Health and Medical Response to Active Shooter and Bombing Events

By John L. Hick, Dan Hanfling, Bruce Evans, Sheldon Greenberg, Roy Alson, Suzet McKinney, and Matthew Minson
June 17, 2016 | Discussion Paper


TW: gun violence



Terrorist attacks, including mass shootings and bombings, have dramatic physical and emotional impact on a community. Terrorists often use inexpensive but deadly bullets and bombs to maximize the number of casualties and the lethality of injuries compared to conventional blunt trauma. Significantly increased severity of injuries have been observed in terrorist bombing incidents compared to “conventional” casualty incidents (Kluger et al., 2004). A recent analysis of mass shooting events noted a wounding pattern different from military experience with very few cases of life-threatening extremity hemorrhage; therefore, extrication and transfer to definitive care needs to be a priority in addition to any in-place care provided (Smith et al., 2016).

Penetrating trauma and blast injuries can kill rapidly. Therefore, accessing patients quickly and providing external hemorrhage control (e.g., tourniquets) and rapid evacuation to an appropriate trauma center to address internal injuries is critical to saving the most lives possible. Active shooter and events of terror involve threats to the responders that in the past prompted a tactical personnel response and definitive threat neutralization prior to providing victim medical care and extrication. Seventy percent of active shooter incidents are over within 5 minutes. However, about half of active shooter incidents do not end until the shooter is confronted by law enforcement personnel (FBI, 2013); therefore, current doctrine has shifted to encourage initial responding officers to immediately enter the area and engage the perpetrators while gaining situational awareness. Recent consensus statements (Jacobs, 2015) and response paradigms (Autrey et al., 2014) encourage law enforcement securing “corridors” of rapid access to victims, with minimal hemorrhage and airway interventions provided-consistent with military combat casualty care techniques—prior to rapid evacuation to ambulances in a more secure area for transport.

These integrated, rapid, law-enforcement-directed responses have the potential to save many lives, but cross-discipline training and excellent incident management and coordination is required to safely perform these responses. It is critical to note that all responders should be trained in these techniques, as waiting for tactically trained personnel to arrive may represent a deadly delay to the injured victims.

Though these paradigms have been endorsed by national organizations, many agencies have been slow to adopt them because of concerns about provider safety, perceived lack of adequate staff, concerns about training or equipment sufficiency, collective bargaining restrictions on responsibilities, or inability to agree on a collaborative response and training framework between law enforcement, fire/rescue, and emergency medical services (EMS). This may lead to providers paradoxically taking unnecessary risks during an incident they have not adequately trained for.

Preventing these types of events is the optimal goal, but when an event occurs a rapid and effective response coordinated between agencies is required to optimize patient outcomes. In this discussion paper, members of the National Academies of Sciences, Engineering, and Medicine’s Forum on Medical and Public Health Preparedness for Catastrophic Disasters examine some of the issues and potential best practices during responses to terrorist incidents. This paper is designed to explore the key issues and is not intended as a comprehensive or expert review of each topic area. This paper should serve as a prompt for responders and planners to consider areas where their community could address potential gaps.


Countering Violent Extremism

Acts of terrorism often have their roots in violent extremism—the beliefs and actions of people who commit or support violence to achieve religious, political, or ideological goals. Violent extremism broadly includes acts of terror, intimidation intended to cause fear, and communal violence ranging from assault on individuals to genocide. It is domestic and international, urban and rural, overt and covert, and despised and embraced. It may be perpetrated by a “lone wolf,” a small group, or a well-organized and well-funded global collective (Gruenewald et al., 2013). Prevention strategies for extremism and the acts of terror they can breed must be equally broad-based and multifaceted. Unfortunately, this often means that well-intentioned but focused efforts may yield poor or negative results.

Responsibility for prevention is shared by law enforcement (federal, state, and local) and other government agencies; public health; behavioral health; emergency medicine; the intelligence community; the faith community; education; nonprofit agencies; community and neighborhood organizations; the business community; tribal governance; and others. In most nations, the police, public health, and emergency medicine are recognized as first responders. They are also society’s first preventers.

Prevention and intervention efforts based on traditional criminal justice approaches have not proven effective (McCants and Watts, 2012; Christmann, 2012). Research shows that some traditional approaches, especially those that target specific populations, may encourage membership in radical organizations (Bhui et al., 2012). Research also shows that systematic cross-sector approaches to understanding the motivation, will, and intent of people who seek to commit terrorist attacks are rare (U.S. Congress, 2010). Current prevention efforts continue to be debated worldwide as agencies, professions, special interest groups, and others seek to balance aggressive enforcement, community cohesion, community engagement, community integration, and targeted focus on people and organizations (Thomas, 2009, 2010).

Innovation, expanded efforts, and a common understanding of and commitment to prevention and intervention across disciplines and sectors are needed. Genuine interdisciplinary research and a collective consistent effort to drive the shared evidence to practice requires more than a series of independent or isolated grants, research projects, and conferences. Building trust among agencies and organizations involved in prevention is as important as building trust in communities.

Law enforcement officers need a better understanding of behavioral health. While some police agencies offer 40 hours of behavioral health training, most provide limited or no instruction (Pauly, 2013). Public and behavioral health professionals need a better understanding of the culture and functioning of law enforcement—particularly the capabilities and limitations of police officers on the frontline. Nonprofit and advocacy organizations need to be part of the cross-profession/cross-agency educational process. Researchers coming together across disciplines—such as is occurring in the Institute of Race Relations in England—can provide evidence to guide practice in addressing important issues such as community cohesion, multiculturalism, human rights law, police custody, incarceration, immigration, and religiously motivated attacks (Kundnani, 2009).

The fields of behavioral health, social psychology, and law enforcement have begun working together to identify and understand people who are vulnerable to recruitment in radical organizations as well as those who may commit acts of violence as (i.e. “lone wolves”), but more needs to be done (Bhui et al., 2012). The increased and dynamic use of the Internet and social media to recruit and radicalize individuals to violent extremism means that traditional prevention activities are less likely to identify plans or aspirations to commit violent acts. It can be assumed that those who foster violent extremism will continue to find new ways to employ social media to advance their cause. Collective efforts at prevention must continue to focus on using social media to counter extremist propaganda (Payne, 2009; Fenstermacher et al., 2011). Collaboration across professions and sectors to create prevention-focused coordinated messaging, particularly targeted to vulnerable populations, is needed to address violent extremism at the ideological level (Deardorff, 2010).

National prevention strategies need to be refined and implemented more effectively on a regional and local level. Frontline practitioners in law enforcement, public health, behavioral health, emergency medicine, and other fields need to be actively engaged coparticipants in collaborative prevention and intervention efforts that are on a grander scale. Unfortunately, this often means tackling a broad set of issues not easily addressed in a focused terrorism prevention program.

Because the antecedents to events of terror are very often rooted in social disenfranchisement, and often exacerbated by preexisting mental health issues and in some cases socioreligious or political estrangement, preparedness focused on prevention must begin with strong links to the community. To achieve the visibility needed to help identify potential risks, and to work with community leaders vested in protecting their own community, an engagement process that highlights transparency, trust, and information sharing is required. Integrating the responsible community partners, particularly those who deliver mental health support services and the faith-based community, is absolutely necessary.

The planning effort ought to focus on those persons or communities deemed at greatest likelihood of being involved in such attacks, being sensitive to the delicate balance needed to uphold civil liberties and privacy. From a mental health community services perspective, this can mean directing interdiction efforts through existing programs that target at-risk individuals in schools, after-school programs, and other community-based services. Proactive messaging that targets potential offenders is important, as is the call for information that might shed light on potential criminal activities.

Such partnerships are often difficult, as the at-risk community may have poor relations with law enforcement or feel targeted as a source of terrorism and thus, further marginalized rather than regarded as a partner in response. Partnerships must often integrate with unrelated efforts to improve the standing of the at-risk community and take an approach that is less focused on law enforcement to be successful.


Preparing for Acts of Mass Violence

Preparing for the health and medical consequences of an active shooter or terrorist bombing event requires open communication and coordination of a number of key stakeholders, especially those in law enforcement, medical practitioners responsible for trauma services and behavioral health services, and those entities involved in providing and supporting community services, including the private sector, nongovernmental organizations, the faith-based community, and other social service agencies.

Identifying at-risk individuals, sources of potential influence, and training private citizens to recognize and seek assistance when they suspect potential danger may reduce the occurrence of events. Law enforcement must maintain resources for prevention and investigations and not just for a robust response to an incident. The law enforcement effort will be enhanced by integrating not only private-sector security elements into the provision of intelligence data and the establishment of a deterrent posture, but also by using the “citizen first responder” to do the same. Thus, facility management staff, private security firms, and the public at large can all play a large role in augmenting traditional law enforcement efforts and capabilities needed to prevent such attacks.

Ultimately, though, the medical community must be prepared to manage the sequelae of violent attack perpetrated in the community. Sudden impact events that generate large numbers of casualties in a very short period of time are rare events, but when they do occur, time is of the essence to reduce the number of lives lost and provide competent and coordinated care to the victims. As demonstrated in Paris and other locations, asymmetric attacks at several locations can exhaust response resources and create issues declaring a scene “secure” owing to the dynamic nature of the attacks.

Planning for a surge in major trauma cases—victims of gunshot wounds and shrapnel injuries, bomb and blast effects—will be of vital importance. In most communities, the ability to manage such patients, let alone scores of such patients, remains elusive. In fact, it must be recognized in the planning process that trauma and burn cases may of necessity need to be managed in non-trauma, nonburn centers. Preparing for this “surge capability” will be key. And recognition of this likelihood by EMS and law enforcement partners will help to better identify the movement of the right patient to the right facility. Public health authorities will be of great help in supporting ESF-8 (Emergency Support Function 8—Health and Medical) requests for support, development of victim registries, and sharing vital risk communications information with the public during such an event. Emergency management agencies will play a central role in helping to coordinate and facilitate the many resources that will be required in the response. All of these functions should be planned for by health care coalitions that play the convening role in emergency response systems, assuring these key stakeholders will be part of the preparedness and response process for these types of attacks.

Communities should emphasize “run, hide, fight” training for citizens, particularly those in locations vulnerable to terrorism (schools, political institutions, religious institutions) and may wish to provide training and access to tourniquets and first aid supplies in addition to the automatic external defibrillators found in public places to emphasize the importance of the “active bystander.” At-risk institutions or locations should optimize passive and active security systems and train and exercise their personnel on responses in conjunction with local law enforcement (e.g., the Federal Emergency Management Agency [FEMA] IS-907 as a starting point).

Public safety agencies should jointly agree on policy for these types of events, and then determine operational policies, logistics/supply, and training needs to support the policies. Operational policies should be developed for dispatch, initial responders and supervisors (including scene operations, perimeters, staging, bomb squad response, command post, and access to the inner/outer perimeters), medical care, patient destination, hospital receiving, and patient tracking. Ad hoc responses in any of these areas may jeopardize patient or responder safety.

Law enforcement, rescue, and EMS personnel should train and exercise together on a framework as outlined above that provides for rapid unified command, early engagement, rapid sweeps for secondary threats and to identify living victims and, as additional personnel arrive, securing of corridors of safety for access to victims for their care and extrication. The “muscle memory” from such training is imperative to serve as the basis for response in dynamic, high-stress environments, and training must be as realistic and frequent as possible. Law enforcement will immediately assume control at these scenes and should work closely with EMS and rescue to assure that they understand the situation and are prepared to enter once law enforcement has adequately secured access.

Responding agencies also must carry extra supplies for hemorrhage control that should be forward deployed and capable of treating many victims that may require tourniquets, as occurred following the Boston Marathon bombing. Personal protective equipment for responders is a controversial topic, as some feel that responders will be more likely to place themselves in unsafe situations when wearing body armor and others hypothesize that with proper training, such equipment is a reasonable additional protective measure against the low (but legitimate) residual risk involved in early access. Agencies may wish to consider armored panels in vests that fit a wide variety of responder body types for those participating on the access teams.

Hospitals should also have plans for these events, including increased security, rapid victim arrival screening for security threats, rapid triage and hemorrhage control, and a surgical triage and decision process including use of damage control surgery when multiple victims require intervention. Tourniquets, blood products, rapid arrival of multiple patients, registration issues, CT scanners, and availability of trauma and vascular surgical trays are all potential bottlenecks that should be addressed prior to an event. Realistic exercises for health care personnel are important to assure comfort with use of rarely practiced decision making and skills, as the first time some of these are used a life may depend on it.


Event Response – EMS Dispatch and Incident Communications

Historically, in almost every incident involving mass shootings a lack of transport resources has influenced the outcome of patients and has led to performance issues. In the Aurora Theater shooting, a lack of available transport resources resulted in a large majority of patients, including pediatric patients, being transported by police vehicles (TriData, 2014). In the Virginia Tech shooting a delay in transport resources caused by a lack of standardized automatic mutual aid slowed patient movement from the treatment areas on scene (TriData, 2009). In contrast, the preparation for a planned event at the Boston Marathon resulted in significant transport capability and access for ambulances to evacuate critical patients in a very short period of time (MEMA, 2014). The focus on scene-related activities, unwillingness to assign fault because of a “you did your best” mentality, and legal considerations of these events often prevent the dispatch and communication phase failures from being identified. Lack of transport resources is usually rooted in human error, system design, lack of policy, or inadequate planning. The delay in transport resources arriving may be compounded by bystanders, family members, or law enforcement vehicles that congest transportation routes and hinder EMS transport units from entering and leaving the scene.

Fire service regulations require the capability to deploy an initial full alarm (usually 15 person) assignment to arrive within 9 minutes to 90 percent of incidents in urban areas (NFPA, 2010). The lack of a similar standard for mass casualty events may contribute to inadequate response in the initial phases.

A more standardized response can be expected to produce a more efficient outcome in the movement of injured patients. The application of a predefined response matrix (pre-defined response matrix: a standardized response that brings a designated set of resources to facilitate a standardized outcome – the resources in the matrix correlate to the required personnel and equipment to resolve an emergency or nonemergency situation) organized around a fire service equivalent in the form of a first alarm medical response or the summoning of an ambulance strike team or EMS task force can minimize errors in initial assignment. Adjustments in computer-aided dispatch systems to include a predefined response matrix for a major medical response adds reliability to meet the transport demand.

The two most commonly used dispatch system protocols (dispatching protocol systems: a system of questions commonly asked by a 911 communication specialist or call taker that distills the answer from a caller to a categorization producing a recommendation from the computer program of the number and type of units to respond in either an emergent or nonemergent fashion) are the Association of Public Safety Communications Officials (APCO) Institute’s Medical Priority Dispatch or the National Academies of Emergency Dispatch’s Priority Dispatch. Each system uses a standard set of codes to identify medical emergencies and the response required. For example, in the APCO and National Academy’s system a “27 Delta” identifies a life-threatening gunshot wound or stabbing; however, information about multiple patients can activate a subdeterminate in the call—recoding the call to indicate multiple patients. That code can then identify a standard set of resources as designated by emergency services leadership that the computer system can find and alert (e.g., automatic initial assignment of five ambulances, two supervisors, and notification to medical directors for any multi-victim shooting). This automation can counter human error (not ordering adequate resources), lack of empowerment of the communication center staff to send resources without a command officers authorization, and compensate for a command officer that does not have recognition-primed decision-making skills. (Recognition primed decision making: A model in which an individual with expertise identifies a problem situation as typical and familiar, based upon a match to a similar situation stored in memory, and decides to initiate an action. If the situation is unfamiliar, or if subsequent information does not fit the pattern, then the individual decides to analyze the situation further before acting.) Little evidence exists as to the appropriate numbers of ambulances to assign. One ambulance per reported shooting victim may be appropriate, but this relies on knowledge of the number of victims—often not determined until well into the incident. The dispatcher should not wait for definitive information to activate initial assignments, but jurisdictions should consider secondary assignments per initial on-scene reports (similar to a fire department’s first-second-third alarm sequencing).

Unfortunately, many rural areas are challenged by limited resources and poor regional interagency coordination. Dispatch centers often lack the sophisticated training and computeraided dispatch resources of urban settings. Standardized response is paramount in a rural setting as the lag time for a volunteer or backup ambulance in rural or super rural areas may increase the chance of poor patient outcomes. The extreme delays in EMS response and transport highlights the need for automatic aid request as illustrated in the motor coach crash in Mexican Hat, Utah, in 2009 (NTSB, 2009). Rural areas should thus automatically request neighboring jurisdiction fire and EMS assistance (including potential rotor-wing resources) and be prepared to cancel them rather than risk life-threatening delays in a mass casualty response.

Organizing the regional EMS response into FEMA-designated ambulance strike teams or EMS task forces (FEMA 508-3 Typed Resource Definitions—Emergency Medical Services Resources: may help compensate for system limitation in the rural or super rural settings and must be automated to compensate for assembly delays. These may be of particular value for moving victims from a smaller local hospital to a trauma center in the initial hours after an incident in a rural area. Advances in technology now allow detailed call specifics to be sent to smart phones that can provide secured information and detailed response instructions. These systems can alert individuals who can also acknowledge via Internet or wireless communications that they are responding and provide information about such things staging and departure areas.

Mutual aid by definition requires two-way (requesting and supporting) human decision making, and owing to the high risk and low frequency of mass casualty events and low decision authority of call takers/dispatchers it can often be poorly implemented. Automatic aid does not require as much human decision making, as it follows a protocol with a standard set of resources. Accreditation and insurance services ratings require fire department automatic aid (rather than mutual aid) to acquire a superior rating or achieve accreditation. Medical response should apply the same principles.

To maximize information exchange and minimize error, dispatchers should assign tactical radio talk groups immediately to any potential mass casualty incident and cross-patch responding agencies into that talk group if necessary. In some areas, this may not be possible, in which case the dispatcher should request all nonessential transmissions be curtailed. Responders should have radio policies in place that minimize usual chatter on these talk groups and confine transmission to command-level officers. Initially evaluating the scene is critical, and if updates are not forthcoming, the dispatcher should prompt the incident commander for updates every 15 minutes of the event and repeat those back. Policies should also consider encrypting the incident talk groups. It may be best to not institute encryption until on-scene unified command is established so crucial incident information is not missed by a failure to set radios to encrypted mode. Unless all responders have access to the appropriate equipment, encryption should not be used as street personnel are acting as the incident commander until arrival of supervisors on the scene. Creation of multiple talk groups should be deferred until the life safety phase of the incident is over as it may be impossible for the incident commander to properly monitor traffic. A talk group should be assigned for each separate incident if multiple incidents are occurring.

As the event continues, information may be shared that is not confirmed or that may be law enforcement sensitive. Dispatchers, EMS, and health care personnel should be careful not to pass on information that has not been vetted by law enforcement (e.g., number of perpetrators) except to other public safety entities with an immediate need to know. Information that may affect the safety of the response (potential secondary devices, secondary perpetrators) should be shared as widely as possible but after the event is controlled information sharing may be restricted.

There is no substitute for face-to-face information exchange; thus, establishment of unified command between law enforcement and fire and EMS supervisors should occur as soon as possible at the scene (“trunk of car command”) close to the scene but in an area of relative safety. Redundant communication by cell and text is also possible, but this should be limited to situations where one-to-one communication is preferred and the information does not need to be shared with other responders.


Event Response – Initial Actions

In the past, EMS and first responders, when confronted with a shooting or other violent situation, historically staged a safe distance away and waited until law enforcement had secured the scene. At that point they entered the scene and began treating the injured. In a mass casualty event, the classic triage and treatment areas were established with patients eventually being transported to facilities after proper sorting and on-scene treatment.

Today, active shooter events are becoming more common and, as was shown in Boston, use of improvised explosive devices is no longer simply a problem for those who are overseas. Furthermore, assailants often use military style firearms, which have much greater lethality, firing rate, and wounding potential, than many civilian weapons. It is time to change our response paradigm.

Responders to such events have to be educated on the appropriate level of response, how to approach the scene, and how to do so in a safe manner. This training must be integrated with that of all the other responders, including law enforcement. Responder safety was the reason that EMS classically did not enter the scene until deemed safe by law enforcement. While EMS has had some training in dealing with threats to safety, such as downed power lines, gasoline leaks, and combative patients, EMS responder have had virtually no training in how to deal with armed threats, and they lack the resources to neutralize such threats. By staying in the cold zone of an event, the threats to EMS responders are minimized.

The impact of waiting to enter until the entire scene is secured can be detrimental to the victims as was illustrated recently in the 2013 shooting at LAX in which a TSA officer was shot (Kandel, 2013). He was visible from the doors of the terminal, but response protocol did not allow for EMS to enter until the scene was safe. By the time EMS was escorted in, the officer had exsanguinated. It was events like this and other mass shootings that led to the development of the Hartford Consensus (Jacobs, 2015), which advocates revising the approach to such events. The approach relies on adjusting the goals of law enforcement to include an early focus on securing access to victims, and adjusting EMS response to operate in a “warm zone” that is dynamically secured rather than wait for the entire incident area to be definitively cleared.

This is not to say that EMS should ignore safety. EMS should never enter a scene first nor enter without a secured area. EMS personnel must be aware of the environs and the hazards. Just as we approach an accident or hazmat scene and perform a scene survey for hazards (unstable vehicle, chemical spill) we need to do the same for mass shootings and other types of terrorist acts. We must always be looking for the “plus one” threat such as additional shooters (even among the victims) or damage from the event causing secondary hazards (e.g., gas, electric, structural). Secondary devices may be designed to be detonated on arrival of responders. This is not new; Eric Rudolph placed a second bomb near where the fire engines would stage when he attacked a reproductive services clinic in Sandy Springs, Georgia (1997) after scouting their response to a fire alarm to the clinic prior to the bombing. Responders may even be the target as happened in 2012 outside of Rochester, New York when a gunman set a house on fire and then waited until firefighters arrived and began shooting, killing two firefighters (Freile and Stanglin, 2012).

Though the new paradigm of dynamic response may seem risky for providers, there is tremendous benefit to patient survival. Further, an emphasis on early access and rapid transport may decrease concentrations of response resources in staging areas where they may be targets for secondary attacks. In the past, high-threat/active-shooter scenarios were addressed by specialized response teams of highly trained officers with specific skill sets. Such teams are extremely effective in barricaded suspect, hostage, and other situations and are able to systematically intervene and neutralize threats. In addition, many teams have specially trained medics or physicians who can provide care in a hostile environment.

These medical providers draw heavily from the lessons learned from the military about providing medical care under fire, which has led to the concept of Tactical Combat Casualty Care. A civilian adaptation of this concept, Tactical Emergency Casualty Care (TECC) has been developed and focuses on the types of threat environments seen in the civilian sector.

As set forth in the Hartford Consensus (Jacobs, 2014), the approach to such event should follow the THREAT algorithm:

  • Threat suppression
  • Hemorrhage control
  • Rapid Extrication to safety
  • Assessment by medical providers
  • Transport to definitive care

Law enforcement needs to control the threat and can initiate hemorrhage control when resources allow. An alternative and likely more practical approach is for first arriving officers to pursue the shooter, with secondary officers securing the area around the victims and securing access for medical responders to allow them to rapidly extricate victims.

Entering EMS personnel should immediately direct all ambulatory casualties out to an area of relative safety (fire apparatus and other shielding may be positioned to assist this effort if necessary) and the nonambulatory casualties should be packaged in sleds or on backboards/fabric litters for rapid evacuation. Once extricated and bleeding controlled, the wounded should be quickly reassessed prior to expedited transport to an appropriate trauma hospital. By example, in a recent workplace mass shooting (Autrey et al., 2014) initial officers went rapidly through the complex and engaged the perpetrator, and secondary officers quickly secured the entry area and subsequent rooms to allow EMS to begin victim care and evacuation within minutes of the initial 911 call, likely resulting in several lives saved.

Classic mass casualty sorting schemes such as START (Simple Triage and Rapid Treatment) and development of staging and casualty collection points takes time and delays transport to definitive care. As long as adequate ambulances are available, there is no reason to delay transport for further assessment, color coding, and interventions that should be provided en route, as with usual trauma care. Remaining on scene during dynamic events (e.g., Paris) may actually increase provider risk. Early notification to the trauma center is essential for its readiness. Regular exercising of this approach as a component of a multiagency response plan is essential to operational success.

Responders to blast events should be aware of secondary hazards such as gas leaks, unstable structural elements, and additional explosive devices. Responders should try to move the minimal amount of debris possible to find and assess victims. Decedents should not be moved. Rescuers in debris areas should follow the paths of those that have walked in the area before them to minimize scene disruption and maximize safety.

In rural areas where there are fewer resources, such events create even more challenges. Responders often perform multiple roles on a daily basis, mutual aid is often coming from long distances, and distance is often an issue for transport to definitive care. Planning with careful allocation of resources is necessary, as well as early request for additional resources. Early engagement is still important, but bystanders and ambulatory victims may need to be directed by law enforcement to help extricate the wounded, and if there are additional first responders in the area besides those on the EMS/fire unit they may be needed to assist, depending on the scope of the incident.

Note that accomplishing these objectives in a time-sensitive manner requires that street personnel, and not special teams, are trained in these types of responses. A follow-on tactical response is still necessary to systematically clear the area and address any contained perpetrators but the initial response cannot afford the delays associated. Conversely, initial responders should generally not be trained for higher-risk area entry (diamond formations, etc.) as these tactics require significantly more training and team training than the initial actions outlined above.


Event Response – Secondary Tactical Considerations

Following the initial rescue actions, the scene should be secured and perimeters established (if not already done). At this point, a structured tactical response should occur to neutralize any remaining threats and sweep the building.

Tactical operations generally include several phases and steps that take place well before, during, and potentially after initial engagement. In some cases, the mission may be “planned” such as in a high-risk search or arrest warrant or they may be in response to an already “active” event. In either case, law enforcement organizations and medical support team operators and all of the support elements (medical, communications, negotiators, etc.) typically convene at a forward staging area and determine their objectives and tactics, adjusting to the specific incident characteristics and environment.

Medical support for law enforcement tactical operations varies by jurisdiction and may range from trained EMS personnel embedded with tactical team to provision of EMS support only outside the operational area. Medical functions will be divided by:

  • Direct threat care: Care that is rendered while under attack or in adverse conditions
  • Indirect threat care: Care that is rendered while the threat has been suppressed, but which may resurface at any point
  • Evacuation: Care that is rendered while a casualty is being evacuated from the incident site


These are still considerations within the initial or active component of the response, with the exception that no “direct threat care” is provided. EMS will need to provide ongoing support to the secondary tactical operations. General tactical training for EMS (Example: CONTOMS— must be supplemented by agency-specific training.

The law enforcement organization having jurisdiction will determine the way EMS personnel will stage (warm versus incorporated response) and the rules of medical engagement. It is not the purpose of this paper to endorse a specific training or tactical approach as this consideration will depend on resources, training, personal protective equipment, and an understanding of the capabilities and limitations of the response agencies involved.

Regardless, certain considerations can be anticipated. Once the initial clearing of acute and salvageable casualties has been addressed, scene integrity, decedent affairs, evidence preservation, and identification of delayed secondary threats rise in priority. A structured approach should be taken to assess for secondary threats or clandestine and delayed insult such as intentional or by-product chemical, radiological, or biological agents.

To protect the first responders, law enforcement, receiving facility personnel, and mortuary support, timely regional communication about potential contamination issues as well as the potential for a secondary attacker among the victims is critical to prevent amplification of harm beyond the primary event. Regional health care coalitions should be well-positioned to provide such alerting and notification.

Unified command should transition to law enforcement command for ongoing investigations as the life safety component concludes. EMS should be prepared to support responders working on the scene during the investigation and recovery efforts.

A goal of terrorism is to disrupt and introduce fear into our daily lives, which is one of the reasons the Israeli police try to conclude on-scene investigations within hours and reopen the streets and affected area as quickly as possible. This desire to resume normality must be balanced against the needs for a thorough investigation of a heinous crime. In either case, consideration should be given for removing the most graphic visuals of the event from public view as soon as is prudent.


Event Response – Hospital Actions and Prioritization of Activities

Hospitals have two immediate priorities after a terrorist event occurs—they must provide mass casualty care at the same time as assuring facility security. Unfortunately, hospitals have been targeted in terrorist events in the past and will be in the future. Implementing access controls (potentially including traffic controls), screening and monitoring bags and packages, and monitoring incoming patients and family members to detect potential criminal intent is a critical early action that must be taken to protect the facility and staff. Hospitals that rely on local law enforcement for security augmentation and protection should understand that during a mass violence event resources are not likely to be available to them.

When the hospital is notified of a potential mass casualty event, it should take prescripted, well-described actions to notify personnel including activating callbacks of offsite personnel (particularly surgical, emergency medicine, critical care, and support personnel such as administration, facilities, radiology, lab, blood bank). Information updates should be provided to hospitals as often as possible. Surge capacity plans including surge discharge should be activated as needed, including surgical plans. The simultaneous execution of a variety of activities according to standard operating procedures or job aids at the departmental level in the first 20 to 60 minutes often will determine whether the response succeeds or fails. Incident command and the hospital command center are needed to manage the less predictable, more dynamic response needs and issues that occur after the first 30 to 60 minutes (Goralnick et al., 2015).

Hospitals can expect many casualties to self-refer to the closest facilities and should be prepared to help unload patients from vehicles. Self-referred patients are often first to arrive but often have minor injuries and should not disproportionately consume space and resources that may be needed by the critically injured.

Upon arrival to the hospital, patients should be triaged by an experienced emergency medicine or trauma surgery physician, as subtle penetrating injuries or evidence of blast trauma can be lethal if missed. Screening for radiation should be part of a blast response as well, since the risk of a “dirty bomb” should not be underestimated. (If radiation is found, this should not delay emergency interventions but should prompt clothing control and more formal assessment and decontamination of the walking wounded according to usual protocols (for examples, see the Radiation Emergency Medical Management website— Victims of blast incidents may not be able to hear or effectively communicate with providers because of tympanic membrane injury; therefore, marker boards and basic written information must be available to aid initial communication with victims. Use of triage tags by the facility can help to maintain information flow until the patient information is entered into the electronic health record (EHR). A recurring theme among hospitals that receive multiple victims in a short period of time is that it is impossible to get the patients registered quickly enough and get information updated in the EHR to be useful, so that patients are often lost in the system for hours (Goralnick et al., 2015; Hick et al., 2008). With the potential for multiple unidentified victims, the hospital system for disaster registration should minimize the potential for confusion between different victims. This is a particular risk when numbers, and especially those in consecutive order, are used as disaster identifiers. Photos that can be easily taken and associated with the patient in the computer and unique bar codes may be helpful, but require daily use in order to be easily practiced in a disaster.

Patient care in a mass violence event differs from conventional mass casualty care with a continued emphasis on external hemorrhage control prior to other interventions (i.e., CAB not ABCs of resuscitation placing circulation first). There may be a very high incidence of operative emergencies among the victims, but the graphic soft tissue injuries may not be the highest priority for the operating room. Severe extremity injuries may be able to wait for operating room access after tourniquet use or other hemorrhage control, but truncal injuries with shock must be prioritized for immediate operative intervention. Note that graphic injuries should be covered as soon as possible to prevent ongoing emotional trauma to the staff and patient but frequently rechecked to assure bleeding stays controlled. Tourniquets are often not stocked in large numbers in most emergency departments. This may be a key limiting factor both for EMS resupply as well as for hospital use since some casualties may require multiple tourniquets to control bleeding. Tourniquets by design stop blood flow distally, so significant pain from tissue schemia within 15–20 minutes after application should be anticipated and will continue until blood flow is restored. As time allows, wounds that may not require tourniquets for bleeding control and are not going emergently to the operating room should be reassessed and other interventions such as packing and bandages may be attempted. The tourniquet should be loosened but left in place in case heavy bleeding recurs.

Operative interventions depend on qualified staff, operating room space, and operative supplies. Penetrating trauma can cause a much higher percentage of vascular injury than blunt trauma, and vascular surgical trays are often in short supply in hospitals. Major procedure or surgical trays may also be in shortage. Since these trays often cost in excess of $10,000 each they represent a significant investment, but since the turnaround time after use is usually between 2-4 hours there is no substitute for adequate surgical instruments being available.

Most disasters do not have a major impact on facility or community blood supplies (Schmidt, 2002). However, multiple patients with life-threatening penetrating trauma can consume enormous amounts of blood products in a short period of time, particularly with the recent emphasis on transfusing fresh frozen plasma and packed red blood cells in 1:1 or 1:2 ratios. Most trauma centers do not keep adequate fresh frozen plasma thawed to run concurrent multiple mass transfusion protocols, and so some triage of blood products, particularly of fresh frozen plasma should be anticipated. Additionally, shortage of common packed red blood cell types is possible depending on the community resources. After the Aurora theatre shooting, the University of Colorado Aurora hospital was reported to have used over 300 units of packed red blood cells, a volume that would be unachievable at smaller centers and without rapid resupply from a regional blood bank. Contingency plans should be in place to address these issues (Sasson, 2013).

The mental health effects of these events on providers and victims cannot be underestimated. The visual impact of gruesome soft tissue injuries, the number of victims, and the caregiver’s empathy toward them can have severe effects on staff. Resilience training and a program of critical incident stress support including psychological first aid is critical for staff mental health. A “hotwash” occurring very soon after the event (ideally within hours) that overviews the event, acknowledges the contributions of staff, reviews areas of success and opportunities for improvement, and reviews the potential effect on staff as well as the range of normal stress reactions can be extremely helpful in providing a common understanding of the event, its impact, and reorient emotions toward tasks that can be achieved to improve the next response. Victims and family members similarly will need emotional support, and some facilities provide an automatic consult with a mental health professional for all inpatient victims to review their emotional state and discuss normal stress and grief reactions as well as resources and followup evaluation.


Community Recovery

The ability to recover from a mass violence event in part depends on the resiliency of the individual and the community. Close ties and an emotional investment in the community or organizations affected are important, as is good underlying mental and physical health. Though the authors agree that building resilience is important to successful recovery, there is less agreement on what measures best “immunize” a group or community against the psychological effects of mass violence.

The U.S. Centers for Disease Control and Prevention defines community recovery as the “ability to collaborate with community partners to plan and advocate for the rebuilding of public health, medical, and mental/behavioral health systems” (CDC, 2011). Ideally, recovery efforts will restore community function to preincident levels, at minimum. In the best-case scenario, recovery efforts will improve community functions to levels that are greater than preincident levels. Effective recovery planning is a collaborative process that involves government, business, and health care (public health, medical, and mental/behavioral) officials, as well as engagement of community residents and leaders.

The primary goal in terrorist attacks is to instill a sense of fear and social disruption among societies and the population in the affected areas. There is no dispute that mass violence, and particularly coordinated, sustained, multisite terrorist attacks, severely disturb the overall emotional and mental health of the community, from individuals and families to health care workers and first responders who will provide the initial care to victims. Many of these groups will sustain intense exposures placing them at high risk for psychological consequences.

Terrorist attacks occurring in the United States and in other countries have resulted in a wide range of mental health effects in individuals, from normal stress responses to longer-lasting emotional and behavioral changes to the onset or exacerbation of psychiatric disorders including significant risks for depression and suicide. Communities may experience different prevalence rates of mental health effects (Grieger, 2006; Whalley and Brewin, 2007). In these types of events, there are no expected patterns of who will be most affected by these events, with the exception of the generally accepted assumption that victims, first responders, and health care personnel will likely be disproportionately susceptible to adverse mental health effects owing to their repeated exposure to the physically grim results of these attacks—namely direct visual exposure to graphic wounds and human suffering. Feelings of anger caused by the senseless nature of the violence and helplessness can also contribute to psychological risk.

Among non-responders and the general public, we can reasonably expect that even persons without a diagnosed mental illness or predisposal to mental health crises, due to past experiences, can and likely will be adversely affected psychologically by these terrorist events. Most effects will be temporary and short-lived, but the prolonged effects of these events will be significant for many. Direct and targeted mental health interventions will be necessary to mitigate these negative effects.

Provision of psychological first aid to the affected population as well as communication of expected stress responses is an important first step in support of personal recovery. Assisting the affected persons and responders with basic needs also helps reduce stress during the immediate post-incident phase. Responders should participate in operations-focused “hotwashes” to receive incident overview information and identify things that went well and opportunities for improvement. This helps to generate a common understanding of the event, and it helps the responders focus on improvements that can be made. A formal after-action review should also be conducted with a corrective action plan developed to improve subsequent responses. Affected staff should be followed by peers and supervisors based on their level of exposure and impact. It is not unusual for symptoms of psychological distress to surface months to even a year later (anniversary effects).

Public health, health care, and mental/behavioral health organizations should be working in a coordinated manner to plan for implementation of mental health support and interventions in the community following terrorist events. Implementation of a systems approach to mental/behavioral health resilience and recovery following terrorist events can ensure that population vulnerabilities and service vulnerabilities are addressed following the event. Health care coalitions are uniquely positioned to ensure an effective systems approach is employed to address the mental and behavioral health effects of terrorist events. Identification of available mental health resources, for both responders and the public, as well the development of effective mechanisms for appropriate triage and delivery of these resources, will be critical in setting communities on a path to recovery in the immediate hours and days following a terrorist event.

“Adverse mental health outcomes of disasters may not be apparent, and therefore a systematic approach to case identification and triage to appropriate interventions is required” (North and Pfefferbaum, 2013). Rapid identification and proper triaging mechanisms for at-risk populations and their families is critical to provide psychological first aid and offer support information. The degree and severity of services needed by multiple population subsets will vary considerably. Direct assistance should be made available, and to the degree possible, at-risk individuals in the community should be followed for symptoms by professionals as well as trusted family members and other agents deeply embedded within communities (e.g., faith-based organizations and their leaders). Organizations such as these can facilitate dissemination of resource information and can be influential in supporting their members and prompting them to seek treatment when it is needed.

At a broader community level, support and resources need to be provided across a variety of platforms including crisis hotlines, counseling services, self-help tips, social media, educational materials, and text messages.

Communities and health care coalitions should consider developing mental health support teams (and define their composition and responsibilities) and encourage individuals to participate in the Medical Reserve Corps and other registries. This will ensure that response officials are aware of limitations on available resources and thus will be better positioned to request mutual aid assistance or resource provision from partner agencies or government entities in the aftermath of terrorist events. Continued monitoring of mental health needs within communities will also be critical to assist providers with directing and allocating resources properly as the needs of those affected change over time.

The physical scene of the event should be cleared of graphic reminders of the attack as quickly as is prudent for the investigation. Families, friends, victims, and the general population will be powerfully drawn to the scene of the attack, and the community should recognize and protect a need to grieve at the site in the short term. Appropriate access and security should be maintained. Communities should determine whether memorial or other community services are appropriate in the days following an event. In the longer term, stigma may affect the site, with effects on business or the conduction of daily activities and may require the community to restructure or rebuild.

The recovery process can last for years, and it is an opportunity to deliberately build strong public-private partnerships that can hopefully improve current systems and resources to “build back better” and provide at least some common good from a senseless crime.



Terrorist attacks can be difficult to prevent, and they present unique hazards to responders. Focus on early access and evacuation of victims to appropriate hospitals, with an early focus on concepts of care borrowed from military models, offer an opportunity to save time and lives, but this must be conducted in accord with interdisciplinary training models and in concert with strong law enforcement incident command. EMS and hospitals should be well resourced and well trained for mass violence attacks and be able to distribute and care for casualties with penetrating and blast trauma. The recovery from these events is difficult and protracted, but a systematic process of support and rebuilding can facilitate community and individual healing.



Download the graphics below and share them on social media!



  1. Atran, S. 2010. Pathways to and from violent extremism: The case for science-based field research. Statement before the U.S. Senate Armed Services Subcommittee on Emerging Threats & Capabilities. March 10, 2010.
  2. Autrey, A. W., J. L. Hick, K. Bramer, J. Berndt, and J. Bundt. 2014. 3 Echo: Concept of operations for early care and evacuation of victims of mass violence. Prehospital and Disaster Medicine 29(4):1-8.
  3. Bhui, K. S., M. H. Hicks, M. Lashley, and E. Jones. 2012. A public health approach to understanding and preventing violent radicalization. BMC Medicine 10(1):16.
  4. CDC (Centers for Disease Control and Prevention). 2011. Public health emergency preparedness grant capabilities. Available at: (accessed June 7, 2016).
  5. Christmann, K. 2012. Preventing religious radicalization and violent extremism: A systematic review of the research evidence. Research Report. Youth Justice Board. London, England.
  6. Deardorff, R. B. 2010. Countering violent extremism: The challenge and the opportunity. Naval Postgraduate School. Monterey, CA.
  7. FBI (Federal Bureau of Investigation). 2013. A study of active shooter incidents in the United States between 2000-2012. U.S. Department of Justice. Washington, DC. Available at: (accessed on June 7, 2016).
  8. Fenstermacher, L., T. Leventhal, and S. Canna. 2011. Countering violent extremism: Scientific methods & strategies. Wright-Patterson Air Force Base, OH; Air Force Research Lab.
  9. Freile, V., and D. Stanglin. 2012. 4 firefighters shot, 2 killed at Webster, N.Y., fire. USA Today, December 24. Available at: (accessed June 10, 2016).
  10. Goralnick, E., P. Halpern, S. Loo, J. Gates, P. Biddinger, J. Fisher, G. Velmahos, S. Chung, D. Mooney, C. Brown, B. Barnewolt, P. Burke, A. Gupta, A. Ulrich, H. Hojman, E. McNulty, B. Dorn, L. Marcus, and K. Peleg. 2015. Leadership during the Boston Marathon bombing: A qualitative after-action review. Disaster Medicine and Public Health Preparedness 9:489-95.
  11. Grieger, T. A., 2006. Psychiatric and societal impacts of terrorism. Psychiatric Times. Available at: (accessed on June 9, 2016).
  12. Gruenewald, J., S. Chermak, and J. D. Freilich. 2013. Distinguishing “loner” attacks from other domestic extremist violence. Criminology & Public Policy 12(1): 65-91. Available at:
  13. Hick, J. L., J. Chipman, F. Loppnow, M. Conterato, D. Roberts, W. G. Heegard, G. Beilman, M. Clark, J. Pohland, J. D. Ho, D. D. Brunette, and J. E. Clinton. 2008. Hospital response to a major freeway bridge collapse. Disaster Medicine and Public Health Preparedness 2:S11-S16.
  14. Jacobs, L., and the Joint Committee to Create a National Policy to Enhance Survivability from Intentional Mass Casualty Shooting Events. 2014. The Hartford Consensus II. American College of Surgeons 218(3):476-478.
    Available at: (accessed June 8, 2016).
  15. Jacobs, L., and the Joint Committee to Create a National Policy to Enhance Survivability from Intentional Mass Casualty Shooting Events. 2015. The Hartford Consensus III: Implementation of bleeding control. Available at: (accessed June 7, 2016).
  16. Kandel, J. 2013. TSA officer bled for 33 minutes in LAX shooting. NBC4 News: Southern California. November 15. Available at: (accessed June 9, 2016).
  17. Kluger, Y., K. Peleg, L. Daniel-Aharonson, and A. Mayo. 2004. The special injury pattern of terrorist bombings. Journal of the American College of Surgeons 199 (6):875-879.
  18. Kundnani, A. 2009. Spooked! How not to prevent violent extremism. London, UK: Institute of Race Relations.
  19. McCants, W., and C. Watts. 2012. US strategy for countering violent extremism: An assessment. Philadelphia, PA: Foreign Policy Research Institute.
  20. MEMA (Massachusetts Emergency Management Agency). 2014. After action report for the response to the 2013 Boston Marathon bombings. Available at: (accessed June 7, 2016).
  21. NFPA (National Fire Protection Association). 2010. Standard for the organization and deployment of fire suppression operations, emergency medical operations, and special operations to the public by volunteer fire departments. Available at: (accessed June 8, 2016).
  22. North, C. S., and B. Pfefferbaum. 2013. Mental health response to community disasters: A systematic review. JAMA 310(5):507-518.
  23. NTSB (National Transportation Safety Board). 2009. Motorcoach run-off-the-road and rollover, U.S. Route 163, Mexican Hat, Utah, on January 6, 2008. Washington, DC: NTSB. Available at: (accessed June 8, 2016).
  24. Pauly, M. 2013. How police officers are (or aren’t) trained in mental health. The Atlantic. Available at: (accessed June 8, 2016).
  25. Payne, K. 2009. Winning the battle of ideas: Propaganda, ideology, and terror. Studies in Conflict & Terrorism 32(2):109-128.
  26. Sasson, C. 2013. Organized Chaos – The Aurora Theatre Shooting. 11th Annual Preparedness Practicum. Presented at Brooklyn Park, MN.
  27. Schmidt, P. 2002. Blood and disaster: Supply and demand. New England Journal of Medicine 346(8):617-620.
  28. Smith, E. R., G. Shapiro, and S. Babak. 2016. The profile of wounding in civilian public mass shooting fatalities. Journal of Trauma.
  29. Thomas, P. 2009. Between two stools? The government’s ‘preventing violent extremism’ agenda. Political Quarterly 80(2):282-291.
  30. Thomas, P. 2010. Failed and friendless: The UK’s ‘Preventing Violent Extremism’ program. British Journal of Politics & International Relations 12(3):442-458.
  31. TriData on behalf of the University of Virginia. 2009. Mass shooting at Virginia Tech. Addendum to the Report of the review panel. Available at: (accessed June 8,
  32. TriData on behalf of the City of Aurora, CO. 2014. Aurora Century 16: After action review for the City of Aurora, Colorado. Available at:
    w%20Report%20Redacted.pdf (accessed June 8, 2016).
  33. Whalley, M. G., and C. R. Brewin. 2007. Mental health following terrorist attacks. British Journal of Psychiatry 190(2):94-96. Available at: (accessed June 7, 2016).



Suggested Citation

Hick, J. L., D. Hanfling, B. Evans, S. Greenberg, R. Alson, S. McKinney, and M. Minson. 2016. Health and Medical Response to Active Shooter and Bombing Events. NAM Perspectives. Discussion Paper, National Academy of Medicine, Washington, DC.


The authors were assisted by Justin Snair and Ashley Ottewell.


The views expressed in this Perspective are those of the authors and not necessarily of the authors’ organizations or of the National Academy of Medicine (NAM). The Perspective is intended to help inform and stimulate discussion. It has not been subjected to the review procedures of, nor is it a report of, the NAM or the National Academies of Sciences, Engineering, and Medicine. Copyright by the National Academy of Sciences. All rights reserved.

Read more by topic:

Join Our Community

Sign up for NAM email updates