I believe that the survey used something like a hundred different categories to come with their rankings.
They're pulling in some serious data to make decisions. This is not anecdote base pseudo science. There are 134 metrics (measurement and evaluation criteria) spread across six categories:
http://nhspi.org/the-index/*Health Security Surveillance: 29 metrics
*Community Planning & Engagement: 20 metrics
*Incident & Information Management: 21 metrics
*Healthcare Delivery: 28 metrics
*Countermeasure Management: 19 metrics
*Environmental & Occupational Health:17 metrics
Also, the foundation paying for the studies (Robert Wood Johnson, of Johnson and Johnson fame) appears to be a legitimate philanthropy and not a political mouthpiece. So, the results presented are probably accurate enough to base decisions on.