Access control evolution allows multiple options for healthcare security

Part 8 of our healthcare series

Hospitals are challenging environments. A hospital requires oversight 24 hours a day, seven days a week

Access control in particular has advanced significantly to offer healthcare facilities the ability to control access remotely, through mobile applications, confirm identity quickly and easily and program varying levels of access for visitors, patients, doctors and staff.

Hospitals are challenging environments. A hospital requires oversight 24 hours a day, seven days a week. In particular, integrated systems can allow officials to program various doors and locks to activate at various times and apply rules based on time of day, shift changes, etc. Sensitive materials, such as pharmaceuticals or surgical equipment, demand an entirely different set of access control standards, which means any solution implemented must be easy to use and scalable to fit growing needs.

A Security Management System (SMS) can be used to integrate a facility’s access control technologies, digital video and alarm monitoring systems into a single, streamlined solution, says Mitchell Kane, President, Vanderbilt. “One advantage to this type of solution is scalability and flexibility, and its ability to serve multiple sites, which is common in this vertical market,” he says.

Meeting each hospital’s unique challenges

Every hospital setting has unique challenges. Consider Highlands-Clarksburg Hospital, a 150-bed behavioural psychiatric centre in Clarksburg, West Virginia. It houses patients in a wide range of circumstances, including forensic patients (deemed unfit to stand trial and/or non-restorable), dual-diagnosis substance abuse patients, children and adolescents, and intellectually challenged individuals.

Because of the nature of the facility, it was determined that a two-step control process was needed to help ensure security and employee safety. Extra security measures were also needed to manage elevator usage, to ensure that high-risk patients are always escorted.

To meet the requirement for a two-step security procedure on interior doors, a Galaxy access control system added an additional layer of protection requiring users to input a five-digit PIN code. The same approach was also applied to the elevators controls, taking advantage of the integration between the access control and patient tracking systems. Thus, both a card swipe and PIN are required to pass through any controlled doors, to call an elevator, or to cause the elevator to move between floors. Escorting a patient requires a card swipe, PIN, and the patient tracking reader, or an alarm sounds.

In all, the integrator installed 208 readers, 24 power supplies and 20 Galaxy controllers to implement the facility access security system.

Sensitive materials, such as pharmaceuticals or surgical equipment, demand an entirely different set of access control standards

Securing access to narcotics

One area that is recently experiencing rapid growth – and drastic change –is the securing of narcotics within healthcare facilities, says Robert Laughlin, President, Galaxy Control Systems. In the past, all medicine was controlled in a central pharmacy located somewhere in the hospital or health facility. These pharmacies were highly secured areas, with strict access limitations; only authorised staff could get near the medicine stocks. To improve the speed of delivery, and to have the necessary medicines ready at hand for in-patients without retaining a large delivery staff, the current trend is to have distributed pharmaceutical closets or carts that hold medicines much closer to the intended patients.

“One consequence of this approach is an increased security challenge to protect these distributed locations and the people that have access to them,” he says. “One solution is to combine the use of new wireless cabinet locks for the storage cabinets and carts with RFID panic devices for the staff. Both of these devices can be integrated into the facility access control systems so that the healthcare facility can monitor the operation and respond quickly to any incidents. “

Managing visitors in multiple scenarios

A hospital chain in Orlando, Florida, uses STOPware’s PassagePoint visitor management system at 13 of their hospitals. While all of the hospitals use PassagePoint at the main reception desk to process visitors, each facilities uses PassagePoint a little differently. The large city hospitals use PassagePoint 24 hours a day at their reception desks to process visitors and control the number of visitors in patient rooms. The smaller hospitals use PassagePoint after hours to keep track of visitors in the hospital after regular visiting hours and also deploy Patrol Officers to check the patient units to confirm that visitors are still with the patients.

A current new system enhancement project for this hospital chain is placing self-service kiosks in the Emergency Department waiting areas. Loved ones who are authorised to visit Emergency Department patients are given instructions to self-register at the kiosk. A key component of the self-registration is the Emergency Department stretcher where the patient is being treated. Only one key family member is allowed to self-register to visitor and/or stay with the patient. The hospital chain is looking forward to adding Health Level-7 (HL-7) patient integration in order to maintain highly accurate patient room locations.

Integrated access and identity management

Another hospital used HID Global’s iCLASS SE platform, powered by Seos, to implement a major upgrade to a single, integrated access control and identity management system. The hospital is using the system to rebadge thousands of staff, contractors and volunteers, replacing magnetic stripe cards with more secure and versatile ID badges that can support numerous future access control applications. The upgrade was launched during a major corporate re-branding and expansion initiative, and was implemented in stages over a several-year period. To support this multi-phase project, HID Global provided the institutions with multiCLASS SE readers that simultaneously support magnetic stripe, Indala proximity and higher-security 13.56 MHz smart card technology.

In the emergency room, 55 percent of nurses are assaulted in some way each year

Another HID Global example highlights a non-physical security example. The hospital selected an integrated, government-certified solution from HID Global that empowers them to attach a digital certificate of identity authentication to a FIPS 140.2 certified credential, using IdenTrust as the Certificate Authority for each authorised prescriber. FIPS 140.2 is a U.S. government computer security standard used to accredit cryptographic modules.

The HID Global credentials also include one-time password (OTP) functionality that allows EPCS (Electronic Prescriptions for Controlled Substances) authentication using an OTP, without the need of a desktop reader. With HID integration to Epic EHR (Electronic Health Records software), either the digital certificate or the OTP (with PIN) can be accepted within the EPCS module for two-factor authentication. This provides the convenience for the prescribing physician to choose the authentication mode that best fits his or her workflow in a given scenario. The integrated solution includes:

• ActivID Credential Management System (CMS), ActivID Authentication Server
• OMNIKEY reader/encoders and FIPS 140.2 contact credentials with an OTP generator and display window
• FARGO printers and Asure ID software to print customised credentials
• HID Professional Services for project management, installation, workflow analysis, training and support.

Focus beyond patients to include staff too

Healthcare security is often centred on the patient and keeping him or her safe, which is absolutely crucial. However, Jim Stankevich, Global Manager – Healthcare Security, Tyco Security Products, points out that the safety of hospital staff, particularly nurses, can be overlooked. In the emergency room, 55 percent of nurses are assaulted in some way each year, which is a high percentage. The safety of nurses and all hospital staff deserves more attention.

Stankevich says one possible solution would be to use duress/emergency notification technology: staff could carry and wear a “panic button” or have a two-key combination on their computer as an alarm trigger. When the staff member hits the panic button, a direct message can be sent to security, alerting security staff about the event and requiring a response. “With Tyco Security Products’ Elpas infant abduction technology and the Lynx duress and notification system, we can pinpoint the alarm down to a six-foot radius, to a specific bed, nurse or location in the facility,” says Stankevich.

Read Part 9 of our Security in Healthcare series here