Responding to Outbreaks
How to Prepare for and Contain Communicable Diseases

There has always been the potential for an outbreak of a communicable disease affecting a large population, but the likelihood increases when considering that such an epidemic can be triggered intentionally by terrorists. Whether the cause is natural or a result of bioterrorism, companies can take steps to prepare a response that will reduce the impact of a communicable disease outbreak.

By Jeremy Haworth

The outbreak of a virulent disease can have widespread effects on daily personal and business routines. From a business perspective, companies need to take strong, visible measures to protect not only those for whom they should care (staff, customers, visitors, vendors, suppliers, etc.) but also the interests of key stakeholders in the organization (shareholders, institutional investors, etc.). Below are just some of the key issues that businesses must address in order to effectively exert control over such a crisis. These are by no means exhaustive but are worthy of further consideration when planning a response to the outbreak of any major epidemic.

Know When to Act

An organization should determine its risk appetite and the time at which it should activate contingency management functions to take steps to contain the incident. Of course it is not quite so easy to identify trigger points in the case of unknown diseases, but it is important that all members of recovery functions or committees understand that their role as guardians of the overall recovery process is not just restricted to being reactive but is also anticipatory.

It costs little if anything to meet to consider evolving events, and for the solicitation of external experts to assist in the decision-making process. Businesses should consider requesting medical advisors or authorities to notify them of disease threats as a matter of course; in many cases this may involve the Human Resources department developing closer ties with company doctors and health authorities.

Acquire Information Quickly

It's imperative at the outset of an epidemic to learn more about the disease's virulence, physical effects, modes of transmission, and appropriate mitigating measures. Immediate consultation with medical experts is critical. Organizations should also learn of the measures to be taken by the government (e.g., quarantine measures) and directives from the World Health Organization and how these might affect business. Legal guidelines must be met and ultimately assimilated into practical response measures to manage the business.

In addition to guidance from the medical community, companies should seek input from their facilities management personnel (i.e., How does the ventilation system in the building work? Are our filtration systems adequate?), legal professionals (i.e., What is the company's duty of care? What categories of work can acceptably be performed from home?), and public relations professionals (i.e., What is the best way to communicate key issues? Who should the company be communicating with?).

Mechanisms should be developed, and parties identified, to monitor all of these issues centrally, and regional head offices must be able to efficiently share guidelines within their areas of responsibility. This can be done by adapting the normal communication and response structures for major incidents. The adaptation of well-understood decision-making structures, rather than reinventing the wheel with ad-hoc committees at the time of crisis, minimizes reaction time and confusion and allows the business to more effectively focus on its rapidly changing needs and those of its customers. Structure, along with flexibility within that structure, is the key. To ensure readiness, scenario-based exercises should be designed to test the crisis management and business continuity functions.

Establish Response Policies

Policies that can be developed for responses to disease outbreak involve the following:

• Leave: special leave for employees to look after children not at school, or for pregnant employees
• Travel: reduced levels of business travel and increased videoconferencing and teleconferencing; identification of restricted countries; the communication of local measures for employees travelling in affected regions to adhere to; monitoring precautionary quarantines that restrict travel to and from countries; knowing the location of all travelling employees
• Off-site activities: accounting for activities, such as sales and promotional events, at other locations
• Handling confirmed cases: identifying the central point of contact and what information is required; consideration of data privacy issues; identifying guidelines for arranging advised medical procedures; ongoing support of affected employees and their families; reintegration into the workplace once recovered
• "Split-Site" moves: identifying who should authorize the split of high priority or high risk departments between two locations and how this will be administered (i.e., decisions to perform split-site moves for critical headcounts only; to use canteen areas and training rooms set aside as backup locations for "normal" disruptions; or to retain monthly reports of vacant space)
• Remote workers: determining who can work from home effectively and who authorizes it; considering how the sudden increase in remote access to computer networks can be managed
• Consumables: identifying the focal point for ordering consumable supplies and ensuring access to a wide variety of sources worldwide when demand is high; determining how stocks are replenished, who pays for them, and what the priorities are for distribution
• Cleaning and facilities management: determining what is involved in increasing the levels and type of cleaning in washrooms, elevators, and work areas; determining if ventilation within the building should be increased while maintaining security
• Data center management: determining if staff should be split between main data centers and backup data centers; determining if hygiene procedures are rigorously enforced in these critical areas

Communicate Policies

Taking into account the above issues and considerations, those responsible for managing an organization's response must develop fair and practical policies and communicate them to staff and other parties openly. The correct response is to be as transparent as possible and to give sufficient credence to the professionalism of the staff to understand why these policies are important to the business. This approach elicits a very positive response from staff and is instrumental in developing a "can do" attitude.

Openness is an act of leadership and confidence, not just management. Those organizations that decide to prevaricate and obfuscate in their communication invariably find that confusion and fear is the result. The key concern of such organizations is that they might be either intruding upon privacy issues or divulging too much about their lack of preparedness. Buy-in from staff, through being honest and open, can overcome both of these issues.

Exercise the Plans

Faced with such a prolonged disruptive event, with implications worldwide, it is essential therefore to have a suitably experienced and dedicated crisis management and business continuity function capable of responding to a disease outbreak. The structure within which this function operates must be understood throughout the entire organization and must be frequently exercised in a scenario-based manner that challenges thought processes and is flexible enough to adapt. So long as the overall structure of response is in place, many other factors can fall into place as the response team exerts control over the incident swiftly.

Summary

Serious consideration should be given to incorporating specific guidelines for the management of communicable diseases. Information gathering from a wide variety of medical and governmental sources and monitoring of the same is critical throughout any response to a virulent disease. Fair policies can be developed (and amended over time) to protect staff, customers, and stakeholders while mitigating the risk of loss of business and reputation. Furthermore, communication is so crucial to effectively and honestly conveying key messages and requirements to staff, customers, and key external parties that the role of intranet, e-mail, and web-based business channels should be considered critical tools, and their resilience should be high on the agenda in the early stages of any response.

About the Author Jeremy Haworth MBCI is the senior regional business continuity planning manager, Asia-Pacific, for HSBC. He is also the Hong Kong representative for the Business Continuity Institute. He can be contacted at jeremyhaworth@hsbc.com.hk.

This article was adapted from "Communicable Diseases: Business Continuity Issues," published in Continuity Magazine, the official magazine of the Business Continuity Institute, and on www.continuitycentral.com.