Chapter 1: Overview of MSCC, Emergency Management and the Incident Command System

Medical surge capacity refers to the ability to evaluate and care for a markedly increased volume of patients—one that challenges or exceeds normal operating capacity. The surge requirements may extend beyond direct patient care to include such tasks as extensive laboratory studies or epidemiological investigations.

Because of its relation to patient volume, most current initiatives to address surge capacity focus on identifying adequate numbers of hospital beds, personnel, pharmaceuticals, supplies, and equipment. The problem with this approach is that the necessary standby quantity of each critical asset depends on the systems and processes that:

• Identify the medical need
• Identify the resources to address the need in a timely manner
• Move the resources expeditiously to locations of patient need (as applicable)
• Manage and support the resources to their absolute maximum capacity.

In other words, fewer standby resources are necessary if systems are in place to maximize the abilities of existing operational resources. Moreover, the integration of additional resources (whether standby, mutual aid, State or Federal aid) is difficult without adequate management systems. Thus, medical surge capacity is primarily about the systems and processes that influence specific asset quantity.

Basic example: If a hospital wishes to have the capacity to medically manage 10 additional patients on respirators, it could buy, store, and maintain 10 respirators. This would provide an important component of that capacity (other critical care equipment and staff would also be needed), but it would also be very expensive for the facility. If the hospital establishes a mutual aid and/or cooperative agreement with regional hospitals, it might be able to rely on neighboring hospitals to loan respirators and credentialed staff and, therefore, might need to invest in only a few standby items (e.g., extra critical care beds), minimizing purchase and maintenance of expensive equipment that generate no income except during rare emergency situations.

When addressing an overall medical surge strategy, it is recommended that guidance be delineated prospectively for maximizing the use of existing resources before resorting to the use of alternate care facilities and standards of care appropriate to the austere conditions of a disaster.^[14]

Medical surge capability refers to the ability to manage patients requiring unusual or very specialized medical evaluation and care. Surge requirements span the range of specialized medical services (expertise, information, procedures, equipment, or personnel) that are not normally available at the location where they are needed (e.g., pediatric care provided at non-pediatric facilities). Surge capability also includes patient problems that require special intervention to protect medical providers, other patients, and the integrity of the HCO.

Basic example: Many hospitals encountered difficulties with the arrival of patients with symptoms of severe acute respiratory syndrome (SARS). The challenge was not presented by a high volume of patients, but rather by the specialty requirements of caring for a few patients with a highly contagious illness that demonstrated particular transmissibility in the healthcare setting. Protection of staff and other patients was a high priority, as was screening incoming patients and staff for illness, preventing undue concerns among staff, and avoiding publicity that could adversely affect the hospital's business. Coordination with public health, emergency management, and other response assets was critical.

Effective strategies for MSCC require a systematic approach to meet patient needs that challenge or exceed normal operational abilities, while preserving quality of care and the integrity of the healthcare system. The MSCC Management System demonstrates management processes that allow HCOs to coordinate existing resources and then obtain "outside" assistance in a timely and efficient manner. In this way, HCOs can transition from baseline operations to incident surge capacity and capability—to meet the response needs of catastrophic events—and then back to baseline.

Figure 1-1. Management System for Reaching MSCC Objectives

Any strategy to enhance MSCC must recognize that the required emergency interventions are time sensitive and must be based primarily at the local level. This urgency limits the ability of the Federal Government to independently establish, stockpile, or own/control resources necessary for immediate MSCC. In addition, because most medical assets in the United States are privately owned, MSCC strategies must bridge the public-private divide, as well as integrate multiple disciplines and levels of government.

A comprehensive effort to address response requirements must include a system description (i.e., how the different response components are organized and managed) and a concept of operations (i.e., how the system components function and interact through successive stages of an event). It must include "all-hazard" processes and procedures, mutual aid, and other validated emergency management concepts. The remainder of this chapter presents key considerations for the system design and the concept of operations to maximize integration between response components and, thus, enhance MSCC.

Tier 1 includes hospitals, integrated healthcare systems, private physician offices, outpatient clinics, nursing homes and other skilled nursing facilities, and other resources where "point of service" medical care is provided. Emergency Medical Services (EMS) may be included in Tier 1 if called on to provide field-based medical care in an emergency. The goal of Tier 1 is to maximize MSCC within each healthcare asset while ensuring the safety of personnel and other patients, and the integrity of the asset's usual operations. This is best accomplished by optimizing an entity's Emergency Operations Plan (EOP) to effectively manage internal resources and to integrate with external response assets. The MSCC Management System describes key considerations for internal preparedness planning, while focusing primarily on the processes within the EOP that facilitate external integration with the larger response community.

The healthcare coalition organizes individual healthcare assets into a single functional unit. Its goal is to maximize MSCC across the coalition through cooperative planning, information sharing, and management coordination. The coalition ensures that public health and medical assets have the information and data they need at a level of detail that will enable them to optimally provide MSCC. In addition to hospitals, the coalition may include long-term care or alternative treatment facilities, dialysis and other outpatient treatment centers, nursing homes and other skilled nursing facilities, private physician offices, clinics, community health centers and any other healthcare asset that may be brought to bear during major medical response. Its reach may extend beyond the geographic area of the primary responding jurisdiction (Tier 3), especially in rural settings where healthcare assets may be scattered.

Tier 2 strengthens MSCC by creating the ability to move medical resources (e.g., personnel, facilities, equipment, supplies) to sites of greatest need.^[15] This is accomplished through mutual aid and cooperative agreements^[16] between HCOs. It also provides a platform for unified interface with the jurisdiction's incident management (Tier 3). To be effective, the coalition must establish a planning process that is equal and fair to all participants, giving each the opportunity for input during preparedness planning, response, and recovery.

Tier 3 directly integrates HCOs with other response disciplines (e.g., public safety, emergency management) to maximize jurisdictional MSCC. It is the most critical tier for integrating the full range of disciplines that may be needed in a mass casualty and/or mass effect incident. The focus of Tier 3 is to describe how to effectively coordinate and manage diverse disciplines in support of medical system resiliency and medical surge demands. This requires healthcare assets to be recognized as integral members of the responder community and to participate in management, operations, and support activities. In other words, public health and medical disciplines must move from a traditional support role based on an Emergency Support Function (ESF) to part of a unified incident command system. This is especially important during events that are primarily public health and medical in nature, such as infectious disease outbreaks.

To address MSCC, Tier 4 describes how State-level actions can support jurisdiction incident management (Tier 3), promote coordination among multiple affected jurisdictions, or assume a primary incident command role. The State management function also serves as the primary interface for requesting Federal assistance. During preparedness planning, State agencies may facilitate arrangements between jurisdictions to coordinate response assets. The use of strategic mutual aid and/or cooperative agreements may standardize the implementation of tactical mutual aid between jurisdictions and promote a cohesive response strategy during a widespread incident.

Tier 5 describes how to maximize interstate coordination to support MSCC. In the past, interstate coordination generally depended on ad hoc arrangements, goodwill at the time of an incident, and other less-than-predictable mechanisms. However, this changed when Congress enacted the Emergency Management Assistance Compact in 1996 (Public Law 104-321). EMAC, as it is commonly known, has now been accepted by all States and U.S. territories, and provides legal authority, financial mechanisms, and operational guidance to establish the ability to request and receive emergency assistance from other States or territories. This tier focuses on how to manage interstate medical and public health assistance and examines how mutual aid, incident management coordination, and information sharing can enhance MSCC.

The Federal Government maintains public health and medical resources to support State, Tribal, and jurisdictional authorities during a mass casualty and/or mass effect incident. The goal of Tier 6 is to maximize MSCC through the optimal integration and management of Federal public health and medical assets. Activation of Federal public health and medical assistance may occur through implementation of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (424 USC 5121, et seq.) or through independent authority of the Department of Health and Human Services (HHS) to declare a Federal public health emergency or disaster.^[17] The National Response Plan (NRP) and National Incident Management System (NIMS) provide operational guidance for Federal action. Tier 6 focuses on key functional concepts that promote integration of the Federal response.

Emergency management describes the science of managing complex systems and multidisciplinary personnel to address extreme events, across all hazards, and through the phases of mitigation, preparedness, response, and recovery. Hospital staff and other healthcare personnel might equate emergency management activities to a hospital's Disaster Committee (hence the recommended name change to Emergency Management Committee). The sum of all emergency management activities conducted by a response organization may be collectively referred to as an Emergency Management Program (EMP) for that entity. The term program is used because it denotes activity that is continuously ongoing, whereas a plan is often considered a series of actions that occur only in response to defined circumstances.

The activities of the EMP address the phases of mitigation, preparedness, response, and recovery. They are based on a hazard vulnerability analysis (HVA), which if properly accomplished, will identify potential hazards, assess their likelihood of occurrence, their potential impact and the organization's vulnerabilities to the impact, and provide a basis for understanding how the hazard likelihood and organizational vulnerabilities can be addressed. Each EMP phase is briefly described below.

• Mitigation encompasses all activities that reduce or eliminate the probability of a hazard occurrence, or eliminate or reduce the impact from the hazard if it should occur. In Comprehensive Emergency Management, mitigation activities are undertaken during the time period prior to an imminent or actual hazard impact. Once an imminent or actual hazard impact is recognized, subsequent actions are considered response actions and are not called "mitigation." This avoids the confusion that occurs with the HAZMAT discipline's use of mitigation, which applies to response actions that reduce the impact of a hazardous materials spill. Mitigation is the cornerstone of emergency management because any response strategy relies on medical assets surviving a hazard and maintaining operations in the post-impact environment (i.e., medical system resiliency). An effective mitigation effort should begin with, and be based on, a valid HVA as this will help an organization prioritize issues during follow-on mitigation and preparedness planning.
• Preparedness encompasses actions designed to build organizational resiliency and/or organizational capacity and capabilities for response to and recovery from hazard impacts. It includes activities that establish, exercise, refine, and maintain systems used for emergency response and recovery. The critical task in preparedness planning is to define the system (how assets are organized) and processes (actions and interactions that must occur) that will guide emergency response and recovery. This is accomplished through the development of an effective EOP (see below for suggested EOP formats). Staff should be educated and trained on the system so they gain the knowledge and skills necessary to adequately perform their assigned roles.
  
• It is important to note that the procedures and systems used to conduct preparedness activities (committee structure and meetings, memo writing, regular email notification of meetings, etc.) are typically not adequate for use during emergency response. This point is often missed by organizations as they attempt to utilize emergency preparedness committees and their associated structures and processes to manage response to an event. The EOP defines effective process and procedures for the context of emergency response (emergency notification procedures, establishing an incident management team, processing of incident information, etc.). It is recommended that, to the extent possible, emergency response process and procedures be used to conduct preparedness activities.^[20]
• Response activities directly address the hazard impact, including actions taken in anticipation of an impending event (e.g., hurricane, tornado) and actions during and after an impact has occurred. Specific guidance for incident response, including processes for asset deployment, is addressed in an EOP. An effective EOP not only guides the initial (reactive) response actions but also promotes transition to subsequent (proactive) incident management.
• Recovery activities restore the community to "normal" after a major incident. The initial recovery stage (which actually begins in the late stages of response) is integrated with response mechanisms, and the EOP incident management process should be extended into recovery. The management transition from response to recovery (both timing and methods) must be carefully planned and implemented to avoid problems. As recovery progresses, recovery management transitions to regular agency management processes or some intermediate method defined by the responsible organizations.
  

The ICS provides guidance for how to organize assets to respond to an incident (system description) and processes to manage the response through its successive stages (concept of operations). All response assets are organized into five functional^[21] areas: Command, Operations, Planning, Logistics, and Administration/Finance. Figure 1-3 highlights the five functional areas of ICS and their primary responsibilities.

Figure 1-3. Incident Command System

The ICS, as described in NIMS, refers to the combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure and designed to aid in the management of resources during incident response. The ICS is based on eight concepts that contribute to the successful application of this system.

Exhibit 1-3. Incident Command System Core Concepts

• Common terminology - use of similar terms and definitions for resource descriptions, organizational functions, and incident facilities across disciplines.
• Integrated communications - ability to send and receive information within an organization, as well as externally to other disciplines.
• Modular organization - response resources are organized according to their responsibilities. Assets within each functional unit may be expanded or contracted based on the requirements of the event.
• Unified command structure - multiple disciplines work through their designated managers to establish common objectives and strategies to prevent conflict or duplication of effort.
• Manageable span of control - response organization is structured so that each supervisory level oversees an appropriate number of assets (varies based on size and complexity of the event) so it can maintain effective supervision.
• Consolidated action plans - a single, formal documentation of incident goals, objectives, and strategies defined by unified incident command.
• Comprehensive resource management - systems in place to describe, maintain, identify, request, and track resources.
• Pre-designated incident facilities - assignment of locations where expected critical incident-related functions will occur.
  
  

For ICS to be effective, the incident must be formally defined so that there is clarity and consistency as to what is being managed. This may be best accomplished by defining the incident response through delineation of response goals and objectives, and by explaining response parameters through an Incident Action Plan (IAP)—the primary documentation that is produced by the incident action planning process.^[22]

Early in the response to the Pentagon on 9/11, incident command (headed by the Arlington County, VA, Fire Department) defined the incident as managing the fire suppression, building collapse, and the search and rescue activities at the Pentagon. It did not include objectives for managing the disruption of traffic or other countywide ramifications of the plane crash. Arlington County emergency management officials, therefore, quickly knew they had to manage these other problems through their Emergency Operations Center (EOC), which was geographically separate from, but closely coordinated with, incident command at the Pentagon.

The utility of ICS becomes evident when analyzing the demands encountered during an incident response.

Figure 1-4. Types of Demands Encountered in Incident Response

When an incident generates demands on the response system, the issues addressed first are usually demands created by the hazard itself—hazard-generated demands. For example, in a highly contagious disease outbreak, hazard-generated demands include the need to evaluate and treat victims, while controlling the spread of the disease. Simultaneously, the response system itself creates response-generated demands. In the same example, these demands include the need to coordinate disparate resources, to process widely dispersed data into accurate epidemiological information, to coordinate the public message, and to protect healthcare workers. Too often, the response community focuses on the hazard demands and neglects response demands until the latter create a significant impediment to overall response effectiveness. With well-developed ICS and emergency management support, the incident response proactively addresses both types of demands and, in fact, reduces many response-generated demands to routine status.

During an emergency, the normal administrative structure for an organization must continue to operate while actions are carried out under the EOP to address the incident. Issues not related to the incident are best managed, to the extent possible, by the usual, day-to-day administrative system. In a sense, the ICS structure works within and for the organization's usual administrative system. This concept may be obvious to some disciplines such as Fire Fighting (the entire Fire Department is not replaced by the ICS structure during response) but may not be as intuitive in the example of smaller organizations such as some healthcare facilities.

For this reason, it is generally NOT advisable for the Chief Executive Officer (CEO) or other senior executive to automatically assume the position of the Incident Commander (IC) for an organization. Instead, this individual may be better situated to serve in the role ICS denotes as "Agency Executive."^[26]. This individual maintains overall authority and responsibility for the organization, including the activated incident management team. The executive is involved in the incident by providing policy and strategic direction to the IC, as well as allocating the authority to the IC to manage the incident. The Agency Executive must have access to the IC and may be included in the incident planning meetings.

This concept of an Agency Executive is important for organizations to understand as they seek to develop an effective EOP and interface with other organizations. Even though the ICS for the organization may be clearly delineated, the role of the Agency Executive is not always well addressed.

Multiple organizations may have leadership responsibilities during a mass casualty and/or mass effect event. ICS has a designated model, Unified Command (UC), which allows multiple stakeholders to actively participate in incident management. When this occurs, the resulting UC team promotes cohesive action within the response system, and provides a uniform interface for integration with other tiers. This concept is critically relevant for participation by public health and medical disciplines since they bear a primary responsibility for the well-being of responders and the general population during emergencies or disasters. The UC model provides a mechanism for direct input from public health and medical practitioners at the decision-making level.

UC brings together incident managers of all major organizations involved in the incident to coordinate an effective response, while allowing each manager to carry out his/her own jurisdictional or discipline responsibilities. UC links response organizations at the leadership level, thus providing a forum for these entities to make joint decisions. Under UC, various jurisdictions and/or agencies and non-government responders may work together throughout the incident to create and maintain an integrated response system. UC may be established to overcome divisions from:

• Geographic boundaries
• Government levels
  
• Functional and/or statutory responsibilities
  
• Some combination of the above.
  

(Adapted from: U.S. Coast Guard Incident Management Handbook, U.S. Coast Guard COMDTPUB P3120.17, April 2001)

Unified, proactive incident command is accomplished through joint decision-making that establishes common incident objectives (i.e., management by objectives). During an incident, clearly delineated goals and objectives are agreed on and formally documented to form the basis of the IAP. To accomplish this strategic guidance throughout an incident, UC must entail:

• A single integrated management structure for the emergency response
• Shared or co-located management facilities
  
• A single planning process and IAP (single set of goals and objectives)
  
• A coordinated process for requesting and managing resources.
  

As previously described, Command and Operations are primarily supported by three internal (within ICS) Sections: Logistics, Planning, and Administration/Finance. However, in large-scale or complex events, incident command may require additional support from entities outside the responsibility/authority of ICS. This commonly occurs through an emergency management operations function—known in NIMS as a Multiagency Coordination System (MACS)—that is usually based in an Emergency Operations Center (EOC).^[27]. For Tier 3, it is usually supervised by the jurisdiction's emergency manager.

Figure 1-6. Relationship of UC and the MACS that provide emergency management operations support to the UC.

Multiagency Coordination Systems provide the architecture to support coordination for incident prioritization, critical resource allocation, communications systems integration, and information coordination.^[28] The coordination center (EOC and others, see figure 1-7) is referred to in NIMS as the Multiagency Coordination Center (MACC) component of the MACS. It provides support and coordination to the Incident Command, facilitates logistical support, and develops and provides information. The component of the MACS that provides strategic decision-making and policy direction (senior policy groups and others) is referred to as the Multiagency Coordination Group (MAC Group).^[29] The MACC implements the MAC Group decisions.^[30]

Figure 1-7. Common types of Multiagency Coordination Groups and Centers^[31]

During response, the MACS:

• Directly supports the UC by providing resources that are not available through incident-specific ICS capabilities. This includes coordinating assistance from outside resources (Federal, State, and other jurisdictions) that cannot be obtained through tactical mutual aid.
  
• Directly manages emergency issues related to the incident, but that are outside the scope of the incident as defined by the UC. This may be determined geographically (outside a scene perimeter) or functionally (beyond the scope of the UC control objectives when no single scene exists or when the impact is diffuse). An example is provided below.
  
• Provides integration between community political leaders and the incident managers.
  

Example: In the event of a widespread outbreak of SARS in a jurisdiction, the UC (with lead participation by public health and the acute-care medical community) would establish protocols to guide the medical evaluation and treatment of confirmed and suspected cases, and to address surge capacity needs. In addition, the UC would be responsible for limiting the spread of the disease (as defined by their IAP).

Addressing the needs of travelers stranded when mass transit is disrupted, addressing requests to minimize the effect of school or business closures, and other significant issues may be considered to be functionally outside the scope of the incident response system. The jurisdiction's EOC would manage these issues using its emergency management team and Emergency Support Functions (ESFs), or other task groups.

Because of its complex role, the EOC's organization and management processes must be well defined. The MACS functions should be physically separate from incident management activities, even if they are co-located in the same facility. This critical concept, which is not widely addressed by many medical and public health managers, ensures that the roles and responsibilities of each remain distinct.

Incident recognition is the point in time when a response agency becomes aware that a significant event (i.e., one requiring emergency response beyond baseline operational capability) is imminent or occurring. This is not always obvious, particularly with the onset of an infectious agent or chemical toxin. For example, one or two patients presenting to scattered HCOs with progressive paralysis indicating botulism may not be immediately recognized as a major public health problem until they are linked to a single toxin source. Because of this potential ambiguity, the process used to move from an early suspicion to recognizing that incident response is indicated should be carefully considered. Early convening of the jurisdiction's (Tier 3) UC, for example, may provide the necessary understanding of any public health impact associated with an event, and it may clarify whether an event needs to be formally declared an emergency.

Notification/activation refers to the activities required to inform appropriate assets within the response system about an incident onset or an important change in incident parameters. "Notification" conveys critical details (if available) and an indication as to whether the notified asset should undertake response actions. Full activation of every response component under UC is often not necessary and, therefore, the activation request in each asset's notification message may vary depending on the type of event.

Many notification/activation categories and schemes have been promulgated. Those selected for use should be consistent within tiers and easily understood across other tiers. To further prevent confusion, the categories should be clearly defined on each communication. The Federal Urban Search and Rescue System (and other Federal agencies) have used one notification/activation categorization for over a decade because of its clarity and simplicity.

Federal Urban Search and Rescue Notification/Activation Categories:

• Advisory: Provides urgent information about an unusual occurrence or threat of occurrence, but no significant action is recommended, requested, or required.
• Alert: Provides notification of an unusual occurrence where a response is anticipated or indicated. It provides guidance on the degree of action to take at the time of the alert. In some systems, an alert from a designated agency also authorizes the expenditure of a specific funding amount to address the costs of the requested pre-mobilization actions.
• Activation: May be either partial or full:
• Partial: Specific components or assets within a unit are activated (all other components should receive notification regardless of their activation status).
• Full: All resources commence response according to procedures described in the asset's EOP.

Other information is conveyed through "updates" during the course of the incident response.

Sources: Adapted from FEMA Urban Search and Rescue System; J. A. Barbera and A. G. Macintyre. Jane's Mass Casualty Handbook: Hospital; Jane's Information Group, Ltd., Surrey, UK, 2003.

The notification process should include a "confirmation of receipt" reply from the intended recipient. This reply should also contain a brief status report from the notified asset (using a standard format developed during preparedness planning) to allow immediate assessment of the response asset's capabilities.

Mobilization marks the transition from baseline operations to the response level designated in the notification. It may be triggered by a hazard that has already occurred, or it may result from a credible threat or an impending hazard (such as an approaching hurricane). Designating the response level enables an organization to execute specific actions delineated in its EOP for that level, such as providing contact information to ensure that the asset can integrate with other mobilizing response entities. For the mobilization process to function efficiently, each step must be clearly defined during preparedness planning and staff must learn the steps through training.

Incident operations encompasses efforts that directly address the hazard impact. Two critical actions that should occur early during operations are:

• Establishment of incident management authority: For certain types of incidents, the lead management authority and how incident management will be conducted are relatively straightforward (e.g., local fire service usually manages an explosion at a shopping mall). Management authority is more ambiguous in events that extend across jurisdictional boundaries or authorities (e.g., bombing at a Federal facility) or when the impact is diffuse (e.g., disease outbreak in multiple State jurisdictions). For most major incidents, tradition (and successful previous experience) dictates that jurisdictional authorities are responsible for incident management. For a diffuse impact scenario, State public health authorities (in a UC model similar to "area command" described in NIMS) might assume the lead role in UC and coordinate the incident response across the affected jurisdictions.
  
• Establishment of Incident Command Post: The site where the primary incident management team will function must be rapidly established and publicized across the response system. During any sudden onset or large-scale incident, several initial management sites are often established and operated by multiple disciplines from a range of MSCC tiers. The terminology used to designate them may not reflect their actual roles. Thus, identifying and publicizing the primary management site and how it integrates the other sites is a critical task in organizing incident-wide, proactive management.
  

When incident response involves multiple disciplines and levels of government, it becomes operationally important to synchronize, as much as possible, the planning activities of participants so that response actions can be coordinated (Figure 1-9). This promotes consistency across tiers in defining the incident objectives and follow-on tactics. It also ensures consistency in the development of public messages.

As Figure 1-9 shows, the planning cycles and operational periods for the jurisdiction (Tier 3) and State (Tier 4) are concurrent; those for the Federal response (Tier 6) are slightly staggered. This allows for information exchange during planning activities. The agency representative meeting enables the evolving IAP to be reviewed in time to identify conflicts before briefing the operational units. This meeting can be conducted face-to-face or via teleconference. A formal media briefing to release incident details could occur after the agency representative meeting to ensure that responders are informed first and to promote a consistent message.

Figure 1-9. Coordination of Planning Activities

Demobilization refers to activities that focus on disengaging response resources as the incident objectives are met, transitioning remaining incident responsibilities to ongoing assets, and promoting rapid return of demobilized response resources to their normal function. There are several important considerations:

• Demobilization across assets: The timing of resource demobilization is a complex and difficult decision, with potentially competing priorities between incident managers and managers of individual assets. The managers of individual assets and agencies should always coordinate any decision with the overall incident command. Demobilization of individual assets may occur at widely varying times, with some taking place early in a response if objectives have been met.
  
• Representing demobilization to the media and public: Management of the public's perception of asset demobilization may be very important, depending on the incident and the asset (e.g., the public believing the event is not over, thus being dismayed that an asset is disengaging). This should be considered carefully and addressed through incident management processes, including public information action that demonstrates that the asset's objectives have been accomplished and it is no longer needed.
• Continued use of ICS during demobilization: For medical resources, demobilization (and initial recovery) must occur efficiently because medical backlogs created during response can present a significant risk to the asset's regular patient population (e.g., delays in performing cardiac catheterizations), as well as a financial risk (e.g., loss of revenue from elective surgery). The continued use of ICS processes may be beneficial in addressing backlogs and should be considered during planning for both individual asset and overall incident demobilization.
  

Recovery refers to longer-term activities that extend beyond demobilization and other response activities. It includes the rehabilitation of personnel and equipment, resupply, and actions related to physical and financial restoration. Returning the overall system to its pre-incident state—the goal of the recovery stage—is addressed by developing and implementing strategic plans for full restoration and system improvement.

Post-incident "organizational learning" is achieved through a timely and objective after-action report process that is designed to capture the positive aspects and the shortcomings of the response system. Findings should be documented in an outline format that can be organized on a spreadsheet and tracked. One basic format that has been widely successful is designed to capture, for each issue, a brief description of the issue, background information, recommendations, and follow-up actions. Improvements should focus on the EOP organization, processes, and training or equipment/supply issues, rather than on individual personnel actions. The review should also examine how effectively each asset integrated into the overall system, as well as how the response tiers coordinated with each other. Indicated changes should be accomplished based on priority and incorporated into the appropriate documentation.