Rio Grande Valley, Texas
March 20, 2025

On March 20 at 9:34 AM, Bernardino Palacios answered an unexpected phone call. Mr. Palacios, the Coastal Bend Regional Advisory Council (CBRAC) Program Director, was out of state when an emergency manager for the largest hospital system in CBRAC’s jurisdiction called to report a significant computer network intrusion. Mr. Palacios and his team immediately stepped in to help, mobilizing the CBRAC network and resources to respond swiftly and minimize disruptions to patient care. 

CBRAC is a health care coalition supported by ASPR’s Hospital Preparedness Program, which provides funding and guidance to hundreds of health care coalitions across the nation. CBRAC oversees health care entities across three regions in Texas, including the Rio Grande Valley where the cyber incident took place. With support from the coalition, CBRAC members prepare for various emergency scenarios, including downtime in the event of a cyber incident. Extended downtime can impact technology and communications systems, access to patient information, and pharmacy and laboratory services, all of which can compromise patient safety. 

To prepare for such scenarios, CBRAC conducts annual emergency preparedness and response exercises, drills, and risk analyses as required by ASPR’s Hospital Preparedness Program. This includes the Medical Response and Surge Exercise, a required annual functional exercise that tests a coalition’s ability to care for an increased volume of patients beyond normal capacity. CBRAC members also conduct bi-annual redundant communications drills on off-grid communication systems. These drills promote clear emergency operations and incident command structures for everyone responding to incidents.

Through these preparedness activities, health care entities under CBRAC’s jurisdiction had already identified and addressed gaps in availability of internet, handheld radios, and satellite systems. When the cyber incident occurred, the impacted hospital system was ready to respond. 

The cyber incident began the morning of March 20 at one of only two Level 1 trauma centers in the region. Level 1 trauma centers are health care facilities that provide care for critical patients and are equipped to handle complex traumas. By the end of the first day, the cyber incident had impacted the entire Level 1 trauma center and over 120 clinics, hospitals, and campuses across multiple counties. Impacted entities lost access to crucial systems for patient tracking, charting, and laboratory and pharmacy services.

For the first 18 hours, CBRAC worked with its local members, as well as state and regional public health organizations, to get hospitals and providers back online as quickly as possible. CBRAC had previously used Hospital Preparedness Program funds to purchase 12 satellite devices for use when traditional communications are down. Just 14 minutes after Mr. Palacios received the call for help, CBRAC’s team prepared the satellites for pick-up. In less than two hours, the satellites were online, providing immediate, reliable internet and connectivity to the 120 impacted entities within the hospital system. With these backup communications devices, the hospital system could continue to provide crucial patient care.  

For the remainder of the incident, CBRAC worked with hospital information technology and relied on its trusted partner network and redundant communication systems to maintain patient safety and continuity of care. For example, when pharmacy systems were down, CBRAC collaborated with the Drug Enforcement Administration for waivers to expedite controlled medication approval to patients in need. CBRAC also worked with impacted laboratory service providers to bolster capabilities and shift services to alternate locations. 

Although pharmacy and laboratory services weren’t restored until March 29, CBRAC coordinated alternate avenues of care so that patient care remained uninterrupted. Additionally, the coalition relied on its vast member network across health care, emergency medical services (EMS), and other providers to coordinate the transfer of critical patients from the facilities under attack to multiple receiving health care facilities. As a result, all patient transfers were smooth and efficient. 

On March 27, with ongoing cyber incident recovery, the region experienced severe weather that impacted the only other Level 1 trauma center. Suddenly, CBRAC was coordinating a multi-threat response. The compounding effects of the cyber incident and the inclement weather created technological and environmental accessibility issues, jeopardizing patient safety. Fortunately, CBRAC was prepared. With the satellite communications redundancy already in place, CBRAC led a continuous response in which no additional patients needed to be transferred out of the region. On April 8, 19 days after the cyber incident began, CBRAC turned off the last satellite and facility operations returned to normal. 

Swift action, existing resources and plans, and effective communication enabled this successful response. The well-established partnership and existing trust between CBRAC and local health care entities strengthened response efforts and minimized disruptions to patient care. 

Cyber incidents threaten sensitive information, risk patient lives, and have the potential to spread rapidly. Knowing what to do when a cyber incident occurs, including who to trust and who to call for help, is crucial. Within minutes of this cyber incident, the Texas hospital system called CBRAC and revisited lessons learned from Hospital Preparedness Program-required activities like the Medical Response and Surge Exercise. With a trusted network, broad connections, and Hospital Preparedness Program-funded planning in place, CBRAC stepped in to support a large hospital system while minimizing disruptions to patient care. 

To learn more about the Hospital Preparedness Program’s requirement for health care coalitions to conduct at least one Medical Response and Surge Exercise every year, access the Exercise and Improve section (page 36) of the Hospital Preparedness Program Fiscal Year 2024-2028 Notice of Funding Opportunity.

Eastern Kentucky Region 
February 15, 2025

On February 15, 2025, relentless rain swept across eastern Kentucky. As the rain fell onto already saturated and snow-covered ground, rivers and waterways began to overflow. The deluge quickly escalated into a catastrophic flooding event, impacting 13 counties in the eastern region and 11 others across the Commonwealth. As the waters rose, so did the urgency for a coordinated response to the lives of people in harm’s way—one that would test the region’s preparedness and the strength of its health care emergency networks.

In anticipation of unfavorable weather conditions, the Kentucky Department for Public Health and Kentucky Hospital Preparedness Program field staff activated their Regional Response Coordination Center, and Commonwealth officials activated the Emergency Operations Center. The Eastern Kentucky Healthcare Preparedness Coalition proactively began planning for possible evacuations and ways to support the health care sector. This early activation was not just a procedural step; it was a testament to the lessons learned from previous disaster responses and the effective communication mechanisms in place between health care and response partners.

The Eastern Kentucky Healthcare Preparedness Coalition is a health care coalition that receives funding and guidance from ASPR’s Hospital Preparedness Program. Kentucky contains eight Emergency Preparedness Coalition regions, each with designated Readiness and Response Coordinators. With Hospital Preparedness Program funding and guidance, Kentucky’s health care coalitions can establish partner networks, coordinate health care and emergency response, and host community-wide trainings and exercises, thereby promoting preparedness and strengthening regional readiness ahead of emergency events.

Prior to the flooding, the Eastern Kentucky Healthcare Preparedness Coalition strategically placed generators, ambulance buses, and evacuation and sheltering trailers in locations that had been previously impacted by extreme weather events. This foresight meant that when flooding escalated, these resources were already on the ground and ready to be deployed at a moment’s notice. As the floodwaters inundated communities, these prepositioned assets proved invaluable. Three ambulance buses, equipped to transport and triage multiple patients, were used immediately to evacuate a combined 241 patients from four nursing homes and one critical access hospital. The ability to move these at-risk patients quickly and safely was a direct result of the efforts made possible by the Kentucky Healthcare Preparedness Program and health care coalition’s networking, planning, and training. Field staff knew how to effectively respond to save lives prior to and during the flood thanks to similarly-focused training exercises, such as the Hospital Preparedness Program-required annual Medical Response and Surge Exercise. The team was also able to quickly deploy mission-ready response packages, such as evacuation equipment and ambulance buses specifically designed to safely evacuate facilities and transport patients while maintaining care.

The response to the flooding was a model for coordination and collaboration. Local Kentucky Department for Public Health and health care coalition teams worked together to coordinate the possible evacuation of a 113-bed acute care hospital, which included six intensive care unit patients. The hospital, surrounded by floodwaters held back by a flood wall, came within one or two feet of a catastrophic breach. Thanks to the robust medical operations coordination process, involving coordination between HCCs and regional partners, the hospital was able to shelter in place safely. Monitoring the situation, multiple hospitals and agencies across the Commonwealth engaged in real-time in case the facility needed to evacuate.

The Kentucky Healthcare Preparedness Program, Emergency Operations Center, Eastern Kentucky field staff, and Eastern Kentucky Healthcare Preparedness Coalition coordinated and shared resources, maintaining situational awareness internally and across coalition members. 
 

The 2025 flooding marked the third major flood event in eastern Kentucky in just four years. Each time, the Eastern Kentucky Healthcare Preparedness Coalition has activated its Regional Coordination Center and response plans based on National Weather Service briefings, allowing for a proactive rather than reactive approach. This event reinforced the need to establish a medical operations coordination center, which would further enhance the region’s ability to coordinate complex medical responses. The response also highlighted the need for an additional ambulance bus in the Eastern Kentucky Healthcare Preparedness Coalition to expand capabilities. Plans are already underway to acquire and retrofit another bus using Hospital Preparedness Program funding, ensuring that the region will be even better prepared for future events.

The February 2025 flooding in eastern Kentucky tested the region’s emergency preparedness and health care response systems. Thanks to the effective partnerships, planning, and investments made possible by the Hospital Preparedness Program, the response was swift, coordinated, and effective. Patients and geographically at-risk populations were kept safe, hospitals continued to operate under extreme conditions, and lives were protected. The event stands as a powerful example of how effective planning, response, and coordination efforts prepare communities for disasters and save lives when every second counts.

Arlington, Virginia  
January 29, 2025

On the night of January 29, 2025, the unthinkable happened – a commercial flight carrying 64 passengers and crew members collided mid-air with a U.S. Army Black Hawk helicopter carrying three service members. The collision occurred at 8:47 PM over the freezing Potomac River. At 8:50 PM, just three minutes after the collision, the Metropolitan Washington Airports Authority’s Fire and Emergency Medical Services (EMS) Department was already on the phone with the Northern Virginia Emergency Response System (NVERS), the health care coalition (HCC) that serves the Northern Virginia region

NVERS is an HCC that receives funding from ASPR’s Hospital Preparedness Program (HPP). With HPP support, HCCs establish response partner networks, build preparedness plans, and conduct trainings and exercises, all of which save time and lives in an emergency response. In Virginia, each HCC has a Regional Healthcare Coordination Center that acts as a single point of contact for emergency coordination of the health care sector and response partners. Each coalition has a 24/7 staffed hotline for its partners to call during an emergency, activating the Regional Healthcare Coordination Center. 

As an HCC, NVERS takes a community approach to preparedness, partnering with traditional health care and emergency response entities, as well as those community partners outside of health care such as law enforcement, information technology offices, and 911 operators. Upon receiving the hotline call from Metropolitan Washington Airports Authority’s Fire and EMS Department, NVERS activated its Regional Healthcare Coordination Center. Through its Regional Healthcare Coordination Center, NVERS began establishing and maintaining direct communication between on-scene fire, EMS, hospitals, and local, regional, and state public health and emergency support functions.  

By 8:52 PM, NVERS had assembled incident management team staff and activated the emergency alarms on its NVERS Radio system. The coalition had used HPP funding to equip every hospital and freestanding emergency department in the region with these NVERS Radios, intended to improve communication and coordination during an emergency. Thanks to this system, NVERS rapidly notified emergency departments of the disaster, prompting them to provide critical hospital capacity information to support response efforts. 

Since the crash occurred in the National Capital Region, which includes Washington, D.C. and surrounding areas in Maryland and Virginia, the response required clear coordination of all operations across multiple jurisdictions and their respective agencies. In the years leading up to the response, NVERS collaborated with National Capital Region HCC staff in the District of Columbia and Maryland Region 5 to develop a suite of National Capital Region-specific plans that outline a coordinated approach to burn, trauma, and pediatric emergencies, as well as information sharing across the region. The information sharing plan outlines specific triggers and processes for notifying HCCs and their partners across the region so that there is clear and consistent situational awareness of events that have the potential to impact the entire National Capital Region. This plan enables HCC members to connect patients with the closest and most appropriate care during a disaster.

By 9:00 PM, all 30 NVERS hospital partners used the Virginia Healthcare Alerting and Status System to provide real-time information on their emergency department bed availability. Simultaneously, NVERS issued a text alert to promptly notify non-hospital partners including public health, emergency management, EMS, and other regional partners, such as the District of Columbia Health and Medical Coalition, of the crash. NVERS’ swift efforts to communicate and coordinate with partners streamlined potential patient routing and resource allocation efforts across the region. 

During a response, HCCs such as NVERS serve a critical coordination role by maintaining clear and centralized communication between all parties. As the central point of contact, NVERS received frequent updates from the team at the scene of the crash and passed key information along to health care and emergency response partners. For example, the Defense Health Agency at Fort Belvoir, one of NVERS’ partners, called the coalition’s hotline requesting support identifying where the helicopter involved had originated. NVERS contacted the response team at the scene and confirmed that the helicopter had originated at Fort Belvoir, all within five minutes. 

By 9:47 PM, the on-scene team contacted NVERS requesting temporary mortuary storage services that could be transported to the scene. In just seven minutes, NVERS identified an HPP-funded fatality management trailer located an hour away from the scene. Without hesitation, one of NVERS’ health system members in that area deployed a team to bring the trailer to the scene. Familiar with the traffic that occurs at all hours in the National Capital Region, NVERS mitigated any potential delays by coordinating with Virginia State Police to arrange a law enforcement escort of the fatality management trailer. 
 

Tragically, later that evening, the on-scene team notified NVERS that there were likely no survivors, and the response shifted to recovery. Despite the tragic outcome, the response demonstrated the value of NVERS’ robust regional planning and extensive multi-disciplinary, multi-jurisdictional relationships. This response served as a real-world test of NVERS' capabilities, proving that a well-prepared coalition makes every minute count when time is of the essence.

Learn more about how other ASPR programs supported the aircraft collision at Reagan National Airport.