Healthcare facilities are some of the trickiest buildings to secure properly. They straddle the line between appearing comfortable and implementing strict safety, security and privacy protocols.
The cold, institutional look that is often associated with older healthcare buildings is no longer an option. Patients and their families want facilities to reflect a commitment to compassionate care. But security must remain the first priority—because the consequences of an insecure facility can become dire.
Clinic and hospital security practices are aimed at protecting three things:
1. People
The most important thing in a healthcare facility is the people inside, from patients and families to facility staff. Security programs should account for all sorts of threats against people at the facility, from patient-generated violence aimed at staff to the risk of vulnerable patients being harmed or abducted.
[Related: Why It’s Time to Converge Physical Security and Cybersecurity]
2. Assets
Medical equipment theft is unfortunately common. Not only can that cost healthcare organizations millions of dollars, it can also drive up the cost of healthcare because organizations have to pass the costs on to future patients. There’s also a risk of causing direct harm to a patient if a piece of important equipment goes missing when it’s needed most.
3. Data
Maintaining privacy in healthcare is paramount. Healthcare organizations’ IT departments handle much of the data privacy duties for electronic medical records. But there are still plenty of data risks that fall into the purview of security and facilities personnel, like safeguarding paper records.
Clinic and Hospital Security Challenges
Certain challenges are unique to healthcare facilities and are often exacerbated by the openness vs. tight security conundrum.
“One of the more unique challenges is caring for a patient population that’s sometimes sedated or unable to care for themselves. You must keep a balanced, open environment, yet place the proper restrictions. Find that balance between taking care of your patient and being open to family and friends,” says Alan Butler, senior vice president of HSS, a security service provider and consultancy for healthcare, and president of the International Association for Healthcare Security and Safety.
Patient care sometimes creates unique challenges, Butler adds. Sometimes patients can’t take care of themselves and count on healthcare staff for all of their basic needs, as well as protecting their privacy and data.
In other cases, behavioral health or substance use disorder issues may complicate the patient’s treatment for emergent physical health issues, like a broken bone. Healthcare security and facilities staffs should consider all of these challenges when they’re assessing where to upgrade technology, implement better security practices and allocate security personnel.
Striking the Balance Between Healthcare Security and Access
Security is all about creating layers of protection. In healthcare, the first layer is an engaged employee population, Butler says. “If your staff understands their environment and why security measures are in place, they can help the public make their way through a hospital safely and in a way that doesn’t make them feel like they’re being shut out,” he adds.
Next is an organization-wide commitment to communicating the idea of a safe, secure facility where anyone can receive high-quality care. The broken windows theory developed for criminology applies to healthcare too, Butler explains; in other words, visible signs of disorder and disarray create an environment that encourages and perpetuates those things.
[On topic: Access Control Technology is Eating Key Cards]
“In an emergency department, when the walls are cluttered, voices are loud and there’s stuff on the floor, it sends a message of ‘Anything goes,’” Butler says. “In the same emergency department, if all the equipment is stored the way it’s supposed to be, the floors are clean and lights are bright, it sends a different message. Your staff has to be engaged in that process—in part, it’s the way your staff interacts in that space and the way they communicate with the public.”
Other layers of security might include access control, mass notification and surveillance. Each plays an important role in a healthcare facility.
1. Access Control
“Access control is by far—today, at least—the best security system investment an organization can make,” says Butler. That’s because it allows you to proactively manage the flow of people in your facility. A good access control platform should use an open database and be able to link to other systems, Butler adds.
“All hospitals have some sort of employee ID program. You need to be able to link to the human resource management system,” says Butler. “It should link to your video surveillance system, so that if there was an unusual event within your surveillance system, it could tell the access control system to lock or unlock a door.”
All staff entrances should have formal access control measures limiting ingress and egress, though you don’t need that at the main public entrance, adds Sean Ahrens, author and security market group leader for Affiliated Engineers, Inc. This should include a standalone alarm system with a cellular backup and a way to identify who is going in and out.
“The staff come in, swipe their card and then open the front door and disarm the alarm,” Ahrens says. “You could also do it with alarm systems as long as you individualize the codes, but I can’t tell you a clinic I’ve assessed where they do that. If everyone uses the same code, there’s no way to audit that.”
Access control even includes basic measures like automated gates on parking lots, Butler adds. “Believe it or not, parking lots with gates are less likely to have car thefts than one without a gate. Many think that a gate’s just a flimsy barrier that comes down and you could drive straight through, but the reality is it’s one more barrier that sends a message about your commitment to creating a secure parking structure.”
BUILDINGS Podcast
Security Threats of Tailgating in Your Building
Sean Ahrens, a leader in the field of security and resilience, as well as a project manager for Affiliated Engineers, Inc., shares insights with Janelle Penny into the security threats of tailgating and piggybacking in respect to the access control of your building. Listen now >>
2. Mass Notification
Mass notification is important inside most healthcare organizations, but it’s especially critical in large facilities where people receive information in varied ways, Butler says.
A smaller clinic can limit their notification system to simple local annunciation, whereas a hospital might need multiple mass notification channels. Some fire detection and alarm systems offer non-fire-related mass notification capabilities that you can program with custom alerts, Ahrens says.
“There should also be cellular and radio repeatability for all law enforcement frequencies and all major carriers that are prominent in that building’s area,” adds Ahrens. “That should extend all the way down to the basement. Many times there is no cellular signal, especially when you go behind a shielded area or into the basement. When you don’t have cellular, you most likely don’t have radio, which is going to impact first responders.”
Consider implementing a duress system as well, Butler urges. It should have local and remote annunciation to draw attention when someone is being accosted. “Staff can come in and say, ‘Hey, is everything OK?’ or intervene in an event,” explains Butler. “There aren’t a lot of people in some of these clinics, yet they can be large facilities..”
3. Surveillance
Surveillance has long been viewed as a reactive technology rather than a proactive one, but new video analytics capabilities are changing the game, Butler says.
“Video surveillance today has the ability to tell you in real time about unusual events,” he adds. “For example, you might have an eight-story medical office building that closed at 6 p.m. and there was no real activity after that, except that at 3 a.m. your surveillance detects motion on the seventh floor and pops up on a screen in front of someone. All of a sudden, video is no longer being reactive—it’s proactively directing you to an event.”
[Read also: Security in Parking Garages, Retail and Schools]
Today’s surveillance cameras can provide a wide range of services beyond simply recording movement, such as:
- Heat mapping, which can tell you the flow of traffic through gates and help you optimize which gates are open at which times
- Foot traffic tracking for various entrances
- Searching recorded footage for people fitting a certain description
“If you have a camera focused on a door and something happens in your organization, and the victim says it was a white male who was approximately 6 feet tall, wearing a red shirt and a blue cap, you can tell the video system software to review stored footage and eliminate all others that don’t fit the description you’ve just given it,” Butler says. “The camera will only show you people who match or who are very close to that description. Imagine the advantage gained if during a particular time period, you had 3,000 people go through a door – and the software illuminated all but the camera can tell you the 12 who closely match your description.”
How to Proactively Improve Healthcare Security
Don’t wait for an incident to start beefing up your healthcare security practices. Investments in physical security can be worked into your budget over time.
BUILDINGS Podcast
Security Red Flags in Existing Healthcare Facilities (FM Friday)
Hear the FM Friday podcast inspired by this article. Listen now >>
Butler recommends reaching out to other healthcare organizations to see what they’re doing. “Some other organization has gone through [a challenge] and has written a whitepaper on it or is more than happy to talk to you about the challenges they’ve faced that you should be aware of,” he explains.
For example, after the 2012 shooting at the Century 16 movie theater in Aurora, CO, politicians and other public figures visited victims at the hospital, Butler explains. This created many challenges for the facility’s security team. If the same thing happened at your facility, how would you corral onlookers and members of the media trying to observe those visits? How would you protect the safety of not only your patients, but of the visiting celebrities?
How will the influx of people change the way you manage vehicular and pedestrian traffic?
Next, look at some of the most common security lapses. Ahrens conducts penetration testing for clients and frequently gains access to hospitals through receiving docks.
“No one questions me and the doors are open,” Ahrens explains. “I’m in the back corridor, so typically there’s access to patient elevators, staff elevators, circulation stairs and critical information structure. Sometimes they have radiological stuff down there. The dock is the No. 1 concern for any hospital wanting to make sure they preclude access.”
[Related: 7 Ways to Protect Your Building]
The key to securing the dock is alert staffing, not high-tech gadgets, Ahrens adds. Anyone entering the facility through a certain point should have to show identification, and anyone without an ID should be challenged. The interior of the building should clearly separate public, quasi-public (where someone must be admitted by another person, like an exam room) and secure space.
Reception desks should separate patients and visitors from staff by at least a foot and a half, Ahrens adds. Ideally, the desk would be large and oval-shaped (which will also make the space more accessible for people in wheelchairs) and have a glass divider to keep people from jumping over the desk. The entire waiting area should be visible from reception. It’s also worth bringing in a consultant to find the blind spots you’ve missed because you see your building every day, Ahrens says.
“If you go into your building, look at your environment and ascertain that you are blinded by the culture and environmental factors that you have become accustomed to, and you can no longer recognize the vulnerabilities, that’s when you want to get a third party,” says Ahrens. “It’s not a bad thing. There are so many conversations I have where I’m asking questions and I watch the light bulb go off. Being able to convey that information in a way that lets hospital administrators make decisions about these risks is where organizations should be.”
BUILDINGS Checklist
Building Security Assessment Checklist
Keeping your building secure is a continuous process—not something you can take care of just once with a single investment in security technology. Start with these basic steps and common security gaps. Move on to upgrades, advanced technologies and other investments as your individual situation warrants. Download your copy here >>
Clinic and Hospital Security: Be the Standard
The cost of a reactive approach is high, and if an incident happens, you’ll be measured by the standards set by the healthcare security community as a whole, Butler says. It’s not good enough to be an average performer where security is concerned.
“When the time comes to be measured, you never want to be measured by some other healthcare organization five miles down the road,” Butler says. “You want to be the standard. That requires that you proactively stay abreast of what’s going on in the world and in your community and taking measures to mitigate the chance of something going wrong in your organization.”
5 Top Trends in Healthcare Security
The nature of healthcare is changing, and with it, healthcare security is evolving too. Here are some of the trends healthcare security professionals have embraced in the last few years.
1. New capabilities for visitor management systems
Visitor management software can tackle many tricky security tasks, says Sean Ahrens, author and security market group leader for Affiliated Engineers, Inc. Visitor check-in kiosks can query the patient management system to see if a patient has been discharged yet. If not, it can print out a sticker admitting the visitor only to the floor the patient is on. It can also tie visitors to watch lists and set up silent alerts to keep patients out of danger.
A patient whose spouse has committed domestic violence may not show up in the visitor management system, for example. Different floors can be assigned different colors so that when the system prints out a sticker for a visitor, they’ll stand out right away if they’re on the wrong floor.
2. Social media monitoring
Emergency departments can get advance notice of shootings and other incidents by integrating social media into their situational awareness practices, Ahrens says. This can buy hospitals a few extra minutes to marshal more security personnel and prepare to receive an influx of patients.
3. Turnstiles and anti-tailgating technology
Optical turnstiles and pressure pads that detect motion and direction keep track of people going in and out of secure areas, but without compromising open design.
4. Interactive, robust access control
Access control packages no longer just open and close doors, says Alan Butler, senior vice president of HSS, a security service provider and consultancy for healthcare, and president of the International Association for Healthcare Security and Safety. Today’s access control offerings can manage alarms, record and manage video, and administer identification systems.
5. Robotics and drones
“There are some organizations in healthcare today that are using robots. They’re highly effective, they have cameras and they can be programmed to message and make announcements. They can even help with wayfinding,” Butler says. “The full use of drones is yet to be determined, but consider a remote parking lot that costs thousands of dollars to run wire to so you can put up a camera. You can tie in a tethered drone over a remote parking lot and get the same video over wifi at a far lower cost. The sky is the limit when it comes to the quality of today’s healthcare security programs."
Two handpicked articles to read next:
