Who needs to be involved in the planning effort? You will want to include members of the hospital's leadership team as well as other internal and external resources. Security should play a key role because a security team's relationship with local law enforcement may be critical in a crisis, said Daria Niewenhous, JD, Esq., an attorney with Mintz, Levin, Cohen, Ferris, Glovsky, and Popeo, PC, of Boston, who also spoke at the IAHSS meeting. "Security is the liaison with local law enforcement," she said.

Your security staff will also be called on to handle the media crush that may result from an incident. For instance, if the victim of a high-profile crime is brought to your facility for treatment, you can be sure the media will not be far behind, said Sterling. It's important that hospital officials alert security so officers know that TV camera trucks may be pulling up in front of the facility.

Train security staff in handling the media. Set some ground rules. For example, to avoid chaos in your ER, you may decide to keep members of the media outside your facility. Do you want to restrict access to reporters and TV cameras? Do you want to require that an employee from media relations escort any members of the press inside the hospital?

In the midst of a crisis, it's important that hospital officials have legal advice and public relations control. Not every hospital has-or needs to have-a lawyer and communications expert on staff. You just need to know how to have access to this expertise when you need it, said Niewenhous.

You may want to seek legal advice whenever you are dealing with law enforcement activities, she said. Hospitals can cooperate with law enforcement investigations but need to do so without violating privacy concerns. If law enforcement officers ask for information, someone should contact legal counsel and make sure any information that is released is proper, she said.

All personnel should know the go-to people for crisis and media management and communications and how to reach them at any time. Facilities should have a phone tree to spread the word to people in a crisis. Test phone numbers and update the phone tree once per month, she recommended.

It's always important to tell the truth in any crisis, she said. If you don't know something, don't speculate. You must be accurate. "Whatever you decide to say, make sure it is the truth or it will come back to haunt you," Sterling said.

It's important to plan, prepare, practice, and refine, said Niewenhous. "You need to be in charge in a crisis. The reputation of your institution will depend on it," added Sterling.

You should have a team debriefing following any incident and look at what went well and what didn't. "Once the crisis is over, rarely do people come together. It's important to take the time and take that step," she said. Learn from each incident and listen not only to the crisis team, but talk to people who had to work with the team about what worked well and what didn't.

A woman contacted the medical center to alert it that she had received information about another patient. Medical center staff members either ignored her calls or did not handle them properly. Frustrated, the woman contacted the media and told them about the problem. Ironically, the mistakes were the result of a new computer program the hospital put in place to enhance patient privacy following the adoption of HIPAA laws.

It is often the case that hospitals have opportunities to address complaints before they snowball, said Niewenhous. For instance, if your risk management staff receives a call from a frustrated patient or family member, it has a golden opportunity to communicate with that person before he or she telephones the media. Don't let a series of missteps build until you have a crisis.

It's also important to reinforce with staff the importance of good patient relations. Staff members who make flippant remarks about a patient can cost you, said Niewenhous. For instance, staff members at one hospital were overheard making a comment about a woman's physical appearance. It turned out she was a state surveyor.

"We got some of our best stories from people who were not happy with the way they were treated," said Sterling, recalling her days working at a TV station where tips were often called in or e-mailed by disgruntled patients.

Hospitals should also exercise caution when terminating an employee. Involve security staff during any exit interview, said Niewenhous. After an employee is fired, a security staff member or other designated person should keep tabs on where the individual is allowed to go within the hospital and what he or she takes with him or her when he or she leaves the job.

Community relations staff members at your hospital are also likely to know members of the media.

The kinds of things that can land your hospital in the headlines

The following are the kinds of incidents and events that can create a crisis situation for your hospital and land the media on your doorstep:

Patient death or injury

Medication issues, such as wrong dose, wrong medication, or wrong patient

Missing medications/drug diversion

OR errors

Lab/diagnostic errors

Patient misidentification

Billing fraud and abuse

Breach of patient confidentiality

Release of protected health information by a facility or vendor

Data release or exposure

Breakdown in data security

Misuse of information by staff, including snooping on fellow staff members, neighbors, or friends

Staff leaking information to the press or others or selling data

Staff issues, such as substance abuse, behavioral problems, sexual harassment, or falsified credentials

Victim of a high-profile crime is brought to your facility for treatment

Physician or staff member commits a high-profile crime or scandalous act

Famous person admitted for treatment

Switched or abducted babies

Patient deaths at the hands of staff, such as mercy killings

Sexual assault of patients, staff members, or visitors

Source: Daria Niewenhous, JD, Esq., and Nancy Sterling, APR.

Five lessons learned from one healthcare crisis

When a situation occurs that can potentially create a media maelstrom, how hospital officials react can make all the difference.

As an example of how to respond in a crisis, Nancy Sterling, APR, senior vice president of strategic communications at ML Strategies, LLC, in Boston, cited the case of a health plan, which was a client of hers.

The health plan learned that an employee who had been fired had downloaded computer files with patient records. Officials feared and prepared for the worst, Sterling said. Would the former employee post patient information on the Internet? Would he use the -information inappropriately? Would the media learn of the security breach and splash the news in the headlines?

By looking at the steps the health plan took, hospitals can learn some lessons about how to react if faced with a similar crisis, Sterling said. She offers the following tips:

1. Act quickly. In this case, even though it was the weekend, a team of health plan officials and a crisis communications expert met immediately to prepare a plan to respond.

2. Call in outside experts if you need them. If you don't have a lawyer and communications expert on staff, bring someone in to advise you in a crisis.

3. Notify the appropriate authorities. Health plan officials worked with legal authorities and got a restraining order to prevent the former employee from using any information from the patient records.

4. Take all possible steps to prevent further damage. In this case, it was important to prevent further data dissemination. This breach was a red flag that alerted the hospital's information systems staff to step up security to protect patient data. The case was also a wake-up call for HR staff about the need to involve security in the dismissal of any employee. Someone needs to keep a handle on where an employee who has been fired is allowed to go in the building, what information he or she has access to, and what he or she is allowed to take from the facility.

5. Prepare communications to key audiences. During the weekend, officials notified board members of the security breach. If they got calls from the media, it was important that board members not be caught off guard, Sterling said. Officials also drafted a letter to health plan members explaining what happened, as well as to employees who might face questions if news of the security breach leaked out. Then they prepared for a media inquiry-one that fortunately never came. They carefully put together a press release explaining what had occurred. Although they never had to issue the press release, officials were ready if the incident became public knowledge, Sterling said.