Pandemic influenza and critical infrastructure dependencies: possible impact on hospitals

In the late 1990s, hospitals were looked at collectively as organisations under threat, because of the Y2K problem,1 which had the potential to affect the operation of core computerised systems and cause havoc with all machinery based on or connected to computers and microchips. Massive investment in new computer equipment was the overall response to this threat, and in the event few systems malfunctioned.

As an acute global threat, pandemic influenza is different in many respects: its arrival date is uncertain and it is not organisation-specific, but ubiquitous by definition. It has the potential to affect humans in large numbers over a longer period, possibly months, and its severity is unknown.

Severe acute respiratory syndrome (SARS) showed that health staff were particularly vulnerable and reported sick in large numbers. With pandemic influenza, 30%–50% of hospital staff may not be able to work — some because of illness, some because of competing family responsibilities, and others because of fear.2 Certain departments of a given hospital with small teams may be completely without staff (eg, the information technology [IT] or accounting departments).

In their pandemic preparedness plans, businesses often assume that a significant proportion of their staff will be unavailable to attend work.3 For example, the New South Wales Health Services Functional Area Supporting Plan recommends contingency plans for surge staff capacity involving the use of medical and nursing students, retired health care workers, and other groups.4 However, absenteeism is not the only factor that can affect the availability of external critical infrastructure. For example, a handful of anthrax-contaminated letters in the United States in 2001 effectively shut down the entire US postal service for days, showing that even perceived health threats can cripple infrastructure.5 In the case of Hurricane Katrina in 2005, police walkie-talkies were rendered useless within hours because the relay stations had run out of power.6

Existing hospital-specific disaster management plans address surge response in relation to terrorist attacks and other emergencies.7,8 However, it is unclear how many hospitals actually have a detailed pandemic or disaster management plan that adequately addresses critical infrastructure. Current pandemic plans focus on health interventions to control outbreaks, and human resource management. Although most hospitals have continuity or disaster plans, our review of these plans has shown that they are not necessarily linked to pandemic preparedness planning.

Large-scale preparations are underway in many countries, at all layers of social organisation from hospitals to councils and businesses, to cope with large numbers of people falling sick or dying from pandemic influenza.9,10

Today in developed societies, industry, businesses and other organisations do not operate as isolated entities. Plans need to consider the complexity and interdependency of systems upon which hospitals rely. The failure of one system can trigger a failure of another, causing cascading breakdowns (Box 1). Health is only one of the many systems that struggle at maximum capacity during “normal” times, as current business models operate with no or minimal “excess” staff and thus have become irreducible operations. This makes a system highly vulnerable to acute disruptions, such as a pandemic.

Hospitals, like other organisations, rely on “critical infrastructure” — goods and services that are essential to everybody, which include not only health, but energy, transport, telecommunications, water, emergency services, sewage disposal, and garbage removal (Box 2).

The absence or failure of any of these services can, within a short time, affect entire segments of society or businesses.

Although many hospitals have at least basic plans in place that outline the measures that must be taken if subsystems such as power or water supply are interrupted, these plans assume that such interruptions will be limited in duration and overall effect.11 For example, diesel generators would have fuel to run them for a few hours, and IT installations would run from special power supplies to prevent data corruption of critical patient databases. Some specialised departments, such as intensive care and emergency, may have dedicated equipment and resources to overcome short disruptions, which are more widely recognised as potential risks and have been catered for by many plans.12

Threats to hospital operations are not the only concern. An outbreak of pandemic influenza could place a substantial economic burden on hospitals, because their normal business would suffer, as was the case when SARS hit the Taiwanese health system.13 It is also uncertain to what degree insurance would cover any losses.

Business continuity management and business continuity planning focus on the analysis of risks and the potential effects of such risks on an organisation or business. Business continuity management considers all departments and all business processes, including the input (such as suppliers and essential infrastructure) and output (such as customers, payment and taxes) of the business. As a result of proper business continuity management, a business continuity plan is drafted. This can then be used to manage business interruptions of (theoretically) any type, including loss of core staff or disruption of supplies, which may be caused by the loss of staff at the supplier’s organisation. Supply is a more critical issue today than it was during previous pandemics because our economy operates in “just in time” mode more than ever before. This means that most supplies will only last for a very short time, perhaps only days, and there is heavy reliance on a continual chain of supply.

The overall objective of an effective plan is to make a system and its business processes less prone to interruptions, to increase their resilience, and reduce potential downtime. If all these components can withstand minor malfunctions and the organisation or business keeps operating, its degree of resilience or the availability of its components is considered high and the system has a high degree of stability.14

A thorough plan would add to these aspects vital components outside the organisation (eg, infrastructure like transport and water, and the resilience of suppliers). Hospitals need to work as part of an integrated plan at state/territory and Commonwealth level. However, some states or territories delegate full responsibility to area health services and hospitals themselves, while others are centrally run.

Applying business continuity management to hospitals and using disruption scenarios for all departments allows the illustration of the potential consequences for the overall functioning of the organisation. Questions remain concerning what could cause any hospital department to become unavailable and what would be the resulting effects for the remainder of the organisation, its staff, and its objective to provide health care services to its customers and patients.

All departments need to be considered under the scenario of a high percentage of staff not being able to attend work, no matter which department or which position. A typical example is accounts payable and salaries: if staff are not paid, they cannot continue their lives; if suppliers are not paid, they will not deliver the supplies. Essential infrastructure services outside hospitals may become unavailable or get disrupted. These include power, telephones, mobile phones, email and paging services, water, and garbage removal.

For a hospital, supplies of food, pharmaceutical products, medical gases and other consumables would have to be added to the “essential” list.

A hospital’s departments or subsystems are similar to those of most other businesses: they all have accounting, human resources, and other “back office” systems, like IT, computer networks, telephone exchanges, and building management (which looks after the building’s technical systems such as lifts, air-conditioning and security).

Back office systems often escape attention until they fail and their relevance for the functioning of the organisation as a whole becomes evident. This moment of failure of less noticeable machinery and equipment demonstrates another important factor — hardly ever have these systems been chosen and acquired with the resilience of their suppliers or service providers in mind. Usually they have become part of the organisation because they were the cheapest on offer.

It is hardly conceivable that a complex and sensitive structure like a hospital, at a time when it is overburdened with a surge of critically ill patients, could maintain any of its core functions without some or all of the infrastructure services.

Pandemic planning for hospitals and the health sector needs to consider not only health-related strategies, but also the broader systems upon which hospitals depend — both inside and outside the health system. Hospital and health sector pandemic plans need to have designated staff responsible for each critical component of operations, as well as strategies for prioritising resources. They need to integrate their specific requirements with all elements of the supply chain outside their own system, and think beyond the medical-specific approaches on which most current plans appear to focus.

Some resources are specialised for the specific emergency requirements of hospitals,15 and offer practical training tools. Box 3 provides a simple checklist of factors that hospitals should consider. Securing critical infrastructure is an overarching requirement for all hospitals, and requires a whole-of-government approach.16

1 Interdependency of internal and external systems to hospital functioning