When it comes to providing security at healthcare facilities, hospitals and large medical complexes likely have in-house lockshops and a professional security director or chief security officer. Smaller facilities, however, generally depend on local service providers for physical security and door hardware services.
This article will discuss problems the many thousands of smaller medical offices face and where you’ll find opportunities to build your business.
The Marketplace
Doctor’s offices, small medical plazas, dentists, urgent-care facilities, specialty clinics, diagnostic centers and independent pharmacies are most likely to use local lock and security services. A common thread runs through all these facilities, but there are important differences.
Of the 600,000-plus doctors in the United States, about one-third are likely to be found in independent medical office facilities, according to the Agency for Healthcare Research and Quality. Others will work in larger clinics or hospitals. This means there are many thousands of doctor’s offices.
You also will find thousands of dentists, pharmacies and other medical offices. Another market segment includes group homes, post-acute-care facilities (PACs), assisted living, skilled nursing facilities and memory care. Of course, each market has slightly different requirements.
Potential Threats
Among the many potential threats that exist, each office will consider some as unlikely and others as necessary to address. The type of facility, physical structure, public interaction, neighborhood, types of medicines available and clientele will drive the security equation. Your job will be to review the realistic threats, survey the door, cabinet and locking hardware and help the owner or manager plan a cost-effective defense.
You might find it helpful to provide a healthcare security checklist so the owner or manager can do their own internal survey and begin to think about goals and solutions. A good place to start is LockNet’s Physical Security Checklist.
A few threats to consider:
Riots/Arson: We’ve seen a lot of civil unrest recently. Some insurance policies might exclude riot, war or civil unrest losses. Reinforced doors, locks and security window films can provide a small medical facility with some protection.
HIPAA: These federal regulations require strict storage, handling and dissemination of patient medical information. Effective physical or electronic access controls are imperative to protect paper or electronic records. Doors, file cabinets and servers must be secured. Internal key control protocols are extremely important as well. (Read more at “Locking Down HIPAA Compliance,” page XX.)
Theft: Internal theft is another area of concern at small (as well as large) medical facilities. Expendable medical supplies, tissues, toilet paper and office supplies often are thought to be an employee benefit when they aren’t.
A two-part procedure has proven effective. The first part is establishing a policy and expectations of employees. If they know that supply pilferage isn’t tolerated, most will comply.
The second issue is having supply storage areas locked. A security director at a small hospital once confided that these two simple procedures reduced theft by tens of thousands of dollars annually.
Medicines: Since the 1960s, pharmaceuticals have been a diversion, burglary and robbery magnet. One small medical office had periodic break-ins that targeted low-level Schedule IV drugs, such as Valium or Ativan. When this office quit stocking the pharmaceuticals, the break-ins stopped.
Stolen or counterfeit prescription pads also were common until the advent of E-Prescribing of Controlled Substances (EPCS) dramatically reduced that problem. EPCS remains the preferred prescription process today.
Violence: Doctor’s offices usually are safe places but not always. Clinics that handle psychiatric patients tend to experience considerably more violence, and even small family practices might have an irate family member from time to time.
In addition to staff training, access from the patient waiting room to treatment and consultation areas must be well-secured. At the least, a strong door and storeroom function lock are necessary, with electronic access control (EAC) recommended. The receptionist area should be accessed from the waiting room only through a window, with an alarm button to warn medical staff of threats.
Sabotage: The Internet of Things has become a daily reality. Burglars generally don’t steal microscopes, dental equipment or X-ray machines, but disgruntled employees sometimes sabotage the equipment. Controllers, computer connections and servers have to be in a secured area and protected from water, temperature extremes and electrical power issues.
A variety of additional threats also can include environmental factors, such as weather, fire, flood and earthquake, as well as power disruptions. Although these might not be your areas of expertise, the client has to consider the probability and potential effect of each.
Market Details
A few issues are common to most small medical facilities. These businesses all require Grade 1 mechanical locks or EAC to treatment areas to defend against uninvited guests. Alarm systems, secure records and pharmaceutical storage, a protected receptionist area and an internal annunciator to warn medical staff are necessary. Supply rooms and any pharmaceutical-storage areas have to be locked. CCTV plus reinforced door to treatment areas typically are recommended also.
Specific types of facilities require different considerations:
Doctor or dental offices generally are the least complex but often require door and lock upgrades. They should defend against hostile entry and protect records, pharmaceuticals and supplies.
Medical plazas and diagnostic centers generally will be larger and have automated doors and multiple interior offices. These buildings likely will have an EAC system, and the doors from the patient waiting area will be well-secured. Purpose-built facilities such as these should have commercial doors and hardware, with the normal lock, closer, hinge and exit device maintenance issues. These facilities also have to secure supplies, patient records and server rooms. CCTV in public areas is advised, because threats of violence are probable.
Nursing facilities cover a rather broad category. An interesting segment is the assisted-living group home. These often are small businesses that own one to six residences that provide assisted living or skilled nursing for four to six residents. These residential facilities keep low-level medications secured on-site but try to avoid more-potent pharmaceuticals.
Exterior doors often will be double-keyed to prevent patients from wandering off. Existing locking arrangements might not meet code, so they might provide upgrade opportunities. Group homes don’t tend to be burglary targets, but hostile relatives can be a problem. Group homes are very cost-sensitive.
Post-operative care, assisted-living or skilled-nursing facilities tend to be considerably larger and include EAC controls on most exterior doors and a reception-screening area at the entrance. Entrance doors often are automated.
These facilities could have several wings that hold 50 or more rooms. In larger facilities, doors to patient rooms will be configured for automatic closure when the fire-alarm system is activated. Pharmaceutical storage will be in a locked room that includes secured cabinets. Larger facilities don’t tend to be robbery targets, because they aren’t accessed easily from outside, but internal diversion is a constant threat. Effective internal key-control procedures are critical.
Memory-care facilities will be locked down to prevent patient elopement. Fire codes will require door release upon alarm, but violations can lead to tragedy and jail time. In some cases, patients will wear a transmitter that locks exterior doors as they approach. Many facilities opt for the less expensive approach of locked hardware (often maglocks) and some form of EAC for entrance and exit. Single-code keypads aren’t recommended, because the code quickly can become common knowledge.
Pharmacies are particularly vulnerable to pharmaceutical diversion, burglary and robbery. These have a 14% annual probability of burglary, robbery or employee pharmaceutical theft, according to Healthcare Consultants Pharmacy Staffing. The Centers for Disease Control and Prevention also estimates that more than 7 million Americans are abusing pharmaceuticals. This issue presents a growing pool of potential threats.
Larger pharmacies generally will have a corporate security program, but privately operated neighborhood pharmacies likely will welcome your professional help.
In recent years, considerable emphasis has been put on tracking the provenance of pharmaceutical sourcing. Each step, from manufacture through shipping and warehousing, is documented. This procedure has reduced diversion, transit theft and inferior product substitution significantly.
Physical barriers, EAC, time-delay vaults and CCTV reduce the incidence of robberies. Secure vaults have reduced the success rate of after-hours robberies significantly, while electronic dispensers improve accuracy and internal accountability.
Hardware Notes
Keep in mind that although CCTV systems can be a great deterrent, they come with some legal guidelines. Cameras can be used only in public areas or areas where there’s no expectation of privacy. This generally includes the patient waiting room and might include the office area and records vaults. Treatment area hallways might be sensitive to privacy issues. A prominent notice should be posted. Recorded data has to be in a locked area, password-secured and routinely deleted or overwritten after a reasonable time.
Reinforcing a door from the waiting room to treatment areas, along with a Grade 1 cylindrical or mortise lock is probably the No. 1 thing any healthcare facility should consider. EAC is helpful to document building access and to control access from the patient waiting room to treatment areas and records storage.
Supply or pharmaceutical storage areas, internal pharmaceutical cabinets or drawers and medical record files have to be locked and must include EAC or good internal key-control procedures.
Of course, each facility is different. Small medical facilities might not have a lot of hardware, but there are a lot of small medical facilities. It can pay to work in this discipline.
Cameron Sharpe, CPP, worked 30 years in the commercial lock and electronic access industry. Contact him at [email protected].
