Layering security
All this information forms the basis of the ‘who/what/when/where’ of a security system, which is an exercise in layering security vertically and scaling that security plan horizontally. Once the stakeholders and decision-makers have been identified, the hospital can creatively scale security solutions to match the risk associated with each opening. This allows the hospital to maximize the security plan while staying within a budget. High-security areas may require more sophisticated online solutions, while lower-risk ones could need simpler, offline products. The hospital has far more flexibility in designing a security system in this manner.
The typical steps for security system design are:
1. Define users (e.g. clinical staff, general public/visitors, patients, those with disabilities, other populations within the hospital).
2. Identify estimated budget.
3. Determine the specific areas of greatest concern (e.g. nursery, intensive care units [ICUs], medication stations, pharmacy, supply cabinets, exterior visitor entrances, employee entrances, linen storage, nurse servers, patient rooms, staff lockers, and stairwells).
4. Assign the frequency of use (e.g. high-traffic or low-use areas).
5. Document locations in the building subject to fire/egress codes such as NFPA 101, Life Safety Code, and NFPA 99, Healthcare Facilities Code, or the International Building Code (IBC). In many instances, the hospital has employed PIN-based devices that do not offer an audit trail or specific, individual accountability. Simply providing one code per unit or department for a push-button lock does not identify individuals who may have access to medicines or supplies. In some cases, the ‘confidential’ codes to access these doors are written either on the doorframe or on a sticky note nearby. Such locations would be suitable for re-evaluation.
6. Assign a level of security (e.g. general access, high security, lockdown areas).
7. Add sustainability requirements such as energy efficiency and/or Leadership in Energy and Environmental Design (LEED) goals. Doors contribute to significant energy loss from
the building envelope. Furthermore, many
of these facilities now require environmental product declarations (EPDs) and/or health product declarations (HPDs).
8. Build in infection control by specifying antimicrobial coatings.
Reviewing the door hardware and security device options
Once the committee has identified and agreed on these factors, selection of devices (and the platforms they require) can begin. Frequently, security consultants, door and hardware manufacturers’ representatives, and end user specialists provide valuable details for product selection. This may include performance specification, integration to third-party access control systems, or maintenance plans.
Online access control
Until recently, the only option for online access control was to hardwire every opening. This technique can be desirable (and even necessary) where immediate lockdown or egress might be required—for example, in the case of stairwells. However, the expense of hardwiring, particularly in the case of a retrofit application, can be cost-prohibitive. Adding in the expense of qualified, licensed electricians and other professionals can raise the actual installed costs much higher than expected. There are other ways to accomplish online access control employing two similar platforms as discussed in the following sections.
Wi-Fi
Most hospitals are equipped with a Wi-Fi network that can be employed as the platform for access control. The main advantage of using Wi-Fi is it is an ideal solution for non-critical openings that still require monitoring, audit trail, and secured access. Wireless devices provide a secure encryption for access codes and, in many cases, can use the existing badge or credential currently employed by the hospital.
Another advantage of a Wi-Fi device is access decisions are authorized ‘locally,’ meaning the locking device does not have to ‘check-in’ with the access control panel. Additionally, a record of transactions is maintained in the device at the door.
Wireless
Typically, a wireless device requires a hub or interface that is actually hard-wired back to an access control panel. One advantage with the wireless devices is the card reader (or integrated reader/lock) can be applied directly to the door, making for an aesthetic and cost-effective application. Further, these devices are often ideal for otherwise-difficult applications, such as historical buildings, stone assemblies, or extra thick walls. Since the hub or interface is above the ceiling, the installation of the device on the door is faster and causes far less disruption for the hospital. Additionally, the programming of wireless devices is typically done right at the access control system and access can be provided to anyone at the time of on-boarding.
Power-Over-Ethernet (PoE)
This platform uses the network power provided by the Cat 5 or Cat 6 cable installed throughout the hospital. The main advantage of PoE is the significantly reduced energy cost. Devices on PoE act just like hard-wired devices and provide immediate tracking on the access control system.
Offline devices
Some non-critical areas of the hospital are not necessarily the object of inventory shrink or losses due to ‘diverting’ of supplies. This may include soiled linen rooms or even staff restrooms. Such areas can be secured with PIN-pad-only devices that do not provide audit trail or monitoring.
Electronic cylinders
Often referred to a ‘portable security,’ some electronic cylinders can replace existing mortise cylinders and provide simple access control. These devices use a battery-powered key to program the cylinder locally or it can be web-based. Another advantage is electronic cylinders are available in a number of form factors that allow application to remote or fenced areas of the hospital campus, such as large equipment storage where padlocks might be used. Other areas might include a cash office or the cabinets on trucks or other areas. This type of platform is particularly effective where there are fewer than 50 users.
The objective of this exercise is to ‘scale’ the security solution to fit the unique needs of the hospital or system. Most of the platform solutions can be cascaded across an entire healthcare system—even one with locations in different states.
