Gather the Resources for your HVA

Mike Dunning
3 days ago
6 min read

Gather Your Resources: Start With What You Already Know

Before looking outside the hospital, begin with what is already inside the organization.

Hospitals usually have far more useful risk information than they realize. The problem is that it may be scattered across departments, buried in reports, sitting in corrective action plans, or living in the memories of people who managed previous emergencies.

The HVA committee’s first responsibility is to bring that information together.

Start by reviewing:

Event and safety reports
Security incident reports
Workplace violence reports
Drill and exercise evaluations
After-action reports
Corrective action and improvement plans
Utility failure reports
IT and communication downtime events
Weather-related operational impacts
Supply chain disruptions
Staffing challenges during emergencies
Patient surge events
Evacuation and shelter-in-place events
Regulatory findings and survey observations
Lessons learned from actual incidents

Each source tells part of the hospital’s risk story.

A generator failure may reveal more than a vulnerability in emergency power. It may expose communication gaps, unclear decision-making authority, inadequate fuel planning, problems moving patients, or departments that were not included in downtime procedures.

A workplace violence report may identify more than an isolated act of aggression.

Several reports reviewed together may reveal recurring locations, times, contributing conditions, staffing patterns, environmental concerns, or delays in requesting help.

An after-action report may show that a plan technically worked, but only because experienced employees improvised around gaps that had never been addressed.

These are not merely records of what happened. They are evidence of where the organization may remain vulnerable.

Do Not Build the HVA From Memory Alone

A common weakness in the HVA process occurs when the committee gathers in a room and begins scoring hazards based primarily on what participants remember from the previous year.

Experience and professional judgment matter. The people around the table often know things that will never appear in a report. Their observations provide essential context.

But memory is selective.

Recent events may receive too much attention. Familiar risks may be normalized. Events that affected only one department may be unknown to the rest of the committee. Longstanding vulnerabilities may be overlooked because everyone has learned to work around them.

The HVA should be informed by memory, but it should not depend on memory alone.

Before scoring begins, the committee should gather both internal and external information.

Look Inside the Hospital

Internal resources help the committee understand the hospital’s own history, capabilities, vulnerabilities, and operational weak points.

The committee should ask:

What emergencies or disruptions have actually occurred?
Which systems have failed or nearly failed?
Where have staff had to improvise?
Which corrective actions remain incomplete?
What conditions repeatedly contribute to safety incidents?
Which departments have experienced staffing, supply, technology, or infrastructure limitations?
What vulnerabilities are known but have become accepted as normal?

This review helps separate theoretical hazards from demonstrated vulnerabilities.

A hospital may have identified severe weather as a high-risk hazard for years. Internal records may show, however, that the greater operational threat is not the storm itself. It may be repeated roof leaks, difficulty replacing staff, flooding near employee entrances, interrupted deliveries, or the inability of home health vendors to support patient discharge.

That distinction matters because the HVA should lead to decisions, not simply scores.

Look Beyond the Hospital

After reviewing internal information, the committee should examine the community around the facility.

External resources can include:

County and regional hazard mitigation plans
Local emergency management information
Healthcare coalition assessments and planning documents
Public health surveillance and emerging disease information
Historical and projected weather data
FEMA risk and hazard resources
State emergency management information
Fire, EMS, law enforcement, and public safety input
Utility provider information
Transportation and infrastructure concerns
Community demographics and access-to-care challenges
Risks associated with nearby industrial, military, transportation, or critical infrastructure sites

Community hazard mitigation plans are especially valuable because they identify locally recognized hazards, historical events, vulnerable populations, critical infrastructure, and planned mitigation activities.

FEMA describes hazard mitigation planning as a process that reduces loss of life and property by minimizing the effects of disasters. The process begins with understanding local risks and using that information to guide long-term decisions.

For Georgia hospitals, county hazard mitigation plans and Georgia Emergency Management and Homeland Security Agency resources can provide important regional context. GEMA/HS explains that mitigation planning creates a framework for risk-based decisions intended to reduce future damage to lives, property, and the economy.

Every state has comparable resources. The point is not simply to download another document. The committee should use those resources to determine:

Which hazards are already recognized within the community?
Which roads, utilities, communications systems, and services may be disrupted?
Which populations may require additional assistance?
What assumptions is the hospital making about outside support?
Could the same event affect the hospital and its community partners at the same time?

Use Healthcare-Specific Resources

General community risk information is necessary, but hospitals also need healthcare-specific guidance.

ASPR TRACIE maintains HVA and risk-assessment resources developed for healthcare preparedness. Its resources include tools, examples, evaluations of different HVA approaches, and publicly available data sources organized by hazard type.

CMS emergency preparedness requirements reinforce the need for this broader view. Participating providers and suppliers must maintain emergency preparedness programs based on an all-hazards approach. CMS identifies risk assessment and planning as one of the four core elements of the program and expects organizations to consider both facility-based and community-based risks.

CMS guidance identifies examples such as:

Hazards likely to occur in the geographic area
Care-related emergencies
Equipment and power failures
Communication interruptions, including cyberattacks
Loss of all or part of the facility
Interruptions in essential supplies

These examples remind the committee that risk is not limited to hurricanes, tornadoes, floods, or other dramatic events. A hospital can be severely disrupted by a failed water system, unavailable electronic health record, medication shortage, damaged oxygen infrastructure, telecommunications outage, or prolonged staffing crisis.

The American Hospital Association also maintains community health and environmental resources that can support the process. These include FEMA’s National Risk Index, environmental information tools, community resilience resources, and planning materials addressing the health effects of environmental conditions.

Ask Better Questions

The committee is not simply asking:

What could happen?

It should also be asking:

What has already happened?

What is happening around us?

Where have our systems struggled?

What assumptions are we making about staffing, utilities, technology, vendors, transportation, and outside assistance?

What are we prepared to manage, and what would quickly exceed our capabilities?

Those questions produce a more realistic picture of risk than probability scores alone.

The quality of an HVA depends heavily on the quality of the information used to build it.

When the committee combines internal experience, community risk information, healthcare-specific resources, and the knowledge of operational partners, the HVA becomes more than an annual form.

It becomes an honest assessment of what could interrupt care, threaten patients and staff, and test the hospital’s ability to continue operating.

The more realistic the information, the more useful the HVA.

Resources:

ASPR TRACIE: Hazard Vulnerability/Risk Assessment Topic Collection

Broad collection of healthcare HVA guidance, tools, templates, and supporting resources.

Georgia-Specific Resources

Comments

Follow us on Social Media