a hurricane either check in or are checked on. Other healthcare leaders coordinate through their human resources department to deploy welfare checks on staff that failed to check in, with the organization's security department and local police reaching out to see if those individuals are safe.
Every hurricane event provides an opportunity to see what can be done better going forward. Hurricane Harvey left an impact on the area that will be felt for many years, and its devastating effects led to many learning opportunities. Although hospitals can be as proactive as possible, facilities should expect to run into several challenges during a severe storm. With the right coordination, planning, and preparation, most of those challenges can be minimized to leave more time and energy for emergency personnel, first responders, and healthcare providers to focus on saving lives during difficult events.
Elhadji Sarr, CPP, was the Chair of the ASIS Healthcare Security Council from 2016 to 2018 and has managed the Security and Emergency programs of large hospitals in the Gulf Coast Region. Keith McGlen, CPP, CHPA, has more than 29 years of experience in healthcare settings. McGlen is a member of the ASIS International Healthcare Security Council.
