Coordinate Health-System Capacity Without Assigning Clinical Authority

The operating question is larger than the bed count

A regional coordinator is asked whether the network can support an aggregate service need through a four-hour window. One facility reports open space. Another has qualified staff but an acceptance window that closes early. A reserve site can participate only after its own leadership activates the capability. Transport can complete two cycles if the route remains open.

No single number answers the question. The answer depends on whether the service category is comparable, the declaration remains valid, support conditions hold, movement fits the interval, and the organizations responsible for action have actually acted.

This use case concerns aggregate operational coordination. It does not select a destination for a person, determine clinical suitability, rank patients, diagnose, triage, assign a bed, order movement, or direct care. Those decisions remain with qualified people and institutions under the laws, policies, privileges, plans, and command structures that apply to them.

The distinction is practical. A planning model can help a coordinator identify a six-unit shortfall or an expired acceptance window. It must not convert that finding into clinical authority.

The current workflow often assembles a plan after the facts arrive

A useful current-state map begins with the work as it exists, not an idealized architecture. A facility may publish capacity through a bed-management system, send a correction by phone, record support status in an incident tool, and confirm transport in a separate dispatch system. A coalition or network desk may reconcile those reports in a spreadsheet or shared log. Clinical teams then review individual cases through their own protected workflows.

Each artifact can be legitimate within its purpose. The coordination risk appears between them:

• the same label can refer to different service capabilities;
• a facility count can outlive the staff, oxygen, pharmacy, power, or acceptance condition that supported it;
• an available destination can be unreachable inside the required window;
• a requested resource can appear as committed before its owner authorizes release; and
• a network summary can remain green after one source has issued a correction.

The current CMS hospital emergency-preparedness condition requires each hospital in scope to maintain a comprehensive emergency-preparedness program covering its emergency plan, policies and procedures, communication plan, and training and testing. Those requirements address matters such as patient populations, continuity, staffing, subsistence and power, evacuation, arrangements with other providers, and a way to report occupancy, needs, and ability to assist to the relevant authority or incident structure. A health system with multiple separately certified facilities may elect to use a unified and integrated program; when it does, the program must account for each participating facility's unique circumstances. The rule establishes responsibilities for hospitals in scope; it does not prescribe a regional capacity formula or transfer clinical authority to a shared system.

The 2024 National Disaster Medical System Federal Coordinating Center Guide makes the operational distinction unusually concrete. Its available-bed definition includes supporting space, equipment, medical materiel, ancillary services, and staff. It treats throughput separately and asks planners to consider reception, off-loading, staging, transport, admission, equipment, staffing, operating windows, travel, reset time, and personnel sustainability. The guide is an NDMS planning source, not a universal rule for every health network, but it demonstrates why a count and an executable path are different things.

Keep the authority map beside the capacity map

The model should show who supplies each planning fact and who retains each decision. Local titles will vary, so the deployment must map actual policy rather than infer authority from a software role.

Responsibility	What the planning model may expose	Authority that remains external
Facility operations	Declared aggregate capability, support conditions, operating window, and corrections	Whether the facility declares, changes, suspends, or activates that capability
Qualified clinical professionals	A required service category supplied by an approved process	Diagnosis, triage, treatment, priority, individual transfer suitability, and destination selection
Network or coalition coordination	Cross-facility constraints, unresolved gaps, and requests for confirmation	Member-facility operations or jurisdictional incident command
Incident or jurisdictional leadership	Planning status, resource gaps, and represented alternatives	Incident objectives, public resource decisions, emergency powers, and risk acceptance within its mandate
Transport and support owners	Vehicle cycles, route windows, staffing, equipment, and acknowledgment state	Commitment, dispatch, release, substitution, and operation of their resources
Technology and security teams	Source bindings, permissions, failures, and audit events	Identity policy, access approval, interface authorization, incident response, and production release

CMS's current governing-body condition places legal responsibility for hospital conduct with the governing body and makes the medical staff accountable to it for quality of care. The exact local allocation of duties depends on applicable law and hospital governance. A Grid configuration cannot supply that interpretation.

Define the information contract before connecting systems

The smallest useful model is not a regional data lake. It is a declared contract for the aggregate facts that determine one planning conclusion.

Input or constraint	Minimum useful fields	State when the contract is not met
Service capability	Category definition, quantity, facility, source owner	unresolved if categories or ownership do not align
Validity interval	Observed time, effective time, valid-through time	expired outside the declared interval
Support gates	Staff, equipment, supplies, utilities, ancillary service, acceptance	conditional or unavailable when a required gate is absent
Aggregate demand	Category, quantity, planning horizon, supplied uncertainty	unresolved when provenance or category is missing
Movement path	Origin, destination, mode, units per cycle, travel, turnaround, route window	infeasible when the required movement cannot finish in time
External action	Responsible role, required evidence, decision state, acknowledgment	pending until the responsible authority acts

Unknown is not zero. Requested is not committed. A count valid at 19:00 is not automatically valid at 22:00. Two categories with the same unit label are not interchangeable until the qualified owners say they are.

A Grid operating pattern for the coordination layer

Configured adapters or controlled imports publish only the facts approved for this planning purpose. Grid represents their identities, definitions, revisions, and time bounds as dependencies. Authored rules evaluate named alternatives and keep at least three dimensions separate:

1. Arithmetic feasibility: does represented capacity cover aggregate demand through the required horizon?
2. Evidence sufficiency: are the material sources current, comparable, and complete?
3. Activation state: have the external facility, transport, support, and incident actions required by the alternative occurred?

A favorable arithmetic result cannot overwrite an unresolved evidence state. A complete evidence set cannot activate a reserve facility. An external authorization can be recorded without claiming the resulting service occurred.

Different participants can receive different projections of the same model revision. A facility sees its declarations and conditions. A coordinator sees cross-site margin and binding constraints. A transport desk sees approved movement requirements. A decision owner sees the open gates and the exact conclusion awaiting action. The shared element is the represented logic, not universal access to every record.

When a source correction arrives, Grid can recalculate affected conclusions and identify why an alternative changed. It can show prior and current states only when the relevant source, model, history, fixtures, and runtime identity were committed and retained. It can propose or evaluate only the alternatives the responsible owners have represented. It cannot invent capacity, extend an acceptance window, assign an individual, activate a facility, dispatch transport, or issue clinical direction.

Worked example: a synthetic aggregate capacity test

The following numbers are a transparent test fixture. Facilities A through D are labels, not real organizations. A “service unit” is an abstract aggregate counter for one externally defined category; it is not a person, patient, bed assignment, diagnosis, or care recommendation.

The planning horizon is 18:00–22:00 and aggregate demand is 20 service units.

Facility	Declared units	Validity and support	Units usable for the full horizon
A	8	Supported and valid through 22:00	8
B	7	Acceptance corrected to end at 20:00	0
C	6	Supported and valid through 22:00	6
D, reserve	8	Requires facility activation, support confirmation, and two transport cycles before 21:00	0 until every gate is satisfied

Before considering reserve capacity, the full-horizon calculation is:

8 from A + 6 from C = 14 usable units

20 required − 14 usable = 6-unit shortfall

Counting B would produce 21 displayed units, but B cannot support the full horizon after its correction. The proper result is not “21 available.” It is “14 usable through 22:00; six short; B expires at 20:00.”

Facility D can add eight units only if all three external gates are satisfied. The transport fixture supplies four units per cycle and requires completion before 21:00:

2 cycles × 4 units = 8 moved units

After the facility activation, support confirmation, and both timely transport acknowledgments arrive, the represented result becomes:

8 from A + 6 from C + 8 from D = 22 usable units

22 usable − 20 required = 2-unit margin

If one transport cycle is lost, only four reserve units fit the window and the result is 8 + 6 + 4 = 18, leaving a two-unit shortfall. The arithmetic is reproducible; the action is not automatic. A qualified process still determines whether the aggregate demand is correctly categorized, each facility stands behind its declaration, the movement is appropriate, and any real transfer should occur.

Design for the failures that a green dashboard hides

Failure injection	Required modeled behavior
Facility B's old window arrives after its correction	Preserve ordering and keep the corrected 20:00 limit authoritative
Facility C reports the same quantity under a different category	Mark the contribution unresolved instead of adding unlike units
Reserve activation arrives without support confirmation	Keep activation conditional and exclude D from executable capacity
One transport acknowledgment is missing	Recalculate to four moved units and expose the shortfall
A coordinator attempts to mark a facility active	Refuse the action unless the configured role and external evidence permit it
A connector fails after the last known report	Show source age and failure state; do not imply the report is current
Two views show different totals	Identify the source/model revision behind each and prevent silent reconciliation

These are system-behavior tests, not clinical safety validation. A production design also needs domain review, downtime procedures, trained users, interface controls, and the organization's required emergency and clinical governance.

Integration and security are part of feasibility

Start with aggregate, minimum-necessary planning data. Do not move patient-level information into this model merely because a source system contains it. If an implementation handles protected or individually identifiable information, the responsible covered entities, business associates, privacy officers, security teams, and counsel must define the permitted use, safeguards, agreements, retention, disclosure, and incident process.

Every source needs an authenticated identity, an accountable owner, a schema and category version, an accepted clock, and explicit stale-data behavior. Every role view needs least-privilege access. Interfaces need encryption, secrets management, logging, replay protection, correction handling, and tested failure modes appropriate to the environment. Cross-organization exchange requires approved agreements and technical controls; a signed message can establish origin and integrity but cannot establish that its content is clinically appropriate or operationally current.

Grid does not provide an automatic hospital, coalition, bed-management, dispatch, health-information-exchange, or incident-management integration. Deployment teams must build and test those bindings. A local model result should never be mistaken for receipt, execution, service delivery, or health outcome.

Acceptance criteria for a bounded evaluation

Run the same synthetic cases through the current workflow and the configured model. Have domain owners approve category definitions, expected results, authority gates, and failure dispositions before the test.

Evaluation dimension	Minimum acceptance evidence
Calculation	Every fixture matches an independently prepared oracle for full-horizon capacity and margin
Time and freshness	Expired, future, late, and corrected facts produce their predefined states
Category integrity	Unlike or undefined service units are never silently combined
Authority	Unauthorized activation, commitment, dispatch, and clinical actions are blocked inside the tested boundary
Explanation	Each result names the binding inputs, windows, support gates, calculation, and unresolved conditions
View consistency	Every permitted view identifies the same model state while exposing only approved fields
Recovery	Duplicate, out-of-order, interrupted, retried, and corrected events remain attributable and replayable

The organization should set its own latency, availability, usability, and security thresholds before the evaluation. A passing fixture supports only the tested product behavior. It does not establish clinical quality, patient safety, legal compliance, emergency readiness, accreditation, cost savings, service continuity, or improved outcomes.

Continue with Capacity, Time, and the Authority to Act for the full planning model, The Medical Plan Must Move for medical movement and sustainment context, and the decision evaluation worksheet for a controlled first assessment.

Primary sources

• 42 CFR § 482.15 — Hospital emergency preparedness
• 42 CFR § 482.12 — Hospital governing body
• ASPR Hospital Preparedness Program
• National Disaster Medical System Federal Coordinating Center Guide, March 2024