Hospital Security: Rules, Regulations, Awareness and Acts

Nov. 2, 2012
Power door operators, antimicrobial door hardware, touchless switches, antiligature knobs, refrigerator locks and key control help secure patients, drugs and records.

Hospitals must follow building codes, fire codes, life safety codes, federal mandated acts, and specific state and local regulations. Hospitals in California are overseen by a number of agencies and organizations. Some of these are specific to California; others have influence nationwide.

The following is a partial listing of the organizations that have influence over the hospitals in California.

OSHPOD - Office of Statewide Health Planning & Development

 In California, OSHPOD is the state government organization that reviews and inspects "patient overnight stay" facility construction projects. These include hospitals, skilled nursing facilities, licensed clinics and correctional treatment centers. OSHPOD enforces building standards including IBC and Title 24 as they relate to construction.

CMS - Centers for Medicare & Medicaid Services

This federal agency administers Medicare, Medicaid, State Children's Health Insurance Program, and Health Insurance Portability and Accountability Act standards in long term care facilities and hospitals using survey and certification process. 

TJC - The Joint Commission (previously known as JCAHO)

This nationwide, private, not-for-profit organization accredits and certifies health care organizations. Joint Commission accreditation includes hospitals; doctor’s offices, nursing homes, office-based surgery centers, behavioral health treatment facilities, and providers of home care services. Certifications and inspections are voluntary.

ADA - Americans with Disabilities Act

This act prohibits discrimination on the basis of disability. A disabled person is defined as having a physical or mental impairment that substantially limits one or more major life activities. The ADA does not specifically name all of the impairments that are covered. The ADA applies to the United States Congress.

Title 24 - California Code of Regulations (CCR)

California instituted Title 24, starting in 1989. Title 24, the California Building Standards Code, is a compilation of three building standards: building standards adopted by state agencies, the national model code standards adapted to meet California condition, and building standards authorized by the California legislature that are not covered by building codes. Although not limited to hospitals, Title 24 access requirements go beyond ADA.

LAHJ - Local Authority Having Jurisdiction

This individual has statutory jurisdiction, having the right and power to interpret and apply laws, codes, regulations, etc. The LAHJ works with OSHPOD, CMS and TJC.

Each of the above agencies and organizations has their specific rules and regulations. For example, the TJC requires under-sink cabinets must remain empty and be locked at all times. The use of keyed spring latch cabinet locks where the key can only be removed in the locked position ensures that if the door is closed, the cabinet is locked. The operating key cannot be on a master key system.

The ADA requires the bottom latch of a surface vertical rod exit device have a guard plate to stop walkers, wheel chairs or gurney wheels from becoming trapped.

Hospitals have additional regulatory oversight because this is where people go when they are ill. Hospitals are particularly conscious of patient health and safety. They attempt to provide services that place patients’ and family members’ needs in high priority.

Antimicrobial Coatings

One of the ways of limiting possible transmission is to provide contact protection or to limit the amount of contact of door hardware.  Many hospitals are purchasing locks and door hardware that have an anti-microbial coating or film that resists the growth of microbes. The use of anti-microbial technology has expanded beyond door hardware. For example, there are door manufacturers offering doors and doorjambs with anti-microbial coating.

Power Door Operators

More and more hospitals are installing power door openers, both low energy and automatic door operators. Door operators simplify the movement of patients in gurneys, wheel chairs and walkers by providing barrier free movement. They can also help to prevent damage to doors that result from carts, gurneys, hand trucks, etc.

According to code, push plates must be located at seven inches minimum above the floor and between 30 and 44 inches above the floor. Using column or bollard switches provide a long switch pad (36") and satisfies the codes as well as two standard activation switches. The long switches enable disabled individuals to gain access using a wheel chair, foot, cane or crutch to provide contact.

Full automatic operators provide opening and closing for exterior doors to control air pressure requirements. In certain areas of hospitals, transplant, isolation, specific laboratories, operating rooms and patient care rooms must have sterile air. They have separate heating and air conditioning systems. To provide sterile air, and to resist non filtered air migration into these areas, the areas have positive air flow sufficient to stop the migration. However, because of the positive air flow, all separation doors must be equipped with full automatic door operators and safety and activation sensors to insure doors close and latch reinstating the barrier.

Touchless Switches

Touchless switches provide contact free door activation. These sensory switches can utilize an infrared (IR) or Doppler effect microwave technology. Waving your hand in range of the sensor activates the door operating mechanism. Touchless switch detection ranges from five inches for IR sensors to 24 inches for Doppler affect microwave sensors.

Antiigature Hardware

Patient safety is also a unique aspect of security for some hospitals. To prevent suicide, hospitals that have psychiatric departments are using ant-ligature knobs and levers on door locks as well as anti-ligature hardware on the hinges including continuous hinges. As an alternative, hospitals are also using push-pull handles installed in the upside down position to prevent patients from tying a bed sheet onto the handle and throwing it over the door to create a noose high enough.

Thermal Pins

When installing new doors, thermal pins can take the place of the bottom rod in surface and concealed vertical rod exit devices. This provides the hospital with the ability to remove the floor strike making it a safer for patient traffic. Depending upon the device manufacturer, thermal pins can be installed in single and double door applications.

Variances can also be made by the different agencies and organizations. For example in one hospital, a variance was permitted that allowed stainless steel armor plates mounted onto fire rated doors be taller than the maximum 36" above the floor. The purpose of the armored plates is to protect the doors against cart, gurney and equipment causing damage.

Narcotic Storage

Hospitals have medicine refrigerators that are required to be monitored for temperature and can notify if the temperature is out of range. Depending upon the content and the method of controlling access, locks can be installed that provide audit trail. The refrigerator locks are available with different modes of access including keypad, Magstripe card, proximity card or smart card. Some of these locks are Ethernet ready or wireless.

Some refrigerators contain "Scheduled Narcotics", the highly addictive prescription medications. These refrigerators are monitored and audit trails are checked for authorized badges. At the beginning and end of each shift, an inventory is completed with cross checking to patients to insure proper dispensing. To ensure that patients are receiving the appropriate amount, blood tests may be performed that test for the medication received.

Access To Health Records

HIPAA, the Health Insurance Portability and Accountability Act, has a Privacy Rule enacted by the federal government that provides protection for personal health information held by covered entities. HIPAA was developed to ensure patient information is protected, while at the same time permitting disclosure of personal health information needed for patient care and other specified purposes. HIPAA specifies administrative, physical, and technical safeguards of electronic protected health information. Clear records must be kept for keys and active badges that have access to health records.

Badges & Badge Readers

A number of hospitals have moved from mechanical access control to electromechanical access control; specifically badges and badge readers. For some of the restricted areas, hospitals can institute dual credentials.

Benefits can include:

  • Tracking employee time and attendance
  • Monitoring who gains and is denied access at what dates and times
  • Deleting dismissed employees before actual dismissal
  • Eliminating the need to obtain issued keys from job changed or terminated employees
  • Limiting access for non-authorized employees
  • Restricting access to HIPAA information to specified individuals
  • Auditing access of scheduled narcotics containers and refrigerators

When a hospital does remodeling or new construction, the OSHPOD must be consulted prior to making any changes. This includes what is called a "lipstick job," making changes that do not require a permit. Contacting the agencies and organizations early on, pre-empts problems. It stops questions from being raised once the hardware has been installed onto the door.

Cross-Corridor Openings

Two of the hospitals I walked for this article are equipped with cross-corridor openings having either closed doors or doors magnetically held open that release on activation of the fire alarm system. Depending upon the location, some of the magnetically held open cross corridor doors are pocketed. This additional clear space provides a larger opening. Exit device manufacturers are working with door manufacturers to provide a recessed exit device to increase the opening.

The purpose of cross corridor fire rated openings are to control the spread of smoke and/or fire and create safety zones with exit information to keep patients and staff safe in the event of an emergency.

In many instances, the cross corridor doors that are not magnetically held open are equipped with automatic door openers that provide access and egress, eliminating the need for physical contact with the doors.

The Locksmith’s Role

Depending upon their employment description,  hospital locksmiths can change combinations, replace doors, door closers, exit devices and related door hardware. One of the most common tasks is trying to simplify their jobs. One hospital inscribes a blind key code onto each lock cylinder or lock body before installation. This makes it much easier to confirm an existing key code when servicing, replacing the lock or changing the combination. The first part of the key code can be a reference to the building, area or services.

Most buildings managed by locksmiths have some form of key control. It does not matter if it is hospital, university, manufacturing facility or school; key control determines the level of safety and security. Of late, there is an increased interest in the number of keys that have and have not been returned by terminated, transferred or departing employees. Keys that are unaccounted for are a liability and there are questions being asked within California as well as several other states as to how many keys are not accounted for and what doors to which they provide access.

These records cover during construction, remodeling as well as day-to-day operation. Each hospital determines if and when there is a sufficient number of missing keys that must be met before lock's combination is changed.


One of the most important considerations when working in a hospital is that everything must be properly documented and all documentation must be available for review. Documentation should include dates of construction of the buildings and any additions/remodels. There should be up-to-date floor plans, prominently showing all fire barriers. If it is not properly documented, it did not happen.

For more information, visit the following web sites.