Hardening Security

Healthcare end-users must be aware of their options to maintain an open, yet secure, environment

• By Steve Connor
• June 17, 2020

Hospitals are where people go to seek treatment, recover and address critical injuries. It’s the place where doctors, nurses, and other healthcare providers devote themselves to helping people who need medical attention. In addition to this critical focus, a hospital also has to protect against unauthorized access, theft of medications or sensitive patient information, and guard against workplace violence, which affects hospitals more than other industries. At the same time, they must maintain a level of accessibility and openness, which presents difficulties as it relates to security.

The healthcare market has a range of specific physical security requirements that make it challenging to provide complete protection for a hospital. Pharmacies and pharmaceutical storage areas need to remain secure against unauthorized personnel with systems in place that recognize and track which employees are entering and why.

Numerous secure zones in a hospital need access control, such as quarantined areas or secure wards. All of this is complicated by the fact that healthcare facilities are often fast-paced environments. Doctors and nurses need quick and easy access to areas during emergencies.

When dealing with an environment as complex as a hospital, it’s crucial to understand the many facets that go into hardening the security of the facility, while simultaneously maintaining an open environment dedicated to patient care. Every business needs to do what it can to stand apart from others in the industry, so a heightened understanding of the total security needs for a healthcare institution will better prepare end-users to invest in technology that will provide safety, both now and in the future.

How Access Fits

Whether it’s in the heat of an emergency or simply going about a normal day, hospital employees must have frictionless access requiring minimal user interaction to secure areas that they are authorized to enter. This fact requires identity management and access control systems that are easy to use, fast and reliable.

Various smart card readers and access control solutions, using RFID, NFC, or UHF technologies, can be implemented to fit this environment. The locking mechanisms that are chosen for hospital entryways should incorporate these same aspects.

The doors that need to be protected in a hospital can vary greatly in their needs for locking mechanisms and access systems, ranging from external-facing entryways to smaller cabinets that contain sensitive pharmaceuticals. These could be implemented as new areas of a hospital are constructed or they might need to be retrofitted onto current rooms to replace outdated equipment. In any case, the solutions need to work well with the hospital’s needs and current systems.

HIPAA laws are very much on everyone’s minds for hospitals and anything healthcare and are often the driving force behind technology adoption. While access control systems do not contribute directly to the protection of cyber-based patient information, they can harden the security of rooms that patients don’t need access to.

For example, clerical offices where protected records are located should receive higher levels of security than the cafeteria. By only giving access rights to necessary individuals, this eliminates other individuals from coming in contact with sensitive information that they don’t necessarily need access to — nurses, doctors and interns. Hardening administrative offices and medical billing, and providing credentials only to people who need to access those areas, provides the means by which hospitals can leverage physical security to protect HIPAA-compliant records.

In addition to monitoring employee access rights, hospitals also need to track critical assets to ensure they haven’t been lost or stolen. This can include tracking where wheelchairs and gurneys are stored on the campus or tagging packages that are at high risk of theft, such as medication like painkillers. These and other customizable applications can be accomplished by using RFID and NFC tags. The same solutions can be used to monitor the location of infants or patients at risk for wandering.

Smart card credentials and readers can handle allowing or denying access, but they are even more powerful and agile when paired with a physical access management platform. These platforms can track movements and easily change parameters around access for certain users or times of the day. The specific needs for access points, which may change over time, could impact the locking mechanism needed for one doorway or another throughout a hospital environment.

Installation Needs For Healthcare

Healthcare facilities require as little down time as possible at their entryways to secure areas. When an access path is taken out of commission, it ideally should be for as short a time as possible. Exploring wireless locks is one way to speed up an install and cause less disruption for both doctors and patients.

Wireless locks can be implemented into doors easier and faster than their wired counterparts, which expand the areas of interruption and increase installation times. Hospital employees need to be allowed quick and easy access around a hospital to best help their patients.

Blocking or eliminating the use of a doorway, which is necessary for wired solutions that require the installation of multiple different elements, could impede many critical functions. For example, patients might have their activity or sleep upset, both of which are necessary elements of recovery. A shorter installation time with wireless locks means that work can be more easily scheduled at a convenient time for patients and doctors.

Protecting Both Data and Assets

Due to the nature of their work, healthcare centers collect and maintain many types of sensitive data. In the event of a breach, patients’ sensitive information could be maliciously accessed via a weak point in the network. Endpoint devices that have access to the network should be cybersecure against breach vulnerabilities. When many systems are interconnected, having proper cybersecurity protocols among all devices is a necessary step to ensure that all systems on a hospital’s network are running smoothly.

Security providers have, for years, been finding new ways to utilize existing infrastructure, and one consistent area of overlap is among video systems, analytics, and business intelligence. Video analytics, when used alongside access control systems, can provide valuable insight into a variety of areas. Users in healthcare are using analytics to improve consumer experiences and help doctors, nurses, and other employees to more effectively provide excellent patient service.

For example, when integrated with access control systems, analytics can provide insight into busier times of days, trends in patient needs, and more in an effort to better assist in scheduling during peak periods. In turn, hospitals can be sure they are staffed properly to provide better patient support to improve patient outcomes.

Certain doorways, such as those housing high-risk patients, have trigger points that let administrators know of a variety of event types: door holding, door forced, etc. Pairing this with video analytics provides the situational awareness necessary to make an informed decision. For example, if a healthcare provider does not close a door after leaving a patient room, data gathered from access control and video analytics can alert administration to this incident, but simply closing the door will fix the issue.

On the other hand, if a patient is actively trying to escape their room, administrators can deploy on-site staff to de-escalate the situation. Keeping people safe and secure is the goal of access control, but doing so with the help of video analytics further contributes to increased insight into patient and employee behaviors.

Solutions to Meet These Goals

The goal in access control within healthcare environments is very similar across all applications: keeping the wrong people out while letting the right people in. This is certainly true for the hospital environment.

Above and beyond other considerations, hospitals must be able to track and locate critical equipment or resources while also monitoring all the people entering secure areas and their reasons for doing so. These various elements of technology hinge upon one critical point: whether the door is physically locked or unlocked when it needs to be.

Healthcare facilities are focused on providing the best level of care for their patients, and that includes keeping them safe, securing their critical medications, and protecting their sensitive information.

This article originally appeared in the May June 2020 issue of Campus Security Today.