v»EPA United States Environmental Protection Agency Guidance for Responding to Drinking Water Contamination Incidents Office of Water (MC 140) EPA 817-B-18-005 October 2018 ------- Disclaimer The Water Security Division of the Office of Ground Water and Drinking Water has reviewed and approved this document for publication. This document does not impose legally binding requirements on any party. The information in this document is intended solely to recommend or suggest and does not imply any requirements. Neither the U.S. Government nor any of its employees, contractors or their employees make any warranty, expressed or implied, or assume any legal liability or responsibility for any third party's use of any information, product, or process discussed in this document, or represent that its use by such party would not infringe on privately owned rights. Mention of trade names or commercial products does not constitute endorsement or recommendation for use. Questions concerning this document should be addressed to WQ SRS@epa.gov or the following contact: William E. Platten III, Ph.D. EPA Water Security Division 26 West Martin Luther King Drive Mail Code 140 Cincinnati, OH 45268 (513) 569-7148 Platten. W illiam@,epa. gov ------- Acknowledgements EPA's Water Security Division developed this document with additional support provided under EPA contract EP-C-15-012. The following individuals contributed to the development of this document: • Steve Allgeier, EPA, Water Security Division • Jeff Fencil, EPA, Water Security Division • Brian Pickard, EPA, Water Security Division • William E. Platten III, EPA, Water Security Division Peer review of this document was provided by the following individuals: • Todd Anderson, Jacobs • Gary Burlingame, Philadelphia Water Department • Elizabeth Hedrick, EPA, Water Security Division • John Laws, Department of Homeland Security • Tom Noble, Horsley Witten Group • Johnathan Reeves, DC Water • Drew Saskowitz, Southeast Morris County Municipal Utilities Authority • Maureen Schmelling, DC Water • Shannon Spence, Prince William County Service Authority • John Strine, The York Water Company • Jeremiah York, City of Lebanon Water System ------- Table of Contents List of Figures iv List of Tables v Abbreviations vi Section 1: Introduction 1 Section 2: Contamination Incident Response Overview 3 2.1 Distribution System Contamination Response Procedure 3 2.2 Integration into Emergency Response Plan 4 Section 3: Contamination Incident Response Fundamentals 5 3.1 Phases of a Contamination Incident Response 6 3.2 Confidence and Impact Evaluation 7 3.3 Investigation Activities 9 3.4 Response Activities 11 3.5 Remediation and Recovery Activities 14 Section 4: Incident Management and Communication 16 4.1 Incident Command System 16 4.2 Response Partners 17 4.3 Communication Equipment and Methods 18 4.4 Information Management 19 Section 5: Training and Exercises 20 5.1 Implementation through Training and Exercises 20 Section 6: Developing a Response Procedure 25 Section 7: Resources 26 Section 8: References 28 Glossary 29 ------- List of Figures Figure 1-1. Document Roadmap 2 Figure 2-1. Conceptual Overview of Contamination Response Activities 3 Figure 2-2. Relationship between a Utility ERP and DSCRP 4 Figure 3-1. Overview of a Contamination Incident Response 5 Figure 5-1. Types and Examples of Trainings and Exercises of Varying Complexity and Resource Requirements 21 Figure 6-1. Steps for Developing a DSCRP 25 iv ------- List of Tables Table 3-1. Example List of Information Sources Useful during an Investigation 9 Table 4-1. Typical Roles and Responsibilities for Implementing a DSCRP 18 Table 5-1. Examples of Discussion-based Exercises to Support Implementation of a DSCRP 22 Table 5-2. Examples of Operations-based Exercises to Support Implementation of a DSCRP 23 v ------- Abbreviations AAR/IP After-Action Report/Improvement Plan CDC Centers for Disease Control and Prevention CFR Code of Federal Regulations DHS Department of Homeland Security DSCRP Distribution System Contamination Response Procedure EPA United States Environmental Protection Agency ERP Emergency Response Plan HazMat Hazardous Materials Unit HSEEP Department of Homeland Security's Homeland Security Exercise and Evaluation Program FBI Federal Bureau of Investigation FEMA Federal Emergency Management Agency ICS Incident Command System LIMS Laboratory Information Management System NIMS National Incident Management System NRF National Response Framework PIO Public Information Officer RAP Remediation Action Plan RCP Risk Communication Plan SAP Sampling and Analysis Plan SCADA Supervisory Control and Data Acquisition SC&SP Site Characterization and Sampling Plan WARN Water/Waste water Agency Response Network WSI Water Security Initiative ------- Guidance for Responding to Drinking Water Contamination Incidents Section 1: Introduction The United States Environmental Protection Agency (EPA) developed this guidance for drinking water utilities and their response partners to help them prepare for responding to incidents of contamination in the distribution system. It provides a framework for responding to distribution system contamination incidents, discusses the fundamental concepts of consequence management, highlights the need for coordinating efforts with local, state, regional, and federal response partners, and describes the use of training and exercises for learning and improving response procedures. The overall goal of this guidance is to assist utilities with planning and creating a contamination incident response procedure that supplements a utility's Emergency Response Plan. The concepts presented in this guidance were developed and refined by EPA in collaboration with five large drinking water utilities1 and their response partners through the Water Security Initiative (WSI) Contamination Warning System Pilot Program (EPA, 2015). This guidance is reflective of the way the concepts were implemented during these pilots. Tips, success stories, and lessons learned from the utility experiences are also highlighted throughout this guidance. The concepts presented in this document are applicable and scalable to utilities of all sizes. However, the degree to which the various responses and decisions are performed by a utility will vary based on utility resources and size. Most utilities, especially smaller utilities, will need to rely on relationships with other utilities, response partners, and their primacy agency to accomplish some or most of the activities required during a contamination incident. Utilities should determine which activities they will perform internally and establish contracts or mutual-aid agreements with their response partners to perform the remaining activities. The Document Roadmap in Figure 1-1 can be used to quickly navigate and explore the topics covered in this document. Selecting one of the topics will navigate to the desired section. When finished, selecting the section header will return to the Roadmap. Template A template for the response procedure aligned with the recommendations presented in this guidance is available in Section 6: Developing a Response Procedure. ^ Referred to in this document as the WSI pilot utilities. 1 ------- Guidance for Responding to Drinking Water Contamination Incidents Response Distribution System Contamination Integration into Emergency Response Procedure Response Plan Contamination Incident Response Fundamentals Phases of a Contamination Incident Response Confidence and Impact Evaluation LLI CC a Ui u o CC CL UJ CO Investigation Activities Gather and Review Available Information Site Characterization, Sampling, and Analysis Response Activities Operational Response Risk Communication / Public Notification Remediation and Recovery Activities Characterization for Remediation Decontamination o CL UI Issuing Use Restrictions Clearance Incident Management and Communication Incident Command System Communication Equipment and Methods Response Partners Information Management Training and Exercises Implementation through Training and Exercises Discussion-Based Exercises Operations-Based Exercises Developing a Response Procedure Figure 1-1. Document Roadmap 2 ------- Guidance for Responding to Drinking Water Contamination Incidents Section 2: Contamination Incident Response Overview Drinking water contamination can result in a number of adverse consequences to the public and the distribution system. Preparing a response procedure for such an occurrence enables a utility to effectively manage the incident to limit these consequences, providing a decision-making framework for implementing activities that, ultimately, returns the system to normal operations. 2.1 Distribution System Contamination Response Procedure Distribution system contamination can occur under a variety of circumstances, including natural, accidental, and intentional causes (EPA, 2005). Regardless of cause, contamination incidents require a measured, yet appropriate response to fully address the potential contamination and protect public health while not over-responding, wasting resources, and causing undue alann to customers. The Distribution System Contamination Response Procedure (DSCRP) serves as a utility's guide for the investigation of, response to, and recovery from drinking water contamination incidents. These activities, outlined in Figure 2-1, are intended to minimize response and recovery timelines through a pre-planned, coordinated effort. Activities are initiated upon identification of an indicator of water contamination to: (1) investigate the credibility of the indicator, (2) minimize public health and economic consequences through operational responses and notifications, and (3) guide remediation and recovery efforts to ultimately return a utility to normal operations. The DSCRP relies upon extensive planning efforts to: • Establish clear roles and responsibilities within the water utility and with local, state, and federal response organizations • Outline the protocols for investigating the contamination incident • Identify potential operational response actions • Develop strategies for communicating with the public • Prepare for remediation and recovery Investigation Operational Responses and Notifications Remediation and Recovery Check other indicators Assess other data sources Site characterization and sampling Field and laboratory analysis Isolation Flushing / disinfection Risk communication Use restrictions System / contaminant characterization Remediation planning Decontamination Clearance Figure 2-1. Conceptual Overview of Contamination Response Activities 3 ------- Guidance for Responding to Drinking Water Contamination Incidents 2.2 Integration into Emergency Response Plan A DSCRP is an annex or appendix in a utility 's overall Emergency Response Plan (ERP), focusing on the incident-specific procedures for response to and recovery from a drinking water contamination incident. Figure 2-2 outlines the relationship between an ERP and a DSCRP. Water Utility Emergency Response Plan Risk Communication Plan System-Specific Information Roles and Responsibilities Core Response Procedures (e.g., alternate water, sampling, safety) Incident-Specific Response Procedures Communication Procedures Natural Disaster Response Procedure (e.g., flood, earthquake) Emergency Water Main Break Response Procedure Fire-flow Response Procedure Distribution System Contamination Response Procedure Source Water Contamination Response Procedure Figure 2-2. Relationship between a Utility ERP and DSCRP In general, an ERP covers overarching response needs, such as general roles and responsibilities, detailed system information, and core response procedures (e.g., alternate water services, safety). These overarching response considerations apply regardless of the type of incident. Incident-specific response procedures are developed as supplements to an ERP. These procedures may include details for responding to natural disasters (e.g., hurricanes, earthquakes) or water main breaks. A DSCRP is an incident-specific response procedure that contains the specific, detailed response processes for a drinking water contamination incident. Unlike other incident response procedures, a DSCRP includes an investigation process to determine whether or not contamination has actually occurred. Specific response activities are implemented incrementally, alongside the investigation, as more information (e.g., identity of the contaminant, extent of contamination, impact on customers) is discovered through investigative activities. The inherent lack of information, particularly in the early stages of the incident, necessitates a cycle of discovery and response until contamination can be confirmed and the extent of the contamination can be fully characterized. Planning in advance for the investigation activities (e.g., data collection, sampling, analysis) as well as the response activities (e.g., operational changes and communication with stakeholders and the public) can accelerate the decision-making process during an incident. Developing an ERP Learn more about planning for emergencies and creating an ERP for your utility at EPA's Water Utility Response website. 4 ------- Guidance for Responding to Drinking Water Contamination Incidents Section 3: Contamination Incident Response Fundamentals The DSCRP focuses on the activities to perform during a water contamination incident and the steps that a utility can take to prepare for those activities. Figure 3-1 provides an illustration of the major decision- points and activities that occur during an incident. A utility's DSCRP should cover each of these topics, providing responders with a decision-framework and the necessary supporting information to select and implement the appropriate activities for a given situation. Validated Indicator of Water Contamination I r Initiate Investigation and Response Phase Gather and Review Available Information Evaluate Initial Findings Contamination is Suspected Contamination is Ruled Out Investigation and Response Activities Site Characterization, Sampling, and Analysis Operational Responses Risk Communication/ Public Notification Contamination is Ruled Out Evaluate Response Actions Contamination is Confirmed Initiate Remediation and Recovery Phase Remediation and Recovery Activities 1/1 < x CL o Q. 1/1 LU CC O < V3 i/i LU > 1/1 < X CL > CC LU > o u LU CC O Operational Responses Characterization Decontamination Risk Communication/ Public Notification < 0 Clearance Figure 3-1. Overview of a Contamination Incident Response 5 ------- Guidance for Responding to Drinking Water Contamination Incidents 3.1 Phases of a Contamination Incident Response r~ As Figure 3-1 illustrates, an incident begins with the discovery and validation of an indicator of water contamination (sqq Important Definition callout box). In general, an incident is investigated to determine the credibility of the suspected contamination incident while performing response activities to reduce potential consequences. The scope and significance of these activities increase as the credibility of the contamination increases. Once contamination has been confirmed, the investigation ends and the incident transitions to remediation and recovery. The DSCRP should include sections to address these two phases of the incident response. V Important Definition An indicator of water contamination is anything that could suggest the presence of contamination in the drinking water (e.g., deviation in monitoring results, report of physical tampering, customer water quality complaint). It is considered validated after ruling out other, non-contamination causes, such as equipment malfunctions, procedural errors, or normal background variability. If the indicator is valid, water contamination is a possibility and Investigation and Response activities begin. Example Investigation and Response Phase Decision Tree Hover over to enlarge Investigation and Response Phase includes the investigation of a suspected water contamination incident to determine if contamination has occurred. Responses occur in parallel to the investigation to protect public health and limit economic impacts. This phase is a cyclical process of collecting and evaluating information about the suspected incident, while also implementing appropriate response actions to limit the impact on the system and customers. Investigation activities include reviewing available information and performing site characterization, sampling, and field and laboratory analysis. Response activities may include operational responses, risk communication/public notification, and issuing use restrictions. With each new piece of information gathered through the investigation, the incident should be evaluated to determine if contamination can be ruled out (the incident ends), has been confirmed (the incident proceeds to remediation and recovery), or remains a possibility (the investigation continues). This phase ends once the contamination has been confirmed or ruled out. Remediation and Recovery Phase begins after contamination has been confirmed. This phase shifts the focus from the investigation activities of the previous phase to planning for remediation while continuing to implement response activities. Remediation and recovery includes characterization, decontamination, and clearance to return the system to normal operation. Characterization involves additional sampling and analysis from the distribution system in order to determine the source, extent, and fate of contamination in the system. Information gathered during characterization informs planning and selection of the decontamination strategy. Once the decontamination strategy has been implemented, clearance of the impacted portion of the system can occur through post-remediation monitoring to verify removal of the contamination. Once cleared, the system returns to normal operations. Example Remediation and Recovery Phase Decision Tree Hover over to enlarge 6 ------- Guidance for Responding to Drinking Water Contamination Incidents 3.2 Confidence and Impact Evaluation During the investigation of a suspected contamination incident, a utility will need to evaluate its confidence in the information indicating that the system may be contaminated. Consideration should also be given to the potential impact of the suspected incident on the system and its customers. Together, the confidence and impact will inform a utility's response decisions. Confidence A utility should evaluate how confident they are that contamination has occurred based on the available information. The confidence can be expressed using descriptive terms or numbers in a tier or level system that have predefined meaning to the utility personnel and response partners. For instance, EPA's Response Protocol Toolbox (EPA, 2003) introduced the terms possible, credible, and confirmed to express three levels of confidence that contamination is present. Expressing the confidence in a standard format helps to efficiently convey the current state of the incident to the response team. Criteria can be established for each confidence level to help the responders assign a level to the incident. Criteria to consider include: • The type of validated indicator of contamination (e.g., verbal threat, water quality anomaly) • Information from other utility departments and partners (e.g., treatment status, work orders) • Any corroborating evidence (e.g., additional indicators, evidence of tampering) • Site characterization and sampling (e.g., sampling results, presence of site hazards) Impact A utility should also evaluate the impact of contamination, that is, the potential consequences to its system and customers. Determining how severe an incident could be will have a significant influence on when and how response activities are implemented. Like confidence, a tier/level system, such as Low, Moderate, and High, can be used to express the potential impact of contamination. Criteria to consider for establishing the impact levels include: • Potential impact on public health (e.g., no effect, illnesses/fatalities) • Number of customers potentially affected (e.g., single block, pressure zone) • Potential impact of use restrictions on customers (e.g., boil warning, do-not-use) • Potential impact on critical customers (e.g., hospitals) • Potential impact on the system/geographic extent (e.g., single storage tank, entire system) • Regulatory impacts (e.g., potential for non-compliance with regulations, reporting requirements) • Potential impacts on non-critical measures (e.g., aesthetics of the water, customer confidence) Confidence and impact should be evaluated initially after a valid indicator of contamination is observed and periodically throughout the investigation as new information is gathered. At the highest level, the evaluation should determine whether to rule out contamination, to begin/continue the investigation, or to confirm contamination has occurred. It can also be used for decision-making when planning the various investigation and response activities. As an example, a confirmed contamination incident (high confidence), like one due to the detection of residual potassium permanganate in finished water, may pose little risk (low impact) to public health, requiring notification but no use restriction. On the other hand, a verbal, unspecific threat of contamination with a "toxin" may have low confidence but high potential impact (e.g., severe consequences to public health), and may warrant aggressive investigation and preliminary responses (e.g., isolation). The confidence and impact levels should be simple and easy to understand in order to convey the meaning clearly, particularly to response partners. In this guidance, the confidence and impact levels 7 ------- Guidance for Responding to Drinking Water Contamination Incidents introduced by the Response Protocol Toolbox (EPA, 2003) are described for reference (see Confidence/Impact Evaluation Example callout box); however, these should be customized as needed to have the most meaning and value to the utility and its response partners. While the confidence and impact ratings are useful tools, it is important to use an evaluation process that allows those leading the incident response the flexibility to adapt to the situation. The evaluation should help guide response decisions, but not constrain or limit the selection of response activities. Confidence/Impact Evaluation Example The Response Protocol Toolbox (EPA, 2003) describes three confidence levels (Possible, Credible, and Confirmed) and three impact levels (Low, Medium, and High). The confidence levels guide the overall investigation and response while the impact levels guide the implementation and urgency of specific activities as the utility's confidence progresses. • Possible Contamination is the first confidence level and is usually assigned to the early stages of the Investigation and Response Phase. This level indicates that the information known about the incident is minimal, and likely based on a single validated indicator of contamination. The primary action to perform at this level is to gather additional evidence to corroborate the presence of water contamination. The extent of the investigation activities (e.g., number of personnel, methods selected), particularly those involving field personnel, depend mostly on the impact of the indicator. If the results of the investigation corroborate the initial indicator, contamination is considered Credible (it may also be Confirmed if there is definitive evidence that contamination has occurred); otherwise the investigation is closed. Response activities should be considered at this confidence level depending on the impact (Low, Medium, or High), but the options are usually limited due to the lack of information. While proactive surveillance of the distribution system may detect a number of Possible contamination incidents, only a small percentage of these are expected to progress to the Credible contamination level. • Credible Contamination is the second confidence level and usually assigned in the latter stages of the Investigation and Response Phase, This level indicates a heightened level of confidence that contamination has occurred. Credible contamination can be established using information from multiple sources (e.g., corroborating evidence, sampling results). The investigation efforts continue and expand to determine whether a drinking water contamination incident has definitively occurred. Response activities should be implemented based on the impact (Low, Medium, or High) of the incident and the consequences of inaction. • Confirmed Contamination is the third confidence level and is assigned once there is definitive evidence that drinking water contamination has occurred, demonstrated by either a positive analytical result or a preponderance of evidence that the water has been contaminated. The Remediation and Recovery Phase begins after contamination has been Confirmed. During the Remediation and Recovery Phase, additional operational responses may be initiated, and planning for remediation and recovery begins, including characterization of the contamination, selection and implementation of a decontamination strategy, and clearance of the system to return to normal operations. Ongoing communication with the public is essential to ensure that the affected population is aware of any water use restrictions, and to keep the public apprised of progress during remediation. 8 ------- Guidance for Responding to Drinking Water Contamination Incidents 3.3 Investigation Activities Investigation activities involve the collection of information about the incident in an attempt to either rule out or confirm contamination. These activities include gathering and reviewing available information from a variety of sources and collecting new information from the field through site characterization and sample collection and analysis. Gather and Review Available Information To begin the investigation, a utility should gather and review all available information from internal utility resources and external response partners. This information includes any data or information that is routinely collected by a utility or a response partner and may have some relevance to the current incident. Examples include customer calls, online water quality monitoring data, compliance sampling data, treatment irregularities, maintenance and repair work orders, and public health trends. These sources of information can provide context and may support decisions on the direction of the investigation and responses, especially during the initial stages of the incident when very little information is known. These sources should continue to be checked periodically throughout the investigation for updated information, particularly those that gather frequent or continuous data (e.g., online monitoring stations, customer complaint calls). A utility should list relevant sources of information (see an example in Table 3-1) in their DSCRP along with how that information can be accessed. The internal information may be located in a central Supervisory Control and Data Acquisition (SCADA) system or distributed amongst a utility's departments whereas response partners may have varying procedures for requesting and accessing the information they collect. When developing a DSCRP, response partners should be contacted to discuss what information they collect and can share as well as the most efficient way of requesting the information during an incident. Table 3-1. Example List of Information Sources Useful during an Investigation Information Source Instrument maintenance records Instrument logbooks or digital management system Online monitoring data SCADA or dedicated water quality information management system Flow and pressure data SCADA or distribution operations department Pump/tank operating status SCADA or distribution operations department Treatment operations information SCADA or treatment plant operations department Modeling results Distribution operations or engineering department Sampling results Laboratory information management system (LIMS) or water quality database Customer complaints records Customer service department Maintenance and repair work orders Distribution and treatment plant operations department Reports of drinking water-related illness Local public health agency Region/state-wide water advisories State environmental agency Recent chemical spills Spill reporting hotline Calendar of regional events City/County events calendars 9 ------- Guidance for Responding to Drinking Water Contamination Incidents Site Characterization. Sampling, and Analysis Characterizing the site of an indicator of contamination and collecting samples for field or laboratory analysis are important activities that support the investigation of suspected contamination. The site of an indicator may provide further evidence of contamination and samples collected from the site can be analyzed for water quality parameters and contaminants of concern. Coupled with other available information, the results from these activities can answer many questions about an incident. Other sites of interest may also require investigation, such as any locations where contamination is suspected to have been introduced. A Site Characterization and Sampling Plan (SC&SP) should be completed for each site to provide instructions to the field teams for performing these tasks. A SC&SP is a brief checklist-style plan prepared in advance that can be filled out during an incident by the Incident Commander (see Section 4.1 for command roles) and distributed to field personnel trained to implement the activities, including key response partners. A SC&SP should describe: • The site of interest along with any known information about the site and indicator • Field activities to be performed • The water quality parameters that will be analyzed at the site • Samples that will be collected for analysis off-site • The personnel and response partners that will be deployed to the site • The disposition of samples after field activities (e.g., sent to a laboratory, given to a response partner) • The method and frequency of communicating and reporting results • The health and safety requirements • Any approvals/authorizations (e.g., Incident Commander, health and safety officer) The field activities to perform at a site should be determined by the specifics of the incident and site, the capabilities of the utility and response partners, and the confidence/impact evaluation. Field activities fall into five general categories: • Visual site hazard assessment, performed upon approach and while accessing the site to screen for the presence of hazards. • Site safety screening, performed to ensure the site is safe for entry. • Water quality parameter testing, performed to collect general water quality data in the field. • Rapid field testing, performed to collect specific contaminant or contaminant class (volatiles, metals, etc.) data in the field. • Sample collection for laboratory analysis, performed to collect samples for detailed or targeted analysis in a laboratory. Sampling should be considered at other locations, in addition to the location of site characterization, to provide supporting evidence for interpreting any results. Sampling other locations can verify transport of a contaminant or water quality change downstream through the system, follow the contaminant upstream to the source, and establish the water quality in uncontaminated regions of the system for comparison. If a site for characterization has been identified, sampling both upstream and downstream of the site from fire r Build Field and Laboratory Capabilities V. Refer to the following guidance documents for more information on developing field and laboratory capabilities for conducting site characterization, sampling, and analysis during a contamination incident: • Guidance for Building Field Capabilities to Respond to Drinking Water Contamination • Guidance for Building Laboratory Capabilities to Respond to Drinking Water Contamination 10 ------- Guidance for Responding to Drinking Water Contamination Incidents hydrants or easily accessible taps can help to determine if the contamination is isolated to the site (e.g., a problem within the premise plumbing) or is in the distribution main. To aid decision-making during an incident, a DSCRP should contain instructions for completing an SC&SP. It is also helpful to include lists for: • Established capabilities for each field activity with details on who (utility/response partner) can perform the activity and general guidelines for when to include the activity in the plan. • Analytical parameters that can be measured in the field or in the laboratory with details on the parameter or contaminant/contaminant class name, the method, required equipment, the responsible party (field personnel/utility laboratory/response partner laboratory), and approximate turn-around time for the analysis. • Sampling locations with general details on the locations such as the asset ID/name, type (e.g., hydrant, tap), and address or descriptive directions as well as the significance of the location (i.e., does the location represent an entry point or a pressure zone). Listing the capabilities and analytical parameters will expedite the selection of field activities by ensuring the available options are accessible without the need to consult field and laboratory personnel. Preselecting sampling locations, such as at fire hydrants or tanks, will reduce the time spent determining suitable locations during an incident as well as allow utility personnel to become familiar with the locations through training and exercises. Locations should be chosen throughout the system: near all entry points into the system, the entry and exit of pressure zones, utility facilities, and important distribution system infrastructure. Utilities likely have some of these locations already identified for current sampling needs (e.g., compliance monitoring) and can utilize these same locations during an incident. Conducting site characterization and sampling will likely occur with limited knowledge of the problem, which can present unknown risks to the personnel performing the activities. A utility should determine which circumstances will be handled internally and which will require a response partner, such as law enforcement or a Hazardous Materials unit (HazMat). Utility personnel should be trained to identify potential site hazards so they can recognize when a circumstance is beyond their capabilities and training. An important part of implementation of the SC&SP is maintaining communication between the field personnel and the Incident Commander to assess any findings and authorize each activity in the plan, as necessary. A DSCRP should include instructions to guide the Incident Commander in implementing an SC&SP, noting important points for communication and for providing approval for the next activity in the plan. Important communication points include site arrival, the discovery of findings, the completion of each activity, the completion of all site activities, and site exit. Communicating with the laboratories that will be analyzing samples early in the site characterization process is also important to ensure they are prepared to receive and process the samples as quickly as possible. 3.4 Response Activities Response activities focus on limiting the consequences of contamination. Operational responses, risk communication, and issuing use restrictions aim to minimize the extent of contamination, keep the public informed of the situation, and protect public health. Example Site Characterization and Sampling Plan Hover over to enlarge 11 ------- Guidance for Responding to Drinking Water Contamination Incidents Operational Response As information on the incident is gathered through the investigation process, a utility should consider operational responses. Operational responses are changes to the operation of the distribution system that limit the spread of contaminated water and prevent or reduce the impact on customers and the system. As information about the contamination incident is gathered, operational response options should be developed by the utility distribution system operators and evaluated by the Incident Commander for implementation. If the location of the source of contamination is known or suspected, a distribution system model and/or knowledge of the distribution system can be used to estimate spread and identify potentially effective operational responses. Operational responses to consider include complete isolation of the affected area or reducing or diverting flow (e.g., opening/closing valves, flushing, isolating tanks, or changing the hydraulic gradient in the system through pump and tank operations) to slow or limit the spread. Operational responses should be considered throughout the Investigation and Response Phase, and may be continued into the Remediation and Recovery Phase, if necessary, to limit the area of the system requiring remediation. Since any operational response will likely disrupt service to some portion of the distribution system, the decision to implement a response action should weigh the current confidence/impact assessment of the incident against the effect of the operational response on customers. Furthermore, due to the lack of information about the source and spread of contamination at the beginning of an incident, a utility should consider the potential of operational responses to increase the extent of contamination. While minor changes in operations can be implemented with little impact, more significant changes should only be implemented when warranted by the confidence/impact assessment. If a change in operations will directly affect customers, they should be notified as soon as practical. As new information is collected about the incident, any implemented change in operations should be re-evaluated and adjusted, as necessary. Operational responses are situation-dependent, but some common options can be planned in advance to hasten the response. Plans for common operational responses, such as isolation or flushing, can be developed for specific facilities, such as tanks and pump stations, and for hydraulically distinct areas of the system. Planning these responses in advance will allow distribution system operators to implement these actions quickly and effectively. A DSCRP should contain the list of planned operational responses that describe the anticipated effect of the operational response on system hydraulics and contaminant spread, an estimate of the time to implement the response, and any adverse impacts to customers or the system. There should also be a decision-making framework, such as a decision tree, to allow the Incident Commander to quickly decide if an operational response is feasible and appropriate to the situation (i.e., confidence/impact levels). Specific procedures for implementing each operational response should also be documented and made available to operators. Distribution System Model Implementing operational responses requires knowledge of the anticipated path of the contaminant through the distribution system. Distribution system operators will be able to provide approximate information, but a more accurate method is to build a distribution system model. Modeling results that estimate the extent of contamination and allow for examining alternative hydraulic/operational scenarios can be used to inform decisions related to operational responses and sampling. Modeling capabilities can also support system planning, operations, and water quality management. A model should be updated to capture changes in operations, demand, and configuration to ensure that model projections are sufficiently accurate for their intended use. Example Operational Response Planning Decision Tree Hover over to enlarge 12 ------- Guidance for Responding to Drinking Water Contamination Incidents Risk Communication/Public Notification Risk communication plays a key role during an incident, keeping the public and customers aware of the situation and providing vital information to protect public health. Public water systems are required by the Safe Drinking Water Act and EPA regulations (40 CFR 141, Subpart Q) to notify the public when "situations with significant potential to have serious adverse effects on human health as a result of short- term exposure, as determined by the primacy agency either in its regulations or on a case-by-case basis" become apparent, which may include incidents under investigation without confirmed contamination (Public Notification of Drinking Water Violations, 2012). By law, a utility must contact the primacy agency to determine public notification requirements as soon as practical, but not later than 24 hours after learning of the situation. These situations require a Tier 1 public notice (see 40 CFR 141, Subpart Q for information on Tier 1 public notices). Refer to EPA's "Revised Public Notification Handbook" for additional guidance regarding public notifications and the requirements of the notification rule (EPA, 2010). A utility should develop a comprehensive Risk Communication Plan (RCP) that is well coordinated with the steps and procedures contained in their DSCRP. An RCP is part of a utility's ERP (see Figure 2-2 in Section 2) covering the utility's communication procedures during an emergency. The purpose of an RCP is to guide a utility and its partners regarding: • When and how to issue public notifications, including drinking water use restrictions • How to identify target audiences and develop messages • How to work with the media • How to establish a delivery system for the message (e.g., media, radio, television, auto-dialer telephone systems) An RCP generally describes the responsibilities of a utility's Public Information Officer (PIO) (see Section 4.1 for command roles) during all phases of an incident. It also covers internal and external communications and coordination with external agencies as well as with the media. An RCP may include an overview of basic crisis communication principles, RCP decision trees for use by the PIO, a section with tools and resources that provide forms, templates, and sample notification documents, and contact information. Development of an RCP should be led by a utility's PIO and confirmed through their counterparts at response partner organizations. A utility and other agencies may already have much of this information covered in existing RCPs or Public Notification Plans, but roles and responsibilities during the response to a contamination incident may still need to be coordinated and confirmed amongst the groups. The goal is to coordinate communication with the public across agencies to promote messages that are clear, consistent, and concise (i.e., messages do not give out superfluous or contradictory information). Issuing Use Restrictions Issuance of use restrictions is part of risk communication, but is discussed separately in this guidance because it is one of the most important decisions made during the Investigation and Response Phase. During an incident, it may become necessary to inform the public and customers that the water may be contaminated, an investigation is underway, and that use of the water should be restricted in some manner. The purpose of issuing use restrictions is to protect the health of the public by alerting them to the issue and providing instructions/restrictions for the use of the drinking water supply. Types of use restrictions include instructions to "do not use," "do not drink," or "boil water." Depending on the Develop a Risk Communication Plan Refer to Developing Risk Communication Plans for Drinking Water Contamination Incidents for more information on how to organize and write an effective RCP. 13 ------- Guidance for Responding to Drinking Water Contamination Incidents restriction, this notification should be closely coordinated with the provision of alternate sources of drinking water. A utility's DSCRP should contain directions for issuing the restrictions in the context of an ongoing investigation; however, the general guidance for developing and issuing the restriction should be contained in an RCP. 3.5 Remediation and Recovery Activities Once contamination has been confirmed, the Remediation and Recovery Phase begins. Remediation activities include characterizing the nature and extent of contamination, implementing further response activities as additional information is gathered, planning and implementing a decontamination strategy, clearing the system for return to service, and continuously updating the public and customers with information on progress. Characterization for Remediation The Remediation and Recovery Phase begins with fully characterizing the nature and extent of contamination. The goal is to identify the contaminant (if not already identified) and to determine the source, extent, and fate of the contamination in the distribution system. Sampling and analyses are continued from the Investigation and Response Phase; however, the parameters of interest narrow to only those most relevant to the identified contaminant (e.g., the contaminant, related chemical groups/degradation products, important water quality parameters). The number of sampling locations increases in order to fully capture the spread of contamination within the distribution system and guide expanded response activities. Personnel with expert knowledge of the distribution system should determine the approximate boundaries of the contaminated area, which will aid the selection of sampling locations for confirming the extent of contamination. A distribution system model can also assist with establishing the contaminated area. A risk assessment can then be conducted to establish the clearance goals for remediation, which will set the parameters to measure, the number of samples to collect, and the locations from which to sample. A Sampling and Analysis Plan (SAP) should be created specifying the details of the characterization activities. While similar to an SC&SP from the Investigation and Response Phase, an SAP focuses primarily on collecting only the specific samples needed to characterize the contaminant and verify the extent of contamination. An SAP may include methods and procedures outside of those typically used by a utility, depending on the nature of the contamination. As the extent of contamination and the risk to customers are determined, additional operational responses may be implemented to limit the area requiring decontamination and risk communication and notifications should be updated and/or issued. These responses should be continually assessed during the characterization process until it has been completed. Decontamination A decontamination strategy should be developed and implemented to remove and treat the contaminated water, decontaminate the system, and return the system to normal operation. The strategy should address removal of the contaminated water from the system, treatment and disposal of the contaminated water (i.e., treatment options or direct discharge), and decontamination of contaminated infrastructure, if necessary. Disposal, either with or without treatment, should be closely coordinated with any partners or agencies responsible for receiving the discharge, such as a wastewater utility for sewer disposal. A Remediation Action Plan (RAP) should be created to document the decontamination strategy. The RAP should describe the process for implementing the decontamination strategy, including the objectives, methods, schedule, personnel involved, health and safety information, and required approvals. The RAP may need to be revised if new information becomes available relating to contaminant properties, the effectiveness of decontamination methods, or anything else that could impact the ability of the decontamination strategy to meet the clearance goals. 14 ------- Guidance for Responding to Drinking Water Contamination Incidents While the RAP is developed and implemented, operational responses and risk communication continue. Operational responses should be maintained to isolate the contaminant and protect the system until it can be decontaminated. Risk communication should provide updates to the public and stakeholders until the remediation process is completed and any drinking water use restrictions can be lifted. Clearance The system must go through clearance before it can return to normal operation. Clearance involves additional sampling and analysis throughout the contaminated areas of the distribution system to verify that clearance goals have been met. The primacy and public health agencies play a lead role in assessing if the goals have been achieved and providing final clearance, but the decision could also include other stakeholders and subject matter experts. If the goals have not been met, adjustments to the risk assessment may be necessary or additional decontamination activities may be required. If the clearance goals have been achieved, the system can return to service. As part of returning to service, the primacy and public health agencies may require a long-term monitoring program to demonstrate that the contaminant concentration remains below the remedial goal. Depending on the specifics of the incident, different sections of the system may be cleared at different times or the clearance may occur gradually, which allows different uses of the water (e.g., toilet flushing, bathing, consumption) at different stages in the clearance process. 15 ------- Guidance for Responding to Drinking Water Contamination Incidents Section 4: Incident Management and Communication Successful investigation, response, and remediation of a contamination incident require coordinated management of the incident and effective communication among those involved. A well-defined command structure is necessary to organize and integrate utility personnel performing tasks outside their normal chain-of-command with any response partners that may be providing support to the incident. In addition, proper methods for communication and information management ensure all involved in the incident have the necessary information to respond in a coordinated effort. A utility's DSCRP should include the details on how to organize the command structure and the equipment, methods, and systems for communication and information management. 4.1 Incident Command System The National Incident Management System (NIMS), developed by the Federal Emergency Management Agency (FEMA), provides a systematic, proactive approach guiding government agencies at all levels, the private sector, and nongovernmental organizations to work seamlessly to prepare for, prevent, respond to, recover from, and mitigate the effects of incidents, regardless of cause, size, location, or complexity, in order to reduce the loss of life and property. The Command and Management component of NIMS includes the Incident Command System (ICS), which should be integrated into utility response procedures. The ICS is a widely applicable management system designed to enable effective and efficient incident management by integrating a combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure. A utility's ERP should have an overview of how the utility implements the ICS during an emergency. A DSCRP should contain provisions for how roles specific to a contamination incident fit into that ICS structure and for when the ICS should be activated, regardless of the scale of the incident and whether the response is managed internally or in cooperation with response partners. It is important to note that the ICS structure is flexible and can be modified or enhanced to meet a utility's needs. Also, the utility ICS may evolve during the course of an incident, and all sections (Operations, Planning, logistics, and Finance/Administration) may not be activated at once. As the contamination incident escalates, the ICS can expand to provide additional resources and support for the investigation and response. At the same time, Incident Command may pass laterally between personnel in different utility departments, transition to higher levels of supervision and management within a utility, or become integrated into a multi-agency command structure under a Unified Command, led by a state or federal agency. Note that passing the role of Incident Commander should be done formally to avoid any confusion during an incident, particularly in the early stages when it may pass quickly between different managers. Many personnel involved in routine operations at the utility that have a role in investigating and responding to a contamination incident would fall under the Operations Section of the ICS structure, grouped in Branches or Divisions/Groups by geography/function (e.g., field sampling personnel could fall under a Field Operations Branch). However, personnel may find themselves assigned to tasks not typical of their daily functions due to the demands of an incident. For instance, a distribution team may be asked to support sampling personnel if there are not enough field teams to perform the required sampling. Some operations personnel with specialist knowledge, such as laboratory capabilities or distribution operations, may be moved over to the Planning Section to provide their knowledge to planning and coordinating various activities. The Planning (outside of the technical specialists), Logistics, and Finance/Administration Sections and the Command Staff (except the PIO) perform similar functions during all types of emergencies and would likely not need specific instructions included in a DSCRP. Learn about the ICS Refer to FEMA's Emergency Management Institute and ICS Resources Center for a variety of resources and courses to learn more about NIMS and the ICS. 16 ------- Guidance for Responding to Drinking Water Contamination Incidents WSI Pilot Utility ICS Structure Examples Each of the WSI pilot utilities included two example ICS structures in their response procedure that were specific to a contamination incident. These examples were not prescriptive, but served to inform the response personnel how the ICS structure might look during an incident. They also helped personnel visualize how their normal role at the utility might fit into the ICS structure during an emergency. Selecting the thumbnail images below will enlarge two example ICS structures similar to those developed by the pilots. Example ICS structure for a small-scale incident: This structure reflects an internal utility command structure that does not require the full activation of all sections of the ICS. The pilot utilities all found that a fusion of their normal command structure with the standard ICS structure worked best for smaller incidents. Hover over to enlarge Example ICS structure for a large-scale incident: This structure reflects a more formal and complete activation of all sections of the ICS. It also incorporates a Unified Command to include response partners and stakeholders that would be involved in larger-scale incidents. Hover over to enlarge 4.2 Response Partners An effective response to a contamination incident will likely require support from a variety of utility personnel and response partners. A DSCRP should identify the roles and responsibilities of all parties involved in a response. Roles and responsibilities outlined in a DSCRP should provide a utility with a description of what they are prepared to do and what is expected from local, state, and federal response partners during the response to a contamination incident. Response to any emergency begins at the local level and thus would engage local response partners first. State and federal response partners may become involved depending on the nature of the incident and the resources required for the response. Roles and responsibilities of response partners will likely be worked out and refined over the course of developing a DSCRP through meetings, workshops, and exercises. Formalizing the relationships through an agreement (e.g., memorandum of understanding, memorandum of agreement, mutual aid and assistance agreement) should be considered to explicitly define expectations. A DSCRP should include notification and communication procedures for each response partner that describes how and under what circumstances each partner should be contacted. In some cases, response partners may want to be notified only for their situational awareness while in other cases their active assistance may be requested. Keeping an up-to-date contact list in a DSCRP with names and contact details will ensure notifications and requests for assistance are made to the appropriate personnel at each agency. A utility should also identify key stakeholders to include in the planning for a contamination incident. Key stakeholders are public and private organizations that are not directly involved in the response, but have influence or are greatly impacted by the incident. For instance, local governments will need to be apprised of the situation, but play only a minimal role in the response. Likewise, local hospitals and other critical care facilities need to know how water use restrictions will impact their operations, but would not have a role in response other than caring for the injured. Mutual Aid and Assistance Learn more about establishing relationships with other local utilities to obtain help during an emergency, such as a contamination incident, through the Water/Wastewater Agency Response Network (WARN) program at EPA's Water Utility Response website. 17 ------- Guidance for Responding to Drinking Water Contamination Incidents EPA, and other federal agencies, can provide a range of assist/ance during an incident. They can become involved through a number of avenues and authorities depending on the circumstances. More information on accessing EPA assistance can be found at EPA's Water Utility Response website. Table 4-1 provides a general overview of the roles and responsibilities that the utility and response partners may play in implementing a DSCRP. Note that this is an example only and not a comprehensive list, since response partner organizations and roles may vary among localities. Table 4-1. Typical Roles and Responsibilities for Implementing a DSCRP Partner Typical Responsibilities Drinking water utility incident command Coordinates and implements overall incident response activities including the investigation, operational responses, risk communication, and planning for remediation. Provides appropriate notifications to response partners. Local health department Supports development of public notifications and serves as a conduit to state and federal health agencies. Serves as a technical resource during the investigation. Provides information about health risks associated with suspected contaminants. Local fire departments Coordinates with the utility if water service in a specific response area should be shut down. They can notify affected neighborhoods and assist in distribution of alternate drinking water supply. They may also be able to assist with flushing operations, provide input regarding fire suppression requirements, and communicate safety considerations related to use of contaminated water for firefighting. HazMat Supports site characterization and sampling activities. Takes responsibility for a location where contamination occurred or a hazard may exist until a determination is made regarding the level of the hazard present. Local law enforcement Supports investigation activities by controlling access to a suspected contamination site. May serve as a conduit to state and federal law enforcement and intelligence agencies. May assist in distribution of an alternate drinking water supply. Environmental and public health laboratories Provide or coordinate laboratory support for the analysis of water samples during investigation and remediation efforts. State public health laboratories provide access to the Centers for Disease Control and Prevention's (CDC's) Laboratory Response Network. State drinking water and wastewater primacy agencies Provide resources and technical expertise during investigation, response, and remediation, and advises the utility regarding regulatory requirements for treating contaminated water, public notification, environmental concerns about discharged water and provision/quality of alternate drinking water supplies. Federal agencies (EPA, CDC, FBI, DHS/FEMA) Provide resources, technical expertise, and support to the utility on investigating and responding to a contamination incident. May assume Incident Command and take charge of the activities under certain circumstances, such as intentional contamination. National Guard Provides resources and support for a wide range of incident activities. Acts as a "force multiplier," bringing personnel trained in a formal command structure who can perform a wide range of tasks (e.g., distributing bottled-water, collecting samples, staffing call centers, analyzing samples). While a federal agency, the National Guard can be activated by state governors in response to an emergency without federal involvement. Local government Communicates with constituencies regarding the impact of the incident on the community, actions taken to protect the public, and updates on the progression of response and recovery efforts. 4.3 Communication Equipment and Methods A variety of equipment and methods can be used to communicate information about a drinking water contamination incident with personnel and response partners as well as stakeholders and the public. Standard equipment and methods are likely already a part of a utility's other response procedures and/or in a utility's ERP. Planning for communications during emergency response should consider requirements 18 ------- Guidance for Responding to Drinking Water Contamination Incidents such as coordinating the activities of multiple field teams and communicating directly with response partners. Communication equipment and methods can include the following: • TV/radio • Landline telephones • Cell phones • Satellite phones • Auto-dialer or reverse 911 voice recording systems • Hand-held or 800 MHz radios • Audiovisual systems (including intercoms and closed-circuit television monitors) • Written bulletins or newsletters • Email • Social media • Web portals or file-sharing platforms (e.g., SharePoint sites) Regardless of the equipment and methods used to disseminate the message, utilities should ensure that the public and response partners are both receiving and understanding the message, particularly for the public who may have limited access to the various means of communication or require accessibility considerations. 4.4 Information Management Information management is the process of collecting, documenting, and managing the large amount of information (e.g., indicators of water contamination, characterization findings, analysis results) that may be generated and used during an incident to support decisions about various response actions. Developing an effective information management strategy helps to promote and maintain overall awareness and understanding of an incident within and across jurisdictions and thus contributes to sound communication principles. As an incident progresses and the number of personnel and response partners involved increases, a well-planned strategy will ease both conveying information to and collecting information from all involved parties. Documenting incident information may also help to effectively manage liability issues, cost recovery, and meeting certain regulatory requirements that may arise as a result of a contamination incident. A utility should establish a records management system as part of their DSCRP for maintaining and organizing both paper records as well as electronic information. The system should include methods for collecting and sharing information both internal to the utility and externally with response partners. Information that may be captured in a records management system includes: • Information about the incident • Results, findings, and outcomes of any investigation and response activities • Chronological log of events • Written records for all response decisions • Chain-of-custody documentation for all laboratory samples • Time records for all personnel involved • Invoices and resource allocation records • Information collected or provided by response partners Considerations should also be given to other systems that may need to be accessed during the response to an incident, such as SCADA, LIMS, work order systems, water quality databases, etc. 19 ------- Guidance for Responding to Drinking Water Contamination Incidents Section 5: Training and Exercises The ability to effectively implement the concepts, guidance, and procedures of a DSCRP requires that the personnel responsible for responding be trained on the DSCRP and supporting procedures. Exercises allow utility personnel and response partners to practice these procedures and tasks that fall outside of their typical job duties, enabling them to meet the challenges associated with a contamination incident. In addition, effective training and exercise programs are useful for integrating utility response procedures with those of external partners. Training and exercises have three main purposes: • To regularly review and update all procedures, contact lists, and other materials in the DSCRP and ERP. • To practice carrying out the aspects of the DSCRP with the multiple parties that may be involved in incident response. • To capture problems in the implementation of procedures during exercises in order to continually improve and compensate for changes. Ultimately, training and exercises allow a utility to learn from its mistakes in a no-fault environment, thereby recognizing potential opportunities to improve execution of plans and procedures, and to modify them when necessary. This section provides guidance on how to plan and conduct appropriate exercises and training for a DSCRP. 5.1 Implementation through Training and To ensure an effective incident response, training should be conducted to familiarize utility personnel and response partners with the DSCRP and their corresponding tasks. Training should include information concerning how the DSCRP is organized (e.g., investigation activities, response activities, planning for remediation), as well as roles and responsibilities of personnel and response partners. Additionally, training activities associated with specific DSCRP activities (e.g., field sampling, site characterization) should be conducted. Training should also stress coordination between utility personnel and external response partners to establish a consistent, shared understanding of roles and capabilities during investigation of and response to a contamination incident. The roles of all parties during an incident should be clearly understood, including the process of working together under an ICS. There are several resources that can be used to assist with training development. Many federal agencies, including EPA and the Department of Homeland Security (DHS), and state agencies have created resources for developing training programs for utilities and periodically conduct general training and large-scale exercises. Local emergency planning committees may also have local training opportunities that allow water utilities to practice response functions with local emergency partners. The training strategy recommended for DSCRPs is a suite of core courses in the ICS (see ICS Training callout box on the next page), augmented by a training program based on the Department of Homeland Pilot Experience The WSI pilot utilities found regular communication, such as through routine joint training and exercises, greatly improved their coordination with response partners and maintained familiarity with their DSCRP. Exercises Important Tool EPA has developed an Sf?S Exercise Development Toolbox to provide utilities with an interactive program to aid in designing, developing, conducting, and evaluating exercises for contamination scenarios. This enables utilities and their response partners to conduct exercises that will help develop, teach, and improve their response procedures. 20 ------- Guidance for Responding to Drinking Water Contamination Incidents Security's Homeland Security Exercise and Evaluation Program (HSEEP). As shown in Figure 5-1, this program begins with "Discussion-Based" exercises (seminars, workshops, and tabletop exercises) to introduce and teach new concepts and to assess plans and procedures with contamination scenarios. Following the discussion-based exercises, "Operations-Based" exercises (drills, functional exercises, and full-scale exercises) test and evaluate procedures and program effectiveness under more advanced simulated or real-world "what-if scenarios. Operations- Based < V. Discussion- Based ^ V DSCRP Tabletop Exercise Site Characterization Tabletop Exercise Site Characterization Workshop FEMA ICS 100 and NIMS 700Training Supervisor and Upper Management Orientation Seminar Operations Staff Orientation Seminar a LU cc LU U QC Z3 o l/l LU QC a z < >- X o u z LO < LU cc u Figure 5-1. Types and Examples of Trainings and Exercises of Varying Complexity and Resource Requirements Utilities with an existing emergency preparedness training program should incorporate DSCRP-specific training and exercises. The training program should include internal exercises to maintain the DSCRP and its supporting procedures, such as site characterization and public notifications, as well as to maintain the competency of personnel in their respective procedural roles. It is recommended that discussion-based exercises be conducted annually or after routine updates to the DSCRP. Operations-based exercises should be conducted on a two- to three-year cycle or after any significant modifications to the DSCRP or changes in personnel. 21 ------- Guidance for Responding to Drinking Water Contamination Incidents ICS Training Introductory ICS training is recommended foraii utility personnel: ® ICS-100 Introduction to the Incident Command System • IS-700 NIMS, an Introduction Additional courses are also recommended for utility personnel who may activate or lead an incident: • ICS-200 ICS for Single Resources and Initial Action Incidents ® ICS-300 Intermediate ICS for Expanding Incidents • ICS-400 Advanced ICS • IS-800 National Response Framework (NRF), an Introduction Details on the training courses are available at the following locations: • FEMA's ICS Resources Center • Water utility-specific training videos for ICS-100, ICS-200, IS-700, and IS-800 are available at EPA's Water Resilience Traininc website Discussion-Based Exercises Discussion-based exercises are normally used as a starting point in a progressive building-block approach leading up to operations-based exercises. They include: • Seminars', used to orient participants to, or provide an overview of, authorities, strategies, plans, policies, procedures, protocols, resources, concepts, and ideas. • Workshops: similar to seminars, workshops are typically used to test new ideas, processes, or procedures; train groups in coordinated activities; and build products like a DSCRP. Workshops often require more participation than seminars, and may use breakout sessions to explore parts of an issue with smaller groups. • Tabletop Exercises: used to assess plans, policies, and procedures or to assess types of systems needed to guide the prevention of response to, or recover}' from a defined/simulated incident. Tabletop exercises are typically aimed at facilitating an understanding of concepts/plans, identifying strengths and areas for improvement, and/or achieving changes in perception. Discussion-based exercises are appropriate tools to develop procedures and to familiarize utility personnel and response partners with their roles and responsibilities in implementing these procedures. Table 5-1 provides an example of discussion-based exercises that can be conducted to support implementation of a DSCRP. They can be used and modified to train utility personnel and external response partners. Table 5-1. Examples of Discussion-based Exercises to Support Implementation of a DSCRP Title Exercise Type Description DHS FEMA/NIMS IS- 100 and IS-700 Seminar Introduces ICS procedures and NIMS for utility personnel. DSCRP Development Workshop Workshop Discusses development of the DSCRP including confidence/impact assessments, phase decision trees, and response partner involvement. This may include both utilities and response partner personnel. DSCRP Orientation Training Seminar Provides training to utility personnel on roles/responsibilities as outlined in the DSCRP. DSCRP Tabletop Exercise Tabletop Exercise Presents contamination scenarios to utility and response partner personnel, allowing them to discuss procedures in the DSCRP during a simulated incident. 22 ------- Guidance for Responding to Drinking Water Contamination Incidents Title Exercise Type Description Site Characterization Workshop and Tabletop Exercise Uses contamination scenarios to demonstrate the procedures that guide the development of an SC&SP. This training is intended for the incident command / management personnel that would be responsible for planning site characterization activities in response to a specific incident. Response partners that would be involved in these activities (e.g., HazMat) may also be included. Operations-Based Exercises Once the DSCRP has been drafted and personnel are trained and prepared, the overall DSCRP should be tested to identify necessary corrections and opportunities for improvement. This evaluation can be done through implementation of operations-based exercises. Operations-based exercises are characterized by actual mobilization of personnel and resources, and usually held over longer periods of time, from several hours to a couple of days. Operations-based exercises can be used to validate plans, procedures, policies, and agreements; clarify roles and responsibilities; and identify resource gaps. They include: • Drills: used to test a single specific operation or function in a response plan through a coordinated/supervised activity (e.g., practice using equipment, develop/test new policies or procedures, practice and maintain current skills). • Functional Exercises: a single or multi-agency activity designed to evaluate capabilities and multiple functions using a simulated response. Functional exercises are typically focused on exercising and evaluating plans, policies, and procedures. They often engage personnel involved in management, direction, command, and control functions. They are conducted in a realistic, real-time environment; however, movement of personnel and equipment is usually simulated. • Full-Scale Exercises: a multi-agency, multi-jurisdictional activity involving actual deployment of resources in a coordinated response as if a real incident had occurred. This facilitates the evaluation of field procedures concurrently with the management processes that guide implementation of the DSCRP. A full-scale exercise is typically used to assess plans, procedures, and coordinated responses under crisis conditions. These exercises often follow discussion-based exercises, which provide basic training on procedures. Overall, operations-based exercises are more complex and detailed than discussion-based exercises and require more time to coordinate, assemble, and conduct. Table 5-2 provides an example of operations- based exercises that can be conducted for a DSCRP. Table 5-2. Examples of Operations-based Exercises to Support Implementation of a DSCRP Title Exercise Type Description Site Characterization and Sampling Drill Tests and practices implementation of site characterization and triggered sampling procedures/equipment for field response personnel. Laboratory Analysis Drill Tests and practices the collection, transport, and analysis of samples and reporting of results for field and laboratory personnel. Public Notification Drill Practices the procedures for assessing when a public notification is necessary, coordinating with primacy/public health agencies, and creating/issuing notifications. Utility Functional Exercise Functional Exercise Exercises roles for utility personnel and/or response partners, tests all of the procedures in a simulated environment (no personnel or equipment movement), and identifies improvements. 23 ------- Guidance for Responding to Drinking Water Contamination Incidents Title Exercise Type Description Utility and Response Partner Full-Scale Exercise Full-Scale Exercise Exercises roles for utility personnel and response partners in a field environment (full deployment and mobilization of personnel and equipment), tests the full implementation of the DSCRP involving the majority of the DSCRP procedures, and identifies improvements. As noted in Tables 5-1 and 5-2, several exercise types (Tabletop, Functional, and Full-Scale Exercises) involve the identification of improvements to be made to the DSCRP and/or other plans. Improving response plans is a significant outcome of exercises and is necessary to ensure that the DSCRP remains relevant and useful overtime. Following an exercise, recommended improvements are typically captured in an After-Action Report/Improvement Plan (AAR/IP). FEMA, as part of its HSEEP resources, offers an AAR/IP template. 24 ------- Guidance for Responding to Drinking Water Contamination Incidents Section 6: Developing a Response Procedure A DSCRP is an actionable document that guides utility actions during a contamination incident. A step- wise process for developing a DSCRP (summarized in Figure 6-1) is detailed in a companion document to this guidance: Planning for Contamination Primer. This guide provides a short set of instructions and supporting worksheets to help utilities complete a DSCRP for their ERP using the DSCRP template. The template can be opened in Word by clicking the icon in the callout box. STEP 1: STEP 2: STEP 3: STEP 4: STEP 5: STEP 6: STEP 7: Assess Current Integrate Existing Interview Response Create an Initial Engage Response Complete a Implement Preparedness Capabilities Partners Draft Partners Final Draft and Maintain Figure 6-1. Steps for Developing a DSCRP The DSCRP should continue to be updated and maintained once it is complete. Certain sections, such as the contact list, may need to be updated yearly, or more often, as personnel, response partners, and utility capabilities change. The remaining sections should be reviewed periodically after the utility conducts training and exercises, after an actual incident occurs, or alongside reviews of the ERP and other emergency response procedures. In particular, the AAR/IPs from exercises and actual incidents provide important lessons-learned from real experiences for improving the DSCRP. It may be helpful to create a schedule for performing updates and assign the task to a specific person at the utility, rather than using an "as needed" updating approach. The schedule adds accountability to the task and ensures it is not forgotten. |w| This template can be used to develop a DCSRP. 25 ------- Guidance for Responding to Drinking Water Contamination Incidents Section 7: Resources Water Quality Surveillance and Response System Primer This document provides an overview of Water Quality Surveillance and Response Systems (SRSs) for drinking water distribution systems. It defines the components of an SRS, describes common design goals and performance objectives for an SRS, and provides an overview of the approach for implementing an SRS. EPA 817-B-15-002, May 2015. http: //www. epa.gov/sites/production/file s/2015 - 06/documents/water quality sureveillance and response svstem primer.pdf Water Utility Response Website EPA provides several resources for preparing for and responding to emergencies tailored specifically for water utilities, including information on Emergency Response Plan development, joining a Water/Wastewater Assistance Response Network, and accessing federal resources during an emergency. https://www.epa.gov/waterutilitvresponse Guidance for Building Field Capabilities to Respond to Drinking Water Contamination Provides guidance for drinking water utilities to plan for and implement field activities that support sampling and analysis in response to drinking water contamination emergencies. EPA 817-R-16-001, January 2017. https://www.epa. gov/sites/production/files/2017- 01/documents/field capabilities guidance ianuarv2017.pdf Guidance for Building Laboratory Capabilities to Respond to Drinking Water Contamination Provides guidance to assist drinking water utilities with building laboratory capabilities for responding to water contamination incidents. It presents contaminants of concern; lists analytical methods for those contaminants; and provides information on the role of national laboratory networks in responding to drinking water contamination incidents. EPA 817-R-13-001, March 2013. https://www.epa. gov/sites/production/files/2015- 06/documents/guidance for building laboratory capabilities to respond to drinking water co ntamination .pdf Developing Risk Communication Plans for Drinking Water Contamination Incidents Provides guidance on developing an effective Risk Communication Plan to guide communications with response partners and the public during drinking water contamination incidents. EPA 817-F-13-003, April 2013. https://www.epa. gov/sites/production/files/2015- 07/documents/developing risk communication plans for drinking water contamination incide nts.pdf Federal Emergency Management's (FEMA's) Emergency Management Institute (EMI) The EMI supports the Department of Homeland Security and FEMA's goals by improving the competencies of the U.S. officials in Emergency Management at all levels of government to prepare for, protect against, respond to, recover from, and mitigate the potential effects of all types of disasters and emergencies on the American people. The EMI provides a number of training resources, including online courses, on emergency management topics, such as the ICS. https://training.fema. gov/emi .aspx 26 ------- Guidance for Responding to Drinking Water Contamination Incidents FEMA's Incident Command System (ICS) Resources Center The ICS Resources Center provides materials related to the implementation of the ICS. ICS is a management system designed to enable effective and efficient domestic incident management by integrating a combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure. https://training.fema.gov/emiweb/is/icsresource/ SRS Exercise Development Toolbox The Exercise Development Toolbox helps drinking water utilities to design and conduct exercises to evaluate procedures developed to support a SRS. These exercises can be used to refine SRS procedures and train personnel in the proper implementation of those procedures. The toolbox guides users through the process of learning about training programs, developing realistic contamination scenarios, designing SRS discussion-based and operations-based exercises, and creating exercise documents. February 2016. https://www.epa.gov/waterqualitvsurveillance/water-qualitv-surveillance-and-response-svstem- exercise-development-toolbox Department of Homeland Security's Homeland Security Exercise and Evaluation Program Provides a set of guiding principles for exercise programs, as well as a common approach to exercise program management, design and development, conduct, evaluation, and improvement planning. This exercise and evaluation doctrine is flexible, adaptable, and is for use by stakeholders across the whole community and is applicable for exercises across all mission areas - prevention, protection, mitigation, response, and recovery. https://www.fema.gov/hseep https://preptoolkit.fema.gov/web/hseep-resources Water Resilience Training Website EPA has recorded a series of training webinars for water and wastewater utilities on ICS including ICS-100, ICS-200, IS-700, and IS-800. https://www.epa.gov/waterresiliencetraining/emergencv-management-training-water-and- wastewater-utilitie s Planning for Contamination Primer Provides a set of instructions and supporting worksheets to help drinking water utilities complete a Distribution System Contamination Response Procedure for their Emergency Response Plan that guides utility actions during a contamination incident. EPA 817-B-18-006, October 2018 https://www.epa.gov/waterqualitvsurveillance/water-contamination-response-resources 27 ------- Guidance for Responding to Drinking Water Contamination Incidents Section 8: References EPA, 2015. Summary of Implementation Approaches and Lessons Learned from the Water Security Initiative Contamination Warning System Pilots, 817-R-15-002. Washington, D.C. EPA, 2005. WaterSentinel System Architecture, Draft for Science Advisory Board Review. EPA 817-D- 05-003, Washington D.C. EPA, 2003. Response Protocol Toolbox: Planning for and Responding to Drinking Water Contamination Threats and Incidents. Contamination Threat Management Guide - Module 2, EPA-817-D-03- 002. Washington, D.C. EPA, 2010. Revised Public Notification Handbook, 816-R-09-013. Washington, D.C. Public Notification of Drinking Water Violations, 2012. 40 CFR 141, Subpart Q §§ 141.201-141.211. 28 ------- Guidance for Responding to Drinking Water Contamination Incidents Glossary baseline. Values for a datastream that include the variability observed during typical system conditions. characterization for remediation. The process of collecting information to determine the extent and fate of contamination in the distribution system and identify the source of contamination. The results of characterization are used in a risk assessment to establish clearance goals. clearance. The process of verifying that clearance goals have been met and approving the return to normal use of the drinking water supply by the public. Following clearance, long-term monitoring may be conducted to verify that the contaminant concentrations remain below the clearance goal. clearance goals. The target concentration of the contaminant(s) in drinking water that is considered acceptable for normal water usage. confidence. Descriptive terms or numbers that a utility uses to describe how confident they are that a water contamination incident has occurred. The terms or numbers have predefined meaning to the utility personnel and response partners that will be responding to the incident. confirmed. Contamination is considered confirmed when the analysis of all available information provides definitive, or nearly definitive, evidence of the presence of a specific contaminant or contaminant class in a distribution system. While positive results from laboratory analysis of a sample collected from a distribution system can be a basis for confirming contamination, a preponderance of evidence, without the benefit of laboratory results, can lead to this same determination. Confirmed contamination is the highest/third confidence level presented in the Response Protocol Toolbox (EPA, 2003). consequence. An adverse public health or economic impact resulting from a contamination incident. contamination incident. The presence of a contaminant (microorganism, chemical, waste, or sewage) in a drinking water distribution system that has the potential to cause harm to a utility or the community served by the utility. Contamination incidents may have natural (e.g., toxins produced by a source water algal bloom), accidental (e.g., chemicals introduced through an accidental cross-connection), or intentional (e.g., purposeful injection of a contaminant at a fire hydrant) causes. credible. Contamination is considered credible if information collected during the investigation of possible contamination corroborates a validated indicator of contamination. Credible contamination is the middle/second confidence level presented in the Response Protocol Toolbox (EPA, 2003). decontamination. The process of removing the contaminated water from the distribution system, treating the contaminated water and infrastructure as necessary, and properly disposing of any waste residuals that are generated. Distribution System Contamination Response Procedure (DSCRP). A planned decision-making framework that establishes roles and responsibilities and guides the investigative and response actions following a determination that distribution system contamination is possible. 29 ------- Guidance for Responding to Drinking Water Contamination Incidents distribution system model. A mathematical representation of a drinking water distribution system, including pipes, junctions, valves, pumps, tanks, reservoirs, and other appurtenances. These models predict flow and pressure of water through the system, and, in some cases, water quality. Emergency Response Plan (ERP). A documented plan that describes the actions a drinking water utility would take in response to a variety of emergencies such as contamination incidents, natural disasters, or acts of terrorism. Finance/Administration Section. The Section responsible for all incident costs and financial considerations. Hazardous Materials unit (HazMat). A specially trained unit of professionals with responsibility for responding to uncontrolled releases of hazardous materials. In situations where the presence of hazardous materials is suspected or discovered, HazMat supports implementation of site characterization activities. impact. Descriptive terms or numbers that a utility uses to describe the potential consequences of a water contamination incident to public health and the distribution system. The terms or numbers have predefined meaning to the utility personnel and response partners that will be responding to the incident. Incident Command System (ICS). A standardized, all-hazards emergency operations structure that is flexible and can be used for incidents of any type, scope, and complexity. ICS is a part of the National Incident Management System. Incident Commander (IC). A person responsible for directing and/or controlling resources by virtue of explicit legal, agency, or delegated authority. indicator of water contamination. Anything that could suggest the presence of contamination in the drinking water (e.g., deviation in monitoring results, report of physical tampering, customer water quality complaint). It is considered validated after ruling out other, non-contamination causes, such as equipment malfunctions, procedural errors, or normal background variability. If the indicator is valid, water contamination is a possibility and the and Investigation and Response activities begin. information management. The processes involved in the collection, storage, access, and visualization of information. In the context of a contamination incident, information includes anything that may be generated or collected during an incident (e.g., investigation results, documentation of decisions, etc.) as well as information relevant to the incident collected prior to the start of the incident (e.g., utility operational information, baseline, etc.). Investigation and Response Phase. The investigation of a validated indicator of water contamination to determine if contamination has occurred, and the implementation of responses to protect public health and limit economic impacts. This phase is a cyclical process of evaluating information, planning the investigation and response activities, and implementing the plans to gather new information and limit the impact on the system/customers. The phase ends if contamination is ruled-out or if contamination is confirmed. Logistics Section. The Section responsible for providing facilities, services, and materials for the incident. monitoring. The process of collecting and analyzing a datastream over time. 30 ------- Guidance for Responding to Drinking Water Contamination Incidents National Incident Management System (NIMS). A system that provides a consistent nationwide framework and approach to enable all government, private-sector, and nongovernmental organizations to work together during domestic incidents. NIMS works within the National Response Framework (NRF), which serves as a guide to national response to all types of disasters and emergencies that range from the serious but purely local to large-scale terrorist attacks or catastrophic natural disasters. NIMS provides the template for the management of incidents, while the NRF provides the structure and mechanisms for national-level policy for incident management. Operations Section. The Section responsible for all tactical operations at the incident. operational response. A change in the way a distribution system is operated (e.g., changes in pumping, storage facility operations, or valve configuration) in order to limit the spread of contamination and prevent or reduce the impact on the system and on customers. possible. Contamination is considered possible if an indicator of contamination is investigated and contamination cannot be ruled out. Possible contamination is the lowest/first confidence level presented in the Response Protocol Toolbox (EPA, 2003). Planning Section. Responsible for the collection, evaluation, and dissemination of information related to the incident, and for the preparation and documentation of the Incident Action Plan. primacy agency. The organization responsible for overseeing drinking water utility compliance with drinking water regulations. In most cases the primacy agency is a state agency such as a state department of environmental protection, environmental quality, or public health, but in some circumstances EPA serves as the primacy agency. public notification. Official communication to utility customers regarding the quality and safety of their drinking water. A public notification may include instructions to customers, such as to not use the water for any purpose, not use the water for drinking, or boil the water before use. rapid field testing. Testing performed in the field to identify specific contaminants or contaminant classes in water and to help determine if additional personal protective equipment or safety precautions are necessary and to focus the investigation. Remediation Action Plan (RAP). A plan developed to guide the process of treating and decontaminating the drinking water distribution system after contamination has been confirmed and fully characterized. The plan specifies the details for performing the decontamination, including the objectives, methods, schedule, personnel involved, health and safety information, and required approvals. Remediation and Recovery Phase. The characterization of the contamination to determine its source, extent, and fate in the distribution system; the planning and implementation of treatment and decontamination of the contaminated water and infrastructure; and the clearance of the distribution system to return to normal operation. This phase follows the Investigation and Response Phase, beginning once contamination has been confirmed by the investigation. response activity. An action taken by a utility, public health agency, or another response partner to minimize the consequences of an undesirable water quality incident. Response actions may include issuing a public notification, changing system operations, flushing the system, or others. 31 ------- Guidance for Responding to Drinking Water Contamination Incidents response partners. A subset of external partners that assist a water utility during emergency response activities such as site characterization, laboratory analysis, public notification, and provision of alternate water supply. risk communication. The communication of issues and information, both internally and externally to a utility, concerning the impact and outcome of an incident, including public information releases. Risk Communication Plan (RCP). A plan developed by a utility to guide communications with the public and coordination with response partners and the media during an emergency. sample collection for laboratory analysis. The collection of water samples for laboratory analysis from taps, dedicated sampling stations, fire hydrants, and storage tanks in the distribution system by field personnel to support the determination of whether drinking water contamination has occurred. site characterization. The process of collecting information from the site of a suspected contamination incident. Site characterization activities include the visual site hazard assessment, site safety screening, rapid field testing, sample collection, and sample packaging and shipping. Site Characterization and Sampling Plan (SC&SP). An incident-specific set of instructions prepared by utility management to guide field response activities. The SC&SP specifies the location of the investigation site or sampling location; field tests to be performed; and the types of samples to collect for laboratory analysis. If multiple locations will be investigated, a separate site-specific SC&SP is required for each location. site safety screening. The process of screening for environmental hazards at the site of a field investigation to help ensure worker safety. Typical site safety screening includes instrumentation for monitoring volatile or combustible gases and radiation. source water. Water from natural resources that is generally treated in order to produce drinking water for a community. Source water is usually classified as either groundwater (drawn from aquifers) or surface water (drawn from rivers, streams, lakes, ponds, etc.). Prior to being removed for the purpose of drinking water production, surface water may have other uses such as recreation (e.g., boating, swimming, fishing), aquaculture, and transportation route, etc. Supervisory Control and Data Acquisition (SCADA). A system that collects data from various sensors at a drinking water treatment plant and locations in a distribution system, and sends this data to a central information management system. Technical Specialist. An ICS unit under the Planning Section that is unique to a contamination incident. The unit is comprised of utility and response partner personnel with specialized knowledge, such as laboratory capabilities or distribution operations, that can aid the Incident Commander in planning and coordinating the various investigation, response, and remediation activities. Unified Command. An application of the Incident Command System used when there is more than one agency with incident jurisdiction. Agencies work together through the designated members of the Unified Command. Often the senior person from agencies participates in the Unified Command, to establish a common set of objectives and strategies and a single Incident Action Plan. use restriction. A notification issued during a water contamination incident to inform the public and customers that the water may be contaminated, an investigation is underway, and that use of the water 32 ------- Guidance for Responding to Drinking Water Contamination Incidents should be restricted in some manner. A use restriction provides instructions/restrictions for the use of the drinking water supply (i.e., "do not use," "do not drink," or "boil water"). validated indicator. An indicator of water contamination is considered validated after ruling out other, non-contamination causes, such as those caused by equipment malfunctions, procedural errors, or normal background variability. If the indicator is valid, water contamination is a possibility and Investigation and Response activities begin. visual site hazard assessment. Visual inspection of an investigation site or sampling location for immediate hazards and indicators of suspicious or criminal activity. Information from a visual site hazard assessment is used to make an initial determination of site safety and to determine if an emergency response partner (law enforcement, HazMat) is needed. water quality parameter testing. Measurement of water quality parameters using instruments in the field or in the laboratory. Examples include disinfectant residual, pH, and temperature. Water Quality Surveillance and Response System (SRS). A system that employs one or more surveillance components to monitor and manage source water and distribution system water quality in real time. An SRS utilizes a variety of data analysis techniques to detect water quality anomalies and generate alerts. Procedures guide the investigation of alerts and the response to validated water quality incidents that might impact operations, public health, or utility infrastructure. Water Security Initiative (WSI). A program developed by EPA to design, evaluate, and promote adoption of Water Quality Surveillance and Response Systems within the drinking water sector. 33 ------- |