As the worldwide response to the COVID 19 pandemic continues, the United States’ death toll has exceeded 50,000 and, with testing still very much underway, the extent of the infected is unknown. However, with the risks of continued outbreaks and deaths from the virus still very much existing (as of the time of this article’s writing), questions, such as who’s at risk for contracting and transmitting the virus; when and how to return to work safety from quarantine; how to protect personnel from virus exposures and how to medically treat patients have been discussed in globally projected press conferences as matters of opinion with limited communication of the scientific analyses behind the decisions being discussed.

With this limited discussion this scientific analysis – the hazard, hazard controls, communication, leading and lagging indicators and investigations – and the risk management decisions serving as inputs and outputs from it, many tertiary arguments and conflicts have come up. However, using a facts-driven risk management decision-making process and a subsequent hazard analysis within the safety continual improvement cycle, COVID 19’s acute and chronic risks can be managed while optimizing exposure prevention.

With this continual improvement, needs include a hazard analysis, risk assessment, hazard controls, communication, leading indicators, lagging indicators and investigations. This article, part one of a three-part series, covers the hazard analysis and risk assessment of COVID 19.

Hazard analysis

To begin the process of developing safety protocols, the hazard must first be analyzed. In this case, COVID 19 is a virus, a pathogen. It is transmitted from person to person through contaminated droplets from an infected person. These droplets can come from surface contamination such as droplets left on a table or a door handle or from contact such as a handshake or a hug. Also, these droplets can be air transmitted from sneezing, coughing, talking or even breathing. In any case, if the droplets can get from an infected person’s mouth or nose to another person’s mouth, nose or eyes, the virus can be spread. In the case of COVID 19, the virus is highly contagious, virulent (the droplets have been documented to live up to nine days on surfaces) and persons can be infectious while asymptomatic, so watching for evident symptoms is not enough to avoid the virus.

Risk assessment

Within the context of infectious disease exposure prevention, methodical decision making based on a scientific risk management and hazard control process is needed. This allows for opening society and business operations within safe parameters. Based on the process below, organizations can determine the safest protocols within the risk management construct deemed appropriate. The objective is to control the risk and hazard in the most effective manner while being feasible for operations as needed. However, if an operational want cannot be accomplished in a safe manner, it would need reconsidered. Finding a balance between operations and safety is of the utmost importance.

Risk level

Within the scope of frequency and severity, disease exposures are very frequent in that they occur every time an individual is exposed to another’s droplets. In fact, being that asymptomatic persons can be infectious, every single person is a potential exposure and the frequency of exposure is higher than any infectious disease since the Spanish Influenza of 1918.

Also, being that each exposure could become a conversion/confirmed case, the severity is very high. In fact, being that each conversion/confirmed case could possibly be fatal and that each confirmed case could mean exponentially more cases in society and increases the possibility that hospitals could be over capacity and without medical and protective equipment and that there is not currently a vaccine or valid and reliable treatment for the COVID 19, the severity is extremely high, more so than any infectious disease since the Spanish Influenza of 1918.

Risk level changes

Knowing the frequency and severity of COVID 19, there are two valid and reliable methods to reduce the risk of a COVID 19 outbreak and continuation of the pandemic: 

• Epidemiological data that the virus is not spreading.
• A vaccine.

With both risk reduction methods being currently unavailable, a valid and reliable medical treatment is also currently unavailable.

At this time, based on frequency and severity, the risk level for COVID 19 is very high due to high frequency of exposure (potentially each person) and high severity of exposure (potentially fatal). This will only be lowered by changes to frequencies of exposure or changes to severities of exposure.

The risk level can only change with a vaccine and/or epidemiological evidence validating that the risk level is lower. Furthermore, without valid and reliable data that the risk level is lower, continued exposures could continue to lead to emergency situations worldwide. Without exposure control at the employee level, continued exposures can continue to lead to public safety situations and infection control situations, all of which lead to emergency management situations and patient safety situations.

Risk management

In the case of infectious disease exposure and a pandemic, all risk areas apply. Because of this, due diligence in risk management aids in preventing losses regarding personnel safety and health, finances and organizational viability alike.

Risk areas

Strategic Risk – long-term ability to operate and/or survive. In the case of a pandemic, the strategic safety and health risk is a continued pandemic with continued outbreaks and continued personnel exposures with sickness and/or death; the strategic business risk is long-term disruption of business operations including solvency, employee losses, litigation and more. Additionally, without safety controls, otherwise community-based exposures to an infectious disease can be considered occupational disease exposures if employees are without safety controls at work.

Operational Risk – day-to-day operational risk. In the case of a pandemic, the operational risk is the inability to perform operations with safety and quality. For example, employees may be ill and unable to work or refuse to work without safety controls. Or, PPE or disinfectants may be difficult to obtain. There are many operational risks posed by infectious disease exposures.

External Risk – “imported” risk. External risk is often uncontrollable such as a natural disaster. In the case of a pandemic, the appearance of the disease in the United States was uncontrollable. However, now that there is knowledge of the virus, its transmission and the needs to prevent exposures to it, it’s difficult to claim an ‘uncontrollable’ risk.

Hazard Risk – risk that cause harm to people. “Occupational Disease Exposures,” or disease exposures during employee duties, is a workplace hazard. If there is reason to believe an employee could be exposed to the virus while performing organizational activities, hazard controls are needed to show due diligence in workplace safety. This is regulated under the General Duty Clause of the Occupational Safety and Health Act of 1970 and through individual applicable regulations related to specific hazard control options such as Respiratory Protection (29 CFR 1910.134), Personal Protective Equipment (29 CFR 1910.132) and more.

Risk treatments

For each risk area, risk treatments determine the way the organization will handle the risk.

Risk Acceptance – accepting the risk as is and whatever losses come with it. In the case of a pandemic, this means resuming operations without controls and the possibilities for disease exposures, personnel losses, regulatory noncompliance, litigation, insolvency and more.

Risk Avoidance – completing eliminating the risk, for better or worse. In the case of a pandemic, risk avoidance would mean not operating to avoid the risk of personnel contracting or transmitting the virus during organizational activities.

Risk Transfer – outsourcing the risk to another organization or individual. In the case of a pandemic, risk transfer would mean outsourcing or displacing operations. For example, if asking an employee to check others’ temperatures is deemed too risky, another could be contracted to perform the task. Or, if an organization’s location is deemed too risky, personnel could be asked to telecommute. They’d still be performing work in the course of their organizational activities, but the location risk would be transferred to the individual employee’s home.

Risk Control – acknowledging the risk but mitigating it to the lowest level possible. In the case of a pandemic, risk control is performing organizational activities but within safety protocols to show due diligence in preventing disease exposures.

For the risk treatment option(s) determined, the means of operationalization requires adherence to applicable safety protocols. Ultimately, this means that the organization can determine the level of risk it is comfortable with, but safety protocols must be developed according to that risk level. For example, if the organization wants to operate and have personnel come in to work, there must be safety protocols for them to do so safely and these protocols must be aligned with regulatory requirements.

In part two of this series, COVID 19 hazard controls will be covered.