Introduction
With major incidents, the demand for clinical care may exceed the availability of the resources. Optimal use of available resources must be achieved through adequate coordination to create “the greatest good for the greatest number of people.”Reference Frykberg1
Dealing with major incidents requires an immediate and coordinated response by multiple organizations. The allocation of various resources over multiple geographical locations makes for a complex decision-making process. Allocation of patients to hospitals and adequate patient tracking and tracing are major issues; the number of victims, their conditions, and the status of their transport are often unknown. This may result in an ineffective response.
In 2000/2001, just six months after the fireworks disaster in Enschede, the Netherlands was hit by a new disaster. On New Year's Eve, a fire in a pub in Volendam killed 14 people and injured 245. It took several hours to get an overview of the number of victims and the severity of their injuries. The confusion persisted even after the evacuation from the scene was completed. The registration of patients at the disaster site and in the 19 receiving hospitals was a major problem. Valuable time was lost identifying patients and seeking family members.2
These problems are encountered and described worldwide; the World Trade Center disaster is one of many examples of communication failure with regard to response from different agencies.Reference Pryor3, Reference Mattox4 Communication problems were a greater hindrance to an effective response concerning triage, patient movement and hospital preparation than all other factors combined.Reference Simon and Teperman5 Also, after Hurricane Katrina, the US Senate Homeland Security and Governmental Affairs Committee Report concluded that responders’ efforts during the crisis were “hampered by the lack of data interoperability.”6
The core problem is an ineffective integration of different systems. The medical, fire and police departments, together with the government chain of command, all have their own systems; these systems are poorly interconnected. This results in a poor understanding of the three basic elements essential to providing an adequate (medical) response:
1. Situational Awareness—The ability to make timely and effective decisions during rapidly evolving events is highly dependent on an understanding of the situation at the scene and in the response chain. This should be based on accurate and up-to-date information.
2. Resource Allocation—In case of a major incident or disaster, the demand for clinical care may rapidly outgrow available staff and hospital facilities. Optimized use of available resources must be achieved through allocating transport availability, hospital capacity, and shelter or mortuary facilities.
3. Stakeholder Information—In today's real-time information society, a major incident will trigger an immediate need for adequate and validated third-party information (authorities, relatives, and media).
To overcome the challenges of providing adequate victim information in a highly complex and chaotic situation, a Victim Tracking and Tracing System (ViTTS) was developed to provide:
1. Early, unique identification, registration and following of victims during a disaster or Major Incident;
2. Real-time information of the victims (quantity, seriousness of injury), their whereabouts and destination;
3. Early management information to the chain of command;
4. A stable data communication platform;
5. Interoperability and availability to relevant authorities and participants in the response; and
6. A secure network.
This report describes the development of an online Victim Tracing and Tracking System (ViTTS), including results of feasibility tests and usability tests in disaster drills. Its strengths, limitations and recommendations for the future are discussed.
Report
Technical Aspects of the System
The ViTTS was developed to record and exchange information about the status and location of victims during and after a mass-casualty incident. It offers an online information exchange network and standards that promote interoperability of existing systems of the various organizations within the disaster management chain.
It consists of a central data bus (Figure 1) that is linked via local and wide area networks to the existing database systems in the disaster management chain. The data bus functions as a “central highway” for data transport. The various local databases (eg, Police, local council, command vehicle, other nongovernmental organizations and emergency databases) are linked to this data bus system. The applications can communicate with the ViTTS data bus through Extensible Markup Language (XML). In 2006, standards were further developed to promote uniform information provision. These are protocols or formats on how data is registered and exchanged among operational services, authorities, hospitals and the ViTTS data bus.
Figure 1 ViTTS Dataflow. The systems of all partners in disaster relief are connected through the ViTTS databus.
The ViTTS data bus is connected to a central database at a secure main hosting site, where all sent messages are saved in data files. Through a Coordination, Evaluation and Report (CER) framework, overviews can be constructed automatically by extracting information from the database. These are then distributed over the data bus and presented to the authorized users.
The data transported over the ViTTS data bus consists of: (1) Major Trauma Outcome Study (MTOS) data and triage data;Reference Champion, Copes and Sacco7 (2) personal data; and (3) location data.
A key feature of the system is an early and unique identification of each victim. From the start of the process, victims are marked with a unique identification number (TGN) that is used in all registration systems of the disaster response chain. The TGN is similar to the number used in the barcode of the injury cards that are used for field triage. This is irrespective of a person's identity. When each victim's identity becomes known, the TGN/barcode can be coupled to a Citizen Service Number, a unique personal ID number for each citizen in the population register (Municipal Personal Records Database) at the local government level. This can be achieved by adding the Citizen Service Number to the personal data. The Citizen Service Number is used by all government organizations.
To enter data in the field, a Personal Digital Assistant (PDA) is used. The PDA is connected to the data bus through a local wireless network (WLAN) (Figures 2 and 3). This WLAN is created by the first ambulance, which is equipped with a Mobile Access Router that establishes a secure, high-capacity data network. Links are maintained among the different wireless devices used in the field and the central database at the secure central hosting site. The PDAs have the capability to work offline, storing the data in the memory of the PDA, which can be transferred at a later stage whenever the LAN becomes available again. In the test version, transfer after network loss was an active step. During the test, it proved not to be necessary because of the automatic handover of dataflow to a Terrestrial Trunked Radio (TETRA) network during loss of WLAN and GPRS coverage (loss of GPRS coverage was mimicked by deliberately switching off the modem, see below).
Figure 2 ViTTS Use During a Disaster/Major Incident
Figure 3 PDA Reading of Injury Card
With the PDA, the barcode containing information on the TGN and triage category can be read (Figure 3). If the barcode scanner fails, manual entry of the TGN is possible; the number under the barcode represents the unique identification. Besides the barcode, triage data are stored in the central database in real time. If the conditions of the patients change, and they are re-triaged to different categories, this is easily changed in the system. Scanning the barcode retrieves all data. Subsequently, this data can be updated; any additional information can be added to the ViTTS database as it becomes available or as time permits.
The wireless network is formed by WLAN hotspots generated by the participating ambulances. A hotspot consists of a wireless access point (base station for an IEEE 802.11b network) and a mobile router. The PDAs have a wireless interface to communicate with the hotspots. If a router fails to generate a WLAN, the router from another ambulance can take over data traffic to guarantee system integrity.
Each hotspot has a gateway for several national mobile networks and is therefore connected to the central database through General Packet Radio Service (GPRS). If one of the mobile networks is not available, or the wireless connection fails, automatic switching of dataflow to another network takes place. Backup networks include TETRA networks that work on a different frequency than does the GSM (Global System for Mobile Communications) network. For example, the digital C2000 network is the current closed network for rescue services in the Netherlands. It is one of the TETRA networks available as a backup for the ViTTS, and was tested to ensure that switching occurred (see below). Altogether, there are three general categories of data transport from the scene to minimize the chance of network failure: WLAN, GPRS and TETRA networks, including C2000. The ViTTS can also be connected via wired Internet connections.
The data bus is connected to all critical emergency and hospital systems, either through GPRS or wired Internet connections. Data are accessible via a series of levels depending on the legal authorization rights of the person accessing the database. The data can be accessed and completed by relevant parties in the rescue chain (Figure 1): ambulances, hospitals, fire department, police, Red Cross, the municipality and other agencies involved in the disaster. Each has its own requirements and authorization. A security and authentication mechanism is built into the database to ensure patient privacy, and all access to information is logged. The 802.11 WLANs themselves do not offer encryption. Therefore, data is encrypted with the use of a key that is renewed automatically on a regular basis. In addition to encryption, access to information by the various organizations is authorized by the local authorities, and secured by Hypertext Transfer Protocol Secure (https) and by Virtual Private Network (VPN) tunnels. Additional information on the ViTTS system and the processes of tracking and tracing patients is shown in Figure 2.
The ViTTS in Practice
In case of a major incident, use of ViTTS requires the following five steps:
1. Activation of ViTTS—When a major incident or disaster is identified, usually based on the initial report of the first ambulance arriving on the scene, the use of ViTTS is initiated by the ambulance dispatch center. When the incident is first described, a unique identification code is activated. Hospitals and ambulances are notified according to the ambulance assistance plan.
2. Triage and Data Gathering—The ambulance personnel arriving on site initiate primary triage according to the Sieve principle.Reference Frykberg1, 8 The injury cards used during a disaster are developed according to the international Major Incident Medical Management and Support (MIMMS) standards.8 Apart from the international color codes, the cards contain a barcode with a unique TGN number. The barcode is scanned by the PDA linked to a local network at the scene (Figure 3). As soon as data are entered, they are available for all authorized services to view. At the victims assembly point, the evaluation teams gather and record additional data about each patient (secondary triage, additional medical data, and, if possible, name and personal details (Figure 4a-c).
Figure 4a PDA Screen—Personal Data and Triage (Urgency)
Figure 4b PDA Screen—Emergency Care Diagnostics Example 1
Figure 4c PDA Screen—Emergency Care Diagnostics Example 2
3. Transport—The transport loading officer receives advice from the centralist regarding the allocation of patients to hospitals based on the victim distribution plan, supported by a ViTTS overview. When the ambulance leaves the disaster site, the designated hospital and transfer status of the victim will be entered by the loading officer (Figure 5). During transport, the ambulance crews are able to access the central database, enabling them to add and receive all available information and upload additional medical data in real time. The receiving hospital is automatically alerted to the pending arrival. In the Emergency Department, an electronic overview is created instantly, describing the patient(s) en route, and providing a real-time overview of victims at the disaster site, awaiting transport and in the hospitals (see Figure 6, online only). These overviews are automatically generated and continuously updated.
Figure 5 PDA Screen—Destination
Figure 6 Real-time Overview of Victims, Triage Categories and Locations.
4. Hospital Arrival—Upon arrival, the patient is handed over to the hospital's clinical staff, and the barcode is scanned again. The receiving hospital has access to the database by logging in through a secured Internet portal, enabling them to obtain all available patient data even before the patient is checked in. Information on subsequent treatment in the hospital is uploaded to the central database using an Internet-connected infrastructure. The final patient discharge marks the end of the tracking and tracing process. Throughout all disaster relief actions, the information obtained about patients is stored and updated in a centralized database via the ViTTS data bus.
5. Public Information (Local Government)—Parallel to the medical process, the local government is supplied with information concerning the number and location of victims via the ViTTS data bus. A security and authentication mechanism is built into the database to assure a patient's privacy, thus preventing access to all medical details of the victim. Family members can contact the authorities and can gain information about their affected relatives. In The Netherlands, the Dutch Red Cross provides its Internet Registration and Information System (I-RIS) to all municipalities.9 This is a web-enabled application for registration of victims and their relatives. Due to a commercially available component for the data transfer over the existing GPRS network, users can access I-RIS in the field, even when the fixed telecommunication network is affected. I-RIS also can be connected to the ViTTS data bus.
Testing for Feasibility and Usability
During the system development process, feasibility was tested in several stages in 2002 and 2004. In 2005, the usability and robustness of the resulting system was tested in a realistic multidisciplinary scenario, and evaluated by the Netherlands Organisation for Applied Scientific Research (TNO-ICT), an independent qualified research institute.
The test was performed in a simulation scenario involving a tanker truck with sulphuric acid that was driven into a building 400 meters from the Major Incident Hospital (MIH).Reference Marres, Bemelman, van der Eijk and Leenen10 Forty victims were involved, as well as three ambulances (each with two staff members), a mobile medical team, doctors and nursing staff, the MIH as the receiving hospital and prehospital personnel of the Utrecht municipality, including the fire brigade and police. All ambulances were equipped with PDAs, injury cards and a Mobile Access Router to generate a local wireless network. The staff (ambulance, medical and administrative) had received a one-hour instruction session about the ViTTS system and PDA use before the simulation. Patients were triaged at the scene and subsequently transported to the MIH. On admission to the hospital, they were re-triaged and registered. The TGN number from the barcode on the triage card can be coupled with an in-hospital registration number, thereby connecting ViTTS data with the in-hospital medical data. In this exercise this was accomplished through the Patient Barcode Registration System (PBRS)Reference Bouman, Schouwerwou, Van der Eijk, van Leusden and Savelkoul11, Reference Noordergraaf, Bouman, van den Brink, van de Pompe and Savelkoul12 of the MIH, but any hospital inpatient medical record system can be used.
All radio communication was scanned during the exercise, and three observers from the research institute were present to follow the entire process. After the exercise, logs for all data and XML messages, with time data linked to the electronic messages, were analyzed by TNO, and compared with their own time measurements.
The focus of the TNO evaluation was:
1. General functioning of the system;
2. Accurate storage of all patient data;
3. Adequacy of the wireless system;
4. On-time availability of data in the central database for the supporting departments (maximum tolerated update time to the central database was set at one minute);
5. Reliability of the updates; and
6. Evaluation of the use of the injury cards and PDAs; initiating a triage priority, scanning of barcode/TGN, insertion of personal and medical data.
Exercise and Evaluation Results
In the first tests, direct wireless connections among all components of the system (PDAs, the WLAN and WAN) as well as integration with hospital electronic medical records were successful. Information transfer was accurate and simple, and it proved feasible to create an accurate overview without user input. These exercises resulted in adaptations including automatic synchronization, automatic generation of overviews, and adaptation of the WLAN.
The following conclusions resulted from the TNO evaluation:
1. There were no observed system failures.
2. All patients were entered in the system at the prehospital incident scene. The patient data was stored accurately when entered in the system. On patient admission to the hospital, not all ViTTS files were linked to patients’ in-hospital files, in this case the PBRS. This was due to human error; on admission, linking should be established by scanning the barcode from the ViTTS as well as the in-hospital registration number. It could also be inserted by hand if a barcode is not available for in-hospital patients.
3. The deployed local radio network with hotspots, mobile routers and connection through GPRS to the central database worked well. Capacity problems did not arise during the trial. The hotspots were in each other's reception range, which generated reciprocal data exchange among the routers.
4. There were no network problems and the network load was low. In the switch-over test, the network switched to another system (C2000) correctly when the GPRS modem was switched off. Switching back to the GPRS when it became available again did not happen automatically; for future use, this requires modification of router switching algorithms.
5. Analysis of the log files for on-time availability of data revealed no time delays. Data were available in the central database within the stated maximum of one minute.
6. An overview of patients at the incident scene and their triage categories was available in real time at the receiving hospital (MIH), before the first patients arrived.
7. Data were updated reliably and in a timely fashion. Information on the servers via the data bus was updated automatically. Average update time for the data bus was 500 milliseconds.
8. From the injury cards, only the barcode and the color (triage) codes were used consistently during the exercise; other injury card functions were rarely used.
Due to unfamiliarity with the PDAs, some medical staff encountered problems using them. This led to two disruptions in the use of PDAs that required technical assistance. It is not clear if this was due to human or system error, but both issues were resolved within one minute by switching the device off and on again. None of the entered data was lost and the devices functioned without problems afterwards.
In this exercise, additional medical parameter options beyond primary triage (eg, RTS) of the PDA system were not often used.
Discussion
The goal of ViTTS is to promote interoperability among the different systems of all the participants in disaster relief. This is achieved through the data bus, providing a platform to connect all different systems. This solution is consistent with the conclusions from the Report of the Advisory Board Coordination of Information and Communication Technology in Disasters commissioned by the Dutch Government in 2005.13 The main bottleneck of information management during disasters is the availability and accessibility of correct and complete information. The Advisory Board concluded this cannot be solved by technical solutions alone, but requires interoperability among the links in the chain.13 The ViTTS data bus brings together the large diversity of currently incompatible information systems, and makes the information available and accessible by all partners. It does not replace existing systems, but merely connects them. The developed standards promote uniform information provision, which is necessary for good interoperability of the systems through the data bus. Furthermore, developing standards and predefining access to parts of the information in the data bus stimulated organizations and partners in the chain to define their information needs and understand the value of information sharing and cooperation with partners.
The ViTTS enables early, unique registration of victims/patients and triage in the field. Personal identification and additional details can be added at any time throughout the process. Online application and connection of the different systems used by all the chains in disaster relief provides a real-time overview of the patient flow, visible to all disaster relief partners. This generates situational awareness; all cooperating services have access to real-time information on the victims (number, seriousness of injury), their whereabouts and destinations. This information is necessary for adequate coordination of the response and optimal deployment of resources. Ambulances and transport can be organized and coordinated according to need, and patients can be transferred to the hospital with relevant capacity. Hospitals can adjust their capacity planning and level of preparedness according to the real-time overview from the disaster site. Furthermore, they can access the prehospital data of their arriving/expected patients; currently, this data is often missing.Reference Winkelhagen, Bijlsma, Bloemers, Heetveld and Goslings14 Local authorities can reproduce information (for authorities, relatives and the media) more quickly and adequately. The Red Cross can use this information and can add information during the process of searching for relatives.
The ViTTS contributes to the three pillars (situational awareness, resource allocation and stakeholder information) mandatory for coordination of an adequate disaster response. The urge to improve this information processing during a disaster, currently insufficient in The Netherlands, was again evident in the evaluation of a recent plane crash near Schiphol airport, where it took four days to locate the 136 victims,Reference Winkelhagen, Bijlsma, Bloemers, Heetveld and Goslings14, 15 resulting in additional suffering for relatives.
The literature does not provide many research-based studies on victim tracing and tracking after disasters.Reference Pate16, Reference Chan, Killeen, Griswold and Lenert17 There are a limited number of reports from pilot tests performed in simulated emergency or disaster scenarios. Some papers describe intelligent triage tags that provide active location trackingReference Lenert, Palmer, Chan and Rao18-Reference Fry and Lenert20 and/or embedded vital monitoring components.Reference Massey, Gao, Welsh and Sharp21 The Wireless Internet Information Systems for Medical Response in Disasters (WIISARD) project used Radio Frequency Identification (RFID) tags and electronic intelligent patient monitoring devices tracking victim identification and location.Reference Lenert, Palmer, Chan and Rao18, Reference Killeen, Chan, Buono, Griswold and Lenert19
In the Integrated Patient Tracking Initiative (IPTI), a group of experts in the US developed a national framework that communities and regions can use when beginning their own patient-tracking programs. The first phase involved creation of national consensus requirements. Participants agreed on the following: platforms should be compatible and interoperable; the same device/system should be used for day-to-day and mass-casualty incidents; the system must be flexible; data must be clinically-based not research-based; devices and software must be configured to exchange data securely; and finally, each incident record should automatically generate an identifying number.22 The ViTTS complies with these requirements.
The injury card that exists for national use in the Netherlands in case of disasters is already fitted with a barcode and works in the system. This card is developed according to the Major Incident Medical Management and Support (MIMMS) system of triage and is derived from models currently used within NATO. Accuracy of the system could be improved further by refining the injury card barcodes to comply with the international EAN-128 barcode system of the GS1 organization.23 Current TGNs on the barcodes can act as unique patient numbers in a given disaster, but currently are not composed as barcodes that necessarily represent specific patients. By adding an application identifier (indicating the data type, in this case patient number, indicated by 8018), country code (87 for The Netherlands) and organization code (this could be a general disaster relief code) the barcodes would all represent a truly unique patient numbering system (Figure 7). The Application Identifier 8018 is an accepted international standard for barcodes to indicate persons (and thus patients), and is also referred to as Service Relation Number (SRN). This differentiates “persons” from barcodes that do not represent persons (eg, barcodes representing household goods). Adding theses codes makes each number truly unique and in compliance with the international EAN-128 barcode system of the GS1 organization.23
Figure 7 EAN-128 Barcodes. The application identifier indicates the type of data (eg, 8018 stands for “patient number”) and the country code is 87 for the Netherlands. The organization code could be Disaster Relief Organization.
As the ViTTS data bus is not dependent on one system, ultimately the ViTTS could also be linked with RFID, in an activeReference Lenert, Palmer, Chan and Rao18 or passive mode. An active tag has an on-board battery and periodically transmits its ID signal. A passive tag has no battery. Instead, the tag uses the radio energy transmitted by the reader as its energy source. The interrogator must be close for the RF field to be strong enough to transfer sufficient power to the tag.
Despite the advantages of RFID (eg, active localization and less operator dependency),Reference Buono, Chan and Killeen24 it still has drawbacks. These concern reliability, privacy and security threats, and the high costs of tags, RFID infrastructure and software. Maintenance costs remain unclear and there is a lack of interoperability, standards and tested best practices.25
Barcodes were used because of simplicity, which is the key to optimal disaster management.Reference Lennquist26, Reference Lennquist27 The likelihood of problems with a process during a disaster increases as the similarity of medical disaster response activity to day-to-day-care activity decreases.Reference Juffermans and Bierens28 The barcodes on the already existing triage cards in The Netherlands can be used. Furthermore, barcodes and barcode scanners are already used daily in every Dutch hospital as well as in the public domain. The use of technology on a daily basis will enhance its use during a major incident or disaster. The hospital staff is accustomed to barcode use and there is no need for in hospital hardware adaptation to use the ViTTS. Barcodes have the advantages of ease of use, speed, proven accuracy,Reference Bouman, Schouwerwou, Van der Eijk, van Leusden and Savelkoul11, Reference Noordergraaf, Bouman, van den Brink, van de Pompe and Savelkoul12 low cost of transmission and hardware,25 and easy maintenance. In addition, simple patient tags with barcodes are inexpensive, and easy to have in stock in several locations (and thus easily available in case of an incident). Furthermore, there is a fall-back option of manual readout when the scanner fails, as the number under the barcode represents the unique identification. The barcode injury cards and the ViTTS combine simplicity with the advantage of online dynamic registration of data. Although the cards are simple paper tags, by scanning them and using them as triage tags in an online system, many disadvantages of paper tag systemsReference Pate16, Reference Killeen, Chan, Buono, Griswold and Lenert19 are resolved; the space for information is no longer limited and they become dynamic. Triage codes can be changed and scanned at transport points, and the hospital emergency department provides tracking information; data can be compiled in different stages and by different providers. By using the ViTTS, the triage cards no longer stand alone, but are connected to the systems of the participants in the disaster management and have the functional advantages of electronically recorded and online data.
To guarantee scalability, the ViTTS does not solely depend on GPRS. As this can be overloaded in disaster situations, communication in the mobile domain is supported WLAN created by Mobile Access Routers in the ambulances. If this fails, Tetra networks provide a robust backup system that is not accessible to the public.
To protect the usability of the ViTTS system in case of an incident that would destroy the terrestial mobile network, an extra satellite gateway could be added, making the system more robust, and providing another fall back for data transfer. Currently, satellite connection as the primary mode was not chosen as it would be possible for outdoor use but has its limitations for indoor use with GPS data traffic.
A weak point in the evaluated exercise was the linking of prehospital data to in-hospital data; on admission to the hospital not all barcodes were scanned simultaneously and therefore not all ViTTS data were linked to the in-hospital PBRS data. This can be corrected at any other location of care (eg, in the treatment area or on the ward). More frequent use of the system will probably resolve this problem as hospital staff become accustomed to linking data at check-in.
Study Limitations
The evaluation by TNO shows that the online ViTTS works and provides on-time availability of data in the central database available for partners in the municipal and medical process. The most significant limitation of the exercise was the relatively low number of victims.
Conclusion
The ViTTS provides interoperability and the ability to start unique registration and triage of victims close to the incident or disaster site, while personal identification and further medical details can be added later in the management process. The system can help prevent the lack of information on patient identity, condition and location that results in inefficient use of medical resources and uncertainty among relatives. The online application and connection of the different systems used by the various organizations in disaster management facilitates a real-time overview of victim flow (quantity, seriousness of injury, location) visible to all involved disaster relief partners. The current systems that now function as islands can remain in place and are connected through the ViTTS data bus. Therefore, the ViTTS provides the early management information necessary for an adequate disaster response with optimized resource allocation and avoidance of unnecessary public distress.
Acknowledgements
The authors wish to thank the Regional Ambulance Service Utrecht, Trauma Centre Midden-Brabant, GHOR Region Utrecht, R. Schouwerwou and Bureau RGF, H. Canters, D. de Jong and Octaaf Adviesgroep for their valuable cooperation in realizing this project. We thank Crossing Channels for resources and setting up the service in collaboration with In Summa, Cisco Systems, Microsoft, Hewlett Packard, Intel, Getronics, KPN and Multiteam.
