Introduction
Due to its inherent political nature, developing a universally accepted definition of “terrorism” has proven challenging. The United States Federal Bureau of Investigation (FBI) has defined terrorism since the 1980s as “the unlawful use of force or violence against persons or property to intimidate, or coerce a government, the civilian population, or any segment thereof in furtherance of political or social objectives.”Reference Pomerantz 1 Over the last 3 decades, there has been an apparent increase in both the complexity and frequency of large-scale terrorism events,Reference Besenyő, Márton and Shaffer 2 –Reference Goralnick, Van Trimpont and Carli 6 likely driven by perpetrators’ aim of maximizing casualties and impact.
Similarly, a universally accepted term and definition do not yet appear to exist for coordinated terrorist attacks (CTAs). Throughout the literature, it is often referred to as asymmetric, mega-terrorism, multi-site, or complex and/or coordinated attacks. For example, the Department of Homeland Security (DHS) defines such events as Complex Coordinated Terror Attacks or CCTAs, 5 whereas Cagliuso et al. in Ciottone’s Disaster Medicine refer to these attacks as Asymmetric or Coordinated Attacks (CAs) defined by a list of criteria.Reference Cagliuso, Goolsby, Kirsch, Ciottone, Burkle and Fares Al-Ali 3
Such attacks differ from conventional, simple singular terror attacks such as the 1991 Musgrave Park Hospital bombing,Reference Hodgetts 7 in that CTAs typically unfold across both space and time. Coordinated attacks may involve sequential, simultaneous, or near-simultaneous attacks across single or multiple sites or over an expansive geographic area, with any combination of such elements. Intent is the consistent variable; CTAs aim to be more destructive and lethal than simple, singular attacks.Reference Cagliuso, Goolsby, Kirsch, Ciottone, Burkle and Fares Al-Ali 3 For this paper, we define a CTA as an intentional terror attack by non-state actors or designated terrorist organizations that occurs across space and time, often against multiple sites using one or more modalities.
Why Do CTAs Matter In Health Care?
Cagliuso in Ciottone’s Disaster Medicine notes that “coordinated attacks…have become a part of the systematic approach of terrorists.”Reference Cagliuso, Goolsby, Kirsch, Ciottone, Burkle and Fares Al-Ali 3 Since the beginning of the 21st century, several high-profile CTAs have left a lasting imprint on global consciousness. The 9/11 attacks, in which 19 terrorists hijacked 4 planes as weapons against 3 targets, resulted in nearly 3,000 deaths.Reference Cushman, Pachter and Beaton 8 In 2004, sequential bombings on four commuter trains in Madrid during morning rush hour caused 193 deaths and 2,050 injuries.Reference Marghella, Ashkenazi, Landesman and Weisfuse 9 , Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 In 2008, terrorists carried out twelve coordinated shooting and bombing attacks across Mumbai over four days, including at a hospital, killing more than 160 individuals and injuring over 300.Reference Bhandarwar, Bakhshi and Tayade 11 –Reference McPartland and Fagel 13In the November 2015 Paris attacks, shootings and bombings at multiple locations resulted in 130 deaths and 416 injuries.Reference Femy, Follin and Juvin 14 –Reference Ghanchi 16 Most recently, the 2023 October 7th Attack in Israel involved over 3000 terrorists who utilized multiple modalities across hundreds of civilian, health care, and military targets, leading to 1,164 fatalities, 3,300 injuries, and the kidnapping of 251 hostages.Reference Goldman, Lipsky and Radimislensky 17 –Reference West, Alpert and Braitberg 20
Except for the 2008 MumbaiReference Bhandarwar, Bakhshi and Tayade 11 –Reference McPartland and Fagel 13 and the 2023 October 7th Attacks,Reference Gozlan, Abuhasira and Dreiher 18 –Reference West, Alpert and Braitberg 20 most of the CTAs above did not directly target health care-related facilities or personnel. This review will discuss how CTA events significantly impacted hospital systems and medical response, underscoring the importance of further distinguishing between simple singular attacks and CTAs in health care planning.
General terror attacks targeting health care are a growing threat.Reference Besenyő, Márton and Shaffer 2 , Reference Hodgetts 7 , Reference Zatat 21 , Reference Torjesen 22 Despite designation as critical infrastructure, health care facilities remain soft targets for terror attacks.Reference Besenyő, Márton and Shaffer 2 , Reference De Cauwer, Somville and Sabbe 23 –Reference Hoffman 27 CTAs have increasingly targeted health care facilities directly or through secondary attacks on responding personnel or facilitiesReference Besenyő, Márton and Shaffer 2 , Reference De Cauwer, Somville and Sabbe 23 , Reference Hojman, Rattan and Osgood 24 , Reference Hoffman 27 , Reference Ganor and Halperin Wernli 28; thereby creating a troubling trend of disrupting health care infrastructure, amplifying the attacks’ impact on affected populations.Reference Besenyő, Márton and Shaffer 2 , Reference De Cauwer, Somville and Sabbe 23 , Reference Hojman, Rattan and Osgood 24 , Reference Hoffman 27
This scoping review aims to examine the existing literature on CTAs of recent history that either directly targeted health care facilities or significantly impacted responding hospital operations. By identifying potential gaps in preparedness and response, the review will outline implications and policy recommendations for enhancing hospital readiness, response protocols, and overall resilience.
Methods
Design
Data collection adhered to the Preferred Reporting Items for Systematic Reviews and Meta-Analysis (PRISMA) Guidelines and followed the Arksey and O’Malley five-step framework.Reference Tricco, Lillie and Zarin 29 Published manuscripts were retrieved from 6 databases and search engines using keywords and controlled vocabulary relating to coordinated attacks/events and hospital facilities. Data analysis was guided by Whittemore and Knafl’s (2005) integrative methodology, evaluating whether the terror event could be characterized as coordinated, whether it directly targeted or impacted a health care facility, and how such a facility might have responded. Given the lack of a universally accepted CTA definition, CTA designation was reviewer-determined, applying our proposed defining criteria based on space or time coordination of the referenced attack, involvement of either multiple sites or sequential versus simultaneous attacks, and evidence of intentionality.
Data Collection
Comprehensive searches were executed in Ovid MEDLINE, Ovid Embase, CINAHL, Scopus, and Web of Science Core Collection on September 5, 2024, using relevant keywords (Table 1). Searches were limited to the English language. Please refer to the appendices for full search strategies. A total of 2,514 results were retrieved. After removing duplicates, 1,416 unique results remained for the initial title and abstract screening using Covidence (www.covidence.org). In addition to subscription databases, the research team reviewed the first 200 results from Google Scholar, which proved to be a reasonable number of results to screen, as there was a high overlap between Web of Science and Google Scholar.Reference Haddaway, Collins and Coughlin 30 Bibliographies from the included studies were also reviewed, and 6 additional results were identified and manually screened.
MeSH terms and keywords
To conduct our scoping review, our reviewers identified CTA-qualifying attacks on hospitals or hospital responses to such terrorism events using our inclusion and exclusion criteria (Table 2). Reviewing authors had access to the inclusion and exclusion criteria throughout the entire process (Table 2). 31 Two authors completed an initial title and abstract screening. Full text screenings were performed independently by 2 reviewers each. Any conflicts throughout the screening and review process were resolved through discussion and, when needed, adjudication by senior reviewer FI. All available full-text papers identified as relevant to the subject were included following our criteria set forth and collected as reported through the PRISMA diagram (Figure 1). Reviewers were not blinded to authorship or journal source, consistent with standard scoping review methodology. Data from the selected and included papers was subsequently extracted as discussed below.
Inclusion and exclusion criteria
PRISMA Flow DiagramReference Tricco, Lillie and Zarin 29
Data Analysis
The extracted data was entered into Microsoft 365 Excel Sheets and Microsoft 365 Word tables (Microsoft Corporation; Redmond, Washington, USA). This information included: authors, type of paper, year of publication, location setting, details of the referenced attacks, including the discussed duration of the event, modalities used, targets, hospital response to the described event, discussed lessons learned, and authors’ proposals for future improvements.
Results
Of the 1,616 peer-reviewed publications screened, 26 met the inclusion criteria and were included in the review (Figure 1). The data extracted from these studies are summarized in Tables 3 and 4. Nearly 30% (n = 7) of these publications directly addressed CTA events in which health care facilities were confirmed targets of the attacks,Reference Bhandarwar, Bakhshi and Tayade 11 –Reference McPartland and Fagel 13 , Reference Gozlan, Abuhasira and Dreiher 18 –Reference West, Alpert and Braitberg 20 , Reference Ganor and Halperin Wernli 28 one suspected hospital targeting,Reference Hojman, Rattan and Osgood 24 and 12 publications examined how non-targeted hospitals responded to specific CTAs.Reference Cushman, Pachter and Beaton 8 –Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 , Reference Femy, Follin and Juvin 14 –Reference Ghanchi 16 , Reference Mohammed, Mann and Nawabi 32 –Reference Gates, Arabian and Biddinger 37 As outlined in Table 3 and Table 4, while most studies (n = 17) employed a Retrospective Descriptive Case Study Analysis (RDCSA) design, 5 (19.2%) Secondary Data Analysis (SDA) papers and 1 special report examined the broader trend of terrorist attacks targeting hospitals where notable CTA events were referenced.Reference Besenyő, Márton and Shaffer 2 , Reference McNeilly, Jasani and Cavaliere 4 , Reference De Cauwer, Somville and Sabbe 23 , Reference Jasani, Alfalasi and Liang 26 , Reference Ulmer, Barten and De Cauwer 38 , Reference Besenyő and Shaffer 39
Coordinated terror attacks and health care facilities impacted and targeted data extraction
RDWTI: RAND Database of Worldwide Terrorism Incidents; GTD: Global Terrorism Database; SHCC: United Nation’s Safeguarding Health in Conflict Coalition; ACLED: Armed Conflict Location and the Event Data Project; AWSD: Aid Worker Security Database; CIS: Coordinated in Sequence; SSC: Simultaneous and Sequential Coordination; NSC: Near-Simultaneous Coordination.
* CTAs where hospitals/health care facilities were targets.
Analyzed and extracted response methods, lessons, and proposal analysis of coordinated terror attack and health care facility literature
* CTAs where hospitals/health care facilities were targets.
Geographic and Temporal Distribution
The included studies described CTAs occurring in a broad range of countries, while SDAs were global in their study population. Most of the CTA events discussed occurred between 2001 and 2015: the September 11, 2001 attacks (USA),Reference Cushman, Pachter and Beaton 8 2003 Istanbul Bombings (Turkey),Reference Rodoplu, Arnold and Tokyay 35 the 2004 Madrid train bombings (Spain) (n = 2, 7.7%),Reference Marghella, Ashkenazi, Landesman and Weisfuse 9 , Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 the 2005 London bombings (UK) (n = 2, 7.7%),Reference Mohammed, Mann and Nawabi 32 , Reference Aylwin, König and Brennan 33 the 2008 Mumbai attacks (India) (n = 3, 11.5%),Reference Bhandarwar, Bakhshi and Tayade 11 –Reference McPartland and Fagel 13 the 2011 Oslo Attacks (Norway),Reference Gaarder, Jorgensen and Kolstadbraaten 34 the 2011 Tikrit Bombings (Iraq),Reference Ganor and Halperin Wernli 28 and the 2015 Paris attacks (France) (n = 3, 11.5%).Reference Femy, Follin and Juvin 14 –Reference Ghanchi 16 More recent analyses published were related to the hospital responses during the 2023 October 7th Attacks in Israel (n = 3, 11.5%).Reference Gozlan, Abuhasira and Dreiher 18 –Reference West, Alpert and Braitberg 20
Characteristics of Attacks
The most common modality utilized was bombings (>75%), followed by shootings, hostage taking, arson, and hijacking (Table 3). The number of attack sites ranged from 2 to 41, and the duration ranged from less than a minute to 60 hours (Table 3), reflecting the unpredictable time frame and nature of such events. CTA targets varied across public transportation infrastructure, religious centers, government buildings, public venues, and health care facilities (Table 3).
Upon review, the timelines of CTA events are outlined in Table 3, and the temporality of these CTA events was analyzed and classified accordingly. Highlighting their temporal nature, most CTAs reviewed either appeared to have been what could be classified as “Coordinated in Sequence” (CIS) or “Simultaneously and Sequentially Coordinated” (SSC) (n = 7, n = 9, respectively). Examples of CIS events include the 9/11 Attacks, the 2004 Madrid Bombings, and the 2011 Oslo Attacks. Examples of SSC events include the 2015 Paris, 2008 Mumbai, and the 2023 October 7th Attacks. Only 4 papers described 2 CTAs, in Istanbul and Boston, which could be classified as “Near-Simultaneous Coordination” (NSC), bombings that occurred within less than a minute of each other.
Hospital Response Measures
The hospitals described varied in type and capacity, encompassing Level I Trauma Centers, regional tertiary referral centers, university-affiliated teaching hospitals, and community medical centers. Although hospital response capacity and infrastructure varied, the literature indicates that responding hospitals employed several common strategies for response (Table 4).
Most hospitals activated disaster and surge protocols, designating trauma bays and operating rooms for the treatment of critically injured patients.Reference Cushman, Pachter and Beaton 8 , Reference Bhandarwar, Bakhshi and Tayade 11 , Reference Femy, Follin and Juvin 14 , Reference Ghanchi 16 , Reference West, Alpert and Braitberg 20 , Reference Aylwin, König and Brennan 33 , Reference Gaarder, Jorgensen and Kolstadbraaten 34 , Reference Osgood, Scanlon and Jotwani 36 Three papers highlighted the immediate cancellation of elective surgeries and outpatient medical services, allowing for increased clinical capacity.Reference Marghella, Ashkenazi, Landesman and Weisfuse 9 , Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 , Reference Gozlan, Abuhasira and Dreiher 18 Non-clinical spaces in hospitals, such as lobbies, were adapted into triage zones, or space was increased by setting up tents outside.Reference Femy, Follin and Juvin 14 , Reference Hirsch, Carli and Nizard 15 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference Rodoplu, Arnold and Tokyay 35
Non-critical patients were diverted to peripheral facilities, and secondary transfers were also utilized in 4 cases to reset surge capacities at receiving hospitals for the incoming waves of patients.Reference Femy, Follin and Juvin 14 , Reference Gozlan, Abuhasira and Dreiher 18 –Reference West, Alpert and Braitberg 20 Three cases discussed the crucial coordination between hospitals, prehospital, and law enforcement agencies in managing scene safety and ensuring continuous patient flow.Reference Hirsch, Carli and Nizard 15 , Reference West, Alpert and Braitberg 20 , Reference De Cauwer, Somville and Sabbe 23 Two cases noted the reassignment of staff to new roles and the integration of external volunteers to meet demands.Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20
Lessons Learned
The most frequently cited key lessons included: communication failures, surge capacity limitations, triage errors, poor coordination, and security concerns (Table 4). During the initial response phases, several papers cited communication failures of pre–existing paging and notification systems, command structure communication, and interagency coordination.Reference Cushman, Pachter and Beaton 8 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20 , Reference Mohammed, Mann and Nawabi 32 Despite many hospitals emptying the ED upon activation, surge capacity limitations were identified in several areas, including final patient dispositions, intensive care unit (ICU) bed and operating room (OR) availability, blood supply, and staffing shortages.Reference Femy, Follin and Juvin 14 , Reference Hirsch, Carli and Nizard 15 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference Alpert, Assaf and Nama 19 , Reference Gaarder, Jorgensen and Kolstadbraaten 34 Retrospectively, triage systems in Mumbai 2008Reference Roy, Kapil and Subbarao 12 , Reference McPartland and Fagel 13 were reported to have failed, while other studies determined that issues of over-triage rather than under-triage appeared to have led to inefficient resource allocation, impacting outcomes.Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 , Reference Aylwin, König and Brennan 33 , Reference Gaarder, Jorgensen and Kolstadbraaten 34 Inadequate prehospital-hospital coordination resulted in delays in patient arrival, uneven distribution of patients, and a general lack of situational awareness.Reference Femy, Follin and Juvin 14 , Reference West, Alpert and Braitberg 20 , Reference Rodoplu, Arnold and Tokyay 35 Several papers also discussed hospitals that encountered direct or suspected security threats, resulting in the need to adjust and tailor emergency department security protocols in real-time.Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20 , Reference Hojman, Rattan and Osgood 24 , Reference Jasani, Alfalasi and Liang 26 , Reference Ganor and Halperin Wernli 28
Recommendations for Future Preparedness
Despite differences in event contexts, the findings across studies revealed recurring patterns in operational challenges and opportunities for improvement of CTA response (Table 4). The literature provided common retrospective evidence-driven recommendations to strengthen future preparations for such challenging attacks. Generally, papers highlighted the need for the development of redundant and resilient communication platforms, as well as the integration of hospital command structures with local law enforcement and EMS.Reference Cushman, Pachter and Beaton 8 , Reference West, Alpert and Braitberg 20 , Reference Hojman, Rattan and Osgood 24 Many called for more frequent, routine multidisciplinary disaster training across hospital systems with complex scenarios to stress the system to its maximum surge capacity.Reference Besenyő, Márton and Shaffer 2 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20 , Reference De Cauwer, Somville and Sabbe 23 , Reference Aylwin, König and Brennan 33 , Reference Rodoplu, Arnold and Tokyay 35 Given the need for diversion and secondary transfers in replenishing surge capacities, papers called for the establishment of regional trauma coordination frameworks to facilitate transfers and interfacility collaboration.Reference Marghella, Ashkenazi, Landesman and Weisfuse 9 , Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 , Reference De Cauwer, Somville and Sabbe 23 , Reference Ulmer, Barten and De Cauwer 38 Lastly, the majority of analyses identified the need for facility hardening measures to reduce the overall vulnerability of health care facilities to primary or secondary attacks.Reference Besenyő, Márton and Shaffer 2 , Reference McNeilly, Jasani and Cavaliere 4 , Reference De Cauwer, Somville and Sabbe 23 , Reference Ganor and Halperin Wernli 28 , Reference Besenyő and Shaffer 39
While the above results in Table 4 summarize recurring themes, the following discussion interprets CTA-specific drivers, vulnerabilities, lessons, and strategies.
Discussion
The existing literature widely acknowledges that terrorist events present magnified challenges for medical and disaster response systems compared to other mass casualty incidents (MCIs).Reference Cagliuso, Goolsby, Kirsch, Ciottone, Burkle and Fares Al-Ali 3 , Reference Goralnick, Van Trimpont and Carli 6 , Reference McPartland and Fagel 13 , Reference De Cauwer, Somville and Sabbe 23 , Reference Pepper, Archer and Moloney 40 Reviewed SDAs demonstrate an adequate body of work exploring the increasing frequency of terror attacks targeting medical response infrastructure, both as primary and secondary attacks, with trends pointing to growing rates of primary direct attacks on hospitals.Reference Besenyő, Márton and Shaffer 2 , Reference McNeilly, Jasani and Cavaliere 4 , Reference De Cauwer, Somville and Sabbe 23 , Reference Jasani, Alfalasi and Liang 26 , Reference Ulmer, Barten and De Cauwer 38 , Reference Besenyő and Shaffer 39 Despite this, a significant gap remains in the literature regarding the distinct classification and analysis of CTAs, as the authors of these publications do not explicitly define the terror events as CTAs. Instead, published papers discuss general trends in hospital-targeted attacks or present case studies regarding hospital responses to qualifying attacks. No quantitative CTA-specific analysis was found within the broader evaluation of global terror events and hospital targeting.
Commonly cited lessons on hospital response to specific CTAs, as well as policy recommendations and strategies for increasing hospital preparedness and resilience, are discussed below.
Lessons, Policy Recommendations, and Strategies for Hospital Preparedness and Resilience
Rapid Activation: Reviewed literature highlights the critical need for enhanced surge capacity and effective staff allocation in response to CTAs. The use of Plan Blanc/ORSAN, preestablished protocols in France for medical response to sudden patient influxes in exceptional events, in Paris in 2015, was a successful model for rapidly mobilizing medical teams and staff within hours.Reference Femy, Follin and Juvin 14 –Reference Ghanchi 16 Similarly, the Mumbai, Oslo, and London responses reaffirmed the necessity for hospitals to immediately activate respective emergency protocols to manage the sudden substantial influx of critically injured patients.Reference Bhandarwar, Bakhshi and Tayade 11 , Reference Roy, Kapil and Subbarao 12 , Reference Femy, Follin and Juvin 14 –Reference Ghanchi 16 , Reference Mohammed, Mann and Nawabi 32 , Reference Aylwin, König and Brennan 33
Staggered Resource Utilization: Managing intentional terror-related MCI events requires efficient resource utilization when facing strained and limited capacities.Reference Adini and Peleg 41 –Reference Singer, Singer and Halperin 43 Multiple papers from events such as 9/11, Paris, Oslo, London, and Israel highlighted the need for effective in-hospital resource utilization to improve surge capacity in the event of large-scale and/or prolonged attacks. Such events underscore the need to ensure hospitals have stockpiles, with redundant and robust supply chains, for critical supplies and medicines to be released in a staggered method, in sync with repeated waves of patients that often occur during unfolding CTA events.Reference Cushman, Pachter and Beaton 8 , Reference Hirsch, Carli and Nizard 15 , Reference Gozlan, Abuhasira and Dreiher 18 –Reference West, Alpert and Braitberg 20 , Reference Aylwin, König and Brennan 33 , Reference Rodoplu, Arnold and Tokyay 35
Effective CTA-specific Triage Systems: Given the crucial role of resource utilization,Reference Einav, Aharonson-Daniel and Weissman 44 triage systems that prioritize care while optimizing use of limited resources were critical in the attacks reviewed.Reference Cushman, Pachter and Beaton 8 –Reference Bhandarwar, Bakhshi and Tayade 11 , Reference Femy, Follin and Juvin 14 , Reference West, Alpert and Braitberg 20 , Reference Hojman, Rattan and Osgood 24 , Reference Aylwin, König and Brennan 33 , Reference Gaarder, Jorgensen and Kolstadbraaten 34 , Reference Osgood, Scanlon and Jotwani 36 , Reference Gates, Arabian and Biddinger 37 Traditional triage systems are typically designed for single-site, single-modality, short-duration incidents and may fail to account for evolving threat environments, repeated casualty influxes, and constrained or compromised evacuation pathways. Gaps in triage identified in the various cases examined, such as Madrid and Mumbai, underscore previous calls that triage systems used for general MCI events are likely insufficient for CTAs.Reference Pepper, Archer and Moloney 40 CTA-specific triage must therefore emphasize resource considerations, dynamic reassessments, and disposition decisions. Future preparedness should motivate innovations aimed at the development of novel triage systems that incorporate CTA resource-minded protocols as well as collaborative interdepartmental in situ simulation training that explicitly models sequential casualty waves and security-restricted transport.
Prehospital-Hospital Coordination Systems: Poor coordination between hospitals and emergency medical services (EMS) caused delays in flow and inappropriate patient distribution, resulting in uneven surges, best highlighted in the 2003 Istanbul Bombings and the 2004 Madrid Bombings.Reference Marghella, Ashkenazi, Landesman and Weisfuse 9 , Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 , Reference West, Alpert and Braitberg 20 , Reference Rodoplu, Arnold and Tokyay 35 Imbalanced patient distribution may also occur due to security-related constraints, as demonstrated during the 2023 October 7th Attacks in Israel, where ongoing attacks and threats directly hindered EMS evacuations.Reference Gozlan, Abuhasira and Dreiher 18 –Reference West, Alpert and Braitberg 20 As a result, multiple studies propose the development of functional regional trauma systems and inter-hospital communication and real-time tracking systems for coordination from the prehospital setting through final disposition within the hospital.Reference Marghella, Ashkenazi, Landesman and Weisfuse 9 , Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 , Reference McPartland and Fagel 13 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20 , Reference De Cauwer, Somville and Sabbe 23 , Reference Rodoplu, Arnold and Tokyay 35
Secondary Transfers: To manage patient surge, during the 2015 Paris Attacks and the 2023 October 7th Attacks in Israel, overwhelmed primary hospitals benefited from the strategic use of secondary transfers of patients to outside facilities.Reference Femy, Follin and Juvin 14 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference Alpert, Assaf and Nama 19 In both responses, stabilized patients were relocated to other medical facilities, preserving capacity at the primary receiving hospitals and enabling improved flow of casualties.
Frequent Multidisciplinary Exercises: Establishing and implementing crisis response plans and frameworks are key to responding to such complex disasters. The Plan Blanc, which mandates regular emergency response training, was credited with improving efficiency during the 2015 Paris attacks.Reference Femy, Follin and Juvin 14 –Reference Ghanchi 16 French hospitals that had conducted similar drills under this plan were better prepared for the mass casualty incidents that unfolded. Similarly, Israeli hospitals that have run regular and frequent large-scale mass casualty exercises for decadesReference Adini and Peleg 41 , Reference Leiba, Blumenfeld and Hourvitz 45 demonstrated largely effective responses despite the scale of the 2023 attack, with recommendations for frequent hospital-wide training and drills involving all departments. Both works by Bruce Hoffman and Cagliuso et al. reaffirm this recommendation to expand exercises and drills to include potential hospital attacks as well as complex attacks.Reference Hirsch, Carli and Nizard 15 , Reference De Cauwer, Somville and Sabbe 23 , Reference Ganor and Halperin Wernli 28 , Reference Ulmer, Barten and De Cauwer 38 , Reference Besenyő and Shaffer 39
Hardening Infrastructure: Hospitals are soft targets and vulnerable to attack. Nearly all reviewed papers advocate for increased security policies and protocols, including controlled access to emergency departments (EDs) and surveillance systems.Reference De Cauwer, Somville and Sabbe 23 , Reference Jasani, Alfalasi and Liang 26 , Reference Ulmer, Barten and De Cauwer 38 All authors of SDAs on general hospital-targeted attacks call for improved and increased security and hardening of health care infrastructure.Reference Besenyő, Márton and Shaffer 2 , Reference McNeilly, Jasani and Cavaliere 4 , Reference De Cauwer, Somville and Sabbe 23 , Reference Jasani, Alfalasi and Liang 26 , Reference Ulmer, Barten and De Cauwer 38 , Reference Besenyő and Shaffer 39 The direct attack on Tikrit Hospital and the horizontal evacuation of hospital departments in Boston and Israel reinforce this call for secure health care infrastructure, including on-site shelters for staff and patients, as well as the establishment and utilization of reinforced underground facilities.Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20 , Reference Hojman, Rattan and Osgood 24 Specifically, during the 2023 October 7th Attacks, rocket fire necessitated that non-fortified hospital departments evacuate and reorganize into pre-designated fortified areas.Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20 Additionally, many patients were unable to be discharged due to ongoing threats outside, resulting in reduced capacity.Reference Gozlan, Abuhasira and Dreiher 18 , Reference West, Alpert and Braitberg 20
Robust Communication and Information Technology (IT) Systems: Coordination, communication, and crisis plans are crucial during terrorism-related MCI events.Reference Cagliuso, Goolsby, Kirsch, Ciottone, Burkle and Fares Al-Ali 3 , 5 , Reference McPartland and Fagel 13 Authors across the literature recommend real-time information sharing through IT, digital media, and communication platforms, as well as mobile triage systems and enhanced interoperability between hospitals, EMS, and each other, to improve efficiency.Reference McPartland and Fagel 13 , Reference Hirsch, Carli and Nizard 15 , Reference Ghanchi 16 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference De Cauwer, Somville and Sabbe 23 , Reference Hojman, Rattan and Osgood 24 , Reference Mohammed, Mann and Nawabi 32 , Reference Gaarder, Jorgensen and Kolstadbraaten 34 Cellular networks may also fail due to the volume of calls. Therefore, redundant modalities and alternative modes of communication, such as satellite phones, should be utilized to communicate within the facility and with external agencies.Reference Cushman, Pachter and Beaton 8 , Reference Gozlan, Abuhasira and Dreiher 18
Digital patient tracking systems and system-wide electronic records can enhance hospital resilience by providing real-time data sharing for current and evolving threats enabling agencies, families, and the public to respond effectively.Reference West, Alpert and Braitberg 20 In the face of strained local hospitals, digitally integrated systems across the entire public health sector could enable the mobilization of health care resources for a system-wide, regional, state, or national response.Reference Hodgetts 7 , Reference Cushman, Pachter and Beaton 8 , Reference Bhandarwar, Bakhshi and Tayade 11 , Reference Femy, Follin and Juvin 14 Additionally, such systems can improve crisis communication methods to mitigate a primary aim of terrorism—public panic and fears.Reference McPartland and Fagel 13 , Reference Ghanchi 16 , Reference Gozlan, Abuhasira and Dreiher 18 , Reference De Cauwer, Somville and Sabbe 23 , Reference Hojman, Rattan and Osgood 24 , Reference Mohammed, Mann and Nawabi 32 , Reference Gaarder, Jorgensen and Kolstadbraaten 34
Psychosocial Support: Several of the reviewed articles highlighted the significant concern for psychological trauma among health care workers in the aftermath of mass casualty events, and this should be improved upon. Health care workers not only faced unprecedented events but were also often directly affected by the attack or threats to their own personal and family safety. Implementing mental health interventions and long-term longitudinal psychosocial support structures were recommended in multiple studies.Reference McNeilly, Jasani and Cavaliere 4 , Reference Marghella, Ashkenazi, Landesman and Weisfuse 9 , Reference Peral-Gutierrez de Ceballos, Turégano-Fuentes and Pérez-Díaz 10 , Reference McPartland and Fagel 13 , Reference Hirsch, Carli and Nizard 15 , Reference Ghanchi 16 , Reference West, Alpert and Braitberg 20 , Reference Gaarder, Jorgensen and Kolstadbraaten 34
Unique Challenges of CTA-Specific Medical Response
Although the reviewed CTA responses occurred across diverse health care settings, including high-resource trauma networks (e.g., Paris, London, or Israel) versus lower-resource systems (e.g., Mumbai or Istanbul), the impact of CTAs on hospital response shared common unique challenges. Unlike general MCIs or simple terror attacks, CTAs present a complex and unique threat to health care systems, particularly hospitals located in urban centers or near other soft targets.Reference De Cauwer, Somville and Sabbe 23 The hospital responses to CTA events discussed in the literature above illustrate how whether be it in a low-resource facility or an advanced high-capacity trauma facility CTAs result in significant operational stress.
While most hospitals demonstrated prompt activation of their disaster plans, consistent failures in communication, inter-agency coordination, and surge capacity management were cited and addressed above. Despite taking place across various geographic regions and contexts, within both resource-limited and resource-rich health care settings, the lessons learned from the studies reviewed were common and repetitive, suggesting recurrent failures of institutional protocols worldwide, of universal recognition of CTA-related gaps, and a lack of applied lessons shared, reinforcing Goralnick et al.’s call-to-action.Reference Goralnick, Van Trimpont and Carli 6
Health care facilities typically aim to prepare for traditional MCIs and general terrorist threats.Reference Besenyő, Márton and Shaffer 2 , Reference De Cauwer, Somville and Sabbe 23 However, terrorists intentionally create attacks that generate increasing devastation. The use of multiple modalities, multiple sites, over an unpredictable and protracted duration within a high-risk security environment, affects disaster response in unprecedented ways.Reference Cagliuso, Goolsby, Kirsch, Ciottone, Burkle and Fares Al-Ali 3 , 5 , Reference McPartland and Fagel 13 This review highlights the added stressors and shortcomings of these systems and plans when confronted with the high volume and patient acuity seen in CTAs.Reference Cagliuso, Goolsby, Kirsch, Ciottone, Burkle and Fares Al-Ali 3 , Reference McPartland and Fagel 13 , Reference Pepper, Archer and Moloney 40 While many operational challenges identified above, such as surge capacity, secondary transfers, and communication failures, also occur in conventional MCIs, CTAs introduce distinct stressors that magnify these issues. These include intentional targeting of hospitals, prolonged attack duration, repeated casualty surges, compromised situational awareness, and concurrent security threats. This CTA-specific insight is therefore not the presence of these challenges alone, but their persistence, interaction, and escalation over time; conditions under which standard MCI protocols are consistently proven insufficient. Future CTA preparedness requires adaptive measures tailored by individual health care systems or facilities to address these highlighted stressors. This review seeks to raise awareness of the shared but unique challenges of CTAs compared to traditional single-event MCIs, so that appropriate mitigation strategies can be considered and implemented accordingly, per system, setting, and resources.
Future Expected Rise in Hospital Targeting
Multiple studies have highlighted the increasing prevalence of terrorist attacks targeting hospitals. Health care facilities, especially EDs, face the continual challenge of ensuring they remain both accessible to patients while limiting accessibility to bad actors.Reference Jasani, Alfalasi and Liang 26 Research has shown that hospitals and personnel are often insufficiently prepared and lack the readiness to respond to the challenges of terrorism-related events.Reference Besenyő, Márton and Shaffer 2 –Reference McNeilly, Jasani and Cavaliere 4 , Reference De Cauwer, Somville and Sabbe 23 , Reference Jasani, Alfalasi and Liang 26 , Reference Hoffman 27 , Reference Besenyő and Shaffer 39
Recognition of this vulnerability is not only apparent to emergency and disaster managers but also to perpetrators themselves. In the Mumbai 2008 attacks, McPartland and Fagel propose that the targeting of the Cama Hospital was not pre-planned but rather a target of opportunity when assailants identified the vulnerability of the hospital.Reference McPartland and Fagel 13 De Cauwer et al. also highlighted cases where attacks were perpetrated by hospital staff and calls for increased security, not only from external actors but also from potential threats within.Reference De Cauwer, Somville and Sabbe 23 As a result of hospitals’ vulnerability, the overall frequency of terror attacks on health care has markedly risen, especially since 2010.Reference McNeilly, Jasani and Cavaliere 4 While Ganor and Halperin outlined 100 terror attacks targeting hospitals between 1981 and 2013, more recent analyses, such as McNeily et al., reported a total of 340 terrorist attacks against hospitals since the year 2000, with 72% or 263 of these occurring between 2010 and 2019 alone.Reference McNeilly, Jasani and Cavaliere 4 , Reference Ganor and Halperin Wernli 28 Jasani et al. identified over the past 5 decades 6 documented terrorist attacks directly targeting Emergency Departments.Reference Jasani, Alfalasi and Liang 26
Despite the growing attention to this phenomenon, there remains a paucity of literature or detailed data specifically examining trends on CTAs within counter-terrorism medicine. Of all the CTA incidents reviewed, only 3 involved the deliberate targeting of hospitals.Reference Bhandarwar, Bakhshi and Tayade 11 –Reference McPartland and Fagel 13 , Reference Gozlan, Abuhasira and Dreiher 18 –Reference West, Alpert and Braitberg 20 , Reference Ganor and Halperin Wernli 28 These findings underscore the need for health care emergency managers to consider not only the potential global rise in CTAs but also the possibility of a corresponding upsurge in CTAs targeting health care. In turn, hazard vulnerability assessments and plans should include such potential threats in plans related to hospital security, preparedness, and response.Reference McPartland and Fagel 13 , Reference Hancock and Johnson 25
Limitations
Several limitations were identified in this scoping review. The inconsistent definition of CTAs and lack of awareness in differentiation and delineation between coordinated attacks and simple singular terror attacks result in a scarcity of literature specific to defined CTAs. As a result, CTAs are likely to be underreported and are not discussed widely. Many papers discuss terror attacks in general but lack CTA respective terminology. This necessitated the manual review of large volumes of papers to determine whether the incident discussed would qualify as a CTA. As such, some articles may have been overlooked in the original literature search. This process introduced potential classification bias, including both over- and under-inclusion of CTA events, depending on the completeness and clarity of event descriptions within primary sources.
Additionally, this review does not provide any quantitative trends of CTAs compared to singular attacks, given the nature of a scoping review. Instead, it relies on the qualitative and anecdotal appearance of increased CTAs compared to singular attacks. Such quantitative research would help demonstrate a graphical trend to promote changes in approach and policy.
Furthermore, this review excluded literature discussing Chemical, Biological, Radiological, and Nuclear (CBRN) and cybersecurity-related attacks. This exclusion was deliberate as both fields warrant focused studies of their own. The catastrophic effects and implications of these two modalities, separately, have been broadly studied in dedicated bodies of literature and preparedness doctrine. However, as CTA perpetrators aim for heightened destruction, an expected growth in prevalence of CTAs involving cybersecurity and CBRN-related threats must be examined and prepared for. Such combined modalities would undoubtedly compound the impact of CTAs and therefore require additional preparation and further research into CTA attacks on health care facilities complicated by cyber or CBRN components. This exclusion should therefore be interpreted as a scoping decision, rather than a minimization of their importance.
Lastly, literature that only discussed the prehospital and EMS response and/or targeting was excluded. This accounts for a large amount of literature that should be studied explicitly to help further strengthen the security of prehospital personnel, including ambulances and EMS infrastructure, on which our MCI responses depend so heavily.
Conclusion
Current disaster and emergency plans often focus on general singular terrorism events but fail to account for the distinct challenges CTAs pose and their dynamic and evolving nature. Amidst evidence of increasing CTAs, hospitals must develop specific preparedness strategies for these events rather than relying on standard protocols. CTAs create compounding resource demands over extended periods, particularly when health care facilities themselves become targets. Standard MCI plans are insufficient for CTA scenarios and will result in system-wide failures if applied without modification and CTA consideration. Health care and prehospital entities must recognize this critical point to increase their readiness for CTAs specifically and improve resilience. The field’s failure to distinguish between CTAs and single-event attacks has created a critical knowledge gap regarding how these complex incidents uniquely and more significantly impact hospital operations. This gap leaves health care systems inadequately prepared and more vulnerable to CTA scenarios.
The literature discussed highlights a lack of forward-thinking preparedness, as many recommendations fail to translate into tangible policy or infrastructure changes across the health care sector. In CTA events, surge capabilities are limited, necessitating novel contingency planning, enhanced security strategies, and public health system-wide integration. Furthermore, hospitals must prepare by creating a judicious and stepwise mechanism for resource allocation to efficiently respond to the forthcoming waves of casualties inherent to CTAs. Likewise, technologies for communication systems must be made redundant and robust to withstand failures and improve coordination.
As terrorist threats grow more sophisticated and complex, health care systems must better understand, prepare for, and mitigate these evolving risks. Hospitals face increasing direct and indirect targeting, requiring a shift from reactive responses to proactive, adaptive strategies specifically designed for CTAs. Effective CTA preparedness demands comprehensive approaches that address clinical readiness, operational resilience, and structural hardening to maintain functionality during the multi-modal, multi-site, cascading, and prolonged nature of CTA events.
Supplementary material
The supplementary material for this article can be found at http://doi.org/10.1017/dmp.2026.10345.
Acknowledgments
None.
Author contribution
AB, AH, FI, and GC conceived the study. JYK conducted a preliminary literature search. AB, AM, EA, and FI performed a screening of literature. AB, AM, CT, and AP conducted a review of the literature. AB and CT extracted the relevant data. AP verified the data extraction. AB performed data analysis and authored the manuscript. All authors revised and edited the manuscript.
Competing interests
None to declare.
Ethics approval
No Ethics or IRB approval required.
