Framework for Public Health Emergency Incident Management Systems

Our proposed framework is comprised of 23 constructs grouped into 5 domains (see Table 1). Each construct captures the activities that, based on the literature and our experts’ feedback, are critical to ensuring effective incident management for a variety of public health incidents, regardless of the specific incident management system used.

Table 1. Conceptual framework for understanding incident management systems during public health emergencies

Note: The framework consists of 23 constructs groups into five domains that together comprise the key elements of public health incident management. Each construct represents a distinct process that is critical for managing public health emergencies. Constructs and domains were developed from literature review and iterative discussions with 50 subject matter experts.

These domains, and their constituent constructs, are explained in detail below:

Situational Awareness and Information Sharing

Situational awareness and information sharing refers to initial and ongoing perceptions and characterization of information from the environment to share information and identify ongoing response needs. Situational awareness is critical in assuring that response activities, including but not limited to the selection of medical and nonmedical countermeasures, are well matched to the threats confronting the public.

In Endsley’s foundational situational awareness framework, situational awareness involves 3 “levels”: (1) perception and intake of information; (2) sense-making, the ability to see the “big picture” by putting all the disjointed elements of information together, finding relationships between them, and assigning meaning to the scenario; and (3) projection, modeling, or the making of predictions about how the incident might unfold in the future. ^{Reference Giordano, Pagano and Pluchinotta22,Reference Endsley23} This involves routinely assessing information about threats (eg, in the context of infectious diseases, virulence, mode of transmission, severity) and their potential impact on at-risk and vulnerable populations, systems (eg, medication supply chains), and resource use (eg, medical countermeasures, deployed staff).

Following Endsley’s (1995) first “level,” construct 1 focuses on determining what information is relevant—and irrelevant. To be relevant, information must be credible, actionable, appropriate, timely, and strike the right balance between sharing too much and too little. ^{Reference Rose, Murthy and Brooks24} Some experts described how staying on top of incoming information while synthesizing previous information could be highly challenging given the volume of information coming in coupled with the speed of incident response. This challenge can be particularly acute during an incident’s initial stages. This is due to a massive volume of information incident managers often encountered coupled with high levels of uncertainty about the incident and the necessary response strategies. Not surprisingly, many experts emphasized the importance of both the quantity and quality of information throughout the incident, noting that, without filtering, information could be a “firehose” that hinders rather than enhances response.

The complexity of many incidents means that there is often a wide range of potentially relevant information sources (eg, epidemiological data, reports from local health officials). Thus, construct 2 is accessing and gathering information from multiple sources. Similarly, sense-making in complex incidents requires group interaction to build sufficiently rich mental models that can help synthesize information and avoid the risk of missing the big picture, ^{Reference Weick, Sutcliffe and Obstfeld25,Reference Weick26} captured by construct 3 on engaging in sense-making to maintain situational awareness.

Because responding to public health incidents usually involves joint action by multiple partners, response leaders must share key information with appropriate partners and the public on an ongoing basis. The severity or duration of an incident can be affected if response leaders are unable to access, assess, document, and share relevant information, often across multiple jurisdictions and different levels of government. ^{Reference Boin and Kuipers27} In addition, several experts noted the importance of sharing information with external partners (construct 4), including elected and appointed officials, impacted organizations, and other decision-makers, and disseminating information to the public (construct 5). Experts described written documentation (construct 6) as a critical tool to not only maintain continuity of response operations and support process improvement, but also provide evidence to resolve billing, litigation, and other investigatory activities (media requests, watchdog inquiries, etc.) that may occur. One government official responsible for county health-care incident management went so far as citing record keeping as one of the reasons for activating incident management systems, describing how activating incident management systems could be a way to help manage record keeping when it was beginning to present a challenge.

Incident Action and Implementation Planning

Incident action and implementation planning involves the ability of incident managers to articulate and communicate decisions in coherent incident action plans in order to set up implementation of those plans. Decision-making is at the heart of incident action and implementation planning, since at the most basic level, decision-making refers to a commitment to action intended to yield desired results. ^{Reference Parker, Nelson and Shelton28} Decision-making for complex incidents requires input from different departmental units, both in identifying and weighing pros and cons of various alternatives, and in minimizing disconnects between the decisions and execution ^{Reference Cohen, March and Olsen29,Reference Clarke30} (construct 7 is identifying and assessing potential courses of action). The experts we spoke with emphasized how they frequently needed to make decisions quickly and often with less-than-complete data to respond to rapidly evolving incidents.

Articulating clear decisions in an incident action plan (IAP) and handing those plans off to be implemented are also crucial parts of incident action and implementation planning. IAPs that successfully articulate clear decisions promote unity of effort and avoid situations in which responders receive conflicting messages. Thus, additional constructs are the articulation of clear decisions (construct 8) and the development of an incident action plan (construct 9).

The incident management team also needs to hand off plans to implementers (construct 10) including priorities, tactics, and timelines. Successful communication of these plans is critical for ensuring execution. Thus, situational awareness and decision-making compromise a feedback loop that promotes agility, adaptiveness, and recovery. ^{Reference Giordano, Pagano and Pluchinotta22,Reference Hambridge, Howitt and Giles31}

Resource Management and Mobilization

Resource management and mobilization involves identifying, accessing, deploying, and monitoring material, human, and organizational resources. Incident management depends on having the right resources at the right time, making resource management and mobilization a necessary part of effectively addressing public health threats.

In most incidents, determining when to stand up the formal incident management system is one of the first decisions that an incident management team needs to make (reflected in the first construct of this domain, initiate stand up of IM system, construct 11). Resource management and mobilization-related decision is closely tied to situational awareness, as it requires considering what is happening (Endsley’s (1995) perception), whether it is serious enough to warrant concern (characterization), and whether the situation is likely to improve without additional intervention (projection). As part of this process, decisions need to be made as to the role public health might play in the incident (construct 12). Regardless of the role of public health in the incident, the incident managers we spoke with described how late stand-up can put the response “behind the curve” at the outset; however, standing up the system too early can unnecessarily consume scarce resources from important routine public health activities.

Incident managers must also make ongoing adjustments to the IM system structure as needed (construct 13), including mobilizing and demobilizing staff, materials, and equipment. As with other decisions, resource management should reflect incident managers’ understanding of the situation, which may evolve as responders take actions to mitigate the incident or respond to external factors outside responders’ control. For instance, incident managers might change the partners that they engage with, the resources that they use, and shorten or elongate operational periods and mobilize or demobilize staff and equipment (construct 14), depending on incident changes. ^{Reference Jensen and Thompson8,Reference Gryth, Rådestad and Nilsson32}

In all multijurisdictional responses, regardless of whether they are public health-related, resources are often “owned” or controlled by a wide variety of entities. Thus, incident managers described resource tracking (construct 15) as a particularly challenging part of incident management, sometimes to the point that they would create special processes solely to track resources. For instance, during the 2009 H1N1 response, the CDC IM team created a separate technical support unit for tracking resource requirements. ^{Reference Posid, Bruce and Guarnizo33,Reference Papagiotas, Frank and Bruce34}

Because public health incidents can potentially occur over an extended time period of weeks and months, as incidents wear on, incident management team members often face increasing pressure to attend to their routine duties. ^{Reference Lewis, Chan, Nelson, Stoto and Higdon35} For extended incidents and others with time and resource constraints, incident managers described how they needed to navigate competing job requirements and be cognizant of factors affecting team morale and fatigue (construct 16), such as scheduling and stress.

Finally, incident management systems must be demobilized (construct 17) on an appropriate timeline to facilitate a smooth return to normal operations and enhance recovery. Information on proper demobilization is critical to ensure safety and a proper close to operations. ^{Reference Burgiel36}

Coordination and Collaboration

Coordination and collaboration refers to the process of mutual adjustment between actors with views to reaching a common objective and maintaining unity of effort. ^{Reference Mathieu, Verhoest and Matthys37,Reference Sagun, Bouchlaghem and Anumba38} The 2 concepts can be considered parts of a spectrum of cooperation: coordination being a basic level of cooperation—cooperating through sharing information—and collaboration a greater level of cooperation—actively working together to reach a shared objective. ^{Reference Clarke and Campbell39} The result of good coordination and collaboration, therefore, is a plan in which the activities of various partners do not conflict and ideally are mutually reinforcing (construct 18).

Establishing and maintaining roles, responsibilities, and legal authorities within IM system (construct 19) by clarifying roles, goals and expectations of an incident is the first step in coordination and collaboration (eg, which agency has the lead response role and what are the limits of their authority). Because of the dispersed set of impacts incidents often have, these entities are often all necessary to manage an incident. Yet our experts described how in some cases it can be difficult to coordinate roles, responsibilities, and legal authorities within the IM system because differences between entities can lead to differences in priorities, which can result in conflicts over what to do.

Establishing and maintaining roles, responsibilities, and legal authorities within the IM system requires knowledge of the broader operating environment. It therefore depends on awareness of IM system partner roles and responsibilities (construct 20), yet differences between partners can make it difficult to build this awareness. Using standard terminology (construct 21) helps ensure participants can effectively communicate their roles and their priorities: for instance, 1 expert described how having a “common language,” allows new participants to join the response “without too much of a learning curve.” Documentation, communication, and clarification of legal authorities such as by establishing memoranda of understandings, was also cited as helping to maintain roles and responsibilities by institutionalizing roles and expectations. One expert noted the importance of informal “socialization” of incident management team members in fostering a mutually agreed and shared understanding during responses—something that can be difficult when use of incident management systems is infrequent, and in communities with high staff turnover.

Feedback and Continuous Quality Improvement

Feedback and continuous quality improvement (CQI) refers to the practice of IM team members seeking, receiving, and using information about the outputs and outcomes of past operational periods to identify lessons for current and future responses. CQI may include capturing lessons about response activities and interventions, such as the reach and coverage of medical countermeasures administered, or risk communications disseminated. It may also include lessons about supporting processes and protocols, such as the procedures for how those medical countermeasures are administered or how information is shared with partners who disseminate communications. It should also include lessons from both within and across agencies involved in incident management, and between response partners and field personnel, particularly to document unplanned or unanticipated innovations that help the incident management team make progress toward objectives.

Feedback and CQI involves both seeking and receiving feedback (construct 22) and using feedback to improve processes and outputs (construct 23). The culture and values of an organization shape feedback and CQI: literature on high reliability organizations suggests that organizations effective in operating in complex task environments have cultures that emphasize and reward continuous learning. ^{Reference Grabowski and Roberts40} These learning cultures include “mindfulness” or a rich awareness of discriminatory detail, a capacity for action, preoccupation with failure, systems thinking, and incentive structures that reward reporting errors. ^{Reference La Porte21,Reference Weick, Sutcliffe and Obstfeld41,Reference Cooke and Rohleder42} Although organizations need learning cultures in order to maximize feedback and CQI, experts identified barriers impacting learning cultures. These include difficulty finding the time and resources to document lessons learned, and hesitation in surfacing weaknesses (for instance, to avoid political fallout and damage to relationships with response partners).

Feedback and CQI tends to occur after an incident is over, but efforts are being made to develop formal mechanisms for feedback and CQI during incidents. Post-incident feedback and CQI often takes the form of documentation of response-related strengths and weaknesses in an after-action report (AAR), a well-established practice in incident management and described in detail by the Homeland Security Exercise Evaluation Program. ⁴³ However, our experts noted that feedback and CQI are also important during an emergency to ensure response leaders can successfully adjust response operations as response priorities and circumstances change. Indeed, efforts are being made to improve CQI during emergency, such as through intra-action reporting mechanisms (see, eg, Chamberlin et al. ^{Reference Chamberlin, Okunogbe and Moore44} ). By overcoming barriers impacting learning cultures and strengthening feedback and CQI during incidents, these mechanisms can help IM teams receive information and use it to enhance performance, ultimately improving their agility during response.

Interactions Between Domains and Incident Management Context

While the proposed constructs are conceptually distinct, in reality they are operationally intertwined to some extent. For instance, once a public health threat has been identified and incident management processes have been established, the incident management team uses situational awareness and information sharing to make decisions and engage in incident action and implementation planning, mobilize resources, and coordinate and collaborate. These activities in turn guide when and how the incident management team shares information, maintains ongoing situational awareness, continually soliciting feedback and adjusting response priorities to ensure mission success. Ideally, these domains and constructs work in concert as part of a larger, complex system where incident management is more than the additive sum of its components but reflects the continuous interaction between components.

The specific manner in which these domains and constructs function depends on the complexity, novelty, spread, and severity of an incident. Many experts noted that most incidents start with a high level of uncertainty (eg, due to unknown origin or scale of public health threat) before response leadership begins the process of making sense of the incident. Bigley and Roberts ^{Reference Bigley and Roberts16} similarly describe how incidents become less complex as the incident management team establishes structures that put a pattern around the incident. Likewise, interconnections between domains may also change over the course of an incident. For instance, initial situational awareness may both shape and be shaped by resource management and mobilization during large scale ups or scale downs.