Restrictions. To keep out persons who might pose a problem, the hospital places what it calls entry “restrictions” on anyone the administration has reason to believe might create a disturbance. A list of these potentially disruptive persons, most of whom are recently terminated employees, is distributed to officers at entrance stations, along with their photos. At the beginning of a shift, the station officer is expected to review this list.
The list includes the date the employee was terminated and whether badges and keys have been returned. Only one or two names are on the list at any one time, says Arnett.
Sometimes parents or other caregivers want to add a name to the restrictions list. For example, they may want the hospital to prevent visits from estranged spouses. A spouse must have a court order on the other spouse as the basis for a restriction. And the paperwork must be provided before the hospital will take action.
In addition to restricting any one person’s visitation privileges, parents have the right to require that the hospital not disclose their child’s location, room number, religion, or condition, Arnett says. When a parent requests such a restriction, security dispatches a supervisor to the child’s room to explain to the parent what it entails: that the hospital can’t give out the phone number to the room, allow flower or food delivery, or even acknowedge that the child is in the hospital. “Ninety percent of the time they say that’s not what we wanted,” says Arnett.
The hospital enforces about one to three such restrictions at any given time. They are highlighted in electronic and hard-copy versions of patient files.
Children’s Mercy imposes its own restriction—called a blackout—if a child is a victim of a shooting. It involves the coordination of the security department with the ER, the social work department, and other hospital units.
When the child is admitted, anyone other than the parents who asks about the child will be told that he or she isn’t there. After about an hour or two, the parents can make a list of ten people who will be allowed to see the child. Anyone else will be told that the child isn’t at the hospital. “Someone may be coming to finish the job,” Arnett explains.
There is also a general standing restriction on the number of visitors that may be admitted at any one time. If dozens of family members show up together, they will be shepherded to a private area by a chaplain or another appropriate person, who can get the group under control. They will then be allowed to visit the patient a few persons at a time. Large groups are not allowed to remain on the premises for extended periods, however.
Another objective of the new access control procedures is to prevent contamination of the facility and its occupants in the event of a nearby incident in which persons are exposed to contaminants.
Protocols have been established by which the health department, ambulance personnel, or other first responders would call ahead to the hospital to say that patients who might be contaminated are being brought in. Security officers and other front-line personnel would then don their protective gear. The sign-in stations would be moved either just inside the doors or right outside the doors so that any contaminated patients would not infect the hospital population.
Children’s Mercy is prepared to treat contaminated patients in its ER, where it can set up different size decontamination tents depending on the extent of the exposure. The hospital conducts two mass-casualty drills per year in which staff practice these procedures and liaise with first responders such as firefighters and EMTs. Security and ER staff also conduct tabletop exercises to run through possible scenarios.
To deal with patients who might have been exposed to hazardous materials and who might try to enter through a non-ER entrance, officers receive training from a safety officer every other month. There they learn verbal techniques and specific language for determining whether a person is contaminated, for routing that person to the ER, and for stopping that person from gaining admittance through an entrance other than the one to the ER. Officers perform scenarios where they must put these techniques to use.
Basic protective gear, such as masks and gloves, is at each post for officer use. If a possibly contaminated person rushes past the post, the hospital would close down the affected area and bring everybody, including security officers, to a safe area. Fortunately, that hasn’t happened.
Internal Doors. After being admitted into the main campus facility by a guard, visitors encounter a second layer of security at their destination floor. At each floor, the elevators open onto a self-contained lobby/waiting area. Visitors push a button that alerts a nurse or other staff person on the floor. The staff have a monitor to see who is asking to get in and to make sure that they have the correct credential. Once allowed to enter, visitors have to sign in here as well. After visiting hours, only parents and grandparents may enter patient areas.
Staff can enter any area by using their magstripe ID cards. Several hundred card readers control access around the hospital, including at the entry into pharmacies and medical-specialty units. Employee IDs are encoded with permissions determining where they can go and when. The security team can track anyone by door use, time of use, and other factors, and it creates reports accordingly.
CCTV. The hospital used CCTV cameras even before it tightened its access control procedures. It factored the existing surveillance capabilities into the revised plan and is in the process of enhancing the coverage as the budget permits.
The main campus uses 175 cameras, many of which include pan-tilt-zoom capabilities. The cameras give security the ability to remotely monitor the entire perimeter. In addition, all entrances and sign-in posts are covered, as are main hallways, the waiting room for the ER, the cafeteria entrance and exit, and anywhere with a cash register, such as the gift shop.
Pharmacies are blanketed by cameras: cameras watch every door, the pickup window, and the accounting area, and several cover the shelves where medicines are kept. The south campus uses a smaller, separate system. Footage from both can be viewed live, and all of it is recorded on digital video recorders (DVRs).
Video feeds go to the main security office, but they are also available on the hospital’s network. Security personnel can monitor video from their desks, with the ability to pull up any camera feed from either campus, in either real time or from recorded footage. “I can follow anyone throughout the hospital in real time,” Arnett says. He can also pull archives and track a person via recorded footage.
Plans are underway to upgrade the system, which now uses mostly analog components but gets some of the benefits of digital through the DVRs. The department is poised to put out a request for proposal for conversion of the system to one based on Internet Protocol and Ethernet networks. The conversion will be phased in, Arnett says, because of the work and expense involved.
Staffing. In addition to enhancing access control protocols and equipment, the administration recognized the need to boost staffing. Two events occurred at the hospital that—along with 9-11—drove home to the administration the hospital’s need to invest in additional personnel to enhance security. One involved theft of money from the cafeteria, another a holdup of a landscaper outside the hospital.
At the time, the hospital had about 25 security officers for all of its complexes. That meant that staff were stretched pretty thin. The administration boosted the security budget by $1 million for additional staffing, which enabled security to upgrade to about 85 officers.
The funding paid for more patrols as well as for more officers to perform access control functions, such as watching the main gate where cars arrive, monitoring the garages, and staffing the newly deployed sign-in posts.
Results. The tightened access control procedures have reduced security incidents and have won the support of staff. But some problems arose early on.
For example, Children’s Mercy is located near a dental school, and students would routinely dine in the hospital cafeteria or shop in the store. That changed overnight, to the dismay of students and the operators of the gift shop and cafeteria, who lost revenue.
“When we locked down, we decided that we’re not in business for the gift shop and cafeteria,” Arnett says. Students have come to accept that the hospital isn’t a site of general public access, he adds. Similarly, after slight resistance from the operators of the gift shop and cafeteria, the change in policy was well accepted because hospital staff understood that the facility’s primary mission was helping patients in a secure environment, not making money.
Another problem early on was making sure that parents and other visitors who stayed overnight remembered to get the next day’s visitor badge. At first, many of these visitors would forget to replace the sticker or would continue using the elapsed credential from the day before. Staff now remind visitors to update their credentials at any of the sign-in posts.
Getting employees—especially doctors—to support the tighter access control procedures was also a challenge. They often forgot their badges and wanted simply to be let in. In a hurry to exit, for instance, doctors might leave their IDs on their desks. They might then get upset when pressed for an ID before being allowed to reenter.
The problem has since dissipated because of the administration’s support. “Top doctors and the administration have been behind this 110 percent,” Arnett says. “Everyone now has bought into the plan, seen that the administration is not pulling back, and seen that it works,” he adds.
Occasional petty thefts of the past are now almost nonexistent, says Arnett, and word has got out in the city that Children’s Mercy is not an easy mark. In one case, a person bypassed security and took the elevator straight to the clinics. There he roamed the halls until he found an unlocked doctor’s office, where he swiped a purse. But security got footage of the man leaving the building with the bag under his arm, and it distributed a color photo of him to all of the officers. Within a week, the man returned to the hospital, and an officer apprehended him.
Not only did the incident show outsiders that the hospital was no longer a soft target, it also helped demonstrate for the staff and administration the value of the program and the importance of following procedures, such as keeping internal doors secured. Security made this point directly to the people who left the doctor’s door open, and Arnett uses this story during staff security orientation as an example of what can go wrong when attitudes about safeguarding valuables are lax.
Additionally, there have been no incidents of unwanted people getting access to a patient. The security staff is not complacent, however. It is constantly looking to improve and fine-tune access control, as by updating its camera system.
Security is also eyeing a switch from magstripe to proximity technology for employee IDs, and it has been tracking the development of computerized visitor credentialing, with plans to go in that direction when the technology gets more user-friendly or when funds for the additional training that would be needed become available.
Some automated visitor systems currently meet Arnett’s desired throughput time of 30 seconds per person, he says, even printing a picture from a driver’s license on the credential. But he considers them too complicated for most officers to use; only people highly proficient with the software could make the 30-second limit, he surmises. Training is too cost-prohibitive for now, he says.
Children rely on the expert practitioners at Children’s Mercy to help them get well. The physicians and researchers rely on security to keep them well away from worries about safety so that they can concentrate on the children.
Michael A. Gips is a senior editor at Security Management magazine.