Before discussing emergencies and disasters, it is important to understand the definition and classification of hazards. A hazard is a process, phenomenon, or human activity that can harm people's lives and health, damage property, disrupt social and economic activities, and damage the environment [3]. The WHO classification of hazards generally consists of natural, human-induced, and environmental hazards, as provided in Multimedia Appendix 1 [36].

Hazards have the potential to create any scale of emergency or disaster. Emergency and disaster, at first glance, have a similar meaning, but there are fundamental differences between the two. An emergency can be defined as a severe disruption to the functioning of a community or society, causing human, material, economic, or environmental impacts, which can be overcome by the internal resources of the community and society itself [43]. However, a disaster is a severe disturbance that impacts communities and society and cannot be overcome solely by relying on internal resources [43]. In other words, a disaster is an event that causes significant damage or loss and thus requires resources beyond a community's capability and multiple agency responses [44]. Thus, an event is declared a disaster if there is a need for external assistance to address its impact [45]. Both emergencies and disasters must be managed to prevent or minimize their impacts.

To answer the research question, we need to understand the general concept of EDM. As previously mentioned, the terms “emergency management” and “disaster management” are often used interchangeably because they have considerable overlap [3]. The EDM cycle consists of 4 phases, namely mitigation, preparedness, response, and recovery [11,45,46], as shown in Figure 1. The mitigation and preparedness phases are part of risk assessments before a hazardous event [45]. Mitigation is the application of actions to prevent a hazard from occurring or reduce its impact [18]. Although the impact of a hazard is often not wholly preventable, various strategies and actions can substantially reduce its scale or severity. Activities during the mitigation phase include engineering techniques and hazard-resistant construction, environmental and social policy development, and public awareness enhancement [3].

The second phase, preparedness, aims to prepare the community to respond to a hazard [18] by providing information, creating partnerships, developing plans, building resources, and creating procedures [47]. When a hazardous event occurs, response and recovery must be carried out [45]. The response actions directly before, during, or immediately after a hazardous event occurs can save lives, reduce health impacts, ensure public safety, and meet the basic needs of the affected people [3]. Activities during the response phase include evacuation, search and rescue, medical care, and temporary housing [3,18]. The response activities may also extend to the recovery stage [45]. Recovery is a long-term action taken after the immediate effects of a hazardous event have passed in order to stabilize society and return to normalcy [18]. Recovery also aims to restore or improve the livelihoods and health of the affected populations and restore the economic, physical, social, cultural, and environmental systems [3].

Each activity shown in Figure 1 requires cooperation and coordination among the various parties, including the community, governments, health institutions, other groups, and regional and international organizations [48]. The community includes at-risk populations, survivors, and community groups or organizations [48]. Governments at all levels include leaders and politicians, ministries and agencies, national disaster management agencies, emergency services (eg, fire department, police, ambulance), and military service [48]. The third stakeholder is health institutions, including the Ministry of Health and health authorities, health-related nongovernment organizations (NGOs), health care providers, hospitals and other health care facilities, the health workforce, and private sector health organizations and professionals [48]. Other groups include universities and research institutes, nongovernment and volunteer groups, media, social media, new media, community influencers, and the private sector [48]. Finally, regional and international organizations include WHO and international NGOs [48].

This research focuses on community stakeholders affected by health hazards. Individuals can contribute to community-level surveillance, household preparedness, first-aid training, and emergency response [48]. Their active engagement in all aspects of EDM activities is vital [48]. To encourage active participation from the community, EDM needs to implement effective risk communication to attract attention and encourage user compliance. A warning is a risk communication used to inform people about a hazard so that accidents, injuries, or unwanted consequences can be avoided [49,50]. The purpose of warning messages is to draw the attention of people at risk, to reduce the time it takes to understand the warning, and to guide people to take appropriate protective measures [51,52,53]. In this case, risk communication serves as a component of disaster control and strategies to reduce the health, economic, and psychosocial impacts of major disaster events [40]. Risk communication is vital in all EDM phases, especially the response phase. The next section maps EDM phases and activities to EDMS features.

Various studies have used different terms to describe the EDMS features for each of the 4 EDM phases. The term “emergency management system” is used by the United Nations [4] and Landau [54], which refers to a system that works for emergency planning, control, and reduction. The term “disaster management system” is used by Hannan et al [55] and Currion et al [56] as a system that aims to manage relief operations, recovery, and rehabilitation. The term “emergency response system“ is used by Amailef and Lu [57] and refers to a system that supports communications, data gathering, data analysis, and decision-making during the response phase. Meanwhile, research by Edwards et al [58] and Malizia et al [59] uses the term “emergency notification system,” which refers to a system that aims to broadcast information to as many devices as possible. Other studies by Ouyang et al [60] and Bonaretti and Fischer-Preßler [61] use the term “early warning system,” which aims to disseminate warnings to a threatened population before or at an early stage of hazardous events. In the context of biological hazards that threaten public health, the terms “digital contact tracing” [14,62] and “contact-tracing application” [34,63] are used to refer to a system that monitors and tracks infection and provides immediate support and information during pandemics.

Tables 1-4 map the activities and system features for each EDM phase and the stakeholders involved according to previous studies. The stakeholders consist of the community, governments, health institutions, other groups, and regional and international organizations. Tables 1-4 also show the stakeholders' roles in each feature with the responsible, accountable, consulted, and informed (RACI) matrix. In this study, the RACI matrix was used to analyze stakeholders and their level of involvement and authorization in each feature of the EDMS. Because this research focused on community users, the RACI matrix showed which features require involvement from community users. From the 4 stages of EDM, 19 main activities and 42 EDMS features were identified. Among all the features identified, there were 27 features that require involvement from the community users that the other stakeholder groups should pay attention to in order to encourage user compliance with the warning messages.

Based on Tables 1-4, community users can act as actors who are informed by or responsible for several features in an EDMS. Before a hazard occurs, community users can receive information about policies and strategies, potential hazards, and various types of education to increase their awareness of emergencies and disasters. When a hazard occurs, community users need information about the location of shelters, evacuation routes, and regular reports on ongoing disasters. During the response and recovery phases, community users play a more important role because in addition to obtaining information, they are also responsible for being actively involved in disaster management efforts. They must actively report disaster victims and missing persons, report tracing data and lab results, report damage to infrastructure, and request medical assistance and treatment. Community users who actively use EDMS features are encouraged to comply with the protocols and measures to deal with emergencies and disasters. Therefore, the design of these features is essential to drive user compliance.

All the features analyzed in the previous section are used in a general EDMS dealing with all types of emergencies and disasters. To find out how these features have been used to address health-related disasters, we investigated their application to Health EDMS, an EDMS that is specifically used to respond to and cope with hazardous events that threaten public health. During the COVID-19 pandemic, Health EDMS was used by multiple countries to assist in contact tracing. Contact tracing is a control measure to prevent further disease transmission [70]. When someone tests positive for COVID-19, that person must be quarantined or self-isolated. After that, the contact-tracing process is carried out by identifying the person's close contacts and advising them to take precautionary self-isolation [71]. Close contact means direct face-to-face contact with an infected person or confirmed case [71]. Various countries have developed contact-tracing mechanisms with technology support. A CTA allows devices to communicate through Bluetooth technology, GPS, wireless technology, and sensors [71]. A CTA has features to automate contact-tracing activities and other features to disseminate information and provide medical care [70].

In this study, the discussion of Health EDMS will focus on a CTA because a CTA is a clear example of a technology application that deals with health emergencies and disasters. As a self-administered warning system, CTAs have been widely used in more than 50 countries [72]. A CTA is implemented when COVID-19 emerges in order to respond to and recover from the pandemic [16]. Therefore, the system features are geared more toward the response and recovery phases than the mitigation and preparedness phases. Table 5 displays a list of features for response and recovery phases in some CTAs implemented by different countries. The countries shown were selected based on the number of COVID-19 cases: high (the United States and India), medium (the United Kingdom and France), and low (Singapore and Switzerland) [73]. In addition to the number of cases, these countries were also chosen to represent the Americas, Europe, and Asia regions. The CTAs selected are available on Apple App Store and Google Play Store with the most significant number of users, free of cost, and launched and supported by the governments of selected countries [73]. The CTA features in the selected countries were based on the information provided by Alanzi [16] and Blasimme et al [17].

There are 6 CTAs reviewed in Table 5. PathCheck SafePlace is a CTA developed in the United States that aims to integrate people and health departments to prevent the spread of COVID-19 by sharing information [16]. The application was developed by the Massachusetts Institute of Technology, TripleBlind, and a nonprofit organization called PathCheck Foundation [16]. Aarogya Setu is an official CTA launched by the Indian government with more than 1.4 million users [16]. NHS COVID19 is a CTA launched by the National Health Service (NHS) Test and Trace in the United Kingdom [16]. Although this application does not store personal information, it still collects location information for track and trace purposes [16]. TousAntiCovid is implemented in France using a centralized IT architecture where data are stored on centralized servers run by the national health authorities [17]. Users must enter their personal information to report a positive test, which triggers a notification to other users [17]. The health authorities in France send an exposure code to users via email and post [17]. In contrast to TousAntiCovid, SwissCovid implements a decentralized protocol like in other European countries, such as the United Kingdom [66]. Users must contact health authorities to activate an exposure code after receiving a notification of a positive test result [66]. Another application, TraceTogether, is an official CTA launched by the Singapore government [16]. This application emphasizes user privacy by using anonymous IDs and giving users the right to delete their data [16].

Based on Table 5, at the most, the CTAs implemented 11 EDMS features in 5 EDM activities: response (RS)2, RS3, RS4, recovery (RC)3, and RC4. Most CTAs implemented all 3 features in RS2 to monitor and report the ongoing hazard; disseminate notifications and warnings; and provide timely, credible, and actionable information to the public. The CTAs also provide data visualization that enables users to monitor the ongoing status of the COVID-19 cases in their areas. Some CTAs (ie, PathCheck SafePlace, and Aarogya Setu, provide query resolution feature as part of RS3, allowing users to request help and ask questions through the applications [16].

Medical care provision (RS4) is 1 of the priority features in CTAs. CTAs provide automatic contact-tracing tools integrated with location mapping through GPS. Aarogya Setu integrates these tools with an electronic pass (e-pass) in transportation and public places [16]. CTAs also provide users with self-assessment tools to check their health status and exposure to COVID-19. Health institutions provide laboratory check reports to users through their handheld devices. Some CTAs(ie, PathCheck SafePlace and Aarogya Setu) also come with online consultation and appointment scheduling with health facilities [16]. The medical care and surveillance activities continue to the recovery phases in RC3 and RC4.

In the previous section, there were 27 EDMS features that involved the user community. Meanwhile, Table 5 shows that only 11 have been implemented in Health EDMS, mainly functioning to monitor and report ongoing hazards and provide medical care and logistical support. Health EDMS does not implement all the features at the mitigation and preparedness stages. Several features in the response and recovery phases are also not implemented because they are not in accordance with the scope of health-related hazards, such as shelter data management, reporting of victims and missing persons, and recording of infrastructure damage. In Health EDMS, all the measures need to be complied with by the users to make them effective in controlling the pandemic [38,40]. When surveillance and monitoring tools detect hazardous conditions, Health EDMS disseminates notifications and warnings to users. User compliance with notifications and warnings determines the success of Health EDMS. The following section discusses user compliance in the information system (IS) context.

Compliance refers to the agreement with the expectations stated in the rules, standards, proposals, requests, orders, or suggestions [74]. It is also defined as a relationship consisting of the power used by superiors to control subordinates and subordinates' orientation to this power [75]. Compliance can include approval as well as obedience [74]. In health care, compliance is conceptualized as a cognitive-motivational process of personal attitudes and intentions, behaviors, and the outcome of patient-practitioner interactions [76]. It also involves professional power over the patient [76]. Compliance is not based solely on an individual risk-benefit assessment but also involves relationships between commanders and followers and between organizations and members [38].

Research on compliance has been investigated in various fields, and theories regarding compliance also come from multiple domains, such as psychology, criminology, health, management, and organization [77]. In the organizational context, business dynamism and IT advancements encourage companies to frequently update their IS and its usage policy [78]. In this case, users need to maintain IS compliance behavior due to the interdependent nature of tasks that need to be accomplished through IS [78]. Social (trust and support) and performance (discipline and stretch) management influences collective compliance with IS [78]. Compliance also has been widely studied in IS security policy research [38]. Employees are willing to comply with IS security policy if they feel they have the capacity to carry out a security task, have a positive attitude in carrying it out, and see others performing the same security task [77]. When they encounter a security threat, they evaluate the threat and coping behavior to decide whether to comply [77]. Employee compliance with IS and its usage policy is critical to achieving IS objectives in supporting business operations [78].

Health EDMS differs from other ISs as it is used in life-critical and time-sensitive situations, often with limited resources. Immediate compliance with the health notifications and warnings is essential to save lives [38]. When a person receives a warning, the warning response can be sequenced as follows: listen to the warning, understand the content of the warning message, believe that the warning is credible and accurate, personalize the warning, confirm the warning, and respond by taking protective action [79]. Previous studies have shown that responses to warning messages are influenced by the type of hazard, the message and its source, the medium or channel through which the message is communicated, the characteristics of the recipient, and situational or environmental factors [51,79]. We conducted a systematic literature review to map the extant studies on user compliance with Health EDMS.

The PADM is a framework for managing the societal response to environmental hazards [51]. The PADM has been applied to 3 different areas: risk communication, evacuation modeling, and long-term hazard adjustment [51]. In the PADM, decision-making begins with environmental cues, social cues, and warnings [51]. Environmental cues are signs of threat obtained from the environment, such as sight, smell, or sound [51]. Social cues are signs obtained after observing the behavior of others [51]. A warning is a message sent from an information source through a channel to the recipient [51]. The 3 triggers encourage a pre–decision-making process involving exposure, attention, and comprehension [51]. Exposure measures whether people receive information, attention measures whether people care about the information, and comprehension measures whether people understand the information [51].

Furthermore, the pre–decision-making process generates perceptions of the environmental threats, alternative protective actions, and relevant stakeholders (government, other groups, and community) [51]. These perceptions provide the basis for protective action decision-making [51]. The dependent variable of the PADM is a behavioral response that is generally in the form of information seeking, protective responses, or emotion-focused coping [51]. The actual implementation of a response depends not only on people's intentions to act but also on the physical and social conditions that can hinder or facilitate the action [51]. The final stage in the PADM is the feedback loop [51]. People attempt to confirm or contradict every warning they receive, usually by searching for additional information from different sources and channels [51].

Stakeholder perceptions and protective action perceptions have been shown to influence compliance with warnings during the avian influenza A (H7N9) outbreak [87] and the COVID-19 pandemic [15]. Meanwhile, threat perception has not been shown to affect warning compliance based on COVID-19 research in Germany and China [15,52]. The use of protective measures can reduce threat appraisal, making people feel less likely to be infected. However, the duration of the pandemic, the extended and repeated warnings, and the familiar feeling of the disease resulted in information fatigue that undermined the perceived threat [52]. Among all the theories in Table 7, the PADM is the only theory that focuses on the human response to threats [51]. The PADM also specifies prompts for action, which are important for encouraging engagement in health-related behaviors [87]. However, for slow-moving and long-term health-related hazards, the PADM has not been able to predict changes in threat perceptions.

Etzioni's compliance theory states that there are 2 parties to a compliance relationship: an actor who has power and another actor who responds to the power (subordinated actor) [91]. Power can be differentiated into 3 types according to the means used to make the subject comply [91]. Coercive power applies physical sanctions, force, and fear to control lower-level participants [91]. Remuneration power applies material resources and rewards to control others [91]. However, normative power is the provision and manipulation of symbolic rewards and deprivations [91]. The effectiveness of each power in obtaining the cooperation of subordinates depends on their involvement [91].

The subordinated actor can have 3 kinds of involvement: alienative, calculative, and moral [91]. Alienative involvement leads to intense negative orientation, while calculative involvement can lead to positive or negative orientation [91]. However, moral involvement, also known as commitment, leads to intensely positive orientation [91]. Moral involvement can be based on pure commitment (based on the internalization of norms) and social commitment (based on pressure from primary groups and their members) [91]. Subsequently, combining 3 types of power and 3 types of involvement produces 9 kinds of compliance [91]. However, 3 kinds of compliance are more frequently found in practice [91]. These are the relationships between coercive power and alienative involvement, remuneration power and calculative involvement, and normative power and moral involvement [91]. These compliance types are called congruent types [91]. This happens when the subordinate's involvement type is the same as the types that want to be generated by organization power [91]. The congruent types are more frequent because they are more effective to implement.

Etzioni's compliance theory has been adapted to campus emergencies [38] and health care–related emergencies [41]. Both studies were designed to accommodate emergency notifications sent by normative organizations, such as the campus and the government [38,41]. Normative power was adapted as the subjective norm, while coercive power and remuneration power were adapted as a perceived security threat and a perceived financial threat, respectively [38,41]. The results of the 2 studies are similar and show that subjective norms are the most important factor promoting immediate compliance in health-related hazard scenarios [38,41].

The HBM is a conceptual model for understanding why individuals do or do not perform various actions related to health behavior [92]. The HBM defines 6 different constructs. These constructs focus on individual representations of threat perceptions and evaluation of health behaviors [93]. Threat perception is defined as 2 central beliefs: perceived susceptibility to health problems and perceived severity of disease consequences [93]. Health behavioral evaluation also consists of 2 constructs: perceptions of the benefits or efficacy of the recommended health behaviors and perceptions related to the barriers to enacting these behaviors [93]. In addition, the HBM proposes that cues to action can activate health behaviors when individuals hold appropriate beliefs [92]. Cues to action can be individual perceptions of symptoms, social influences, and health education campaigns [93]. In a later version of the theory, individual health motivations are also included as constructs that drive health behavior actions [93].

The HBM has been used to analyze individual compliance with warnings to take recommended protective actions during the H7N9 [87] and COVID-19 [88] outbreaks. The perceived risk or perceived vulnerability positively influenced compliance intentions in the H7N9 outbreak [87]. Meanwhile, all HBM constructs except health motivation were used by Guillon and Kergall [88] and were shown to affect compliance to protective measures and CTAs during the COVID-19 pandemic. However, the HBM does not consider the effect of information on protective behavior, even though risk information has been seen as an essential driver of risk perception and behavioral response [87].

In a hazardous event, the increased fear of the individual also increases their intention to take action [90]. The PMT describes the social and cognitive processes that underlie protective behavior [94]. The PMT proposes that people protect themselves based on threat appraisal and coping appraisal [94]. Threat appraisal refers to the perceived likelihood that the event will occur and have negative consequences [94]. Threat appraisal is a person's assessment of the estimated severity of the disease (perceived severity) and estimates the likelihood of contracting the disease (perceived susceptibility) [95]. In addition, the PMT also states that fear arousal indirectly affects attitudes and behavior changes through the perceived severity of danger [95]. However, coping appraisal consists of the individual's expectation that implementing the recommendations will eliminate the threat (response efficacy) and the belief that they can successfully carry out the recommended actions (self-efficacy) [95]. Thus, if individuals conclude that a threat will affect them, they will be more motivated to protect themselves and initiate or continue certain self-protective behaviors [94].

In Health EDMS compliance studies, the PMT has been used in campus emergency notification systems [90] and emergency alerts during the COVID-19 pandemic in South Korea [89]. However, the PMT constructs cannot explain rapid compliance with health advisory warnings on campus. Instead, the PMT can better explain compliance in fast-evolving scenarios, such as robberies, active shooters, and building fires. In the COVID-19 alert study, the PMT construct was used as a mediating factor between reading text messages and practicing preventive behaviors. Response efficacy was the only variable driving compliance to warnings, whereas the perceived risk was insignificant. Based on these 2 studies [89,90], the PMT constructs are less predictive of explaining compliance in slower-developing scenarios, such as health-related hazards.

SARF describes a dynamic process for understanding how risk is perceived when communicated to the community [15]. SARF conceptualizes that individual and social perceptions of risk and risk behavior can be shaped, enhanced, or attenuated when there is an interaction between hazardous events and psychological, social, institutional, and cultural processes [96]. In this case, the IS and the characteristics of the public response can form a social amplification that determines the nature and magnitude of the risk. ISs can amplify risk events in 2 ways: by intensifying or attenuating the signals that individuals and social groups receive about risk and by filtering out the many signals related to risk attributes and their importance [96].

Amplification occurs in 2 stages: when transferring information about the risk and when the community responds to the information [96]. Signals about risk are processed by individual and social amplification stations, including scientists communicating risk assessments, news media, cultural groups, and interpersonal networks [96]. Reinforced risk leads to a behavioral response, resulting in secondary impacts, such as financial loss, organizational change, and physical risk [96]. Communication is at the core of SARF, as individuals are most often exposed to risky information through the media or discussions with others [15]. In this manner, risk amplification allows different “amplification stations” to compete for public attention and influence how the public perceives and responds to risk [15].

SARF has been used to investigate compliance behavior in China during the COVID-19 pandemic [15]. One variable from SARF, namely information interaction, is used to examine how interactions between individuals can shape risk perceptions [15]. Information interaction significantly influences risk perception and preparedness intentions, while also serving as a mediator for warning [15]. Of the 2 stages of amplification in SARF, this study only analyzed amplification when the public responds to information [15]. Other SARF variables have not been found in Health EDMS compliance studies.

TAM2 extends the original TAM by including additional key determinants of perceived usefulness and usage intention constructs: social influence and cognitive instrumental process [97]. The social influence processes consist of subjective norms, voluntariness, and image [97]. Subjective norms are added as determinants considering that people can choose to perform a behavior if they believe their important references think they should [97]. TAM2 distinguishes between mandatory and voluntary use arrangements by adding voluntariness as a moderating variable [97]. In addition, TAM2 theorizes that social influences can affect how users judge the system's image (ie, whether the system can increase their status in a social system) [97]. The elevated status leads to increased power and influence that eventually provides a general basis for greater productivity (perceived usefulness) [97]. TAM2 also investigates how these determinants' effects change with increasing user experience over time with the target system [97]. As cognitive instrumental processes, TAM2 includes job relevance, output quality, and result demonstrability constructs. TAM2 shows that the influence of cognitive instrumental processes is not influenced by experience over time [97].

Research on CTAs in the United Kingdom found that most TAM2 constructs significantly affect user behavior to download the application and comply with notifications [27]. The trust factor was added and proved to be significant [27]. Compliance with the notification was fairly high, but there were issues surrounding trust and understanding of the application's features that hindered the adoption of the CTA [27]. Moreover, Dowthwaite et al [27] stated that users would likely delete the CTA when they are frustrated by a notification from the application (output quality) and do not understand how their data would be used (result demonstrability). Although TAM2 has described the factors that influence compliance with Health EDMS, it is still unclear what level of experience, output quality, and result demonstrability can positively affect compliance.

The TPB was first introduced as a development of the theory of reasoned action (TRA) and has been most widely adopted in the research on motivations for human behavior. The TPB explains that behavior is influenced by intention and intention is determined by 3 types of beliefs: attitudes, subjective norms, and perceived behavioral control [98]. Attitude is a comprehensive evaluation of the implementation of behavior [98]. Subjective norms are individual perceptions of other people's expectations considered important about certain behaviors [98]. Meanwhile, perceived behavioral control is an individual's perception of how easy or difficult it is to do something [98]. It can also be interpreted as the resources and opportunities available to a person to encourage them to perform a behavior [98]. The TPB has been applied in studies of ISs, organizations, and user populations.

The TPB is 1 of the most influential theories in disaster and emergency preparedness planning. The TPB has been used to analyze the factors that affect rapid compliance with emergency notifications in 7 emergency scenarios in a campus: robbery, active shooter, building fire, hazardous material, riot/violent protest, air quality advisory, and health advisory [90]. Attitude significantly affected compliance across all scenarios, while subjective norms significantly affected almost all scenarios except the active shooter [90]. However, perceived behavioral control was only significant in the air quality advisory scenario [90].