It might sound like the plot of an Arnold Schwarzenegger action flick, a futuristic horror film with a timely twist: Terrorists attack the food supply at a company party, poisoning prominent guests and striking fear into the heart of an American city.
Everyone hopes such a scenario will remain a work of fiction, one that was portrayed in a mock, homeland security-inspired disaster drill recently.
That drill came in December 2004, only days after outgoing HHS Secretary Tommy Thompson delivered a Washington farewell speech citing the nation's vulnerability to terrorist attacks on America's food supply. A group of about 70 executives of outsourcing giant Sodexho, its clients and vendors met with leaders from local and federal regulatory agencies in Washington in a crisis simulation to assess how they would perform if a terrorist attack involved the food supply. The crisis scenario was not set at a hospital, but it could have been. Sodexho operates food-service programs in 1,600 hospitals and 500 assisted-living centers in the U.S.
"We wanted to overtly exercise a terrorist event outside the scope of our crisis team so they could see how a company like Sodexho would react," says Bill Lyons, vice president of risk management for Gaithersburg, Md.-based Sodexho. "It was an exercise to reach out to partners and vendors and those government agencies we'd have to interact with in a significant event defined as a terrorist attack. We wanted to be proactive and see how we would recover from this to test our crisis skills."
As recent events have heightened awareness of hospitals as potential terrorist targets, hospital food-services departments and the vendors that operate and supply them have boosted food-security programs to reduce vulnerabilities to such attacks.
Last month, two men were arrested in Lodi, Calif., and charged with lying to a federal official during an investigation of alleged terrorist activity. The suspected al-Qaida operatives reportedly told FBI interrogators that hospitals and supermarkets were potential targets for al-Qaida attacks. Earlier this year, a handful of hospitals around the country reported incidents of attempted entry at strange hours by impostors posing as hospital inspectors (March 21, 2005, p. 36). And late last year when Thompson resigned his HHS post, he said his greatest fear was terrorists contaminating America's food supply.
"For the life of me, I cannot understand why the terrorists have not attacked our food supply," Thompson said at his final news conference in December 2004, "because it is so easy to do."
Food security, also known as food defense, has become a front-burner issue in the homeland security debate. Food security, involving efforts to prevent the deliberate contamination of food supplies for criminal or terrorist purposes, is distinguished from food safety. While both require similar precautions, hospitals have traditionally looked to protect the safety of food supplies from inadvertent adulteration, not terrorists, psychopaths, blackmailers or others purposely contaminating food supplies.
Richard Wade, spokesman for the American Hospital Association, agreed that hospitals have always been vulnerable to criminals seeking drugs, medical records, computer data and costly medical equipment. And hospital food seems to be just as vulnerable, he says.
"We've pointed out to our members that it's time to take stock of all systems within, and food services is obviously one of those," Wade says. "When people who want to harm patients can disarm hospitals, they render them unable to function and disarm those communities. If they can do that, they can strike a serious blow."
The World Health Organization has urged countries to prepare for the possibility of a food-related terrorist action, noting in its 50-page 2002 report, Terrorist Threats to Food: Guidelines for Establishing and Strengthening Prevention and Response Systems, that "The malicious contamination of food for terrorist purposes is a real and current threat."
That report concludes that "Prevention, although never completely effective, is the first line of defense."
To date, no food-related terrorist actions have been reported within U.S. borders, but there have been cases in which food was deliberately adulterated. Last year a Michigan supermarket employee deliberately contaminated 200 pounds of beef with an insecticide, sickening 92. In 1984 an Oregon cult contaminated salad bars with salmonella bacteria, causing 750 to become ill, and in 1996 a worker at a medical laboratory tampered with food in a Texas break room, causing 12 to develop dysentery, according to the WHO and a 2004 briefing on food security by the Association of State and Territorial Health Officials.
The largest and best-documented food-safety related incident in the U.S. was a 1985 infection outbreak caused by contaminated milk from a dairy plant that affected 170,000. The best-known food-borne illness case outside the U.S. was an outbreak of hepatitis A related to infected clams in Shanghai, China, in 1991, affecting 300,000 people. The deadliest incident occurred in Spain in 1981 when 800 died and 20,000 were sickened by cooking oil sold in Spain. But the large quantity of food imports, in spite of the government's best attempts to inspect incoming products, can bring home another country's food dangers. For example, in 1989 a rash of staphylococcal food-poisoning cases reported in the U.S. were traced to canned mushrooms imported from China.
"If an unintentional outbreak from one food, such as clams, can affect 300,000 individuals, a concerted, deliberate attack could be devastating, especially if a more dangerous chemical, biological or radionuclear agent was used," the WHO report found.
Charnette Norton, vice president of food-service consulting firm Romano Gatland of Texas, says food-security issues are paramount with hospital food-services directors and their professional associations. Norton, a dietitian and member of the Food Service Consultants Society International, says that if terrorists can wipe out a hospital during an attack, then "It's a force multiplier. It's important to them to do that. Killing a doctor is like killing a thousand soldiers. If you can contaminate the food, you not only get the patients but the medical staff as well.
"And that not only applies to hospitals. The quickest way to harm the most people is through the food supply. Everyone eats. If you can take out half the workforce, you damage an enemy's ability to respond."
Sept. 11 was wake-up call
An executive with hospital outsourcing contractor Aramark Corp., a company with 1,200 hospital clients-400 on the food side alone-says hospital food services have always been a highly regulated business.
"Prior to Sept. 11 we had food-security measures in place, but that event served as a wake-up call and since then we've expanded our policies," says Paul Gizara, vice president of product development for Aramark Healthcare Management Services, Food. For example, since the Sept. 11 attacks, Aramark has tightened employee-screening and hiring processes and has reviewed food-service access procedures at client hospitals.
"We go beyond that to the supply chain- to food processors and the ingredients that go into the foods we buy," he says. "Bioterrorism is a big concern for us."
He says the company employs a microbiologist who performs more than 40 audits annually, tracing food products "from the plants in the field to the cows on the hoof" to confirm the handling procedures and verify the environment. Gizara says that partly because of the actions of one client hospital-St. Vincent's Midtown Hospital in New York, which treated many of those injured in the Sept. 11, 2001 attacks-the New York City Office of Emergency Management has included food security in its bioterrorism emergency preparedness program, when appropriate.
Sodexho officials noted that they had planned last December's crisis drill months before Thompson's announcement. Sodexho sources say the company will continue to stage crisis drills but has no immediate plans to create a large program like the one last year. However, it will continue to participate in other organizations' drills, for example, such as one sponsored by the Maryland Restaurant Association last year.
The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 requires domestic and foreign food facilities to register with the U.S. Food and Drug Administration and assigns registration numbers to vendors. The purpose is to identify and track food sources up and down the supply chain through manufacturers, processors, packers, distributors and importers via mandated record-keeping.
No single agency has primary responsibility for food safety or food security in a crisis, sources told Modern Healthcare. Responses to both food-safety and -security incidents begin with local health departments and, depending upon the severity of the incident, can escalate to higher levels of agency involvement to state and federal agency oversight. In food-security incidents, which involve deliberate contamination, it could move from a regulatory to a criminal issue quickly and involve the FBI, FDA and other agencies.
Sodexho contracted with a firm called the Uriah Group to stage the scenario, called an escalation event, which played out through the mock disaster video Uriah developed. Uriah officials interrupted the video at crucial moments to elicit responses and questions from those attending. The video plot revealed that one of the mock suppliers had been infiltrated by a terrorist cell. There were no walking wounded as in many other disaster drills. Instead, the scenario was illustrated through the video, which began with mock TV news reports.
"What was good was, we had to differentiate between what we knew and what was speculation," Sodexho's Lyons says. "In the real events people have to distinguish between fact and fiction. It was a very interesting exercise. We wanted to understand each other's thought processes. We all walked away saying we hope we'd never have to go through that in real life. But we learned a lot."
In April the participants gathered again to share what they gleaned from the all-day event and how they changed their practices. Mike Dunn, Sodexho's food-safety zone director and director of product-quality assurance, says the drill proved that the company's internal programs were sound.
"The one issue we identified was how do we recover businesswise from an event like that," Dunn says.
Dunn says the drill, known in the industry as a "tabletop exercise" because the various participants are seated at tables, first observing and then gathering to decide their actions, showed Sodexho that a situation can "quickly escalate and grow out of our hands. The feds described how they'd take over. That was a concern because this is our business."
He says the company learned it had to work more closely with local authorities to improve the level of trust.
"We don't want them to be the last to know and we don't want to be the last to know that something has gone wrong," he says.
After Sept. 11, Sodexho established an internal bioterrorism task force with representatives from its legal, human resources, risk management and public relations departments.
"In the wake of the anthrax scare, SARS epidemic and with avian flu on our radar, we established this to determine how we should deal with these kinds of events if they impacted us," Dunn says.
The company developed a Sodexho Actions for Emergencies, or SAFE, document in English, Spanish and French listing emergency contact information and procedures and distributed the placards to all of its units. Information on potential events such as bomb threats, explosions and how to report contaminated food is covered on the placards, which are posted prominently to make information immediately available to kitchen staff mem-bers if something happened in their areas.
"We took a good aggressive food-safety program and expanded it to include a distinguished food-security program," Lyons says.
The SAFE program for emergencies is "force fed" to the units, Lyons says. "It goes over what to look for in the front of the house, the back of the house. More than anything, it's an awareness builder. We encourage the staff to report signs of product tampering. We closely supervise contract workers. We restrict entry to the health facilities and control our areas. We check products on schedule and restrict access to chemicals to designated employees."
Dunn says he's unaware of any specific, identified terrorist threats against hospital food supplies.
"I've heard of individual actions by disgruntled employees, but none by terrorists," he says. "Nonetheless we take the possibility very seriously. We're guests in people's homes. We try to stay on top of this."
He says it's not only Sodexho's business at stake, but its customers' well-being, as well.
"If there's a contamination of food, we need to know how to pull it out of the supply chain," he says. "We want to have a system with no secrets, without overly alarming the public."
One hospital's approach
At Chicago's 679-bed Rush University Medical Center, the food-services managers implemented stricter food-safety and security policies after Sept. 11.
Linda Lafferty, Rush director of food and nutrition, says vendors now must give the medical center a guarantee of food safety and wholesomeness when products are delivered.
"We have procedures in place to ensure that the food supply is safe when it arrives," says Lafferty, president-elect of the National Society for Healthcare Food Services Management. "But we don't stop there. We also look at their (vendor) safety and security procedures: the routes their drivers travel and the timeliness of their deliveries. We do inspections of our vendors, too. We make sure our dock and campus are secured and only authorized people are permitted entry."
Like most hospitals, Rush already had stringent food-safety procedures in place before Sept. 11, Lafferty says.
"But our focus on controlling food as we process and serve it has expanded," she says. She notes that the hospital now conducts more thorough background checks on potential employees, including criminal checks, drug testing and citizenship history.
"We closely supervise our retail area-salad bars and self-service counters-where we're most vulnerable, to watch for intentional or unintentional adulteration. We have a written disaster plan and we're preparing a drill in November."
Rush, which prepares 2.1 million meals per year at its Chicago campus, also performs unannounced vendor visits. Marcy Stone, past president of the American Society for Healthcare Food Service Administrators, one of two professional and educational organizations for hospital food-services directors, says restricting access has been a big part of the system's food-security program.
"We're more vigilant in checking IDs," says Stone, Rush manager of food-service operations. "We stop people, strangers and even those who work here. Employees know they can be disciplined for not showing their ID badges. We've become much more wary about locking down ingredients and supplies."
What do you think?
Write us with your comments. Via e-mail, it's [email protected]; through the Web, use modernhealthcare.com; by fax, 312-280-3183; or through the mail, Modern Healthcare, Letters to the Editor, 360 N. Michigan Ave., Chicago, Ill. 60601. To publish letters, we need your name, title, affiliation, location and phone number.