Published by the Public Risk Management Association
ABCs
www.primacentral.org
April 2010
AEDs
The of in Public Schools
An Ounce of Prevention‌
How a Property Conservation Program Can Reduce Loss and Save Your Entity Money Information Technology Risk Management:
Protecting Your Entity by Protecting Data
Public Risk Management Association
Your
Risk Management Journey Begins Here
Are you taking advantage of all that PRIMA has to offer? Professional Development
Networking
• PRIMA Annual Conference • Online education opportunities including PRIMA’s Webinar Series and the industry’s only Associate in Risk Management and Risk Management for Public Entities online tutorials. • PRIMA Institute: The industry’s premier risk management four-day training program for professionals new to the field.
• Leadership Opportunities: Get Involved! Join a committee, task force or even become a director on PRIMA’s board and provide input in what PRIMA does and how we do it. • PRIMA Chapters: Make contacts on your local level, share what you know, and learn from experts and innovators in meetings, workshops, and seminars in your area. • Online Membership Directory: A members-only resource where you can locate and contact PRIMA members in various risk management fields.
Information Resources • PRIMA Cybrary • PRIMA Job Bank • PRIMAtalk: Member-only listserv that provides access to more than 500 industry specialists. • RiskWatch: Weekly e-news service for public risk managers
AND MUCH MORE!!!!
For more information on any of PRIMA’s member benefits, visit our Web site: www.primacentral.org.
Volume 26, No. 4 | April 2010 | www.primacentral.org
The Public Risk Management Association promotes effective risk management in the public interest as an essential component of public administration.
Executive Director Lisa Lopinsky, CAE
Contents
President Ron Hayes Risk Manager Calcasieu Parish School Board Lake Charles, LA Past President Sarah Perry, ARM-P Risk Manager City of Columbia Columbia, MO
6
11
6 The ABCs of AEDs in Public Schools
President-Elect Laura Peterson, JD, MPA State Risk Manager/Agency General Counsel State of Nebraska Lincoln, NE Directors Dan Hurley, ARM-P, CSP Sr. Director, Risk Management & Safety Norfolk Public Schools Chesapeake, VA
By Dan Foster, ARM-P
Mary Sue Linville, ALCM, ARM-P Director of Risk Management and Operations Washington Schools Risk Mgt. Pool Tukwila, WA
11 An Ounce of Prevention…
Cindy B. Mallett, AIC, CWCP, ARM-P Risk Manager City of Gainesville Gainesville, GA
How a Property Conservation Program Can Reduce Loss and Save Your Entity Money By Paree Roper
16 Information Technology Risk Management: Protecting Your Entity by Protecting Data By Joseph G. Jarret, Esq.
John J. Nacht, ARM Risk Management Program Administrator State of Washington, Employment Security Dept. Olympia, WA Dave Parker, ARM-P Risk Manager Pima County Sheriff’s Department Tucson, AZ Marilyn Rivers, CPCU, ARM, AIC Director of Risk and Safety City of Saratoga Springs Saratoga Springs, NY Editor Jennifer Ackerman, CAE Senior Manager, Communications 703.253.1267 • jackerman@primacentral.org Advertising Donna Stigler 888.814.0022 • donna@ahi-services.com
16 In Every Issue 4 News Briefs | 19 Advertiser Index | 20 Member Spotlight
Public Risk (ISSN 0891-7183) is published 10 times per year by the Public Risk Management Association, 500 Montgomery Street, #750, Alexandria, VA 22314 tel: 703.528.7701 • fax: 703.739.0200 email: info@primacentral.org • Web site: www.primacentral.org Opinions and ideas expressed are not necessarily representative of the policies of PRIMA. Subscription rate: $140 per year. Back issue copies for members available for $7 each ($13 each for non-PRIMA members). All back issues are subject to availability. Apply to the editor for permission to reprint any part of the magazine. Periodical postage paid at Alexandria, VA, and additional mailing offices. POSTMASTER: Send address changes to PRIMA, 500 Montgomery Street, #750, Alexandria, VA 22314. Copyright 2010 Public Risk Management Association Reprints: Contact the Reprint Outsource at 717.394.7350.
April 2010 | Public Risk
1
Safety First!
Kathleen Morris, Safety Compliance Coordinator, Animas Valley Elementary School
Colorado School District Self-Insurance Pool members share an intense commitment to the safety of their children. Kathleen Morris of Durango District 9-R says, “It’s safety first. Nothing else matters if our kids don’t feel safe. They’re our most precious assets.” To guarantee the stability and security of Colorado’s schools, the Pool relies on Genesis for its reinsurance. With A.M. Best and Standard & Poor’s ratings A++ and AAA, respectively, for financial security, Pool members can be confident that their most precious assets are being well protected.
Visit our website at www.GenesisGov.com
Genesis Underwriting Management Company, Financial Center, 695 East Main Street, Stamford, CT 06901
A.M. Best A++ XV
S&P AAA
A Berkshire Hathaway Company
Message from PRIMA President Ron Hayes
It’s Not a Matter of If, but When
A
utomated external defibrillators (AEDs) may not occupy a place of prominence on your priority list. Until two years ago, they weren’t at the top of my list either. I submit that you are only one event away from placing AEDs at or near the top of your safety priority list. I found this out the hard way. It was roughly two years ago during a high school basketball game when the event occurred. One of the players collapsed onto the gym floor as the game was progressing. Fellow players, coaches, fans and family rushed to the boy’s side. Realizing the gravity of the athlete’s situation, an alert adult remembered the fire station located across the street from the school. Reacting quickly, the adult rushed across the street in an effort to enlist assistance. Fortunately, several firemen were on duty at the fire station. Grabbing the AED, the firemen rushed across the street to attend the downed player. In a matter of seconds, the AED was being administered in an effort to revive the stricken high school athlete. Through fast action by the firemen, an alert adult and the availability of an AED, a young life was saved.
I ask that you read Dan Foster’s article, “The ABCs of AEDS in Public Schools.” His article reinforces the importance of AEDs in schools throughout the country. If you currently have AEDs in your system, good direction in location of units, oversight committee, training and maintenance is offered. If you are considering placing AEDs in schools within your system, you will benefit from the author’s true life examples of the duty of care expected should these devices be included in your emergency response plans. As is so often the case in school risk management, the concern is not if your entity will face an event such as the one described in the article, but when your entity will face such an event. Preparation, planning and practice may be the difference between life and death when an event occurs on your watch. You can learn more about the challenges of school risk management and lots more at PRIMA’s 2010 Annual Conference in Orlando. I hope to see you there! Sincerely,
Since that event, 24 AEDs have been placed throughout the high school and middle schools in our school district. Four devices are currently located in elementary schools with another seven promised in the near future. Our goal for the district is to have at least one AED in every school within the next 24 months along with at least two trained personnel per site.
As is so often the case in school risk management, the concern is not if your entity will face an event such as the one described in the article, but when your entity will face such an event. Preparation, planning and practice may be the difference between life and death when an event occurs on your watch.
Ron Hayes 2009–2010 PRIMA President Risk Manager, Calcasieu (La.) Parish School Board
April 2010 | Public Risk
3
News Briefs
News
Briefs Appeals Court Overturns $1 million Providence, R.I., Liability in Telephone Call Recordings A federal appeals court in Boston overturned a jury verdict that held the City of Providence, R.I., and two of its former employees liable for more than $1 million in damages and attorneys’ fees for illegally recording hundreds of thousands of phone calls at the city’s Public Safety Complex, reports The Providence Journal. The 1st U.S. Court of Appeals vacated the verdict in a civil suit that had as plaintiffs 135 current and former employees of the police and fire departments and their families. It said that the city and its officials are shielded by “qualified immunity,” which is designed to protect government officials from liability unless their conduct clearly violates someone’s constitutional rights, the officials knew they were doing so and the right at issue was clearly established under the law at the time of the alleged wrongful conduct. The decision, written by Chief Judge Sandra L. Lynch, leaves the door open, but only narrowly, for the plaintiffs to re-file some of their claims in Rhode Island Superior Court.
Airport Body Scanners Have Critics, including Pope Pope Benedict XVI has joined civil libertarians and airline safety experts in voicing concern about new airport scanners like the ones destined for Chicago’s O’Hare International Airport and which will provide security officers with near-nude images of airline passengers, reports the Chicago Tribune. U.S. and European governments, including Italy, are rushing to install new, full-body scanners in airports in an attempt to stop terrorists like the “underwear bomber,” Umar Farouk Abdulmutallab, the man accused of attempting to incinerate a Northwest Airlines jet on Christmas Day. The machines are controversial. While they likely would have prevented the Detroit incident, security experts question whether they’d be effective against terrorists who hide explosives in body cavities. The scanners have also raised privacy concerns, although the Transportation Security Administration and European airport officials insist they won’t store passenger images.
4
Public Risk | April 2010
w w w.primacentral .org
Cameras Change Focus on Crime Watch
More Police Inside Seattle’s Downtown Transit Tunnel
In a digital age where cell phone cameras are continually pointed at police, a group of San Diego officers is turning the tables with cameras of their own. The San Diego Police Department has joined a handful of other agencies across the nation to begin testing head-mounted video cameras that record officers’ interactions with the public, reports the San Diego News-Tribune.
Dow Constantine, an executive for King County, Wash., said that more sheriffs’ deputies would be stationed inside Seattle’s Downtown Transit Tunnel after a video showed a 15-year-old girl beaten while private security guards watched but didn’t intervene.
Nine officers who work out of the Mid-City Division, which includes City Heights and the College Area, will wear the RoboCoplike gear while on routine patrol over the next 60 days. They will record everything from traffic stops and domestic disturbances to more volatile situations that have the potential to end with force. “It gives real-time information on exactly what occurred at the scene. Anything that helps put the case into perspective,” San Diego Assistant Police Chief Bob Kanaski said yesterday. “No more ‘he said, she said.’ Now it’s in color.”
Bill Would Shield Property Owners from Gunfire Liability
“These new measures will assure transit customers of a police presence that meets their expectations for safety and security in the bus tunnel,” Constantine said in a statement. The Seattle Post-Intelligencer reports that at least one King County sheriff’s deputy will be assigned to each of Metro’s five tunnel station during operating hours, similar to staffing levels before Metro contracted with private security guards to mostly handle security in the tunnel in 2005.
The House approved legislation in Utah that would protect a property owner from civil or criminal liability if a concealed weapon holder is allowed onto the property and fires his or her weapon, reports The Salt Lake Tribune. Rep. Stephen Sandstrom, R-Orem, said he has heard from property owners who fear they would be sued if a concealed weapon carrier fires a gun on their property and HB380 is intended to give those property owners protection. Business owners still have the option of posting a sign saying that concealed weapons are not allowed. But Sandstrom said allowing concealed weapons could avert tragedies like the Virginia Tech and Trolley Square massacres. Rep. Brian King, D-Salt Lake City, said the immunity is too sweeping and would eliminate accountability. The House passed the bill 45-24. It now goes to the Senate for consideration.
April 2010 | Public Risk
5
The ABCs of AEDs in Public Schools
ABCs
AEDs
The of in Public Schools By Dan Foster, ARM-P
Automated External Defibrillators (AEDs) have been instrumental in saving lives for decades and their success at public schools is no exception. When an AED is introduced during the first three to five minutes of a sudden cardiac arrest (SCA), the chances of survival for the victim are as high as 74 percent.1 Public schools throughout the United States have AEDs on hand to respond to emergencies that range from collapsed athletes to citizens suffering cardiac arrest while on campus. In his Journal of the American Heart Association article, “Emergency Planning for SCA in U.S. High Schools,” Dr. Jonathan Drezner studied AED programs at 1,710 high schools throughout the nation and concluded that school-based AED programs provide a high survival rate for both student athletes and older non-students who suffer SCA on school grounds.2 But is having an AED all it takes to consider your school “prepared” for cardiac emergencies? Recent incidents and court cases show that a higher duty of care is expected when a public entity adds these devices to their emergency response plans. In most cases, the courts have decided in favor of the public entity upholding the immunity protections afforded to them. But this still comes at a cost: the loss of a life and expensive defense costs. Congress and every state have taken steps to provide legal oversight for the use of AEDs. The Federal Cardiac Arrest Survival Act of 2000 provides limited immunity for users of AEDs. Some states (CO, FL, GA, IL, MD, MI, NV, NY, OH, PA, SC, TN and VA) have laws that specifically regulate the use of AEDs in schools. But all of these laws require the owner of the AED to maintain a standard of care for the use and availability of these units. Many AED acquisitions are made with good intentions. But as part of a school district’s risk management program, a plan needs to be developed to ensure the district is providing the proper implementation and follow through. The following factors need to be addressed when a school district acquires an AED.
6
Public Risk | April 2010
w w w.primacentral .org
In 2005, a 14-year-old student at a Rhode Island high school dies of sudden cardiac arrest during baseball practice because the only AED in the building was locked in the school nurse’s office—1/5 of a mile from the baseball field. In 2006, a 16-year-old Texas high school student collapses and dies during a cross country workout while on school campus. An AED was 25 feet away but was locked up in a trainer’s office in the field house next to the track. In 2007, the widow of a Florida man sues the school when her husband dies at a school field house while playing basketball. The lawsuit alleged the school was negligent because it failed to train staff to respond to a heart attack; notify staff, students and faculty about AED locations; place AEDs in locations where heart attacks were likely to occur (i.e., field house); or ensure AEDs were accessible. In 2007, a Texas student collapsed during halftime at an away basketball game. While the hosting school had an AED that might have been used to save the student’s life, potential rescuers did not know where to find it. And while the student’s school also had AEDs, an athletic trainer equipped with an AED did not travel with the team.
Equipment Selection AEDs are not all alike. The following are some of the major considerations school districts must address BEFORE purchasing an AED: Compatibility With Local Emergency Equipment: Before you make the decision to purchase an AED for your school, consult with your local emergency medical providers and consider purchasing a unit that has leads compatible with the paramedic’s equipment. They will also want to collect information after an event and take this information with the patient to the hospital. Many machines come with removable data cards or USB storage devices that assist in this important step. Automatic vs. Semi-Automatic Units: Fully automatic versions deliver a shock without any commands from the user. Semi-automatic versions, on the other hand, tell the operator that a shock is needed; however, with the semi-automatic version, the user must actively tell the defibrillator when to deliver the shock, usually by pushing a button. Pediatric vs. Adult Units: There are models made for adults (ages 8 and older) as well as pediatric units. The age of the victims treated needs to be considered when purchasing an AED. Some AED units designed for adult use have variable energy settings which allow you to set the equipment at a lower level for use with children under the age of 8.
Audible vs. Visual Cues: Because some AED users may be hearing impaired, many units now include visual instructions as well as voice prompts. Escalating Energy vs. Non-Escalating Energy: Escalating energy units will automatically adjust shock output with incremental strength if needed. These types of AEDs are more efficient. Non-escalating energy units are not capable of escalating energy shocks and output only one level of energy strength. It lacks the ability to output incremental strength if needed. Diagnostic Testing of Equipment: Most AEDs have a means to test their readiness. This ensures that the unit is ready for use at any time. Some AED units come with internal circuitry and software that allows the machine to conduct a daily self-test and prepare a report to advise the equipment owner if there is a problem. The most sophisticated equipment is directly wired from the storage unit to a central station that receives reports of malfunction and notifies the equipment user. Donated Equipment: In many cases, this is a dream come true for cash-strapped schools, but this gift can quickly become a burden. Used equipment can have damaged or missing
April 2010 | Public Risk
7
The ABCs of AEDs in Public Schools
AEDs save lives, but work best when they are available, operable and in the hands of trained staff. Implementing a comprehensive AED program will help ensure that your schools are prepared to address SCAs when they occur.
components. New items may not meet the district’s equipment requirements or medical protocols. It’s best if donors work with the school to determine their need and purchase equipment appropriate for the school.
Medical Oversight Many states require that AEDs be prescribed or approved by a licensed physician. Even if this is not required in your state, it is advisable to utilize the medical community since they are familiar with AEDs. Seek out a provider who is knowledgeable in CPR and AED use. In addition, the medical director can assist the district in identifying training resources, monitoring AED user readiness and performing post-defibrillation patient follow up.
Oversight Committee It’s important to form a committee of key personnel who will help with the location, use and maintenance of the AEDs. The district’s risk manager, safety representatives, nurses, athletic directors, physical education teachers, facilities, security and building principals have a critical role in how effective the plan will be.
Consider where the risk of sudden cardiac arrest is highest at your school. If at an elementary school, and you know of students or staff who are diagnosed with a serious heart condition, you may consider placing the AED in close proximity to the nurses office or the centrally located cafeteria. However, if your building is a high school facility, you may be better served to place the unit (or units) in areas of general assembly such as the theatre or sports stadiums. Consideration is also needed for remote locations such as fields and off-site athletic areas. Since cardiac arrest among students is as likely during practice as during an event, the availability of an AED for any sports activity needs to be thought out in the plan. Include signage at every location identifying that an AED is present.
Training
Getting board approval for the purchase, implementation, use and maintenance of AEDs helps ensure that the program is recognized as an integral part of the district’s operations. A written plan is needed to outline the responsibilities.
School personnel using AEDs need to be trained on their use along with first aid and CPR. Most states consider this a requirement that comes with owning an AED. While most AED units are intuitive, studies show that trained personnel are better prepared and more responsive with AEDs during emergencies. Practice drills should be performed periodically to test the effectiveness of the plan and build familiarity with using the units in the context of the school setting.
Location of Units
Documentation
The placement and quantity of units is a decision that is best made with the district, physician and local emergency personnel. The American Heart Association recommends using the three minute response time (from arrest to first
Certain items need to be documented and retained for recordkeeping and proof of action. Examples include your district’s AED plan and policies, purchase records, maintenance records, inspection checklists and incident reports.
Board Policy and Written Plan
8
shock) as a guideline to help determine how many AEDs are needed and where to place them.
Public Risk | April 2010
w w w.primacentral .org
Maintenance AEDs require periodic inspection and preventative maintenance to ensure they work properly when an emergency arises. Follow the manufacturer’s recommendations for specific items to check on each unit. A checklist should be utilized to make sure units are checked consistently and thoroughly. At a minimum, the checklist should include the following: • • • • • •
Verify AED is in proper location Verify battery installation and expiration Check the status/service indicator light Inspect exterior components for damage Check expiration date on pads Check supplies (disposable gloves, CPR mask, scissors, razor, extra battery and extra electrode pads)
Security AEDs are a life-saving tool. If parts are missing or the equipment is vandalized or missing, the results could be devastating. In addition to life safety, this equipment is an expensive asset that should be protected from theft and abuse. AEDs can be made available for public access in a secure manner. This can be done by installing them in alarmed wall cabinets. The manufacturers of AEDs offer various types of cabinets with several alarm options.
Endnotes
be checked every time it is returned and the unit tested for readiness.
1. “AED Implementation Guide” American Heart Association, 2004
Recalls and Equipment Modifications Periodically AEDs are recalled by the manufacturer due to defects. Be sure to register every device and periodically check with the manufacturer to see if your units are subject to changes. AEDs save lives, but work best when they are available, operable and in the hands of trained staff. Implementing a comprehensive AED program will help ensure that your schools are prepared to address SCAs when they occur. Dan Foster, ARM-P is a loss control consultant with the Washington Schools Risk Management Pool.
2. “Effectiveness of Emergency Response Planning for Sudden Cardiac Arrest in United States High Schools With Automated External Defibrillators” Jonathan A. Drezner, MD; Ashwin L. Rao, MD; Justin Heistand, MD; Megan K. Bloomingdale; Kimberly G. Harmon, MD, Circulation 2009;120;518-525
Special Thanks Jonathan A. Drezner, MD is a family physician who specializes in sports medicine. He is an Associate Professor in the Department of Family Medicine at the University of Washington. Dr. Drezner also serves as team physician for the Seattle Seahawks and the University of Washington Huskies.
If a portable device is used, the AED must be in a bag or case that protects the equipment from damage. Initiate a “check-out” sheet where authorized users check out the portable AED and equipment from a secure storage area. The sheet should clearly designate where the equipment is to be taken and left in a pre-designated place so that individuals who need the AED in an emergency situation know where to locate it. The contents should
April 2010 | Public Risk
9
RISK MANAGEMENT:
PRIMA’s 31st Annual Conference June 6 – 9, 2010 | Orlando, FL For more information, visit www.primacentral.org.
Register Today for the ONLY Conference Dedicated to Risk Management in the Public Sector! In 2010, PRIMA is planning another outstanding conference, where attendees will enjoy dynamic risk management educational sessions, fun and productive networking events and an exhibit hall that highlights vendors from all areas of the public risk management arena. PRIMA’s Annual Conference is the forum for all levels of risk managers in the public sector as well as professionals in related fields such as school administration, human resources, employee benefits, health and safety, legal and regulatory, risk financing, claims management and pooling.
For more information, visit www.primacentral.org.
Property Conservation
An Ounce of Prevention‌
How a Property Conservation Program Can Reduce
Loss and Save Your Entity Money By Paree Roper
In southern California, wind-blown sparks from a welder’s torch set off a brush fire that blackened more than 23,000 acres. The crew was working on a tank that belonged to the local water district. A total of 12 fire trucks and 60 firefighters were called in order to extinguish a fire at a highly competitive public school in New York City. A 16-year-old student was arrested and charged with arson. Two men in North Carolina were arrested for setting fire to a city-owned storage facility. The materials that fueled the blaze? Beer and hay. The media certainly gives these types of incidents a great deal of attention. The purpose of this article is to shift some of that attention from the sensational stories to a more mundane, yet essential and appropriate focus: property conservation.
Property conservation is a system that identifies and protects physical assets. Property conservation activities apply to real property (owned or leased), building contents and boilers and machinery. A property conservation program reduces physical losses and personal injuries through the systematic use of loss control techniques within all sectors of an entity. In order to meet this goal, written property conservation and loss control guidelines must be established. The following text will outline some of the basic loss control elements that support an effective property conservation program and will focus on fire exposures.
Elements of a Property Conservation Program Policy An effective property conservation program starts with a policy that outlines responsibilities and provides guidance for those involved with implementing safeguards. The
April 2010 | Public Risk
11
Property Conservation
Physical inventories of property provide the basis for working an effective program. This activity should be conducted on a periodic basis in order to account for structures, equipment used off-premises and building contents. This inventory also assists with the valuation and scheduling of property for insurance coverage.
policy should explicitly state the entity’s commitment to loss control and protection of physical assets. Procedures concerning the treatment of loaned equipment, personal property and off-premise use of equipment may be placed in the policy as well. Paperwork such as sign-out sheets and logs pertaining to the program can be shown as attachments to the policy. Property Equipment Inventory Physical inventories of property provide the basis for working an effective program. This activity should be conducted on a periodic basis in order to account for structures, equipment used off-premises and building contents. This inventory also assists with the valuation and scheduling of property for insurance coverage. In order for an item to be covered, it has to be included on the property schedule prior to a loss. In some instances, certain types of property are specifically excluded from coverage unless it appears on a schedule. Newly purchased property or equipment should be scheduled immediately. A rule of thumb is that the potential for an uncovered property loss can be reduced significantly if the property and equipment schedules are updated on an annual basis. Loss Control Inspections The heart of any property conservation program is the attention that is paid to actual physical safeguards. The following loss control inspection activities can help assure that your facilities and equipment receive the maximum protection from perils that can shut down operations and create hardship for many: • Inspection of fire protection equipment. If a facility has sprinklers, visual inspections of sprinkler control valves and risers should occur on a weekly basis. This is to make certain that a) valves are fully opened, b) appropriate locks and chains are secured and in place, c) access to valves and risers is unobstructed and d) adequate water pressure is indicated on pressure gauges. Weekly inspections should also include checking the condition of electric and diesel fire pumps as well. These inspections should be conducted with the applicable National Fire Protection Association (NFPA) standards in mind. In this particular case, NFPA 25 is the Standard for Inspection of Water-Based Fire Protection Systems. Monthly inspections can focus on housekeeping, smoking and storage issues. Make sure those areas surrounding fire protection equipment is kept free of trash, combustibles and is kept in a neat fashion. Special attention should be paid to hidden areas and portions
12
Public Risk | April 2010
of a building that are not easily accessible, for these are the areas where someone may sneak a smoke or store an inappropriate item. Sprinkler heads must have adequate clearance in order to function properly. A minimum clearance of 18” is recommended between the sprinkler heads and the top of any storage (NFPA 13, Section A-5-6.6). Many preventable fires have occurred as a result of this rule not being followed. The portable fire extinguisher is a first line of defense when fighting fire. NFPA 10 is the Standard for Portable Fire Extinguishers that outlines inspection and maintenance requirements. According to NFPA 10, Section 4.4-3.1, portable fire extinguishers “shall be inspected when initially placed in service and thereafter at approximately 30-day intervals.” When inspecting portable fire extinguishers, make certain: • The extinguisher is not blocked by objects that could interfere with access in an emergency. • The pressure is at the recommended level. On extinguishers equipped with a gauge, the needle should be in the green zone. • Nozzles and other parts are unobstructed. • Pins and tamper seals are intact. • There are no dents, leaks, rust, chemical deposits or other signs of wear and tear. Clean off any items that may have leaked or that have been deposited on the extinguisher. Special fire protection systems such as kitchen hoods or Halon should be inspected by a qualified individual. Discharge heads should be clear of obstructions and any leakage or discharge should be noted and remedied. • Monitoring of hot work. Heat, open flames and sparks from a number of activities produce unique exposures to property. For instance, a spark can fly into a crack or crevice and remain hot (as well as invisible) for enough time to cause a blaze. Hot work operations include activities such as electric arc welding, use of oxygen and acetylene as cutting torches and the applications of heat guns, soldering irons and grinding wheels. A hot work permitting system is a safe and methodical way of handling these types of activities. The system can help employees determine: • Whether the hot work is necessary and can be done through alternative means • Appropriate places where hot work can be done within a facility • Precautions that need to be taken before engaging in hot work • How hot work is to be monitored
w w w.primacentral .org
Monitoring use of facility by outsiders Outsiders will not instantly know what is expected of them regarding property conservation, so these requirements must be communicated in a plain and forthright fashion. When dealing with contractors, make certain that at some point, all parties get information on what their responsibilities will be while performing work at a particular site. This would include issues such as hot work, access within the facility, smoking, housekeeping and fire prevention activities. When dealing with groups that are using a facility for an activity, make them aware of any outside user policies and their attendant permits and applications. These items should explain insurance requirements, fees, and the conditions and expectations under which they will operate.
Arson and Vandalism Prevention In addition to some of the fire prevention methods already discussed, there are effective ways of combating the effects of this deliberate and costly exposure. They include the following: • Surveillance. Good sight lines mean that the criminals can be easily spotted. This can be accomplished by trimming trees and shrubs so that potential hiding places are exposed, good housekeeping and maintenance in order to give the impression that the property is cared for and clear views from entryways and windows that allow for sweeping views. When designing new facilities, take principles such as Crime Prevention Through Environmental Design (CPTED, pronounced “SEP-ted”) into consideration. This is the school of thought that says built environment can be designed in ways that discourage criminal activity.
These activities can be enhanced through appropriate and plentiful lighting, closed circuit cameras and on-site security patrols. Note: there is a school of thought that says crime can be deterred by turning lights off in a specific area, so there is not a consensus. • Controlled access and well-defined boundaries. This would include the use of restricted areas within a facility, locked doors and fencing, well-defined entryways and proper signage that tells the public where they are allowed access. Use of security stations, gates and even changes in landscaping send clear messages to potential arsonists and vandals that this particular facility may not be the one to hit. • Target hardening. Strengthening building components makes it more difficult for arsonist or vandal to strike quickly. These activities could include: • Reinforced door frames and windows • Electronic access to sensitive or vulnerable areas • Locked interior rooms (especially ones holding valuable equipment) An effective property conservation program pays dividends in that equipment and facilities receive the care they are due. In return, your entity is able to utilize these items to the fullest in order to provide top-notch services to the public it serves. If these methods help with providing top-notch services, kick back and reward yourself with a cold one (it can be non-alcoholic as well). Minus the hay. Paree Roper is PRIMA’s industry specialist.
April 2010 | Public Risk
13
PRIM A 2010
Webinar Series Expand your knowledge of public sector risk management with PRIMA’s Webinar series! Train your whole office for the cost of just one registration! Watch the presentation, submit questions and participate in audience polls from the comfort of your office. Mark your calendar for these live events, featuring engaging subject matter experts presenting need-to-know topics.
Register today for these upcoming Webinars:
April 21 The Anatomy of a Lawsuit
May 19 Public Sector HR Basics
September 15 Key Issues in Loss Mitigation—Is your organization prepared to respond?
October 13 Protecting our Children: Keeping our Communities and Schools Safe
November 17 Winning Strategies for Contractual Risk Transfer
Can’t participate in a Webinar? All Webinars are recorded and available for purchase on CD.
Series Sponsor:
Visit www.primacentral.org to register.
Calendar of Events The Public Risk Management Association (PRIMA) hosts or sponsors a wide variety of educational programs for public risk practitioners. These meetings and events provide an optimum forum for public risk professionals to acquire new knowledge or skills, exchange ideas and expand peer networks.
Are you searching for new employees? Looking for a new position for yourself? Not finding what you’re looking for? The possibilities to find qualified employees and top-notch jobs just became endless...
PRIMA’s
Job Bank PRIMA has partnered with JobTarget, an industry leader in job board development and management to bring you an all-inclusive job search and recruiting center. With PRIMA’s online Job Bank, you’ll have opportunities to fill your open positions that you wouldn’t be able to find anywhere else AND you’ll find jobs that are specific to YOU, a professional in the risk management industry.
PRIMA’s calendar of events is current at time of publication. For the most up-to-date schedule, visit www.primacentral.org. Webinars 2010 April 21 The Anatomy of a Lawsuit May 19 Public Sector HR Basics September 15 Key Issues in Loss Mitigation— Is Your Organization Prepared to Respond? October 13 Protecting our Children: Keeping our Communities and Schools Safe November 17 Winning Strategies for Contractual Risk Transfer Meetings & Events 2010 September 13-16, 2010 PRIMA Institute San Antonio, TX Crowne Plaza Riverwalk PRIMA Annual Conferences June 6–9, 2010 PRIMA 2010 Annual Conference Orlando, FL Orlando World Center Marriott June 5–8, 2011 PRIMA 2011 Annual Conference Portland, OR Portland Convention Center June 3–6, 2012 PRIMA 2012 Annual Conference Nashville, TN Opryland Hotel
Visit www.primacentral.org and get on the road to your new career!
June 2-5, 2013 PRIMA 2013 Annual Conference Tampa, FL Tampa Convention Center
Information Technology Risk Management
Information Technology Risk Management:
Protecting Your Entity by Protecting Data By Joseph G. Jarret, Esquire
When that vital piece of equipment otherwise known as the computer gets out of sorts, the cry across an organization is usually, “Quick, call IT!” Our dependence upon computers and the people who service them has grown exponentially in the last decade. To presume we can do without either in this information age is naive at best. Because many IT employees possess a technical expertise and, more often than not, seem to speak a language all of their own, it is not uncommon for members of an organization to wryly observe, “I don’t know what these people do or what they’re talking about, so long as they fix the problem.” Unfortunately, the risk manager doesn’t have the luxury of assuming a laissez-faire attitude when it comes to the risks an entity’s IT function can pose. It takes only one employee to send sexually suggestive material over your organization’s computer system, or import a crippling virus to realize just how vulnerable an IT system can be. The risk manager can play an integral role in protecting an entity from IT-generated claims by becoming glib about the structure, function and potential risks inherent in maintain a sophisticated computer/IT system.
IT as a Risk to be Managed For the purposes of this article, the term “IT system” is a general support system (e.g., mainframe computer, mid-range, lap top and desk computers, local area network) consisting of electronic computers and computer software designed to convert, store, protect, process, transmit and securely retrieve information. Obviously, organizations such as the Information Technology Association of America (ITAA) would provide a more expansive, and I dare say, technical definition.1 So where does the risk manager fit in to the IT scheme? To begin, the risk manager is instrumental in assisting the IT department or division to better secure an entity’s IT systems that store, process or transmit organizational information. This assumption is
16
Public Risk | April 2010
w w w.primacentral .org
Because many IT employees possess a technical expertise and, more often than not, seem to speak a language all of their own, it is not uncommon for members of an organization to wryly observe, “I don’t know what these people do or what they’re talking about, so long as they fix the problem.” Unfortunately, the risk manager doesn’t have the luxury of assuming a laissez-faire attitude when it comes to the risks an entity’s IT function can pose… The risk manager can play an integral role in protecting an entity from IT-generated claims by becoming glib about the structure, function and potential risks inherent in maintain a sophisticated computer/IT system.
predicated on the willingness of the risk manager to become as informed as possible as to her or his IT system’s capabilities and vulnerabilities. The risk manager should take the time to learn: • • • •
How does IT fit into the mission of the organization? Who has access to the system? What are the system’s vulnerabilities? What information (both incoming and outgoing) is required by the organization? • What information is generated by, consumed by, processed on, stored in and retrieved by the system? • How important is the information to the user organization’s mission? • What are the paths of information flow? • What is the sensitivity (or classification) level of the information? • What information handled by or about the system should not be disclosed and to whom? • Where specifically is the information processed and stored? • What are the types of information storage? • What is the potential impact on the organization if the information is disclosed to unauthorized personnel? • What is the effect on the organization’s mission if the system or information is not reliable? • How much system downtime can the organization tolerate? • Could a system or security malfunction or unavailability result in injury or death?2
The Role of the Risk Manager Armed with the above knowledge, the risk manager assists the IT manager with the balancing of the operational and economic costs of protective measures in an effort to achieve gains in mission capability by protecting the IT systems and data that support their organizations’ missions.3 Further, the risk manager can be instrumental in identifying offsite facilities designed to store and protect data that is vulnerable due to the location of the entity, i.e., in close proximity to flood plains, seismic faults and dams, organizations that produce, store, use or transport hazardous materials, major transportation routes and airports, nuclear power plants and hurricane or tornado prone areas. Another area where the risk manager is vital in the IT protection process concerns the creation and implementation of an internet use policy. Such a policy should clearly and concisely alert all personnel as to the appropriate use of the entity’s computer and e-mail systems, as well as alert them to inappropriate use such as: • Accessing (including browsing) any sexually-oriented or other similar “adult” Web sites, news groups or other Internet locations and forwarding such inappropriate materials to other employees and third parties; • Accessing (including browsing) any other Web sites, news groups or other Internet locations for purposes of gambling or engaging in any illegal activity.
April 2010 | Public Risk
17
Information Technology Risk Management
End Notes: 1. The Information Technology Association of America (ITAA) is a leading industry trade group for information technology companies. The Association’s membership contains most all of the world’s major ICT firms and accounts for over 90% of ICT goods and services sold in North America. On the web: www.ITAA.org 2. Risk Management Guide for Information Technology Systems Recommendations of the National Institute of Standards and Technology, Unites States Department of Commerce, by Gary Stoneburner, Alice Goguen and Alexis Feringa. The list provided above is by no means exhaustive. 3. Id.
18
• Downloading executable programs (e.g., self-extracting zip files) or program modules (i.e., software applications or applets) or installing executable attachments to e-mail, except as authorized by the Information Services Department, to protect the entity’s computer systems from viruses and to prevent incompatibility with entityprovided software. Clearly, the above list is no means exhaustive. Your IT team can assist you in identifying other system vulnerabilities. One area that is often overlooked is the manner in which former employees are treated in terms of system access. Once an employee is terminated, or in some instances, put on administrative leave, then her or his computer access should cease at once. The Computer Fraud and Abuse Act (CFAA), enacted by Congress affords public entities who suffer specific types of loss or damage as a result of a violations of the Act in the form of hacking, imported virus, etc., to bring civil actions against the violators for compensatory
Public Risk | April 2010
damages. Despite the CFAA, it is infinitely more productive to take preventive measures before a disgruntled employee can wreak havoc, rather than attempting to pursue a civil action after the fact. Needless to say, the risk manager plays a key role in safeguarding an organization’s mission and its IT systems. Because every organization possesses its own unique environment, vulnerabilities and objectives, the techniques and policies implemented to mitigate the entity’s risk will vary. Consequently, although there exists commonalities amongst polices, the “one size fits all” policy probably won’t do. By working with your IT professionals to better understand the structure, function and vulnerabilities of your entity’s IT system and by conferring with similarly situated risk managers, you can go a long way in insuring the protection of this vital function of government. Joseph G. Jarret, Esq., is the chief deputy Knox County, TN, law director and a former public risk manager.
w w w.primacentral .org
Advertiser Index
Advertiser Index Genesis Underwriting Mgmt. Co.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 2 Munich Reinsurance America. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Outside Back Cover States Self-Insurers Risk Retention Group, Inc.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inside Back Cover
Has your entity launched a successful program? An innovative solution to a common problem? A money-saving idea that kept a program underbudget? Each month, Public Risk features articles from practitioners like you. Share your successes with your colleagues by writing for Public Risk magazine! For more information, or to submit an article, contact Jennifer Ackerman at jackerman@primacentral.org or 703.253.1267.
RISKWATCH RiskWatch is PRIMA’s weekly e-news service that delivers handpicked, high-quality news articles relating to the public risk management industry directly to your email inbox. In addition, RiskWatch will provide PRIMA members with valuable association-related news. Distributed each Thursday, RiskWatch is an excellent opportunity for you to increase the value of your PRIMA membership and share valuable knowledge with your peers!
Want others in your entity—such as your senior management—to receive this new benefit of PRIMA membership? Subscribe up to two additional recipients in your entity by contacting Jessica Konrath at jkonrath@primacentral.org and provide the name, title and email address of your colleague(s).
April 2010 | Public Risk
19
Member Spotlight
Virginia School District Improves Playground Safety Each month, Public Risk features a member who has gone above and beyond in a feature column titled “Member Spotlight.” Do you know someone who deserves recognition, has made a contribution or excelled in their profession? If so, we’d like to hear from you for this exciting column, as PRIMA shines the spotlight on its members. To be considered for the Member Spotlight column, contact Jennifer Ackerman at jackerman@primacentral.org or 703.253.1267.
A
s Virginia’s second largest school district, Prince William County Public Schools faced an issue that many districts face today: ensuring that all new playground equipment met consistent, detailed standards for installation to ensure the safety of students and the community. “We needed to assure all installations met the same specification for a safe, quality product to reduce the number of injuries,” said Don Mercer, director, risk management and security services. Mercer, along with members of the facilities and purchasing departments and the county’s playground contractors, developed Prince William County Schools’ first playground safety program. The program, which was recently codified by the county to become regulation 401.01-5, provides procedures for planning, procurement, inspection, maintenance and audit of playground equipment in the school district. The regulation covers the responsibilities of the school division and parent organization involved in providing sites and equipment for playgrounds. The process also takes into consideration all stakeholders who have a voice in the planning process, including students, physical education teachers, principals and risk management, among others. “By utilizing a consistent program, playgrounds across the school division are delivered at a high level of quality,” said Mercer. “Ultimately, this has become a positive risk management tool to reduce the number of injuries at our schools.”
20
Public Risk | April 2010
The cost of the process included staff time and labor to prepare the original material developed using various playground professional documents, suggestions and checklists. An annual inspection process with an electronic database was also developed to enhance the program. “One minor cost to the program is the training and certification of the division’s playground safety inspector,” said Mercer. “The cost was $510 for a three-day course and examination by the National Playground Safety Institute.” Mercer says that this program could be utilized by other entities, as well as non-governmental organizations. “This process is easily adaptable for parks and rec departments, day care facilities, churches and homeowner associations, who would all benefit from a methodical review and approval process for their playgrounds.” Mercer says that the benefits of the playground safety program are hard to define in dollars. “We feel that prevention of student injuries has saved the school division from legal action many times,” he said. “If one serious injury to a child is avoided, the program is a success. By having a comprehensive system in place, we are better prepared to eliminate or reduce the risk of injury claims.” For more information on Prince William County Public Schools playground safety program, contact Don Mercer at mercerd@pwcs.edu or Patti Pittman at pittmanp@pwcs.edu.
w w w.primacentral .org
How do you find security and
safety in an evolving market?
You join States.
OUR GOAL IS A LONG-TERM PUBLIC ENTITY RISK MANAGEMENT PARTNERSHIP, NOT MARKET SHARE States, as a group captive, is a member-owned insurance company domiciled in Vermont. For over 20 years, the Company has operated as a financially strong, well-managed and highlyregulated national program providing its members with a broadly interpreted coverage form that is second to none in the industry. States members receive excellent claims and loss control support and specialized public entity-oriented services from an experienced, service-driven staff of professionals. Our “Partners in Protection” have a long and proven history of reliability, accountability, and well-earned trust. Despite challenges in the economy, States has maintained premium stability and continues its record of sound financial results for partner members. The States concept works. Premiums paid by members are investments in their own Company. States’ focus is to be a viable, long-term solution for its owner-members. John Grook, one of these owners, is proud to be a part of a public entity risk management success story. We know you will be too.
JOHN GROOK RISK MANAGEMENT ADMINISTRATOR CITY OF VIRGINIA BEACH, VIRGINIA
FOR INFORMATION CONTACT:
States Self-Insurers Risk Retention Group, Inc. at 1-800-640-0345, extension 3357, or visit our website at www.statesrrg.com 222 South Ninth Street, Suite 1300 Minneapolis, Minnesota 55402-3332
To see whether a risk poses a threat, don’t we have to see the big picture?
The future is like an iceberg. Most of the time what we can see before our eyes is only half the story. So how do we know the unknowable? Only those with relentless drive, expertise and foresight can see the whole picture — the risk that lies beyond. At Munich Re, seeing more is what we do. We work in interdisciplinary teams, each pair of eyes viewing something from a different perspective, all focusing on the best solution. With our worldwide network we can pinpoint complex global patterns when they arise. When it comes to grasping our future, we are never satisfied with half the story. To find out what lies beyond, visit our U.S. website at www.munichreamerica.com
Products and services provided by Munich Reinsurance America, Inc.