Enhancing Cross-Level Coordination in Healthcare Incident Command Through Virtual Incident Command System (VICS) Integration

Introduction

Emergency incidents in healthcare are managed by dispersed teams, requiring coordination under time pressure, uncertainty, and rapidly changing conditions. Many organisations rely on the Incident Command System (ICS) to clarify roles, standardise communication, and manage escalation across facilities and coordinating bodies [1-3]. Nonetheless, near-misses and operational breakdowns are still frequently attributed to slow or fragmented information flow, late recognition of severity, and weak cross-level situational awareness, especially when key decision-makers are not physically present at the scene [4-6]. Communication limitations of traditional incident command models In many healthcare ICS implementations, the higher coordination tier depends on phone calls, sequential updates, and second-hand summaries from the incident scene. During rapidly developing events, this model can introduce lag, distortion as messages pass through intermediaries, and limited verifiability of critical details (for example, what is happening at the scene, who is present, and which control measures are in place). The result is often a blurred shared picture across levels and delayed, sometimes disproportionate escalation [4,6]. In multi-level healthcare systems, the earliest trajectory of an incident is often shaped at the interface between facility command and higher coordination tiers. Facility teams must quickly establish operational control, judge whether resources are sufficient, and decide whether escalation is warranted [1,3]. However, higher tiers commonly depend on indirect reporting, which can fragment understanding, increase uncertainty, and slow support that should be mobilised early [4,6]. Improving the timeliness and verifiability of situational information without undermining established command authority remains a practical governance challenge [7-10].

Virtual command approaches, including virtual emergency operations centres (VEOCs) and digital coordination functions, have expanded as health systems have normalised remote coordination, particularly during large-scale incidents and public health emergencies [11-14]. Across this literature, visual streams and technology-enabled coordination are repeatedly linked to stronger situational awareness for remote leaders and a more consistent shared picture across distributed command locations [7,15-17]. Nonetheless, many implementations struggle with the same organisational question: how to embed virtual visibility into existing ICS practice without blurring decision rights, triggering perceptions of command override, or conflicting with governance-based escalation pathways [11,18,19]. Saudi Arabia’s Ministry of Health (MOH) cluster system provides a useful setting in which to examine this problem because it formalises escalation and coordination across facility and cluster tiers, supported by regional and central governance functions [18,20]. In effect, it mirrors scalable emergency governance models: local command is preserved when effective, while higher levels maintain readiness to support, coordinate resources, and intervene when capacity is exceeded [19-22]. This study examines the integration of a virtual incident command system (VICS) as an operational augmentation within facility-level (Level 1) and healthcare cluster-level (Level 2) emergency management. VICS is framed as a visibility-and-coordination layer rather than a replacement for ICS, to strengthen how information is accessed, verified, and acted upon across levels [11,14,17]. Specifically, we explore how real-time visual access, cross-level interaction, and virtual situational coordination influence (1) situational awareness, (2) leadership presence and accountability, and (3) adaptive escalation decision-making across Levels 1-2 [7-

10,23,24]. In this framing, limited verifiable visibility is treated as an operational communication risk, and VICS is evaluated as a mitigation that can also enable earlier supportive oversight, faster assistance, and structured improvement across facilities within the cluster governance model.

Methods

Study design

We conducted a qualitative, embedded case study with a design-oriented focus to examine how VICS can be integrated into routine incident command practice [25-27]. The analytical focus was pragmatic: whether virtual visibility helps teams verify information, converge on a shared situational picture, and prepare proportionate escalation while keeping existing roles, authority structures, and governance arrangements intact. Study context and command levels Saudi Arabia’s MOH cluster-based emergency governance operates through a multi-tier incident command and coordination framework across five levels. For MOH operations, the framework comprises four operational and coordination levels (Levels 1–4), with a fifth national/intersectoral strategic tier (Level 5) that is outside the scope of this study: facility incident command, supported operationally by HEPPU activation (Level 1), Cluster Emergency Operations Centre (Cluster EOC) coordination/command when escalated (Level 2), Directorate of Health Affairs regional coordination (Level 3), and MOH central coordination via the National Health Emergency Operations Centre (NHEOC) (Level 4) [20]. A wider national, intersectoral (whole-of- government) strategic tier (Level 5) may be activated for major events beyond MOH remit and is outside the scope of this study. In practice, command typically begins at facility level and escalates only when complexity, resource demand, or multi-site impact exceeds the lower level’s capacity. Accordingly, this study

concentrates on cross-level coordination across Levels 1–2, while Levels 3–4 are treated as governance/support tiers. The command-level structure and escalation-relevant characteristics are summarised in Table 1, including Level 5 as an out-of-scope national/intersectoral strategic tier for clarity. Operational activation versus command authority In practice, effective incident management depends on separating operational activation from incident command authority. When these functions are conflated, roles become ambiguous and early actions can stall [1,3,18]. Operational activation starts immediately after detection and includes notification, activation of emergency arrangements, and establishment of cross-level communication pathways. These tasks enable readiness and coordination, but they do not constitute command authority or strategic decision-making rights. Incident command authority remains vested in the designated Incident Commander at the lowest appropriate operational level, which is most often the facility during the initial phase of an incident [1-3]. The Incident Commander directs strategy and decides whether command should remain at Level 1 or transition to Level 2, based on ongoing assessment of complexity, leadership capacity, and resource sufficiency [23,24]. When incidents exceed facility-level coordination capacity, command may transition to the healthcare cluster, which can mobilise inter-facility resources and coordinate response across multiple sites [18,20]. This governance-aligned escalation logic, as well as the way in which virtual visibility can support graded oversight across Levels 1-2 without implying a transfer of command, is depicted in Figure 1. Role of Hospital Emergency Planning and Preparedness Units (HEPPU) Within MOH hospitals, hospital emergency planning and preparedness units (HEPPU)

operate as a facility-level enabling function for preparedness and incident management. In routine periods, HEPPU maintains emergency plans, supports training and exercises, and organises incident documentation and after-action learning. During incidents, it supports activation and structured information flow to the Incident Commander and the facility incident management team, while remaining outside formal incident command authority. Operationally, HEPPU is responsible for early detection, immediate notification, and activation of emergency management processes [18,20]. Once an incident is identified, HEPPU initiates notification procedures, activates facility arrangements, and establishes communication with the Cluster EOC to enable timely engagement and coordination. In this study, a central HEPPU function was to enable visual activation. It facilitated real-time visual connectivity (for example, live video links) between incident locations, emergency operations rooms, and coordinating tiers to support shared situational awareness and information verification across Levels 1-2 without conferring command authority [7,15-17]. HEPPU also helped to maintain documentation continuity and information flow between on-site teams and coordinating bodies. It did not decide on escalation or command transfer; authority remained with the designated Incident Commander at Level 1 or Level 2 [1-3]. HEPPU activation and visual enablement are illustrated in Figure 2. Incident types and command dynamics Incident management in healthcare is adaptive and rarely follows rigid escalation formulas [23,24]. In Saudi Arabia, incident activation is also supported by standardised, colour-coded emergency alerts unified at the health-sector level [29]. These alerts define the initial activation category and notification pathway; however, they do not determine whether command should transfer from

Level 1 to Level 2. Cross-level escalation remains a separate leadership decision based on incident complexity, resource sufficiency, operational stability, and facility command capacity ]23,24,29[. To clarify how escalation judgements are shaped by incident tempo and how VICS- enabled visibility may support earlier, proportionate escalation, two incident patterns are outlined below. Progressive incidents evolve over time, allowing staged assessment of operational control, leadership capacity, and resource sufficiency. Command may remain at Level 1 while higher levels maintain readiness to support, with a transition to Level 2 as demands increase (for example, an internal facility fire, a prolonged power outage, or a medical gas interruption such as oxygen supply disruption). Sudden high-impact incidents can exceed facility or cluster capacity almost immediately and may require rapid higher-level engagement (for example, mass-casualty incidents, chemical spills requiring decontamination, or an abrupt high- consequence internal failure). Across both patterns, escalation from Level 1 to Level 2 is distinct from initial code activation. Colour-coded alerts support activation and notification, while escalation depends on whether the incident exceeds facility-level command capacity, resource sufficiency, operational stability, or leadership continuity. VICS does not affect decision rights; it strengthens the information basis used to decide whether command should remain at Level 1 or transition to Level 2. Role of Virtual Incident Command System (VICS) Within this operational context, VICS was conceptualised as an augmentation layer embedded within existing incident command practices at Levels 1-2 [11,14]. It does not replace command roles, governance arrangements, or escalation pathways; rather, it improves how

information is shared, verified, and acted upon during response. The cross-level integration logic and the three VICS functions operationalised in this study–access dashboard, shared live video feed, and virtual situational coordination–are illustrated in Figure 3. VICS enabled real-time visual access to incident environments and created a channel for direct interaction between on-site leadership and coordinating teams. Participants emphasised that visual information reduced uncertainty because leaders could validate reported conditions and converge on a shared interpretation of incident dynamics [7,15-17]. They also described this visibility as supporting informed oversight rather than micromanagement: on-site authority was preserved, while escalation readiness and proactive resource coordination improved [30,31]. Participants and data collection Data were collected through semi-structured interviews complemented by documentary review of non-identifying incident and exercise artefacts (including incident/exercise reports, debrief notes, meeting minutes, corrective action plans, and after-action review summaries). Participants were purposively selected based on direct involvement in response leadership, coordination, or operational decision-making [32,33]. The study was conducted within a single Ministry of Health healthcare cluster system (anonymised for blind review), comprising a reference hospital, multiple affiliated hospitals, specialised centres, and an extensive primary healthcare network across a wide geographic area, including remote facilities with variable digital readiness. A role-stratified sample was recruited primarily at the cluster system level (N=34), representing three strata: cluster incident command leadership (n=10), operational first responders/support units (n=15), and Cluster EOC/crisis-disaster specialists (n=9). Participant strata and represented roles are summarised in Table 2.

Thematic saturation was assessed iteratively within each participant stratum and across the full dataset; after the final interviews in each stratum, later accounts no longer produced materially new themes and mainly added role-specific detail to existing categories ]33[. Interview prompts covered communication and reporting practices, situational awareness, leadership engagement and accountability, command continuity, escalation decisions, and perceived impacts of virtual command modalities. Semi-structured interviews provided a common core of questions while allowing follow-up on emergent issues [34]. Interviews were audio- recorded, transcribed verbatim by the researcher, de-identified, and organised by role, response priority, and command position to support cross- role comparison. Role-by-theme matrices were used to examine convergence and divergence across strata and to ensure that operational first- responder accounts were analysed alongside leadership and coordination perspectives. Documentary materials were catalogued by incident/exercise type and source. Non-identifying operational records and after- action review artefacts were reviewed to contextualise interview accounts and support triangulation [35]. To connect perceptions to observed practice, VICS-enabled live visual connectivity was piloted during tabletop exercises and functional drills in selected facilities, generating exercise outputs and debrief materials that were included in the documentary corpus. No patient-level or clinical outcome data were collected. Given that VICS was piloted within the same cluster system, social desirability bias was recognised as a potential risk because participants may have been inclined to report favourable views of a system tested in their own organisational context. This mattered because overly favourable accounts could overstate the perceived usefulness of VICS. To mitigate this risk, participation was voluntary, interviews were de-identified, responses were

reported in aggregate, and accounts were cross- checked against documentary and exercise debrief materials where possible ]35[. Interview prompts were also framed neutrally and did not present VICS as a preferred solution, to reduce the risk of leading responses.

Data analysis Interview and documentary data were analysed using a framework-guided thematic analysis [36,37]. To strengthen confirmability, verbatim quotes from participants were extracted during coding and purposively selected to illustrate both convergent and divergent perspectives across the three strata (incident command leadership, operational first responders/support units, and Cluster EOC/disaster specialists). These quotes are presented in the Results section using anonymised, role-stratum identifiers to indicate the source stratum without revealing participants’ identity. Themes were charted in role-by-theme matrices to compare convergence and divergence across strata, and analytical decisions were documented through reflexive note-taking [38]. Triangulation across interviews and documentary sources was used to corroborate recurrent patterns and reduce single-source bias [35].

Trustworthiness Credibility was strengthened through purposive, role-stratified sampling and triangulation across interviews and documentary sources (including incident/exercise and after-action review materials) [35]. Dependability was supported by maintaining an audit trail of coding decisions and analytical iterations. Confirmability was enhanced by presenting anonymised participant excerpts in the Results section, linking these excerpts to the three themes and role strata, corroborating patterns with documentary evidence, and reflexive note-taking [38]. Transferability was supported through detailed description of the Saudi healthcare cluster context and represented roles. Ethical considerations

Ethical approval was obtained from the Institutional Review Board (IRB), Riyadh Second Health Cluster / King Fahad Medical City, Saudi Arabia (IRB Log No. 24-057; Exempt; 26 Jan 2025). All participants provided informed consent prior to participation, and transcripts were anonymised to protect confidentiality. The study was conducted in accordance with the Declaration of Helsinki [39].

Results

Across 34 interviews, three linked themes described how participants perceived VICS to influence cross-level command between facility (Level 1) and cluster (Level 2) operations in exercise-based settings. Although accounts converged around three practical effects — a clearer shared picture of the incident, more visible leadership engagement across tiers, and quicker, better-supported escalation discussions — emphasis differed by participant stratum. Leadership participants emphasised escalation readiness and oversight; operational first responders more frequently highlighted communication delays, clarity of direction, and the practical value of faster information exchange; and Cluster EOC and disaster specialists emphasised verification burden, coordination workload, and shared situational awareness across levels.

Theme 1: Situational awareness as a determinant of effective incident command Participants repeatedly described information uncertainty and verification delays as the first operational bottleneck, particularly when coordination relied on phone-based updates relayed through sequential chains. Incident command leaders noted that second-hand summaries could be incomplete or unreliable, and difficult to verify against on-scene reality, including confirmation of the presence and actions of key personnel before committing to decisions. One cluster leadership participant explained, “When the update comes only by phone, we

cannot always verify whether the person reporting is at the incident site. For high-risk decisions, such as evacuation during a fire or medical gas disruption, any delay or wrong decision can directly affect patient safety; therefore, visual verification becomes critical” (cluster incident command leadership). As a result, leaders described activating multiple parallel communication pathways to triangulate inputs, reconcile inconsistencies, and form an actionable operational picture. This verification burden was perceived to consume critical time, a consequential constraint in healthcare settings where response timeliness directly affects patient- facing risk and operational continuity. First responders and operational support units likewise described delays in transmitting field updates and receiving timely direction, with lag in the flow of orders, situational information, and coordination messages between the incident scene, facility command, and supporting clinical and technical departments. Cluster-level EOC and disaster specialists emphasised the workload created by fragmented inputs, as they were expected to aggregate, verify, and translate high-volume updates into actionable coordination outputs; when inputs were fragmented or unverifiable, decision support and coordinated messaging slowed.

VICS-enabled live visual connectivity was viewed as a potential corrective within exercise- based scenarios. By providing shared, direct visibility between incident command, on-site responders, and higher coordination levels, participants perceived that it reduced reliance on intermediaries, accelerated verification of evolving conditions, and stabilised the shared situational picture — thereby strengthening situational awareness and improving time- critical coordination across Levels 1–2. across Levels 1-2. Across roles, leaders emphasised decision confidence and verification, first responders highlighted delays in directional flow,

and EOC/disaster staff described the aggregation burden that live visual feeds helped to relieve. Theme 2: Leadership presence and accountability across levels

Participants described leadership presence as difficult to sustain across multiple facilities when cluster leaders could not rapidly reach incident sites. Under traditional arrangements, remote oversight relied heavily on mediated updates, which participants perceived could weaken timely guidance, adherence to protocols, and a clear line of accountability across teams operating under pressure.

VICS was perceived to extend leadership presence beyond physical constraints by allowing leaders to observe evolving conditions and interact directly with on-scene teams and facility command in real time. One operational first responder/support participant stated, “When live visibility was available to command levels, different leadership tiers could discuss the incident directly, clarify resource needs, assign tasks, and follow implementation in real time. This gave us greater ability to improve the response and accelerate operational support” (operational first responder/support unit). Participants described this ‘visible engagement’ as strengthening mutual accountability between tiers, supporting clearer tasking and follow-through, and reducing ambiguity about who was present and what actions were being taken. Importantly, this visibility was generally framed not as punitive surveillance, but as enabling professional discipline, assurance, and shared ownership of outcomes. Leaders also reported greater confidence when visual verification was perceived to allow them to monitor implementation and maintain timely oversight during high-risk healthcare incidents. Theme 3: Adaptive command and informed escalation decision-making

Participants emphasised that escalation and command continuity are context-dependent decisions rather than mechanical threshold triggers. They described escalation as a judgement-based process shaped by evolving incident severity, operational stability, resource availability, and leadership capacity at the facility level, often changing over hours rather than minutes. Under traditional communication modes, participants reported that escalation decisions could be delayed or contested because higher coordination levels lacked timely, verified situational information, making it harder to determine whether local command remained effective or whether broader coordination and resource mobilisation were required. VICS visibility was described as improving escalation readiness by allowing higher tiers to maintain informed oversight without signalling automatic command takeover. One cluster EOC/disaster specialist explained, “Live visibility helped us coordinate support with the relevant teams without taking command away from the facility. It also gave disaster specialists a clearer picture and more time for planning, and later supported feedback, lessons learned, and continuous improvement” (cluster EOC/disaster specialist). Visual access was perceived to help leaders verify whether critical actions and staffing were in place and assess whether the incident remained within facility capacity, while parallel planning for support (e.g., resource mobilisation preparation and cross-facility coordination readiness) could begin earlier. Across accounts, VICS was framed as strengthening the evidence base for escalation discussions rather than redefining decision rights. With faster verification and a shared picture, escalation conversations were described as quicker, more evidence-informed, and less reliant on repeated clarification loops. Negative cases and cautions were also identified. Some participants noted that implementation could be constrained by uneven digital

infrastructure across facilities, the cost of establishing an integrated system, and the risk that live visibility might be misunderstood as surveillance rather than operational support. These views did not reject the concept of VICS, but emphasised the need for proportionate rollout, clear governance, and supportive use within existing incident command arrangements.

Discussion

This study examined how a virtual incident command system (VICS) can be embedded as an operational augmentation within facility- and cluster-level incident command. Overall, participants described VICS as improving cross- level coordination by making the incident picture more verifiable, leadership engagement more visible, and escalation discussions timelier while leaving established ICS authority intact. Situational awareness as the operational bottleneck Across roles, situational awareness emerged as the limiting condition for command effectiveness [7- 10]. Phone-based updates and sequential reporting were seen as vulnerable to delay and distortion, producing a partial picture for remote decision- makers [4,6]. VICS addressed this by enabling real-time visual access and verification, which improved the perception-and-comprehension cycle that underpins sound command judgement [7,15-17]. Importantly, participants viewed this as strengthening rather than replacing existing ICS work practices [1-3]. Leadership presence and accountability without micromanagement

Participants also highlighted the value of leadership ‘being seen’ during fast-moving incidents. Virtual connectivity expanded leadership reach across multiple sites, reinforced accountability, and supported clearer tasking and follow-up [11-13,40-41]. When implemented with clear governance boundaries, virtual presence was described as supportive oversight rather than micromanagement, preserving local

autonomy while improving cross-level assurance [30-31]. Adaptive escalation and proportional readiness Escalation was described as dynamic and judgement-based, not rule-driven [23-24]. By giving higher tiers a more verifiable view of conditions, VICS enabled earlier preparation of resources and coordination without premature command takeover [18-19,23]. This aligns with governance models that preserve local command when effective, while keeping higher levels ready to support when capacity is exceeded [18,20- 22,42].

Implications Practically, the findings support formalising early visual activation and governance-aligned virtual visibility in multi-level healthcare emergency management. At the system level, VICS can be positioned as a standard augmentation layer across Levels 1-2 to improve coordination and escalation readiness while keeping decision rights and accountability boundaries clear [11,14,18]. Put simply, limited verifiable visibility in voice- based reporting can delay recognition and undermine a shared operational picture. VICS mitigates this through real-time visual verification and, at the same time, creates an opportunity for supportive governance oversight, coaching, and improvement without displacing local command (Figure 3).

Conclusion

Integrating VICS as an augmentation layer within facility- and cluster-level emergency management can improve shared situational awareness, strengthen leadership presence, and support more proportionate escalation readiness without transferring or redefining established command authority. Operationally, this points to embedding early visual activation in incident procedures, maintaining a clear separation between activation and command, and standardising governance-aligned virtual visibility

across Levels 1-2. Future mixed-methods work should test measurable effects on response timeliness, coordination efficiency, and patient safety outcomes, and examine how advanced technologies can be incorporated into virtual command architectures.

Acknowledgements AI Disclosure Statement

Artificial intelligence (AI) tools were used solely to assist with language editing, grammar refinement, and improvement of manuscript readability. The authors retained full responsibility for the study design, data collection, data analysis, interpretation of findings, and final manuscript content. All scientific content, conclusions, and intellectual contribution are those of the authors.