Ebola and Risk Management Gone Awry

Like any other thinking human being these days, I’m increasingly worried about the ebola virus.

Now, I am not worried that ebola is destined to spread like wildfire and drive us into some god-awful real-life version of “The Stand” or “Walking Dead.” Nor do I worry that mankind will never find a cure. I believe we will, and fairly soon. I believe we have the scientific skill to find a way out of this fledgling nightmare before it gets millions of us killed.

But I worry deeply that we lack the organizational mastery to execute that plan once we find it. I worry that we might see the way out, and then be unable to get out of our own way to take it. The ebola crisis is a study in corporate risk management that is as life-or-death as a test could possibly be, and right now, we’re failing.

Policy management and business process mavens should be scouring Texas Presbyterian Hospital in Dallas, where Thomas Eric Duncan was treated before he died last week. His relatives took him to a hospital with fever, vomiting, and sweating, and he told medical staff he had been in Liberia—yet somehow that piece of information never reached the attending physician who saw him and sent the man home. Only several days later, when his symptoms were much worse and Duncan returned to the hospital, did medical personnel grasp the gravity of the problem and place him in isolation.

We all know the rest of the story. By the time Texas Presbyterian admitted him, Duncan had exposed dozens of people to the virus and they are all in isolation. Duncan himself then died Oct. 8. One of his nurses tested positive for ebola yesterday and is in critical condition.

The usual fools in this country are panicked and prepping, of course. The rest of us are simply alarmed at the missteps that led Texas Presbyterian to release Duncan the first time. Who at the hospital knew during his first visit that he was from Liberia? What did they do with that information? How did they not raise an immediate alarm to the head of the infections diseases department? Why was the Centers for Disease Control not informed immediately? How did the doctor not also ask the victim proper questions to gauge his risk of ebola?

Examining this disaster through the lens of the COSO framework seems trite, but the truth is that somehow Texas Presbyterian failed on all sorts of elements in the COSO cube. Risk assessment, control activities, control environment, information and communications—you name it, and somehow the organization handling Duncan’s care flubbed it. How?

I’m reminded of the launch of Healthcare.gov one year ago, to let people sign up for health insurance under the Affordable Care Act; it failed by every benchmark. Eventually the government remedied the situation and I believe this year’s enrollment period will go far more smoothly since we have last year’s experience behind us. We learned.

With ebola, however, the room for error is so much less. Before news of the second infection in Dallas broke Sunday, I thought to myself: if even one other person in tests positive for ebola because we did not isolate Duncan immediately, that would be a public health crisis. We were told to trust the system, and the system failed us.  Now that is exactly what happened, and trust in our ability to manage ebola risk has gone out the window.

Indeed, if you want a history lesson on how large organizations should respond to unexpected risks, look to New York City in the spring of 1947. That was the last outbreak of smallpox in the United States.

By that time smallpox was extremely rare in the United States, but not eradicated. In March, a businessman from Mexico City arrived in New York complaining of fever and ill health (gee, that sounds familiar), and doctors mis-diagnosed him (sounding familiar too) with bronchitis before he died. By the time they realized the man had smallpox, two others had been infected. The public health crisis was underway.

Here is where New York demonstrated risk management excellence: In the next 10 days, New York City public health officials vaccinated six million people. Police stations, fire houses, churches, schools—every public establishment in the city became a vaccination center.

Now ask yourself: do you believe we could do that again today, even when we do have a vaccine for ebola? Do you believe we could move mountains of supplies, and people, and public sentiment, to do what is right for the public good?

Neither do I. We have a tremendous amount of work in front of us to contain and defeat ebola, even if a cure falls out of the sky tomorrow. And that’s not happening either.