Assessing the Health Sector using Model Based Vulnerability Analysis. Harry Mayer

(1)

Assessing the Health Sector

using

Model Based Vulnerability

Analysis

(2)

Healthcare and Public Health

Sector Vision Statement

The Sector’s Vision

:

–

Achieve sector resiliency against all threats

_―

natural and manmade

–

Prevent or minimize damage to, or destruction of, the nation’s

healthcare and public health infrastructure

–

Preserve the ability to mount a timely and effective response

(3)

Required activities

–

Development of Sector Specific Plan (completed)

–

Development of Sector Annual Report (July 2007 submitted)

–

Critical asset, system, functions, networks Identification and

Prioritization

–

Risk Assessment (consequence assessment) and Gap Analysis

–

Dependencies and Interdependencies on other sectors

–

Measures of Effectiveness – Core / Sector Specific Metrics

–

Training and Exercises

–

Grants (ASPR-hospitals, CDC-public health, DHS-security (7))

–

Research and Development needs of the sector

–

Modeling and Simulation

–

Critical Infrastructure reporting of the Sector to DHS during events

National Infrastructure Protection

Plan Health Sector Mandates

(4)

Healthcare and Public Health

Sector Specific Plan May 2007

(5)

Sector Partnership Model:

HSCC (Private Sector)

Healthcare Personnel Includes: Doctors, nurses, pharmacists, dentists, emergency medicine and other clinicians and practitioners with direct involvement in healthcare delivery Insurers, Payers, HMOs Includes: Representative s of third-party payers for medical treatment and healthcare delivery including insurance companies, HMOs and others Information Technology Includes: All IT systems, capabilities and networks supporting delivery of healthcare services Laboratories and Blood Includes: Laboratories and lab support services separate from medical treatment facilities, and companies and associations from the blood, tissue and organ industry Mass Fatality Mgt Services Includes: Medical examiners, coroners, funeral directors, cremationists, cemeterians, clergy, and manufacturers and distributors of funeral, memorial, and cremation supplies

Each sub-council is responsible for organizing itself

Sample Priority Issues for Sub-Councils: Emergency Preparedness, Emergency Response; Vulnerability Assessment / Prioritization; Communication & Information Sharing among members, with HHS and DHS, and with other sectors

Medical Materials Coordinating Includes: Manufacturers, suppliers, and distributors of medical supplies and equipment, as well as health care materials managers Medical Treatment Includes: Hospitals, clinics, and other organizations/ entities that deliver medical treatment Occupational Health Includes: Occupational health physicians and nurses, industrial hygienists, and other occupational health professionals Pharma and Biotech Includes: Manufacturers, suppliers and distributors of generic and branded pharmaceuticals and biological equipment

Cross-cutting Work Groups will be established to address priority issues that cut across sub-councils

Healthcare Sector Coordinating Council (HSCC)

The HSCC is comprised of representatives and alternates from each sub-council. Issue will be identified by Subcouncils. Coordination across Subcouncils and with the HPHGCC will be organized through the HSCC.

(6)

Major Challenges in Assessing the

Health Sector

Vastness and complexity of the sector

White box versus black box systems

(7)

Vastness and Complexity

A vast network comprised of

–

Over 13 million--Healthcare Providers

–

Over 6 K: Hospitals

–

Over 700 K: Ambulatory Facilities

–

Over 70 K: Long Term Care Facilities

–

Over 6.9 K: Home Health Agencies

–

Over 70 K:

Pharmacies--–

Over 172 K: Laboratories

–

Over 2.5 K: Pharmaceutical Manufactures

Majority of sector is located in the private and not for profit

sectors

(8)

Black Box System Versus White Box

In a black box system we do not look at all of the interactions

between the sub-systems

For practical reasons we only look at total inputs and total outputs

–

Input: Total Cases of Cigarettes Consumed

–

Output: Total # Lung Cancer Cases in the population

(9)

Black Box System Versus White Box

In a white box system we want to see the internal interactions

between the components

Systems are hierarchal—the higher you go in the hierarchy the

more abstract—the lower you go the analytic approach becomes

more useful

(10)

Po we r/E ne_rg y Po we r/E ne_rg y Loss of Power

White Box Approach

Consequences of Electrical Power Loss

Hospitals back up generators are designed for immediate life safety Back up generators will not operate HVAC or elevators

Many hospitals have generators and switching rooms located in flood prone areas such as basements Loss of back up generators may render some installed fires suppression systems useless

(11)

Po we r/E ne_rg y Po we r/E ne_rg y Medical Medical Surge Surge

Tech Dependent Homecare

Home mechanical ventilator failures and increase cardiac arrests can be expected at hospital Emergency Rooms. This problem may be exacerbated by the nationwide trend to close hospital emergency departments.

White Box Approach

(12)

Transportation Transportation Po we r/E ne_rg y Po we r/E ne_rg y Medical Medical Surge Surge

Loss of power to transportation sector may have bleed over effects to medical supply chain distribution networks. Possible shortages of oxygen, blood, food, and pharmaceuticals should be anticipated

White Box Approach

(13)

Water Water Transportation Transportation Po we r/E ne_rg y Po we r/E ne_rg y Medical Medical Surge Surge

Loss of electric may impact water distribution systems, sanitation systems and hospital infection control programs

White Box Approach

(14)

Water Water Transportation Transportation Po we r/E ne_rg y Po we r/E ne_rg y Tel eco m/IT Tel eco m/IT Medical Medical Surge Surge

Telecom and IT failure may impact a facilities ability to evacuate, exercise command and control, manage electronic medical records, hospital bed count and other informatics systems

Loss of electrical power may result in degradations of the 911 System

White Box Approach

(15)

Jurisdictional Variation

3,000 county and city health departments and local boards of hea3,000 county and city health departments and local boards of healthlth

59 state and territorial health departments59 state and territorial health departments

Tribal health departmentsTribal health departments

Over 160,000 public and private laboratoriesOver 160,000 public and private laboratories

40 Federal departments and agencies40 Federal departments and agencies

Thousands of hospitals and other health providersThousands of hospitals and other health providers

Numerous volunteer organizations such as the Red CrossNumerous volunteer organizations such as the Red Cross

Approximately 500,000 in the public health workforce deployed abApproximately 500,000 in the public health workforce deployed about evenly at the local, state, out evenly at the local, state,

and national levels

Funding to increase capacity:Funding to increase capacity:

–

– Federal, state, and local public health expenditures of $17.1 biFederal, state, and local public health expenditures of $17.1 billion for 2000llion for 2000 –

– New federal funding of close to $1billion annually to state healNew federal funding of close to $1billion annually to state health departments to build basic public th departments to build basic public health infrastructure at the state and local levels

(16)

Network Analysis Approach

In Public Health we know that the complex interactions between

people create intricate networks with multifaceted

interdependencies

So if we know that Public Health is a complex network of

interdependencies then the Healthcare and Public Health Sector

should readily lend itself to NETWORK ANALYSIS

(17)

Networks

A network is a collection of nodes and links that connect pairs of nodes.

Nodes and links are abstract

–

A node can represent anything—a city, a train station, a hospital or a person

–

A link represents a relationship between the nodes

Network theory is general and it can be used to model a variety of things in the

real world and to gain insights

Network modeling can reveal things as varied as “Does the internet have a

single point of failure” or “are relationships between people in society

responsible for the spread of contagious diseases”

(18)

Networks

Correctly identifying the correct hubs and links is important if you

are going to correctly model a sector

Network maps are mathematical graphs that lend themselves to

different analytic techniques

(19)

Networks

Networks are abstract maps that depict relationships

Node

Link (Shows Relationship)

(20)

Medical Supply Chain Network

Pharmaceutical Manufacturer Pharmaceutical Distributor

Blood Distribution Center Medical Equipment Manufacturer

(21)

Abstract Network Map of

Relationships

3

1

2

1

(22)

Critical Node/Link Approach

Although a sector is vast and complex it has usually has a structure

because of some type of organizing principle

Even completely random networks will have structure

Termites Organizing Principle

–

Wander in a random direction until encounter a wood chip

–

Pick up chip and wander in random direction

–

Encounter a new chip and drop old and wander in random direction

–

Repeat forever

(23)

Organizing Principles

Principle of Emergent Behavior

–

Over time order appears out of randomness

–

The public health infrastructure was not designed, in emerged

–

Emergence is typically around some organizing principle

–

Even though it emerged there is order

–

We believe that we will eventually be able to use network theory to

help determine where the potential points of failure in the public

health infrastructure

(24)

Critical Node/Link Approach

Several infrastructure networks are either

“Scale Free”

or

“Small

World”

networks

1

3

1

2

1

5

2

1 SCALE FREE NETWORK

WITH 2 HUBS

Hypothetical

Network

(25)

Scale Free Networks

A scale free network is a network that contains a relatively small

number of highly connected nodes

Some hubs have a seemingly unlimited number of links and no

node is typical of the others

–

Research has found that scale-free networks are resistant to

accidental failures but extremely prone to coordinated attacks….

Scale free networks will follow a “power law”

(26)

Scale Free Histogram

0

10

20

30

40

50

60 1 Deg

2Deg

3Deg

4Deg

5 Deg

Hypo

Best Fitting

(27)

Bell Curve Distribution Power Law Distribution

(28)

Small World Networks

Small Worlds are networks formed around clusters (neighborhoods) of

nodes—not merely a single hub—

Neighborhoods however may act as a hub

Neighborhoods are small clusters that can be reached by one another

in a relatively small number of hops.

(29)

Small World Network

6

1

6

1

1 SMALL WORLD NETWORK

WITH TWO NEIGHBORHOODS

Number of Nodes=12

(30)

Examples of Emergent Networks

Internet (hardware)—scale free

World Wide Web—scale free

Electrical Power Grid—small world

Federal Reserve banking network—scale free

Social networks responsible for the spread of sexually transmitted

diseases—scale free

(31)

Critical Node Approach

Since the Public Health Sector is so vast we can not afford to

fund every program, task or function

By focusing on critical nodes or small world neighborhoods we

can surgically apply limited resources to where they do the most

good

(32)

Vulnerability Analysis

The HHS CIP Strategy will be to use model based vulnerability analysis

(MBVA) to zero in on vulnerabilities of critical nodes

MBVA requires:

1. Identification of essential components (Critical Nodes)

2. Understanding linkages and relationships among nodes (Network

Analysis)

3. Focusing on what is critical

(33)

Model Based Vulnerability Analysis

1. List Assets—Take Inventory

2. Perform Network Analysis—Identify Hubs

3. Model the Hubs as a Fault Tree

4. Analyze the Fault Tree Model Using an Event Tree

5. Budget Analysis—Compute Optimal Resource Allocation

(34)

Typical Fault Tree

Sector Fault

or

Component X

Component Y

and

Threat A

Threat B

Threat C

Threat D

S

ec

to

r

C

o

m

p

o

n

en

ts

T

h

re

at

s

Root Node

Logic Gate

(35)

Probability of Failure

Sector Fault

and

Component X

Component Y

25%

10%

AND means both probabilities must occur in order to propagate the tree

Probability = 25% * 10% = 2.5%

2.5%

(36)

Probability of Failure

Sector Fault

or

Component X

Component Y

25%

10%

OR means one, two or all faults may occur in order to

propagate up the tree

Probability = 1-[(1-1.25) * (1-1.10) = 1-[(.75) * (.90)] = 32.5%

32.5%

(37)

Typical Fault Tree

Sector Fault

or

Component X

Component Y

and

Threat A

Threat B

Threat C

Threat D

50%

80%

20%

80%

50%*80%=40%

20%*80%=16%

V=49.6% = 1-[(1-40%)*(1-16%)]

(38)

Threat A

Threat B

Threat C

Threat D

1.6% 25.6% 6.4% 1.6% UNK 0.4% IMPOSSIBLE OK 6.4% OK OK OK 1.6% OK OK OK Vulnerability N 80% Y 80% N 50% N 20% N 20% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% Y 80% N 20% N 20% N 20% N 20% N 20% N 20% N 20% N 20% N 20% N 20% N 20%

50%

80%

20%

80%

(39)

Fault Probability v. Fault

33.6

9.6

6.4

0.4

0

5

10

15

20

25

30

35 X

Y

Both X & Y

Unknown

F

au

lt

P

ro

b

ab

il

it

y

%

Component Faults

(40)

Risk Assessment and Resource

Allocation

MBVA gives us unique insight into relationships and variables

But how do we reduce the risk?

Where do we spend our money?

(41)

Budget Allocation Strategies

Once we have the results of our Event Matrix we need two other

data points to complete our analysis

How much money do we have in our budget

(42)

Budget Allocation Strategies

Manual Risk Reduction

Ranked Order Risk Reduction

Optimal Risk Reduction

Apportioned Risk Reduction

(43)

Manual Risk Reduction

Discard the analysis—Policy maker knows best

The policy maker determines the best method to spend the

money

Could be followed for political reasons or to fund pet projects

(44)

Ranked Order Risk Reduction

Fund the highest vulnerability and work your way down to the

least

Problem is you seldom have enough money to fund everything

As the threat histogram indicates you may have greater risk from

combinations of threats

(45)

Optimal Risk Reduction

This is like dealing cards, you fund each threat with a dollar to

each and repeat until the vulnerability reaches zero or until all

funds are allocated

(46)

Apportioned Risk Reduction

Assign the percentage of available funds commensurate to the

risk

Example: Component X has 35% of failure then assign 35% of

your budget to Component X

(47)

(48)

This assumes $96

million available for

allocation in California.

(49)

Examples of MBVA in the

Public Health Sector

(50)

Public Health Preparedness Pyramid:

Prevent Cascade

public health services

surveillance laboratory _practice _{investigation}epidemic

workforce

capacity &

competency

information

& data

systems

organizational

& systems

capacity

Derived from: CDC

Basic Infrastructure: Inputs

Essential

Capabilities:

Processes and

Programs

Mission Delivery:

Outcomes

Detect disease outbreak Perform lab analyses to support surveillance and epidemiology Ascertain the nature of a disease epidemic

C

as

ca

de

F

ail

_ur

e

To prevent cascade failure—emphasis

should be placed on the basic

infrastructure across all the actors.

Employers and Business Health Care Delivery System Governmental Public Health Infrastructure Academia The Media Community

(51)

Essential Capabilities for

Service Delivery

Surveillance

– Detect a disease outbreak

Laboratory Practice

– Perform laboratory analyses to support surveillance and

epidemiology

Epidemic Investigation

– Ascertain the nature of a disease epidemic

surveillance laboratory _practice _{investigation}epidemic

public health services

– Regulate environmental conditions and food and water safety to minimize disease threats

– Plan for emergency medical and public health response capacity

– Pursue public health interventions to limit the spread of disease

– Assure the provision of emergency medical treatment and prophylaxis

– Remediate environmental conditions

– Prevent secondary public health emergencies following a disaster

(52)

National Notional Public Health Fault Tree

Failure Probabilities: “OR”

Public Health

Services Failure

Surveillance

Epidemic

Investigation

OR OR Workforce Failure Inform./Data Systems Failure Organiz./ Systems Failure Workforce Failure Inform./Data Systems Failure Organiz./ Systems Failure OR V = 68% V = 80% V = 98% V= 50% V= 20% V= 20%

Laboratory

Practice

Workforce Failure Inform./Data Systems Failure Organiz./ Systems Failure OR V = 68 % V= 50% V= 20% V= 20% V= 50% V= 20% V= 50%

Continuation of fault tree, e.g., causal factors of funding shortages, lack of competitive salaries, lack of training

(53)

Biological Agent Release

Actors and Actions

Source: GAO Public Clinics Testing and treatment Physicians Testing and treatment Public and Private Hospitals Testing and treatment Medical Laboratory Testing Local Public Health Departments Epidemiologic services, laboratory services Local Emergency Management Agency

Planning and support

State Public Health Department

Epidemiologic services, laboratory services, advice on diagnosis and treatment,

other support

State Emergency Management Agency

Planning and coordination efforts Civil Support Teams Assistance and advice Governor Leadership BIOWATCH Biological Agent Released

Note: Not all areas of the country have BioWatch sensors.

(54)

Biological Agent Release

Actors and Actions

Source: GAO Public Clinics Testing and treatment Physicians Testing and treatment Public and Private Hospitals Testing and treatment Medical Laboratory Testing Local Public Health Departments Epidemiologic services, laboratory services Local Emergency Management Agency

Planning and support

State Public Health Department

Epidemiologic services, laboratory services, advice on diagnosis and treatment,

other support

State Emergency Management Agency

Planning and coordination efforts Civil Support Teams Assistance and advice Governor Leadership BIOWATCH Biological Agent Released

Note: Not all areas of the country have BioWatch sensors.

3

4

5

7

3

4

1

(55)

Histogram for Bio Release

0

5

10

15

20

25

30

35

40

45

50

1

2

3

4

5

6

7

(56)

What is the Critical Hub?

(57)

Cardinal

Owens & Minorl

Medline

A Hospital

Independent

Supplier

Medical Supply Chain

Distribution Network

(58)

4

3

2

1

2

1

8

(59)

Scale Free Histogram

0

1

2

3

4

5

6

7

1 deg

2

3

4

5

6

7

8 Hypo

(60)

CASE STUDY

Southeastern Pennsylvania BioWatch

Pennsylvania Department of Health

–

Links to communities through 6 Health Districts, with each District responsible for 8 to

13 counties

–

Pennsylvania operates a network of Health Districts and 57 state health centers

–

They also provide oversight for 10 county and municipal health departments that

service 40% of the population

Southeastern Pennsylvania District (SEPA)

–

Mix of urban, suburban, and rural communities

–

Contains the Lionville State Laboratory (a Laboratory Response Network Reference

Lab) which performs all BioWatch testing for Pennsylvania and New Jersey

(61)

BioWatch is nationwide early detection focusing on urban centers

The system uses EPA air quality monitoring sites that can detect trace amounts of natural or

intentionally released pathogens

Samples must be sent to a certified lab each day to determine presence of a pathogen

Labs identify bio/chemical agents which in turn drives containment, treatment, and clean-up

efforts

Rapid detection information is critical for dispensing Strategic National Stockpile and mass

prophylaxis

Health Alert Network (HAN) used to disseminate information; depends on timely confirmation of

lab samples from a Laboratory Response Network Reference Lab

(62)

Key Communication Links

The Lionville Laboratory processes all New Jersey and Pennsylvania BioWatch samples from 10

BioWatch monitors

Test results are reported to the Pennsylvania and New Jersey Departments of Health

If there is a confirmed biological event, Lionville will notify CDC, EPA, and the FBI, and the

Secretary's of Health and Governors in Pennsylvania and New Jersey

The Pennsylvania Department of Health simultaneously transmits an alert via HAN to all

Pennsylvania hospitals and county health departments; FRED notification to hospital emergency departments

The Philadelphia Health Department will transmit a Health Alert Notice to area healthcare

providers in Bucks, Chester, and Montgomery Counties

(63)

PA DOH

B C M D P

_Lionville

Lab

The BioWatch Network

CDC PA BioWatch Monitors LRN Member Labs County Health Dept Hospitals NJ BioWatch Monitors No Hea lth D ept In D elaw are Cou nty

Hubs: Labs, Hospitals, Health Departments Links: BioWatch Detection Information

(64)

SEPA BioWatch Network Analysis

1 10 Delaware County Hospitals

2 79 Hospitals

National CDC

138 State Lab Lionville

126 LRN Labs

107 PA Dept of Health

48 Philadelphia County Health Department

20 Montgomery County Health Department

12 Chester County Health Department

11 Bucks County Health Department

Links Hubs 0 20 40 60 80 100 120 140 1 2 11 12 20 48 107 126 138 Links

Hubs are organizations that link

through communication channels to

detect and respond to a biological

agent in the BioWatch program.

(65)

Component: Workforce Capacity and Capability Threat:

– 8% decrease in public health funding in Pennsylvania

– 26% of workforce will retire within 5 years (New PA retirement plan for state employees encourages many careerists to leave)

– Currently insufficient laboratory scientists to manage tests for anthrax or plague in an outbreak

– Nationwide shortages in public health nurses, environmental health specialists, health educators, epidemiologists, and laboratorians

– 50% of epidemiologists in state health departments have no training in area of specialty

– Public health cannot compete with private sector—Difficult to attract talented health professionals

– Hiring replacement personnel is difficult due to hiring freezes and civil service requirements

– Difficult to fire poor performers

– No provision to bring in surge personnel to work in labs (Selected agent registration is slow)

75%

Workforce Capacity and Capability

(66)

Information and Data Systems

Component: Information and Data Systems Threat:

– Lionville does not have a secure LAN (SIPRNET)

– Location of BioWatch monitors is classified, but location of EPA monitors is not

– FRED Hospital notification system is unreliable

– HAN is unstructured and is a hodgepodge of digital pager signals, fax broadcasts, e-mails

– Significant under reporting of reportable diseases from hospitals, health care practioners and health departments

– Philadelphia Health Department has no power back-up or data back-up for public health surveillance information

– Philadelphia does not use PA NEDSS (National Electronic Disease Surveillance System)

75%

(67)

Organizational Systems and Capabilities

Component: Organizational Systems and Capabilities

Threat:

–

Insufficient capability to test for chemical agents

–

CDC found that only 8% of the states could contact their partners within 20 minutes

–

Decrease of 1.5% in senior influenza vaccinations

–

Insufficient bed space to hospitalize pandemic flu patients (Projected 12,686 deaths

and 52,573 hospitalizations from a contraction rate of 35%)

–

Security clearance process cumbersome and time consuming, FBI and Lionville lab

cannot share classified information

75%

(68)

Summary: SEPA Vulnerabilities and Costs

Probability of Component Failure

–

Workforce: 75%

–

Information and Data System: 75%

–

Organizational Systems and Capabilities: 75%

Cost to Harden: $66 Million*

Cost to Repair: $38.5 Billion**

Budget: $30 Million***

Sources: SME’s Former State Sec of Health of PA, Philadelphia Bio-terrorism Coordinator, PA Director of Epidemiology, PA Director of Labs, PA Assistant Director of Labs and

US PHS Regional Health Administrator and Trust for America “Ready or Not?” December 2004

* (Allocation based on per capita amount of $10 Billion)

**(Allocation based on CIA Global Infectious Disease Report worst case estimate of 2% of GDP 36 Billion is 2 % of SEPA’s % of GDP)

(69)

SEPA BioWatch Failure

OR

BioWatch Failure

Workforce Capacity and Competence Information and Data Systems Organizational Systems and Capacity

75%

98%

N 25% N 25% N 25% Y 75% N 25% Y 75% N 25% Y 75% N 25% Y 75% Y 75% N 25% Y 75% Y 75% OK 5% 5% 14% 5% 14% 14% 42% All 3 None Org. Inf. Inf, Org WF WF, Org WF, Inf

(70)

Budget Allocation

$15.58 Million 32.08% All three vulnerabilities $4.8 Million 12.47% Information System and Org Capacity

$4.8 Million 12.47%

Workforce and Org Capacity

$4.8 Million 12.47%

Workforce and Info System $0 5% Organizational Capacity $0 5% Information and Data System Only

$0 5% Workforce Only Amount Allocated After Allocation Vulnerability 0 5 10 15 20 25 30 35 40 45

WF I O WF+I WF+O I+O WF+I+O

Before After

Recommend funding equal amounts to each vulnerability Workforce: $10 Million

Information/Data Systems: $10 Million Organizational Capacity: $10 Million

(71)

MBVA Challenges: State and Local

Vulnerabilities, event, and failure analysis easier to “get arms around” with smaller

scope and better definition of assets and services

Still wide diversification of structure, services, and need; sometimes differing views as

to responsibilities, capacities, and resources:

Generalization is difficult

Gathering and validating cost and damage data is a challenge—will require a major

effort and consistent methodology

Lessons

: MBVA useful if defined structure and linkages, clear ownership and

responsibilities, inventoried assets and capabilities, and understanding of protection

needs and resource impact

(72)