By admin

Control Hospital Access with Care

Categories : Articles

Medical facilities such as hospitals and out-patient centers require more than the usual access-control and security systems.


Derek Trimble, Johnson Controls Inc.


Its difficult enough for facilities that must remain accessible to the public, such as museums, airports, and city halls, it is particularly challenging to concurrently maintain access and the level of security needed to protect the people, property, and assets contained in that building. It is fair to say that this challenge can be even more strenuous for hospitals and medical centers, where those who are most vulnerable are welcomed, housed, treated, and visited.

Hospitals and medical centers must provide access to many people, including visitors, patients, medical professionals, and support staff. However, access must be controlled by sophisticated systems to protect patients, patient information, pharmaceuticals, and medical professionals.

Because hospitals are considered by many to be a community resource, people want to easily enter a facility and come or go at their leisure and through any door.
On the other hand, the public is quick to criticize when a security incident occurs. Hospitals are not the sanctuary they once were considered, said Fred Roll, president and principal consultant with Roll Enterprises Inc., a healthcare security consulting and training firm in Morrison, CO.

Access control defined

Access control has traditionally been one of the most important elements of a hospitals security solution. Ideally, the phrase access control refers to controlling who goes where and when. This includes providing and limiting access to people, places, and things, as well as tracking and monitoring individuals and assets. It can be as simple as locking cabinets or as complex as a formal audit trail for card access into a pharmaceutical dispensary.

According to JCAHO (the Joint Commission on Accreditation of Healthcare Organizations, Oakbrook Terrace, IL), one element of performance by which a hospitals environment of care is measured is that the hospital controls access to and egress from security-sensitive areas, as determined by the hospital.

Roll advises his clients to think of the varying levels of security sensitivity as concentric rings with intensifying access-control efforts as the circles become more focused on security-sensitive areas. For example, the outside ring would start at the property perimeter, the next ring includes access points to the building, and the most concentrated ring involves the most sensitive areas, such as the nursery and pharmaceutical storage.

Employees and visitors

The original access-control device, the key-and-lock system, deters casual unauthorized access attempts but does not provide feedback, through an alarm for example, on these attempts. The advent of electronic access control allows monitoring of unauthorized access attempts. It also introduced a new class of keys that were not keys at all. The earliest key substitutes were insert devices, such as tokens, Holerith cards, and barium ferrite cards. Those were followed by swipe cards and numeric keypads. But insert/swipe cards and their readers are subject to wear and tear and require maintenance.

Unfortunately, some medical facilities are still using code locks as a level of protection, and they often do not follow protocols in changing the codes, said Roll. Most that use electronic access controls are still at the swipe card level of technology and are seriously looking to upgrade to proximity [technology].

Proximity cards use radio frequency (RF) technology. This contact-free solution reduces wear on cards and readers, and is more convenient for the staff.

Although not yet commonplace in hospitals and medical centers today, smart cards represent the state of the art in the evolution of the card. The chips in smart cards are capable of storing large amounts of data, performing calculations for encryption, or supporting an operating system on some of the more advanced cards.

Furthermore, data can be written to or read from smart cards on the fly. Thus a card used for access control could also hold additional information and carry other application-specific data.

The ability to incorporate many individual identifiers onto a single media makes this access control solution easier and more cost effective to administer, and provides a tighter degree of security. For example, hybrid solutions can handle a bar code for inventory control, a photo of the employee for identification, a dollar value for use in the cafeteria, a biometric template for data protection in the IT department, and proximity technology for access control, all on a single credential.

Closed-circuit television (CCTV) is a key component of a security system and the tool most commonly used, in combination with access control, to validate and manage personnel traffic into and out of a medical building. It also serves as an overt reminder that a security system is present and helps to mitigate liability in the event that the hospital is sued.

The combination of video and CCTV provides a powerful enhancement for security and response. For example, the event of a triggered alarm could signal the CCTV system to provide real-time video of the site in question. It is also possible to use digital video recorders to isolate the sequence of frames from immediately prior to the event, providing the means to see what caused the alarm state.

Visitor management, or tracking visitors, is a very necessary part of an access-control system. Furthermore, JCAHO standard EC.2.10 for security management plans now mandates the tracking of visitors. Compliance further reinforces the need for an access-control system to track visitors and record their whereabouts at all times.

Patient management

Patient security is another area where hospitals seek to keep the appropriate balance between safety and open access. A range of specialized products is used to keep patients safe without unduly restricting freedom of movement for staff, patients, and visitors.

Medical facility access control should be viewed as concentric rings with intensifying control efforts as the circles get closer to security-sensitive areas. The lowest level of control is used in lobbies and reception areas and much higher levels in waiting areas and patient rooms.

Protecting newborn infants and the smallest pediatric patientsfive years old or youngeris of particular concern. Although infant abduction is rare, it is a devastating event when it occurs, resulting in a barrage of negative publicity, staff morale problems and, very often, litigation. To prevent this nightmarish scenario from happening, most hospitals have taken the proactive step of installing electronic infant protection systems in their obstetric and pediatric departments.

These products consist of a wireless RF tag worn by the infant on the ankle or wrist, door monitors to protect exits, a network of RF receivers, and a control panel. If an infant is brought near a protected exit without authorization, the door will immediately lock. If the door is already open at the time, an alarm will occur at the control panel. Cutting the strap on the tag also triggers an alarm.
Some of the more advanced products also help accurately match the mother and infant for feedings or at any other time. The mother wears a small wrist tag that is bonded with the infant tag. Whenever the two come together, the system provides an audible or visual match confirmation.

An infant protection system enables a hospital to provide the highest level of security for infants, as well as prevent mismatches, without restricting, in any way, access to the birth and postpartum recovery area. Mothers can roam the hallways with their babies, visitors can come and go, and the staff doesnt have to monitor every single person who comes on the floor.

Freedom of movement with security is also the key advantage of products designed to protect those at the opposite end of the age spectrumAlzheimers sufferers or others with dementia who are prone to wandering. These patients are not as much at risk from others as they are from themselves. Restless behavior can often lead the patient into danger, whether it is exposure to severe winter cold or a busy road.

These patients could be secured by placing them in a lock-down unit. However, such physical restraint is not only a violation of their dignity, but also of their rights. For many years, the federal government has required facilities to ensure the civil rights of each resident and to conduct individual assessments of needs. Only those who pose a serious danger to themselves or others can be locked in.

In contrast, an electronic wander prevention system restricts movement only when a patient is at immediate risk of leaving the safe area. Like the infant protection systems, the patient or resident wears a discreet RF bracelet on the wrist or ankle and doors are secured by monitors. A closed door will lock when the monitored patient approaches it. An open door will trigger an alarm. Central reporting is provided by a display panel or a control panel.

As with other access-control products, infant protection and wander prevention systems are designed to be integrated into the facilitys overall security management system. One manufacturer, Xmark, a division of Instantel Inc., Kanata, Ontario, Canada, actually extracts images from the CCTV system and displays them in the software application for its Hugs infant protection system and WatchMate wander prevention system. Each exit is linked in the software to a specific CCTV camera. When a door alarm occurs, nurses are automatically shown what happened at the exit in the moments just before and after the alarm. Armed with this information, they know exactly how to respond. The CCTV footage, automatically cross-referenced with alarm data from the Xmark software, also provides invaluable evidence of the incident for legal purposes.

In addition, these products can be connected to subsystems such as paging or intercom systems to help personnel react to events. With a local paging system, for example, staff members can be automatically notified of alarms no matter where they are in the facility. They are given the name of the person, the location, and the time, so they can respond effectively.

An intercom system can also help minimize incidents and ensure that response to an event is suitable and controlled. By communicating with a witness at the incident location, a security officer will know how to respond and with what level of urgency. For example, responding to a request for assistance from an orderly who is taking a patient back to his room is very different emergency from one that requires an outside police agency to assist in containing and arresting an individual who has assaulted someone.

Whether a medical facility is new or existing, security and access control are a key component in the overall building plan. While there is no crystal ball for access-control and security needs, medical facility builders and owners have an obligation to monitor security trends and maximize the efficiencies of their facility infrastructures.

Part of this obligation involves making the transition from legacy technologies to those that can be leveraged long term with new applications running on the existing, now-paid-for systems. Doing so creates tremendous efficiencies and precludes repeated purchases and replacement of critical access-control cards and equipment.

Derek Trimble is senior marketing manager with the fire and security solutions division of Johnson Controls Inc., Milwaukee.