The potential human toll of a bird flu pandemic is hard enough to contemplate, but the possible economic impact is also vast. CSOs (and all continuity planners) need to think ahead to keep their organizations -- and the economy at large -- working to the greatest extent possible. Ed Carubis, former CIO of the New York City Department of Health and Mental Hygiene and now senior consultant to geospatial data company ESRI, spoke with Senior Editor Sarah D. Scalet and offered specific steps for CSOs to follow.
CSOs' first steps in preparing for an outbreak:
Preparation starts with an assessment of the critical assets you'll need to manage effectively during an outbreak: employees and facilities. It's very important to do an assessment of the quality of the information your company is capturing about its employees and facilities.
A big part of that is spatial data, of course. Do you have precise addresses for employees? Can you display that information on a map? What about the details regarding facilities' locations and where they fit in your overall business process?
During emergencies you need to move from whatever your everyday organizational structure is -- flat, hierarchical, et cetera -- into a command-and-control structure. At the New York City Department of Health, we had a process -- a skills assessment of all 6,000 employees to determine what role they would play in a major emergency. That's an important process for all corporations, not just those directly involved in emergency preparedness.
Possible quarantine scenarios:
The recent national strategy that President Bush has put forward indicates that quarantine and community-based interventions may come into play. Those decisions potentially will have a very big impact on businesses. There may be "snow days," where the government asks the population at large to stay home for a few days, depending on how an outbreak is progressing. Or the government may ask everyone to stay home in a particular community where that outbreak is occurring.
You don't really know, depending on how a virus mutates, what the incubation period will be. Typically, viruses have an incubation period of 48 hours. To be safe, the [national strategy] guidelines call for a 10-day period, which is more than enough, in my opinion, to deal with most influenza-based outbreaks. The government may ask schools to close, and there are related child-care issues that a company's going to have to deal with. Another scenario is that the government may establish what they call working quarantine, whereby a set of individuals can go to work if they are medically screened on a daily basis. Typically this happens first in health-care settings. You'd rather have people stay at home, but in those critical areas like first responders, law enforcement, sanitation, public health, and the medical/health-care delivery system, you want as much as possible to keep those people working. In those areas particularly, a working quarantine approach may be suggested. Corporations need to build partnerships with the public health entity to see how that would play out.
Companies need to know which employees and facilities are in an affected area, and they need contingency plans to redirect services to other facilities outside that area. For large companies, it becomes complex rather quickly. Think about multiple communities that have different levels of restrictions placed on them, and decisions that the company has to make in order to keep their business running.
CSOs should look at their current telecommuting policies, because strategically that can be a really important way to retain a high level of functionality, letting folks work from home wherever possible. CSOs should think about that up front. Do we have the capacity to have 80 percent of our employees working from home? Do they have access to all of the information assets they would need?
The other piece they may want to think about is the current travel policies. Travel introduces a risk, particularly to influenza source countries in Eurasia. [CSOs should] begin to develop a travel profile for their company so that when an outbreak occurs the company knows who travels where, and why they go there. And they should also have contingency plans if they were not able to travel to Asia for six months, or if certain goods from Asia weren't available.
The private sector's role in helping detect outbreaks:
Public health could ask companies: "Let us know the locations where employees are calling in sick, and capture the reasons why." By tapping into the large employers and the attendance systems of public schools, public health officials would be able to use that data for detecting at the earliest possible stage when an outbreak might be unfolding. Extended collaboration and participation from large employers would certainly help in understanding the directionality and extent of the outbreak.
CSOs have to be thinking about how to do that securely, without compromising employee information. This really calls for establishing those relationships up front with public health people. Our conversations with the [Centers for Disease Control] shows they haven't thought about proactively forming partnerships with CSOs, or relying on industry associations or what have you, to create data-sharing agreements ahead of time. The last time to try to figure this stuff out is when something is unfolding. [CSOs should] say, "We want to be a partner, to do this securely. We don't want to do it in any way that compromises our intellectual property or our employees, but we do want to participate." In return, they can get from public health the latest information about outbreaks so they can make decisions about business continuity.
That question is best answered by the public health folks, though my take is they would not advocate that. Vaccine for a pandemic flu is not going to be available for at least six months after the outbreak begins. So that wouldn't even help. And then as it ramps up and starts being produced, government is going to control that distribution to the areas of greatest need.