Healthcare & Public Health

SECTION 01

Domain overview and system boundary

A health system should be bounded by the population it serves and the functions it must sustain. Mapping only hospitals misses prevention, primary care, laboratories, social care and informal support. For a flood case, the relevant unit may be a referral catchment connected by seasonally accessible routes. Identify where people normally seek help, who remains outside the records, and which minimum services must continue. This establishes the denominator against which continuity and recovery are judged; it also prevents installed infrastructure from being mistaken for effective access. [HEA01]

Healthcare and public health form an interdependent system of prevention, surveillance, primary care, referral, hospital care, rehabilitation and social support. A functioning building is only one part of this system: a service also needs a competent workforce, reliable utilities, usable information, medicines, transport, financing and public trust. Analysis therefore begins with a defined population and essential service, rather than with an undifferentiated national readiness score. The learning case may concern a flood-exposed referral network, pandemic surge, heat emergency or disruption of a shared digital provider. [HEA01] [HEA04]

The domain studies how service interruption can create irreversible losses even when infrastructure is later repaired. A missed time-sensitive service, a preventable infection, lost clinical records or prolonged exclusion from care cannot always be compensated by a later increase in capacity. Distribution matters: aggregate recovery can coexist with persistent harm among remote communities, disabled people, migrants, older adults or people with chronic conditions. The analytical objective is to identify mechanisms, observe deterioration early and preserve accountable choices before recovery options narrow. [HEA02] [HEA05]

Within the c-ECO learning architecture, P, ΔV, σ and Lr are analytical constructs requiring an explicit case specification. P must name the performance margin or failure event being assessed; ΔV describes its rate of change; σ represents identified uncertainty rather than general discomfort; and Lr concerns recoverability under stated resource and time constraints. None is a clinical triage score, a substitute for licensed professional judgment or an automatic legal authority. The case links these constructs to service continuity, population exposure and restoration evidence. [HEA03] [HEA06]

A domain label is not yet a case boundary. Separate the condition of a resource or asset from the function delivered to users. A nominally available installation may fail to deliver usable service, and a system-wide average can conceal localized loss. Preserve the original physical or institutional unit alongside any normalized representation. The boundary should make it possible to ask what enters, what changes, what leaves and who experiences the consequences.

Section readings [HEA01]

SECTION 02

Historical development and changing conditions

The history of health-system resilience reflects repeated encounters between emergency preparedness and weak everyday services. Epidemics reveal surveillance and trust deficits; financial crises reveal access and financing fragility; disasters expose physical and logistical dependencies. These histories do not justify importing a universal resilience index. Fellows should construct a timeline of institutional reforms, service expansion and previous disruptions for their own case, then ask which capacities were preserved between emergencies. An apparently successful surge may depend on postponed routine care whose costs become visible only later. [HEA06]

A historical baseline must be examined for changes in exposure, technology, operating practice and observation. Compare episodes using their mechanisms and evidence, rather than treating all events with a similar label as exchangeable observations. A reconstruction should show what was known at each time; later explanations should not be presented as information available to the original decision maker. Recovery and long-term change may require a separate timeline from the initiating incident.

Section readings [HEA06]

SECTION 03

Actors, institutions and decision responsibilities

Responsibility is distributed among ministries, local health authorities, providers, professional bodies, laboratories, emergency agencies and communities. Their mandates overlap but are not interchangeable. A case governance map should distinguish who observes a signal, validates it, authorizes a response, delivers services and reviews outcomes. WHO standards and international coordination do not give a training programme authority over local care. Record the applicable legal instrument, information-sharing permission and named accountable office for each handoff. A missing agreement can be as consequential as a missing piece of equipment. [HEA14]

Map actors by the function they perform and the responsibility they actually hold in the case. The same organization may observe a condition, supply a service and participate in a decision; those roles should remain distinguishable. Examine information access, resources, expertise, affected users and accountability together. A list of institution names is not an operating governance arrangement. Record the evidence for each responsibility and the process for resolving a disagreement or correcting a record.

Section readings [HEA14; C07]

SECTION 04

Primary systemic risks

Primary risks are failures in essential functions rather than a list of diseases. Service interruption can originate in workforce loss, utility failure, inadequate supply, inaccessible transport or demand beyond functional capacity. Distinguish the initiating hazard from the resulting failure: a flood is an event, while loss of referral access is a service mechanism. The risk inventory should name the affected population, minimum service, observation and consequence. This permits comparison across hospitals without assuming that identical bed counts or budgets imply identical exposure or capability. [HEA15]

The inventory is a structured set of research hypotheses. It separates a threatening condition from the mechanism of loss and from its consequences. The proposed TFP association indicates which question to investigate; it is not evidence that a particular indicator predicts the event. Risk importance depends on the defined function, exposure, duration and usable alternatives. Do not infer frequency, severity or priority from the position of a row in the table.

Section readings [HEA15]

SECTION 05

Amplification mechanisms and secondary risks

Secondary risks often arise from adaptations that preserve one function while weakening another. Redeploying staff can protect emergency care but interrupt chronic services; centralizing supplies can improve oversight while lengthening peripheral delivery routes. Document the tradeoff, affected group and expected duration rather than labelling all adaptation as resilience. Organizational analysis should examine communication, relationships and local decision space alongside material resources. A response remains provisional until monitoring shows whether its indirect burdens persist and whether those burdens fall disproportionately on already underserved populations. [HEA07]

An amplifier changes the consequences of an initiating condition without necessarily causing the initiating event. Useful counterfactuals hold the threat constant and vary concentration, maintenance, access, information or response capacity. Document the mechanism and the observation that would distinguish it from an alternative explanation. Several amplifiers may share the same upstream cause; counting each one as independent evidence exaggerates confidence.

Section readings [HEA07]

SECTION 06

Emerging risks and research horizons

Emerging risks require separation between plausible mechanisms and demonstrated local effects. AI-supported scheduling may alter access through biased training data or changing demand; a shared cloud provider may introduce correlated outages; climate change may modify seasonal disease and infrastructure stress. None should be assigned an invented probability simply because it is new. The useful output is a testable claim with an exposure pathway, observation plan and decision relevance. Where evidence remains sparse, document competing explanations and the information that would discriminate between them before deployment decisions. [HEA16]

A research horizon is tied to the time needed to investigate, prepare or change a system. It is not a date at which an emerging threat is predicted to occur. Record the reason for concern, the strength of evidence, the exposed function and the observation that would change the priority. Distinguish a newly observed mechanism from a known mechanism whose exposure, scale or institutional context is changing.

Section readings [HEA16]

SECTION 07

Cascades and cross-domain dependencies

Cascades can travel through referral, workforce, supply and information networks at different speeds. Closure of one hospital may reroute patients to another, while the same transport disruption delays supplies to both. A dependency graph should therefore distinguish patient-flow edges from commodity and information edges. Geographic proximity alone cannot represent the relevant coupling. Fellows can compare alternative network boundaries and examine whether a hub is substitutable under shared stress. The purpose is to identify pathways and bottlenecks, not to infer a complete epidemic forecast from a simple diagram. Temporal contact observations also show why aggregate maps can miss when and how people actually interact. [HEA10] [HEA11]

For each directed dependency, specify the function supplied, the destination, the propagation time and the substitute. Shared-cause failure, interacting threats and cascading propagation are different structures. A directed arrow becomes an explanatory claim only when the timing and mechanism are supported. Test apparent redundancy by removing the common access route, platform, energy supply or specialist on which both alternatives depend.

Section readings [HEA10; HEA11; C01; C02]

SECTION 08

Readiness and response protocols

An escalation protocol needs an observable trigger, an authorized recipient, a required acknowledgment and a review time. For example, a verified loss of a minimum service can initiate a coordination review even before a complete damage estimate is available. Clinical instructions and legally mandated emergency decisions remain with competent authorities. The educational exercise should instead test whether information reaches those authorities and whether essential services have a documented continuity option. Timestamp the first signal, confirmation, notification and decision so institutional delay can be distinguished from physical response time. [HEA08]

Preparedness connects a signal to a responsible actor, an available measure and a condition of completion. This learning architecture does not grant emergency command or operational authority to the c-ECO Institute or a course participant. A useful protocol distinguishes checking the signal, protecting exposed functions and verifying recovery. A paper plan contributes to usable capacity only when its relevant assumptions have been tested.

Section readings [HEA08]

SECTION 09

Scientific review and decision records

Independent review should challenge assumptions about capacity, population coverage and data completeness before a risk estimate guides institutional action. A hospital may report adequate beds while lacking the staff or utilities needed to use them. Reviewers should request the operational denominator and evidence supporting each claimed reserve. Separate the analysts who prepare the model from those who approve its intended use, and document relevant conflicts. The learning exercise can compare divergent reviewer interpretations and identify which additional observation would resolve a disagreement without asserting that consensus establishes empirical validity. [HEA03]

A review record separates observation, inference and decision. Record the data version, methods, alternative explanations, relevant expertise, conflicts of interest and unresolved disagreement. Review should be matched to the question and its consequences. Scientific analysis can inform a competent actor without replacing that actor’s mandate. No membership size, quorum or institutional power is established by this teaching library.

Section readings [HEA03; C05; C07]

SECTION 10

Communication and observation continuity

Risk communication is part of the service system because people use information to decide where and when to seek help. An accurate message can still fail if it is inaccessible, delayed or issued through an untrusted channel. Communication plans should specify languages, disability access, offline routes and a mechanism for reporting misunderstanding. They should also state what remains uncertain and when the next update is due. During digital outages, loss of institutional email should not silently sever coordination; tested alternative channels and clear responsibility for reconciliation are essential. [HEA18]

Continuity of observation should be tested alongside continuity of the function itself. Losing data may increase uncertainty before the physical process visibly changes. Redundancy must be demonstrated against common causes, including power, location, communications, credentials and specialist availability. During disconnected operation, preserve the last reliable observation, record the uncertainty that follows and reconcile timestamps and authorship when information paths return.

Section readings [HEA18; C01]

SECTION 11

International instruments and technical references

International health instruments establish duties and cooperation processes that require jurisdiction-specific interpretation. The International Health Regulations address public-health capacities and international reporting; they do not replace domestic professional licensing, privacy law or emergency mandates. Use the consolidated amended text and verify the position applicable to the country in the case. A legal matrix should identify the relevant provision, responsible authority, triggering circumstance and domestic implementation instrument. This gives fellows a disciplined way to distinguish a technical recommendation, an institutional procedure and a binding obligation. [HEA14]

Classify each instrument before using it. A scholarly article supports an inference, a technical guide describes a method, a standard has a defined scope, and a legal instrument may create obligations only where applicable. The case record should identify the specific provision or method, its version and the activity to which it relates. A source’s institutional reputation cannot by itself establish applicability or demonstrate compliance.

Section readings [HEA14]

SECTION 12

Jurisdiction-specific responsibilities and requirements

National and local rules determine facility licensing, disease reporting, health-worker responsibilities, procurement and access to personal data. The analysis should begin with authoritative consolidated texts and a qualified local review rather than assumptions imported from another country. Cross-border projects need separate columns for each jurisdiction. A data field useful for research may require additional safeguards before operational sharing. Record purpose, minimum necessary data, access permissions and retention obligations. Governance quality is demonstrated by a workable and accountable arrangement, not by collecting the largest possible dataset. [HEA03]

The register should cover the actual activity and location, including interfaces between organizations and jurisdictions. Separate responsibility for observing, supervising, deciding and executing. Retain the official source, version consulted and evidence needed to assess a condition. Conflicting definitions and overlapping mandates are analytical findings to investigate. A general library cannot create a universal legal threshold for all settings.

Section readings [HEA03]

SECTION 13

Causation, accountability and cascading consequences

Responsibility for an adverse outcome cannot be inferred solely from a model score. Clinical care, facility management, public-health action and infrastructure maintenance involve different duties and standards of evidence. For educational analysis, construct a chronology of decisions, information available at each time and documented responsibilities. Avoid hindsight reasoning that treats later knowledge as available to earlier actors. The systems approach directs attention to latent organizational conditions and failed defenses while retaining individual accountability where the evidence supports it. A learning review and a legal determination have different purposes. [HEA12]

A technical chain of consequences is not automatically a legal allocation of liability. Separate evidence of causation from the duties, control and decisions relevant to each actor. A case may contain direct damage, dependent service interruption and persistent environmental or social consequences on different timescales. The analysis should show which links are documented and which need further investigation, without presuming an institutional restoration fund, mandatory levy or insurance mechanism.

Section readings [HEA12]

SECTION 14

Cross-boundary coordination

Health risks cross borders through mobility, supply chains, environmental exposure and information systems. A border-based map can obscure the actual referral network or the shared supplier connecting distant facilities. International collaboration requires agreed definitions and authorized information exchange, especially when personal data are involved. Compare aggregated indicators before considering record-level linkage and state what cannot be compared because ascertainment differs. A regional platform should preserve provenance and local responsibility rather than create an appearance of centralized authority over services that remain governed by national institutions. [HEA10]

Processes and dependencies often cross administrative, organizational or national boundaries. Coordination requires compatible definitions, useful timing, authorized exchange and an identifiable decision interface. Sharing data does not by itself resolve disagreements over objectives, risk allocation or resources. An exercise should expose which decision can be coordinated under existing arrangements and which would require an additional agreement or competent determination.

Section readings [HEA10; C07]

SECTION 15

Position (P): candidate observations

To operationalize P, first specify whether the object is a service margin, exposure indicator or estimated failure probability. A ratio of available capacity to demand is not automatically a probability. For emergency services, distinguish installed, staffed and currently functional capacity; then examine the distribution of waiting times and unmet referrals. A single national average can conceal a peripheral breakdown. The specification must state orientation, units, population and time window before aggregation. This enables reviewers to identify whether an apparent improvement reflects real service restoration or a reduced reporting denominator. [HEA02]

P represents position relative to a specified loss of function. The raw observation, reference condition, direction of deterioration and boundary of failure must remain explicit. A candidate monotone transformation can help compare states within a defined case, but it does not establish the threshold or validate an aggregate index. Capacity, delivered performance and exposure may require different indicators even when they concern the same installation.

A didactic monotone transformation for an indicator that worsens as it rises is p = clip[(x − x_ref)/(x_failure − x_ref), 0, 1]. Reverse the direction for a reserve that deteriorates as it falls. The expression makes the reference points visible; it does not choose those points, prove comparability or establish an operational aggregate. Retain x in its original unit and justify the function separately for each case.

Section readings [HEA02]

SECTION 16

Velocity (ΔV): rates and trajectory

ΔV concerns change in a defined observable over an explicit interval. Queue growth, stock drawdown and rising staff absence describe different processes and cannot be added in their native units. Estimate trends using stable definitions and retain uncertainty from reporting delays. A falling reported case count may reflect reduced testing rather than slower transmission. Compare raw observations with delay-adjusted estimates, and state how revisions enter the record. The most useful rate is often the one that can be compared with the time needed to mobilize an effective response. [HEA09]

ΔV describes direction and rate of change over a declared interval. Two systems at the same apparent position may have different reaction times because their trajectories differ. Compare rates using consistent units, observation windows and reference systems. Check seasonality, missing periods, reporting changes and process acceleration before extrapolating. A time-to-boundary calculation is conditional on its trajectory assumption; it is not a general forecast.

Section readings [HEA09]

SECTION 17

Uncertainty (σ): evidence and model limits

Uncertainty has identifiable sources: incomplete ascertainment, delayed reporting, inconsistent case definitions, uncertain population denominators and model assumptions. These sources should be recorded separately because they require different remedies. More simulations cannot correct a systematically excluded population. During an emerging outbreak, cohort studies, representative sampling and linked observation designs answer different questions; convenience clinical data alone may not identify population severity. Fellows should build an uncertainty register connecting each unknown to its potential decision effect, an observation strategy and the date when the assumption will be reconsidered. [HEA13]

Uncertainty should be recorded by object and source. Measurement uncertainty, sampling limitations, parameter uncertainty, model structure, future scenarios and institutional ambiguity cannot be replaced by one unsupported percentage. More simulation samples can reduce numerical sampling error without resolving a missing mechanism. Identify which uncertainty changes the decision and which further observation, comparison or test could reduce it.

Section readings [HEA13; C06]

SECTION 18

Reversibility liquidity (Lr): usable recovery resources

Recoverability depends on a functioning sequence of resources rather than nominal stock. Oxygen supply, for example, requires qualified production, reliable power, suitable distribution, competent staff and accessible receiving facilities. A reserve that cannot reach the service point before interruption provides little practical margin. Lr should therefore describe the restoration objective, available resource, mobilization time and dependencies. Use documented exercises or events to test these claims. Assess sustainable recovery over repeated days, since an initial surge supported by exhausted staff can conceal a second deterioration in service capability. [HEA19]

Lr examines resources that can preserve, contain or recover the defined function within the relevant time. A resource listed in an inventory is different from a resource that is accessible, compatible, staffed and mobilizable. Record capacity, useful arrival time, duration, dependencies and evidence of testing. Avoid averaging away an essential bottleneck. Recovery of a service does not necessarily restore ecological condition, accumulated losses or public trust.

Section readings [HEA19]

SECTION 19

Stress scenarios and comparative strategies

Scenario design should connect a hazard to demand, capacity and distributional consequences. Compare at least a demand-only surge, a utility outage and a compound scenario affecting both. Keep baseline staffing, population and time horizon explicit so differences can be attributed to changed assumptions. A scenario is a structured question about plausible mechanisms, not a prediction. Include a scenario in which the central hospital remains open but peripheral transport fails; this reveals access losses that a facility-only assessment misses. Specify which evidence would make the scenario less plausible or more urgent. [HEA16]

A stress scenario states the initiating condition, prior state, time sequence, exposed function, shared dependencies and feasible responses. Its purpose is to reveal when a strategy loses usefulness and why. Compare alternatives across several conditions, including absent substitutes and simultaneous demand. Scenarios should lead to observations, tests and resource questions; assigning a precise event probability requires a separate justified model and evidence.

Section readings [HEA16]

SECTION 20

Reproducible simulation and sensitivity analysis

A health-service simulation can represent arrivals, service completion, referral delays and supply replenishment without reproducing clinical decisions. Discrete-event models are appropriate for queues; transmission models address different questions and require different data. Validate each component against withheld observations where possible, and compare a simpler model before adding detail. Correlated disruptions matter: simultaneous staff absence and demand growth should not be sampled independently without justification. Report ranges of service outcomes, sensitivity to assumptions and model inadequacies; do not present precise outputs as a validated operational instruction. [HEA09]

Simulation is an explicit transformation of assumptions. Input distributions, dependencies, parameter estimation, output definition and testing must be documented. Numerical convergence does not establish model validity. Examine sensitivity to the function used, the weights selected, dependence assumptions and conditions outside the fitting data. The reproducible laboratory below is a synthetic exercise, separated from SPS and from any claim about real-event frequency.

The factor loadings define association on the latent scale. Correlations after the nonlinear transform should be estimated from the simulated samples. Q is a teaching index and is not SPS. Its exceedance fraction concerns the generated sample under these assumptions; it is not the probability of a real event or a forecast over a stated number of years. A temporal forecast would require a separately specified process and observation model.

from random import Random
from math import log, exp, sqrt
from statistics import mean
rng = Random(1511918917)
m = [.72, .62, .40, .38]
s = [.40, .45, .30, .40]
a = [.65, .55, .35, -.45]
q = []
for _ in range(10000):
    g = rng.gauss(0, 1)
    x = []
    for mj, sj, aj in zip(m, s, a):
        z = aj*g + sqrt(1-aj*aj)*rng.gauss(0, 1)
        x.append(1/(1+exp(-(log(mj/(1-mj))+sj*z))))
    p, v, u, lr = x
    q.append(.35*p+.25*v+.15*u+.25*(1-lr))
q.sort()
print(mean(q), q[499], (q[4999]+q[5000])/2, q[9499])
print(sum(x >= .70 for x in q)/len(q))

Sensitivity exercise: remove the common factor, vary one dispersion, change the weight of recovery resources, and compare the ranking of the selected strategies. Then state which domain observations would be needed to replace each illustrative assumption. Use a suitable estimator when inputs are dependent; the common-factor experiment is a dependence check, not a claim that a particular Sobol estimator applies unchanged.

Section readings [HEA09; C03; C06]

SECTION 21

Restoration and performance verification

Restoration simulation should measure whether essential functions return for the affected population. Reopening a building does not establish safe water, information continuity, accessible transport or sustainable staffing. Define a minimum service bundle and verify its components at each proposed recovery stage. A staged model can reveal that restoring one dependency produces little benefit until another bottleneck is removed. Compare restoration sequences under the same resource constraints, including the effect on peripheral and vulnerable groups. The educational deliverable is a reasoned restoration argument with evidence requirements, not an unqualified claim of resilience. [HEA15]

Restoration follows prerequisites and verification conditions rather than a universal fixed clock. Tasks may proceed in parallel only where they do not compete for the same people, access, equipment or information. Protect essential functions while the critical path is addressed. Define what is measured before returning service, who can make that determination and which effects require continued observation after a technical restart.

Section readings [HEA15]

SECTION 22

Recovery provider capability

Qualification of recovery providers should be based on task-relevant competence, legal authorization, availability and demonstrated performance. A supplier's ordinary capacity may be committed elsewhere during a regional emergency. Verify the service specification, quality assurance, mobilization conditions and dependencies before treating a contract as usable reserve. For clinical work, professional credentials and local authorization require competent institutional checks. For technical support, test compatibility and handover requirements. An academic affiliation alone does not demonstrate the capability to restore a hospital service under the conditions represented in the case. [HEA07]

Capability assessment must be specific to the task, place and stress conditions. A training certificate cannot demonstrate that a team can mobilize and deliver the required function. Inspect competence, safety, compatibility, relevant experience and actual availability. Define the verification method and limits of recognition. This teaching library does not establish a c-ECO provider certification scheme or substitute for professional or regulatory requirements.

Section readings [HEA07]

SECTION 23

Recovery sequencing and time constraints

The recovery sequence should distinguish stabilization, minimum-service restoration, backlog management and long-term rehabilitation. Returning throughput to its previous level may leave accumulated unmet need unresolved. Record which services were deferred, which populations lost continuity and how those losses will be followed. Restoration acceptance must include quality as well as volume. In a referral network, compare the time when facilities become operational with the time when patients can actually reach them. A recovery plan is incomplete if it reports central capacity while ignoring persistent service gaps outside the main facility. [HEA05]

A recovery time objective is a decision criterion to test against real capacity. Distinguish mobilization, work, verification and decision time, and identify dependencies between tasks. Shared resources can prevent apparently parallel activities from proceeding together. Repeating the sequence with unavailable access, a specialist or a verification service reveals where a target relies on an untested assumption.

Section readings [HEA05]

SECTION 24

Equipment, inputs and replenishment

An inventory becomes analytically useful when quantities are connected to usable function. Product identity, quality status, expiry, storage conditions and location affect whether a nominal stock can support care. Track replenishment lead time and qualified substitution rather than only purchase value. Demand-based stock cover should be recalculated when service demand changes; a fixed number of days based on ordinary consumption can misstate surge reserve. Keep physical verification separate from administrative balances and preserve the timestamp of each update so decision-makers can see whether the inventory is current. [HEA19]

Inventory analysis connects each item to a protected function. Use condition, compatibility, accessibility and consumption under stress rather than a nominal stock count alone. Replenishment time must include procurement, transport, installation and verification where relevant. A substitute that depends on the same supplier or platform may disappear in the same event. Keep the last inspection date and the evidence supporting usable availability.

Section readings [HEA19]

SECTION 25

Mutual aid and cooperation arrangements

Mutual aid can shift capacity between institutions but cannot create unlimited regional reserve. Agreements should specify what can be provided, under which authority, for how long and with what reimbursement or return conditions where applicable. A joint emergency may disable both requesting and supplying organizations. Test mutual aid with a common-cause scenario and include workforce, transport and receiving capability. The institutional exercise should record acknowledgment and mobilization delays, not just signed agreements. Reciprocal support is most credible when it is periodically exercised and its competing commitments are visible. [HEA06]

Cooperation contributes to recovery when its scope, activation, resources and practical availability are demonstrated. Record who requests support, who authorizes it, the useful arrival time, responsibility for the work and conditions of return. Consider simultaneous demand across participants. A reference to an organization or network in the literature does not imply that c-ECO or a case partner has joined it or secured a deployment commitment.

Section readings [HEA06]

SECTION 26

Source classification and evidence quality

Source classification should distinguish the organization producing a dataset from the evidentiary status of a particular claim. A ministry's administrative series, a hospital incident log and a research survey serve different purposes and may share the same original records. Rank neither solely by institutional prestige. Record definitions, sampling, completeness, revision policy and intended use for each product. A field observation may detect a local failure earlier than a national dashboard while still requiring verification. The classification supports appropriate interpretation and review; it should not automatically convert a reported signal into validated evidence. [HEA08]

Source classes organize origin and function; they do not form an automatic hierarchy of evidential strength. An official statistic, an operational record and a causal study answer different questions. Classify the product, not only the organization. Detect shared data origins so that a dashboard, article and secondary report based on one observation are not counted as three independent confirmations.

Section readings [HEA08; C04; C05]

SECTION 27

Institutional, regulatory and technical sources

Intergovernmental and regulatory sources provide legal texts, surveillance standards, comparative statistics and technical guidance. They are strongest when the analyst preserves the document version and distinguishes normative recommendations from empirical measurements. WHO's Hospital Safety Index, for example, organizes multidisciplinary assessment; its use does not prove that a particular facility will remain functional in every event. For the case, identify exactly which guide supports a definition, which dataset supports an observation and which local authority is responsible for implementation. This makes the evidence chain inspectable rather than merely authoritative in appearance. [HEA15]

Institutional sources should be selected by product, method and scale. Record whether the source defines a requirement, observes a condition, reports an investigation or synthesizes a literature. A current portal may contain several editions and methods; cite the actual version used. Public access does not establish accuracy for a different question, and a restricted source can still be used only under its authorized conditions.

Section readings [HEA15]

SECTION 28

Operational observations and monitoring products

Operational sources include dispatch logs, stock records, utility interruptions, staffing rosters and service cancellation registers. Their proximity to operations is valuable, but records may be incomplete precisely when the system is most stressed. Define the expected reporting process and investigate missingness around outages. Reconcile records through approved institutional procedures and avoid exposing personal details in public learning materials. A provider's self-reported recovery time should be accompanied by the criterion used to declare recovery. Whenever possible, compare administrative claims with independently observed service availability and population access. [HEA18]

Operational observations should show what the system delivered, not merely that an asset was declared available. Inspect the acquisition process, sensor or reporting changes, gaps, coverage and quality controls. Compare records with independent observations where feasible. Aggregated performance, a status dashboard and user experience can diverge because they concern different units, locations, periods or definitions of availability.

Section readings [HEA18]

SECTION 29

Academic research and independent evidence

Academic and community sources can reveal mechanisms and experiences absent from routine reporting. Peer review improves scrutiny but does not establish transferability to every setting. Examine study design, population, measurement and uncertainty before applying findings. Community reports should be documented with consent, context and an appropriate verification route; they can identify exclusion that official denominators miss. For comparative learning, retain disagreements rather than silently averaging incompatible evidence. The objective is a defensible account of who was served, who remained outside the system and which explanation best fits the observed service pattern. [HEA02]

Read the research design before transferring a conclusion. Identify the question, unit of analysis, method, comparison, result, limitations and conditions that matter for the case. Foundational concepts, empirical studies, critical replications and technical syntheses serve different functions. A literature-supported mechanism may justify a hypothesis without validating a local threshold, forecasting performance or a complete TFP application.

Section readings [HEA02]

SECTION 30

Source–variable correspondence

A source-to-variable map should explain the transformation from observation to analytical construct. Staffing rosters measure scheduled availability, not necessarily competent staff present; a facility registry measures listed infrastructure, not current function. Record the transformation, assumptions, geographic support and update frequency for each indicator. If several variables depend on the same log, their apparent agreement may not provide independent confirmation. The map should also identify which variables require field validation. A transparent calculation with a weak denominator is still weak evidence, even when its software implementation is correct. [HEA04]

The source–variable matrix exposes the path from an observation to an analytical representation. Preserve the raw unit, time, location, method, transformation and uncertainty. Multiple derived variables may share one observation and therefore share its limitations. Record the code or reproducible procedure, authorized access and version. A score should remain inspectable through its originating evidence rather than replacing that evidence.

Section readings [HEA04; C04; C05]

SECTION 31

Source–risk correspondence

A source-to-risk map asks whether the available observation can detect a named mechanism early enough to matter. A national mortality series may document consequences but offer little local operational lead time. Dispatch delays may reveal referral stress earlier, although they cover only people who reach dispatch. For each risk, identify at least one leading observation, one consequence measure and one independent corroboration route where feasible. State the population excluded by each source. This prevents a data-rich dashboard from creating false confidence about risks its measurement system cannot actually observe. [HEA13]

A source–risk matrix should cover the threat, the observed state, the mechanism and the consequences separately. Evidence that an event occurred does not alone show why a function failed or who was affected. Use a chronology and alternative explanations to test the chain. A citation becomes useful when the specific part of the claim it supports and its limits are visible.

Section readings [HEA13]

SECTION 32

Monitoring gaps and research priorities

Monitoring gaps should be prioritized by their effect on decisions. Missing timestamps prevent delay analysis; missing catchment data prevent access estimates; absent subgroup identifiers can conceal unequal recovery. Collecting every possible field is neither necessary nor appropriate. Choose the smallest additional observation that materially changes a decision and can be gathered lawfully and reliably. Record whether the gap concerns coverage, quality, latency or interpretation. A useful exercise asks how the preferred response changes when the missing population experiences twice the interruption assumed in the main analysis, without treating that assumption as a measured fact. [HEA03]

Prioritize a gap by its consequence for the decision. The next observation may be a targeted measurement, an independent comparison, a capability test or a correction of incompatible definitions. More data of the same kind may not resolve structural uncertainty. Specify the question, required observation, responsible custodian, time of collection and condition under which the gap is considered sufficiently addressed.

Section readings [HEA03; C03]

SECTION 33

Dependency matrix and propagation tests

The dependency matrix should distinguish direction, mechanism and evidence. Health services consume energy and water, but they also support recovery in other sectors through occupational health and emergency care. Edges can change during an incident as facilities reroute patients or suppliers substitute routes. Version the graph and identify which links are observed, inferred or hypothetical. Shared suppliers and regional infrastructure create correlated failures that simple pairwise scores may miss. Use the matrix to structure scenario questions and validation priorities rather than multiplying uncalibrated weights into an apparently precise national risk score. [HEA10]

A dependency matrix should be directional and time-specific. Record the supplying function, receiving function, mechanism, useful delay, substitute and evidence. Test the destination when the origin becomes unavailable for different periods. Then remove a common prerequisite of the substitute. The resulting structure describes the case; it does not establish all connections in a global architecture or validate an edge weight.

For each relationship, add the measured delay, duration of tolerable interruption, substitute and observation supporting the directed edge. Repeat the test for short, intermediate and extended unavailability. A generic list of linked sectors is not an estimated network, and no edge weight is validated by inclusion in this table.

Section readings [HEA10; C01; C02]

SECTION 34

Documented cases, near misses and recovery

Historical cases should be compared through common questions: what failed, which dependencies amplified the event, what information existed and how recovery was verified. The six cases here span epidemic response, cyber disruption, extreme weather and supply-chain surge. They are not interchangeable demonstrations of a universal model. Hurricane Maria emphasizes operational function after physical damage, while WannaCry emphasizes continuity under information loss. Compare the decision pathways and evidence quality, and retain the original case context. Avoid unsupported casualty figures or attributing an outcome to a single mechanism when the investigation describes interacting causes. [HEA20] [HEA21]

Historical analysis distinguishes observed loss, protective response, near miss and recovery. Several records can concern one event without becoming independent events. Preserve what the source actually investigated and avoid adding unsupported casualty, cost or restoration-time estimates. Compare cases by mechanism and evidence quality; the fact that one response was associated with an outcome does not alone establish a general causal effect.

Section readings [HEA20; HEA21]

SECTION 35

Integrated review, transfer and learning portfolio

Cross-domain evidence is essential because demand and service capacity are shaped outside health institutions. Heat forecasts, flood accessibility, electricity reliability, household income and digital availability can all alter the case. They require different spatial and temporal resolutions; linking them by a shared place name alone is insufficient. Document the alignment method, uncertainty and plausible causal pathway. The final learning product should connect these observations to a defined service decision, explain alternatives and identify the evidence required for review. Its credibility comes from this traceable reasoning, not from the number of sources displayed. [HEA16] [HEA22]

The integrated portfolio should allow a reviewer to move from the question to observations, transformations, mechanism tests, scenarios and proposed monitoring. Make the strongest competing explanation and the most consequential unresolved gap visible. Transfer requires checking mechanisms, exposure and recovery resources in the new setting. Formation, optional credentialing, submission permission and licensing remain distinct processes; no case or data contribution enters the SIL without an associated fellow and applicable review.

Section readings [HEA16; HEA22; C04; C05]