Market Focus: Healthcare Security

Danger Zones

Parking lots and garages are among the most dangerous areas of any facility. According to recent FBI statistics, 6% of the nation’s violent crimes occur in parking facilities, topped only by personal residences and sidewalks or alleys.

Ruddo says most hospitals install video cameras and blue-light emergency stations with intercoms to monitor the facilities and enable visitors to quickly contact the security operations center. Signage is also crucial in getting visitors to their destinations.

“Some medical centers are massive, and you want people knowing where to go,” Ruddo says. “Lost and confused people are more likely to be victimized.”

Emergency rooms, often open 24/7, pose another security challenge. The panelists recommend installing analytic cameras on entries to warn the SOC when too many people attempt to enter simultaneously. Locking doors into the exam rooms helps keep gang members from settling scores on events that began on the streets.

Ruddo says IST installs duress systems, using wall buttons and wearable pendants, throughout a healthcare facility enabling employees to quickly reach security if they fear an attack.

Regulations

The healthcare industry is one of the most highly regulated vertical markets. The federal Health Insurance Portability and Accountability (HIPAA) Act of 1996 covers the privacy and security of health records, notifications of data breaches, and patient rights over their information.

The independent Joint Commission on Accreditation of Healthcare Organizations (the Joint Commission) provides accreditation to more than 20,000 U.S. healthcare organizations based on the safety and quality of care, including security. Losing accreditation could result in severe financial hardships for an institution.

Nemerofsky says Joint Commission staff can be comprehensive and picky. “If an integrator ran cable through walls above a false ceiling in a high-rise office building and didn’t close the penetrations, there’d be no problems, as no one would see them,” Nemerofsky says. “But a Joint Commission inspector will find it and require a patch.”

where laptops, even handwritten notes, are found. Castillo says integrators must help their healthcare clients make it clear to the public why data, such as video, is collected. “I think we will get more public buy-in if people know what we are collecting, how we collect and use it, and what we do with it when we don’t need it anymore. As integrators, we need to get better at advising our customers.”

The integrators say many hospitals install cameras in patient rooms with video displayed at nurses’ stations. The live video enables nurses to check patients more frequently without leaving their posts or interrupting a patient’s sleep; however, HIPAA privacy regulations prohibit recording this video.

Cybersecurity

Hospital networks contain detailed private patient data, meaning a successful hack could lead to regulatory fines and lost accreditation. That is why hackers make hospitals a prime target for ransomware attacks, demanding millions of dollars to provide a decryption key. Hospitals are more likely to pay quickly, as a frozen network leads to delays in testing and procedures, more extended patient stays and even potential deaths.

That taps into one of Nemerofsky’s topics – Open Supervised Device Protocol (OSDP), SIA’s new standard for access control installations. Older, non-encrypted technologies easily expose hospitals to hackers. “It is our job to impress upon hospital security directors the importance of running the latest versions of access control or video systems,” Nemerofsky says. “And they must routinely change passwords.”

Recently, many larger hospitals began requiring integrators to carry cybersecurity liability insurance, Ruddo adds. “The security devices you install are plugged into the IT network. If a technician is troubleshooting a problem, they are using a company laptop on the network, which puts [the integrator] at risk,” he explains. “We have one hospital system in northern Virginia that requires $10 million in cyber insurance. It is a new expense in this market.”

Standardization

manufacturers within a large healthcare organization.

“It doesn’t matter which manufacturer made the access control systems – bringing data from different systems into the SOC puts a strain on the operators,” Nemerofsky explains. “The goal is to standardize on one system. Hospitals need help from their integrators to create a reasonable migration plan.”

Castillo points out that doctors and staff often have responsibilities at multiple sites, requiring them to carry multiple access credentials. “It is not unusual to see nurses with six or seven badges around their necks. Too many card technologies introduce risk. Condense the credentials so employees can move between facilities, buildings or departments with one card.”

How Security Can Provide Efficiency

Several traditional security tools can help hospitals become more efficient. For example, Nemerofsky says video surveillance helps with COVID-19 contact tracing: “If an employee arrives at work and tests positive for the virus, security can look to see which doors the person touched in the past 24 hours,” he explains. “Other employees immediately following the infected person should be warned to watch for symptoms. And the doors should be sanitized.”

Nemerofsky adds that using cameras to monitor visitor and employee temperatures is not reliable, as the devices require hourly calibration. Also, the technology monitors skin, not body, temperature. He tells a story of a technician walking six blocks to a meeting during a Dallas summer. The outdoor temperature was 106 degrees and by the time he arrived at the hospital, the camera indicated he had a fever. He cooled off in the lobby before arriving late at his meeting.

Castillo says integrators can leverage data from access control or video systems to help hospitals increase their return on investment. “The access system may show that one area is impacted by heavy use while another nearby hospital section is relatively quiet,” he says. “Maybe we can help rearrange things to maximize efficiency.”

All three integrators agree that a handheld biometric scanner accurately authenticates a person’s identity and may be used more often to avoid giving a patient treatments or medications intended for another hospital patient sharing the same name and birthdate.

New Technologies?

Are hospitals open to new technologies? According to the integrators, they are, but to a point. Ruddo says real-time location tracking solutions are used widely for keeping track of newborns and elderly patients in memory care. Touchless, including biometric access control devices, are popular in areas such as an ER.

“If a staff member or a nurse is wheeling a patient between departments, they don’t want to keep presenting their credentials,” Ruddo says. “Touchless technologies are deployed to make it easier to do their jobs without sacrificing security.”

Nemerofsky says many hospitals include video analytics in their security mix. He provides an example of a car being stolen from a hospital campus. “You want to know who stole a blue Honda Civic on Tuesday, somewhere between 1 and 3 p.m. – an analytic can pick up on that,” he says. “As a result, maybe I need one less investigator in my department because now I can do this investigation in minutes instead of hours or days.”

Castillo says that drug cabinets, integrated with the access control system and charting and prescription-writing software, protect against thefts or mistakes. “We can arrange it so that a nurse goes to room XYZ to access a cabinet that distributes only the exact amount of drugs for a specific patient. That’s an opportunity for applying security technology.”

Castillo adds that hospitals generally prefer proven, reliable security products instead of cutting-edge technologies. “This is not a tip-of-the-spear type of industry when it comes to security.”

RMR for Integrators

Hospitals offer many RMR opportunities, including hosted video and access control services, system maintenance and credential management. The latter choice works well for healthcare organizations with regional facilities.

“Traditionally, hospitals were located in central areas, but now community hospitals, part of the same system, are in the suburbs,” Nemerofsky says. “Remote badging for these community sites is a valuable managed service.”

According to Nemerofsky, most visitor management systems are cloud-based, as are weapons and gunshot detection, which he identified as two more RMR possibilities. Managing a hospital’s IoT devices is another hosted service integrators may offer.

Ruddo says most hospitals have strong IT teams, yet there’s a need for embedded staff to handle workstation and software upgrades. “Integrator employees can perform standard repair tasks as well as preventive maintenance to keep systems operating optimally,” he says.

Castillo says hospitals are ripe with RMR opportunities, especially those looking to expense systems vs. making an upfront investment.

“The creative mind can turn anything into an RMR opportunity,” Castillo says. “There are so many systems within a hospital – child abduction systems, you name it. Again, just look at the systems they have and apply a little creativity, see how you can go about making that work.”

Getting Your Foot in the Door

The size and complexity of hospitals may intimidate smaller integrators, stopping them from bidding on healthcare projects. The panel says there are ways to prepare for that first project.

An integrator will need experience dealing with general contractors for new construction, says Ruddo. That requires familiarity with the bid process and having bonding capability – things that may be difficult for many smaller integrators. “When dealing with system upgrades, you have to show you are certified by the manufacturers whose products are being installed,” Ruddo says.

Castillo says large hospital systems prefer hiring well-known integration firms. “There’s a saying that no one was ever fired for hiring IBM.” He recommends smaller integrators take sub-contractor roles to ask questions of veteran integrators with healthcare experience. “Over time, you build the capacity to deliver a job as the lead integrator.”

Nemerofsky recommends integrators new to the vertical join organizations such as the International Association of Healthcare Security and Safety (IAHSS) to learn more about the market and network with members of hospital security teams.

As final advice, Castillo urges integrators taking on a healthcare project to plan carefully. “The cost of failure is extremely high in a healthcare environment. Be prepared if something goes wrong. Have backup supplies and technicians readily available to make things work – fast. There is a high demand for that level of service.”

Jon Daum of security-centric PR firm Daum Weigle (www.daumweigle.com) contributed to the writing of this article.