Your Emergency Manager Should Not Be the Incident Commander

During a cyber event at a health system, there is a reasonable chance that two people in the building both hold the title Incident Commander.

Technology operations borrowed the term from its own discipline, so the IT major incident lead is often called the Incident Commander. Emergency management uses the identical title for a different role with different authority. When someone reports that the Incident Commander made a decision, nobody is certain which one they mean.

The title collision is the visible symptom. The real question underneath it is harder, and most organizations have never answered it deliberately: who should hold command during a healthcare response?

There are two obvious candidates. Both are wrong.

Not the IT lead

When a disruption is of technical origin, some organizations place the IT major incident lead in the Incident Commander seat. The logic seems sound. The event is a technology event. The technology leader understands it best.

That is the wrong seat for them, and the reason is not disrespect for the discipline.

In a healthcare response, decisions that look technical resolve into clinical risk. Restoration sequence is the clearest example. Which application returns first determines which service line resumes, which procedures go forward, and which patients wait. That is a clinical prioritization question wearing technical clothing.

An Incident Commander who cannot independently evaluate that consequence is dependent on translation. Translation is exactly what fails under stress and time pressure, when the people doing the translating are tired, when the question is urgent, and when nobody has time to explain the second-order effects of restoring the lab interface before the pharmacy system.

The answer to a cyber event is not handing command to IT. It is giving IT a defined seat inside the command structure, with real authority over technical execution and a clear interface to clinical operations, while clinical leadership sets restoration priorities.

Not the emergency manager either

If not IT, the obvious next candidate is the emergency manager. They know the system better than anyone in the building. They wrote the plan. They run the exercises. In many organizations they end up holding the vest by default, because they are the person who understands incident command.

They should not hold it.

The Incident Commander must be someone who already holds authority over the operation. A clinical or operational executive who can direct resources, suspend services, redirect staff, and commit the organization. Emergency managers do not hold that authority. Their value is influence.

Why that is a feature, not a deficiency

The absence of command authority is what makes the emergency management function work.

Because the emergency manager did not make the command decisions, they can evaluate the response objectively afterward. They have no decisions of their own to defend. That independence is the entire basis of a credible after-action process.

Consider what that is worth. I once watched a senior executive drive to one of their hospitals during an evacuation and personally take control of air-evacuation operations, leaving the enterprise without anyone to run it. He still tells that story with pride. He will never write it up as a finding, and neither will the people who watched him do it, because he is senior and he was brave. Somebody has to. The only person positioned to is the one who held no command authority that day.

Give the emergency manager command, and you lose your only credible evaluator. You also introduce a single point of failure and an unnecessary dependency on one person being present, rested, and available. A response system should work with any qualified commander on any given day. Building it around one individual reproduces the exact fragility the structure exists to prevent.

What the emergency manager actually does

The emergency manager serves the Incident Commander, whoever that is on the day. What they do during a response is the part nobody writes down.

They make sure the team is actually activated. They ensure operational briefings are established and appropriately paced, and they help set the agenda for them. They remind the group that communicating to the larger enterprise is not a courtesy but a requirement.

They make sure the Public Information Officer is drafting and packaging the message. They make sure the Incident Commander is approving it before it goes out. They make sure somebody is measuring whether it landed.

They make sure significant events are documented as they happen rather than reconstructed later. They log open tasks and chase them to closure. They run the hotwash and the scheduled debrief. They draft the after-action report with its improvement matrix, get it approved by the senior executive, and chase the corrective actions to ground.

They enforce the response system and hold it together by paying attention to the parts that are most often overlooked or forgotten. None of that requires authority. All of it requires standing, credibility, and the willingness to ask a senior person whether something has been done.

They are not speaking into the bullhorn. They are making sure one is in the room and that the person in charge knows how to use it.

Where the emergency manager should hold real authority

There is one arena where the emergency manager should hold genuine authority, and it is not the response.

It is the design and delivery of training and exercises. Not authority for its own sake, but because they are the ones trained in the appropriate methodologies, and because they understand the regulatory bar an exercise has to clear. An exercise designed to satisfy a surveyor and an exercise designed to find real gaps are different products, and only one of them is worth the organization’s time.

That is functional authority over standards and method, of the kind a Chief Performance Improvement Officer holds for their institution. It is exercised through governance, not through command.

The same logic explains how program standardization is carried out across a multi-facility system. Influence is the right instrument during a live event. Governance and executive sponsorship are the right instruments in steady state, when the work is making hazard assessment methodology, drill design, and program metrics comparable across facilities that do not report to one another.

The distinction, simply

The emergency management director is a coach, not the starting quarterback.

A coach who takes the field has stopped coaching. The team may still score on that play. It will not run a game.

If your organization cannot name who would command an enterprise-wide disruption tomorrow morning, and cannot name a second person qualified to do so, the answer is not to hand the role to whoever best understands incident command. It is to decide which executives hold that authority, train them to use it, and let your emergency manager build the system that makes them competent when the day comes.

Mitigant Risk Solutions works with health systems on incident command design, role definition, and the training that makes command structures function under real pressure.