#VegasStrong,One Year Later

Abstract

It has been about a year since the tragic events in Las Vegas of October 1, 2017, when a gunman opened fire on concert attendees at the Route 91 Harvest Festival. For many in southern Nevada, including public health staff at the Southern Nevada Health District, there has been no reprieve. Our activities have seamlessly transitioned from the immediate response following notification of the mass casualty incident and the coordinated response in the first 24 hours to recovery support operations, which continue today. I am proud of my #VegasStrong community and community leaders as we continue to support the needs of those most affected by this mass casualty incident. I am also honored to serve with so many exceptional preparedness and healthcare system partners, including numerous hospitals, emergency management, law enforcement, city and county managers, the coroner and medical examiner, behavioral health agencies, our resort properties, and the Vegas Strong Resiliency Center. This report is dedicated to all of those affected by this tragedy.

Background

On October 1, 2017, more than 22,000 attendees, of whom only 2,000 were local, and nearly 2,000 vendors gathered for the Route 91 Harvest Music Festival at a 17.5-acre open-air concert venue in Las Vegas, Nevada. At 22:05, a lone gunman broke out 2 windows of a suite on the 32nd floor of the Mandalay Bay Hotel and began shooting more than 900 rounds into the crowd of concertgoers; an additional 200 rounds were fired at security and law enforcement personnel inside the hotel. In less than 11 minutes, the gunman had injured more than 800 and killed 58 individuals before killing himself. Many first responders were already gathered on site and immediately began responding. They include 50 Las Vegas Metropolitan Police Department personnel at a command post; several ambulances with 16 intermediate and advanced life-support providers; and an inspector from Clark County Fire Prevention, as well as many off-duty first responders attending the festival. Despite the instantaneous response, the incident was chaotic.

Patients were rushed to area hospitals by ambulances, personal vehicles, vehicles for hire (eg, taxis, Lyft, Uber), public buses, and law enforcement vehicles, making it extremely challenging from the outset to track patients. During the response, EMS transported more than 180 patients, and the number of patients per ambulance may have exceeded standard 2-person capacity. The 3 closest hospitals—Desert Springs Hospital, Sunrise Hospital, and University Medical Center—received most injured patients (Table 1). Governor Brian Sandoval issued a declaration of emergency on October 2, 2017.¹

Table 1.

Patient Distribution from October 1 Event in Las Vegas^a

				Patients Received
Facility	Facility Type	Distance from Festival	Total	Treated and Released (first 24 hours)	Admitted	Surgeries	Decedents (DOA)
University Medical Center	Level I trauma center	6 miles	104	44	60	20	3
Sunrise Hospital	Level II trauma center	4.8 miles	212	148	64	83	16
Desert Spring Hospital	Community hospital	4.4 miles	103^b	65	20	3	4
Nine other area hospitals	8 community hospitals; 1 level III trauma	>7 miles	181	151	30	NA	4
Urgent cares; micro-hospitals	Urgent care; micro-hospitals	>7 miles	71^c	NA	0	0	0
Private providers, or out-of-area medical provider	Other	>7 miles	367+^c	NA	NA	NA	NA

As of March 1, 2018, the aggregate numbers for Table 1 were compiled by Southern Nevada Healthcare Preparedness Coalition member agencies from multiple sources. Dr. Felix Acevedo Jr, PhD, CEM, provided the estimated total number of injured patients seeking treatment related to 1 October event outside of the Clark County, Nevada, area.

18 trauma transfers.

Injuries directly related to 1 October event identified during recovery phase period, not verified by MSAC. Aggregate numbers provided are through collaborative efforts of multiple supporting agencies to identify potential victims injured during or immediately following the shooting.

NA: Information not currently available.

From the public health and healthcare system support perspective, the process of patient tracking from the pre-hospital scene to area hospitals, and then to discharge and beyond, proved to be the single most challenging aspect of our response. Patient tracking was complicated by additional factors, including media inquiries and competing and varying needs for information among responding organizations. The mass casualty incident quickly exploited vulnerabilities in patient tracking identified during previous community drills and exercises. In order to contribute to improved preparedness nationally, I am sharing lessons learned from the deadliest mass shooting by a single person in the United States.

Public Health Response and Patient Tracking

Situational awareness was an immediate need, and planning, training, and experience gained from previous exercises allowed us to quickly navigate how we would get timely information from area hospitals. Patient tracking was assigned to the Medical Surge Area Command (MSAC) through the Clark County Multi-Agency Coordination Center (MACC). Healthcare coalition members were notified and, as part of the county's MSAC Mobile Support Unit (MSU),² immediately began tracking patients. We did not use a vendor-supported patient tracking technology to assist us in this activity; rather, we used more labor-intensive processes relying on paper, telephone, and email. Limited initial metrics tracked during the first few days aligned with Health Insurance Portability and Accountability Act of 1996 (HIPAA) rules (Table 2).

Table 2.

Patient Tracking Metrics

Phases of Response	Activities Supported by Public Health	Operational Period (dates)	Metrics Tracked	Notes
Response phase	Emergency support function 8 and medical surge area command support activities of fully activated multi-agency coordination center immediately following mass casualty incident	11pm-11am October 1-2, 2017	Hospital name Patient name Patient disposition: treated, discharged/released, admitted, transferred location, deceased	Collected printed and handwritten hospital patient lists through medical surge area command, worked to compile master electronic spreadsheet for unified command and hospitals
Short-term recovery phase	Family Assistance Center operations: coroner's office, law enforcement operations, behavioral health and family support resources; multi-agency coordination center supporting Family Assistance Center operations	October 3-22, 2017	Same metrics as above; for patients admitted, started tracking changes in disposition and length of stay until discharge^a Additional information requested to support Family Assistance Center operations: coroner notifications and law enforcement investigations; patient address and contact information	Medical surge area command: daily additions to hospital patient lists and cleaning of metrics (removal of duplicates and ED gunshot wound patients not associated with October 1 event) Deactivation of multi-agency coordination center and medical surge area command October 26, 2017
Long-term recovery phase	Vegas Strong Resiliency Center, Nevada Victims of Crime, California Victim Compensation Board	October 23, 2017, to date	Victim, families, first responders, first receivers Intake form: Victim or family member, Name, Date of birth of victim, Full address, Telephone numbers, Email address, Privacy statement preferences and consent to be contacted, Interviewed by law enforcement? Relationship to victim, number of people in party Assistance requested: Financial, air travel, health care, personal property, counseling/spiritual care, ground/local travel, childcare, victim of crime referral, social services referral, and other	Outreach services and support for victims, families, first responders, and first receivers. Clark County Recovery Framework and various working groups to support efforts of Vegas Strong Resiliency Center and community.
Planning and exercise phase (AAR/IP)		October 1, 2017, to date	Nevada revised statutes proposed changes, solutions to improved information sharing metrics:Patient name, Hospital, Injury type (if terrorist attack, mass casualty incident, or crime related event), Patient acuity level, Total number of patients treated	Ongoing community planning activities to improve existing relationships and communication with regard to improving patient care, tracking, and information sharing metrics during emergencies without violating local, state, and federal laws including HIPAA.Review of electronic patient tracking systemsLocal HIPAA workshop held with federal, state, Nevada Hospital Association, and community stakeholdersInformation sharing presentations to share lessons learned and best practices with state and national partnersOperational changes in supporting real planned events such as New Year's Eve and other large venue, special events

Victims no longer tracked following local discharge. Many may have had significant, extended recovery and rehabilitation. The medical surge area command did not track behavioral health services following discharge of injured from local hospitals. This may continue to be tracked through support services coordinated through Nevada Victims of Crime, Vegas Strong Resiliency Center, and CaVCB.

Initially, basic information was requested from area hospitals, including patient surge volume; numbers of patients, transfers, and decedents; and EMS triage acuity. After the establishment of the Family Assistance Center (FAC) on October 2, additional metrics were requested, including the total number of patients treated and released and the disposition of injured patients who were admitted to hospitals. Every 12 hours, MSAC staff reviewed existing patient lists with hospitals to correct duplications and errors. Additional metrics continued to be added in the days following the initial response, as more support agencies requested information to help them provide the best possible services to those affected by the shooting (Table 2).

Initial patient information allowed unified command to quickly measure the size and scope of this medical surge incident, evaluate the need for additional resources, and assist other emergency support function (ESF) agencies to prepare for scheduled media briefings to report to the public on the number of injured. Names of patients at local hospitals were shared with law enforcement and the coroner to assist as a cross-referencing tool with available call center logs, missing person reports, and decedent next-of-kin notifications. As response moved into the recovery phase, patient tracking data supported a variety of operations by different agencies. The information was used to:

Provide the location of injured concertgoers and direct their families or friends to specific area hospitals;

Provide a secondary source for the coroner and medical examiner's office to assist in identification location of decedents who were transported to hospitals by private vehicles;

Assist law enforcement in cross-referencing missing person reports and identifying potential witnesses in the criminal investigations;

Update the joint information center (JIC) to provide information to the public and media about the size and scale of the event and the disposition of injured;

Update support agencies to coordinate resources and services for people who were injured or the families of the deceased;

Assist Clark County in identifying injured people who might have had lengthy hospital stays or increased medical costs, and who might benefit from the distribution of donated funds or compensation sources and services;

Update the state of Nevada and Clark County following the immediate response to secure funding and ensure sustained recovery and behavioral health needs were met;

Assist hospitals in identifying patients who might have been seen during the night of the incident, but who were not initially entered into the electronic medical/health records systems;

Assist researchers in comparing, evaluating, and analyzing multiple aspects of this mass casualty incident;

Identify more appropriate metrics for evaluating response volume and strengthen local awareness to improve emergency operations plans; and

Justify the need for electronic patient tracking systems and procedures that reduce the time necessary to share information during an emergency response, and support agencies providing recovery and mental health services following the incident.

Challenge #1: Demands for Information

Patient tracking metrics provided the aggregate information needed by unified command to report on the size and scale of the emergency and the numbers of victims injured or deceased and assisted in determining resources needed to mount effective response and recovery operations to support the needs of the community. While there were many end users of patient tracking data, having a single group—the MSAC—responsible for establishing and executing the patient tracking process was critical. Nonetheless, it was time-consuming to gather and share requested information. Stakeholders had competing and differing needs for patient information, and information wasn't always available or being tracked by MSAC or hospitals at the time of request. As more stakeholders were added to the response, requests for additional metrics to be tracked and provided by MSAC increased.

Establishing the joint information center and holding regular media briefings helped to build public trust that the incident was being managed appropriately. As a valued community asset providing necessary reporting, the media was pressured to provide more metrics; trying to meet these needs in a timely way was perceived as a burden by those compiling this information. It was a challenge to convey to media that patient numbers are not fixed and would change as patient lists were continually reviewed for accuracy. However, the media was truly a partner in information dissemination to the public.

Hospital staff was inundated with visits and telephone calls from family and friends seeking missing or separated persons. Patient tracking has the potential to streamline the process of linking location of injured or deceased people to families through appropriate responders, including law enforcement, the coroner, NGOs like the American Red Cross, and emergency management agencies. All area hospitals reported a secondary surge of concerned family members calling or arriving at emergency rooms to inquire if a person was being treated at their location. Having an established process in place for directing people to appropriate locations such as the Family Assistance Center was helpful. Many hospital leaders filled hospital's immediate staffing needs by meeting with individuals and groups arriving at hospitals seeking information.

Challenge #2: Privacy and Disclosure of Protected Health Information

Patient tracking was complicated by a lack of appreciation of or the fear of violating HIPAA and privacy rules, which protect the privacy of Personally Identifiable Information (PII) and protected health information (PHI).³ In several instances, additional metrics requested were not able to be provided immediately to the joint information center or law enforcement, because of HIPAA. Without completed consent forms to release this information, hospitals were reluctant to provide data, including patients' home addresses, telephone numbers, or email contact information, and the types of injuries individuals sustained. Having representatives from hospitals in the MSAC requesting information from their respective agencies was also essential to getting specific information; however, we still encountered challenges in the willingness of some hospitals to provide requested information, even to their own personnel. Many hospitals were not aware of the MSAC's role during emergencies and feared violating agency policy or HIPAA. HIPAA does have a public health emergency exception, as well as exceptions that relate to actions that are in the best interest of the patient. When the medical response operations concluded, so did several hospitals' willingness to continue to provide information to the MSAC to support recovery activities and share metrics needed during media briefings.

For the patient tracking to work effectively, every agency needs to designate an agency point of contact familiar with community needs for specific patient information and be willing to support the needs of other responders to better assist them in getting and sharing timely, consistent, uniform, and accurate information. Without legislation, mutual aid agreements, and standing requests for incident information that predetermine what patient information will be shared with response agencies during emergencies, our experience will likely be repeated.⁴ Bi-directional sharing of patient tracking information among the healthcare system, emergency management, first responders, and law enforcement agencies remains a gap that we are working to improve.

Corrective action planning has been ongoing since October 1. On May 4, 2018, following several local after-action report meetings that identified challenges with HIPAA and information sharing, the Nevada Hospital Association, in partnership with the state of Nevada, Division of Public and Behavioral Health, hosted a workshop in Las Vegas to discuss HIPAA challenges during the October 1 response and recovery.

Community stakeholders, as well as federal partners from the Department of Justice, the Department of Health and Human Services' Office of the Assistant Secretary for Preparedness and Response (ASPR), and others were invited to attend. Drawing from these discussions, Governor Sandoval issued Executive Order 2018-4, Implementation of Nevada's Statewide Resilience Strategy, on March 13, 2018. Section 3, Subcategory 5, states, “Under the authority of NRS 414.300, the Co-Chairs shall develop regulations for information sharing protocols for HIPAA-protected information and Personally Identifiable Information between federal, state, tribal, local, private sector, and non-profit partners during emergencies. These regulations shall include training requirements for state and local agencies to ensure understanding of the information sharing protocols.” This order currently aligns well with other local corrective action, and improvement planning.

Challenge #3: Tracking Non-Local Victims

On October 23, 2017, the Vegas Strong Resiliency Center (VSRC)⁵ was established as a resource and referral center for individuals and responders affected by the shooting. The VSRC provides victim advocacy and support, case management, counseling and spiritual care referrals, and technical assistance with applying for online services, including FBI victim assistance services. We were able to successfully track victims who sought services or registered with either Nevada's VSRC or the California Victim Compensation Board (CaVCB).⁶ However, more than 90% of the injured from October 1 were visitors to our community, from other states and countries. Unconfirmed media stories were circulating about injured victims not being treated locally, boarding planes to fly home, and then seeking care for injuries sustained at the mass casualty incident.⁷ In the months since, we have not been able to track or validate all of the injured or affected people from this event, including individuals with behavioral health needs, individuals who deferred seeking care to let more seriously injured patients get immediate care, and individuals who sought care after having returned home. In order for victims to receive resources and time-limited services, they must register with the Nevada Victim of Crime Program through the VSRC. This challenge persists; those affected by this event had until Monday, October 1, 2018, to complete this registration through the VSRC.

New Year's Eve 2017

New Year's Eve is one of our jurisdiction's largest annual events, with more than 300,000 visitors coming to Las Vegas to ring in the new year. Las Vegas hosts many large-venue events, all of which have the potential to have a profound impact on the healthcare system and emergency medical services. When natural or intentional emergencies occur, this impact is compounded by the added influx of visitors into our community. We look forward to New Year's Eve from the preparedness and emergency management community perspective; a large-scale event provides us with the opportunity to plan, to mitigate threats that may lead to negative outcomes, to test our emergency response plans, and to improve our emergency operation center coordination and communication systems.

This year was no exception, and lessons learned from the October 1 mass casualty incident were incorporated and implemented. On New Year's Eve, an immediate change was to have regional representatives from Uber, Lyft, and the Nevada Taxicab Authority in our county MACC, so that if we needed to push information to their drivers, we would be able to do so.

Next Steps

On October 1, many critical patients arrived at nontrauma hospitals by private vehicles, only to be transferred to trauma facilities once they were triaged and stabilized. Traditional approaches to triaging and distributing patients ensure that hospitals are not overwhelmed and that patients are sent to facilities capable of treating their injuries; these protocols were not compatible with the transport patterns we experienced. Planners need to review existing EMS protocols and transport regulations and Nevada's Crisis Standards of Care, and to review ethical, moral, and legal considerations if an alternative tactic is to be employed. As well, planners need to consider safeguards that may be necessary to ensure that harm to patients is minimized and that private citizens or drivers, with good intent under existing Good Samaritan Laws, are not harmed for offering their services to help those in need during emergencies.

Based on the challenges we encountered tracking patients during this mass casualty incident, and subsequent meetings and workshops, public health's next steps are to:

Continue to discuss patient tracking needs, including HIPAA compliance, with our partners including healthcare system and emergency management personnel;

Identify partner-supported patient tracking metrics and processes to assist first responder, first receiver, and coordinating agencies with fulfillment of their respective duties and incident objectives; pre-identify agency points of contact and develop memoranda of understanding, if necessary;

Consider stand-alone, vendor-supported patient tracking systems that integrate with systems already in use;

Train partners on use of the patient tracking system and use the system to identify access and information-sharing barriers;

Continue to train partners on use of paper methods and processes for patient tracking, should technology fail;

Identify cost-sharing opportunities and funding for patient tracking systems, as well as opportunities to use this system routinely for large-venue special events;

Promote and support community partnerships to review, modify, revise, or develop new regulations or statutes to support sharing of pre-identified patient information during emergencies or disasters;

Continue to provide support to the Vegas Strong Resiliency Center and working groups; and

Continue to share lessons learned and best practices with other states and jurisdictions and, in the sharing of information, adopt into our practice the positive work done by others.

Conclusion

Patient tracking and considerations for the type of information shared is essential in health care and the incident command system. These metrics are not often directly related to immediate health or safety of the patient but do have significant value. During this event, debates about justifying and prioritizing who needs information while trying to support the immediate community response created unnecessary work. Justifications in support of or opposition to providing this information to emergency responders, emergency management, law enforcement, and public health by healthcare agencies during emergencies must be discussed, and an understanding among local agencies should be reached prior to future events.

The Las Vegas Metropolitan Police Department released the criminal investigative report of the October 1 mass casualty shooting on August 3, 2018. This report identified 869 documented physical injuries. The report's conclusions are consistent with our experiences supporting the possibility that the total number of physically injured could be much higher considering affected populations outside of the concert venue. The report is a thorough review of the incident and outlines many more patient tracking and injury metrics gathered through their force investigations team in the months following this incident.⁸

References

State of Nevada. Office of the Governor. Declaration of emergency. October 2, 2017. http://gov.nv.gov/News-and-Media/Orders/2017ADA/Declaration-of-Emergency-for-Clark-County. Accessed September 28, 2018.

2010 Nevada Code. Title 36 Military Affairs and Civil Emergencies. Chapter 414 Emergency Management. NRS 414.037 “Mobile support unit” defined. https://law.justia.com/codes/nevada/2010/title36/chapter414/nrs414-037.html. Accessed September 28, 2018.

45 CFR §§ 164.502(b), 164.514(d).

38 USC §(f)(2) & Nevada Revised Statutes, NRS 439.5102 through 439.5108. To investigate or obtain information for the purposes set forth in and authorized by the cited statutes.

Vegas Strong Resiliency Center. https://vegasstrongrc.org. Accessed September 28, 2018.

California Victim Compensation Board. https://victims.ca.gov. Accessed September 28, 2018.

Saul

. Beyond the shooting: how more victims ended up at Las Vegas hospitals throughout the week. Newsweek October 11, 2017. https://www.newsweek.com/las-vegas-shooting-more-victims-hospitals-682675. Accessed September 28, 2018.

LVMPD Criminal Investigative Report of the 1 October Mass Casualty Shooting. https://www.lvmpd.com/en-us/Documents/1-October-FIT-Criminal-Investigative-Report-FINAL_080318.pdf. Accessed September 28, 2018.