Hospitals are places for healing the sick and wounded, but unfortunately given their necessarily open nature they can be challenging environments to physically secure – potentially leading to additional medical emergencies.

Security executives in healthcare institutions face a range of threats that include violent patients or family members, active shooter or terrorist incidents, and department-specific issues such as understandably erratic behavior of mentally ill people in behavioral health, stressed visitors in the emergency department, and drug addicts attempting to burglarize the pharmacy.

“It’s a microcosm of society,” says Jeffrey Hauk, director of public safety at Memorial Healthcare in Owosso, Michigan. “Workplace violence has increased even over the three years I’ve been here with Memorial. It’s about being able to protect not just your patients but your employees, as well, especially when it relates to your more volatile areas.”

Bonnie Michelman, CPP, CHPA, executive director for police, security and outside services at Massachusetts General Hospital, sees workplace violence as the most significant security problem for her institution and hospitals in general.

“Particularly with homelessness, and opioid addiction and mental health issues increasing, that’s huge, and it’s pounding every hospital in the country, especially in psychiatric units as well as emergency departments,” says Michelman, who also serves as security consultant for Partners Healthcare, parent of Mass General. “Hospitals are not hard targets; they’re soft targets because they have to be open for people. You don’t get to invite in who you want.”

And that means all types of people come in through their doors, Michelman says. “There’s a lot of different needs for protecting vulnerable or at-risk populations,” she says, including “babies, children, people with Alzheimer’s or dementia, gang members, domestic violence victims, psychiatric patients.” She adds that hospitals are also “places with major, escalated emotions, with people who are not terribly rational. They may be impaired, or in pain.”

Michael Cummings, senior vice president of security & loss prevention at Milwaukee-based Aurora Health Care, has been in healthcare security for 32 years and says his job has become much more complex than it once was, especially with healthcare being identified as an area of “critical infrastructure” by the Department of Homeland Security.

“We’re open all day. You have literally thousands of patients and visitors coming through our doors every day,” he says. “Over the holidays, a reminder went out from DHS that hospitals are an open target. Notices like this are distributed broadly and can cause angst on the part of staff and leaders, and cause people to ask, ‘What are we doing? Are we prepared?’ We could be a target, whether of a large, organized terrorist attack or a lone
wolf – it could be somebody angry with Aurora Health because a loved one died there.”

Lancaster (Pa.) Regional Medical Center and Heart of Lancaster Regional Medical Center have seen a drop in incidents since adding new security equipment, although the actions of security personnel themselves probably are the biggest reason, says Jeffrey Hatfield, market director of security.

“I’d better knock on wood because I don’t want to jinx us,” he says. “Good security is officers out and about, doing their patrols, being professional and making sure they come into contact with people. … One thing I tell my guys is, make sure you’re out and about, making sure you’re being seen. Make eye contact with people and say, ‘Hi.’ ”

The issue of patient violence is always top of mind for Brian Rich, chief security officer at Mayo Clinic, based in Rochester, Minnesota, with major campuses in Arizona and Florida. He’s constantly planning for how to deal with patients who become aggressive with staff, whether because they’re mentally ill, high on drugs and/or have been brought in by the police. “They become a problem for staff if they decided to hurt, threaten, scream, push or aggressively assault our nurses, our physicians and also our security officers,” he says.

Mayo has made an aggressive push in recent years to encourage staff to say something if they see something, notifying security immediately rather than accepting that violence comes with the territory, and the number of incidents reported has risen dramatically as a result, Rich says. “We have changed the paradigm from a veteran nurse saying, ‘Well, that’s my job’ to ‘It’s not your job to get hurt,’ ” he says.

Not only do they notify security but when appropriate, criminal charges are filed. This does not include patients who are mentally ill, or perhaps temporarily incapacitated because they have just come out of anesthesia, Rich says. “We’re talking about somebody who knows what they’re doing,” he says. “These are situations where the patient has decided he or she doesn’t want to be a patient anymore. They’re now a criminal.”

Cummings notes that healthcare workers are the second-most victimized and abused group, according to records from the national Occupational Safety and Health Administration. “That’s a challenge for us on a number of fronts,” he says. “That’s one of the biggest issues that keeps me awake at night.”

Aurora Health Care is always aware of the need to balance security and people-based nature of healthcare. “Most [patients and visitors] don’t want to be there,” Cummings says. “People act emotionally because of the stress they’re under. We’re striking that balance between being efficient and using access control. It’s not about being an enforcement department – but we have that role when everything goes south.”

Equipment and Technology

Mass General and other hospitals have stepped up their approach to designing and installing state-of-the-art security technology, Michelman says. “These systems are integrated with hospitals’ needs in mind, ranging from panic alarms to closed circuit television systems,” she says. “It’s not an end-all, be-all. It’s a really important tool. Protection is a layered approach.”

As an integrated healthcare system with 15 hospitals, clinics, hospice and home health delivery, Aurora Health Care uses a tiered approach to triage the most security sensitive areas, Cummings says. The organization has used technology to bring efficiency, for example merging the five different platforms it once had for access control into a single, centralized system that has brought economies of scale with help from primary integrator Convergint Technologies.

Aurora still has a mix of older, analog cameras and more recently installed IP cameras from Genetec that new facilities and renovations have been migrating toward, all able to be controlled both through the individual medical center security command center as well as the command center in the headquarters building.

“As we have the opportunity to replace things going forward, we look at the technology and what can we use that’s somewhat transparent and augments the safe environment,” Cummings says. The same goes for access control and locking systems, he says.

Memorial Healthcare has emphasized access control with a new DSX system, shrinking from more than 50 accessible exterior doors to on average 10 daily, further mitigating access after-hours by dropping down to one access point – the Emergency Department (ED), Hauk says. The hospital has upgraded its camera network from 14 units to 57 that have 90-day archival capability, using the video management system platform from Avigilon, as well as developing a five-year plan for continued growth.

“Right now it’s a great investigative tool,” he says, adding: “The next step is to gain additional resources to monitor our CCTV system, along with adding systems and monitoring capabilities 24/7. The goal is to have a program built to be proactive and predictive, with a response component.”

Memorial also has embarked upon a multi-phase re-keying project for the organization top to bottom for the first time in more than 40 years with ASSA ABLOY Medeco X4 secured master keyway and Morse Watchmans’ KeyWatcher for securing keys and tracking them electronically. “We [previously] didn’t know how many master keys had been issued, or to whom,” Hauk says. “We’re trying to gain some semblance of control over that, as well as have the ability to electronically track and account for the keys to the most critical areas.”

Lancaster Regional has integrated wireless lock systems from Best Locks Systems and key card access control with employee badges from IDenticard for sensitive areas, Hatfield says. “It’s a good audit trail, especially in areas that we just had construction in – we’re redoing certain areas of the hospital,” he says. “It’s a cost saving because the wireless lock set is a lot cheaper than putting hardwired access card readers in.”

The facility has about 90 cameras and more are being added all the time, digital cameras that stream through the server, Hatfield says. “Which really helps in any type of investigation, or incidents that occur, we can go back and review the video and so forth. It also alerts us to any potential thing that we may not have seen,” he says. “We can find out who might be the perpetrator in an incident.”

Lancaster has worked to prevent theft from patient rooms by installing safes that they can code access numbers themselves, he adds. “Let’s try and prevent something from happening,” Hatfield says. Otherwise, “somebody comes in and takes their wallet, or their dentures.”

Policies and Training

Mayo has been evaluating how to maintain an open environment while still restricting access when necessary, Rich says. The organization has initiated a threat assessment process with a cross-functional team comprised of security, legal, administration, social work and nursing. “We’re getting in front of these situations to help mitigate and reduce any problem we would be otherwise responding to,” he says.

Mayo has been aiming to “harden facilities” by strengthening access control and ensuring that everyone who sets foot in a facility has been identified and vetted, Rich says. Then, they’re issued security visitor badges, security officers round through different departments, and certain doors are locked at certain times as appropriate.

Mayo rates its facilities as low, medium and high risk based on the past record of injuries and assaults, Rich says. While hospitals in downtown urban areas know to be on their guard, he says, “Most of our sites in Mayo Clinic are not in urban environments. They’re in Anywhere, U.S.A.” Low to medium risk facilities might not need security officers, per se, but in those cases Mayo has been instituting site security liaisons to take the lead and notify regional security leaders about issues related to violence and other threats, he says.

Staff in all departments at Mayo have gotten training through modules or, when needed, in person. For active shooter training, the organization decided that in-person training was paramount and has touched about 20,000 employees in the past year. Mayo also created videos with exercises involving law enforcement based on real scenarios in 13 high-risk departments. “We made it every bit of our effort to meet 100 percent of the employees in every one of those departments,” Rich says. “We came very close to reaching 100 percent.”

Training and policies and procedures have received increased focus at Aurora, as well, with a newly created director of training position where both functions had been carried out under the same leadership, and a partnership around training, Cummings says. The healthcare organization has trained more than 170 security officers in both verbal de-escalation skills and appropriate use of force techniques to help defuse violent incidents, and the training section has developed four modules to meet the needs of non-security personnel.

Aurora is piloting at one of its hospitals a 24-hour call line for people to report assaultive behavior, both physical and verbal, so the security personnel can get a more specific idea of where the greatest problems lie that goes beyond anecdotal, after-the-fact recollections, Cummings says.

“We’re really trying to address the specific root causes,” he says. “That will drive actual changes in the training curriculum. We won’t know unless we ask. It is important that staff understand how to appropriately deal with disruptive situations and can de-escalate, as there will never be enough officers to be everywhere and respond as immediately as we would like at any given time.”

Aurora is also developing a process in its electronic medical records that can alert nurses and other personnel that a certain patient has been aggressive, violent or sexually inappropriate, Cummings says. “It’s so our care team is aware of what they’re up against,” he says. “They’re on guard.” Another option for dealing with consistently inappropriate behavior against staff is the use of a dismissal letter.

Memorial Healthcare has gone through an “intense” review of its policies and procedures, Hauk says, with a full-scale active shooter exercise last fall and pending moves to arm security officers and gain private police authority. “We’ve developed a weapons policy for the hospital itself, as well as specific departmental programs, standards and training regimens to ensure our officers are well-prepared professionals, which includes continuous training requirements,” he says.

As part of the firearms training, officers have been going through decision-making training called MILO Training, which is a high-tech firearms simulator. This training includes taking officers through scenarios in which they have to apply more than just shooting skills but also communication, conflict resolution, threat identification and predictive profiling skills. They also must explain any use of force for their instructors, who then provide immediate feedback and coaching.

Other staff have undergone security awareness training and brown bag lunches covering issues like active shooter, which was rolled out to 1,500 employees through one-hour face-to-face sessions last year. “We’re looking to build on that, all the foundations we’ve put in place,” Hauk says.

Lancaster Regional has done workplace violence and active shooter training for all new employees, Hatfield says. “We discuss what types and aspects of workplace violence to look for, and what can you do if you’re in an active shooter situation,” he says. “The more [employees] experience learning how to combat and deal with situations like that, the better off we are in the long run.” The facility also fingerprints new employees and volunteers in-house, he adds.

Mass General starts by hiring the most well qualified, trained and educated security personnel, which “we certainly have improved significantly over the past many years,” Michelman says. “We are extremely focused on that. We hire people with bachelor’s degree, and the right [combination of] experience and temperament, people who understand both customer service and crisis management.”

The facility has put in place policies and procedures for patients, visitors and staff “that make sense, and that are enforced,” Michelman says. “The next thing is, we have very good training and awareness for all employees [that covers topics like] workplace violence, active shooter, what to do with suspicious packages, how to identify suspicious people. What to do if somebody tries to ‘piggyback’ into a locked area…how to manage aggressive behavior.”

Department by Department

When it comes to specific departments that often face threats, the emergency department heads just about everyone’s list. “ED’s are where the majority of all hospitals see the majority of violent patients,” Rich says. “We have nurses and security officers training in tandem. The last thing you need is for nurses to be trained in something different, or never trained at all. Closing a portion of your ED for half a day to run through exercises is just invaluable.”

Brown bag lunch training sessions at Aurora primarily target high-volume and security sensitive areas such as the ED and behavioral health, covering issues like, “How do you manage, physically, if somebody is trying to choke you, or how to properly apply restraints,” Cummings says. Behavioral health is security-sensitive “for obvious reasons,” he says. The emergency department is a volatile mix because of why people are there, the sometimes frustrating waits, the 24-hour portal to the building, and situations like “if a gunshot victim comes in, there’s a possibility that whoever started it wants to finish the job.”

The ED at Lancaster Regional handles patients experiencing anything from mental health issues to heroin overdoses, Hatfield says. “They’re combative because they don’t know what they’re doing,” he says. “We teach de-escalation skills plus security awareness. I have guys making hourly patrols through the ED during peak hours.” Lancaster Regional has posted notices stating a policy of zero tolerance for violence throughout the facility, he adds.

Violence prompts an immediate lockdown in the ED, even when it’s occurred prior to the patient arriving out of fear that retaliation might follow, Hatfield says. “We limit any visitors going back there and so forth,” he says. “We have one officer in the back and one in front near the registration area to make sure a bad person isn’t coming in, especially if it’s something related to a gang incident.”

Hatfield trains the staff in the behavioral health department, which has separate adult and geriatric units, on verbal de-escalation skills and safe physical takedown skills for violent patients. He meets weekly with the behavioral health and ED directors to discuss and analyze any issues or incidents raised during the week and come up with a prevention-oriented solution.

“You’re dealing with all types of psychological issues,” he says. “You’ve got to treat people with professionalism and be able to understand where they’re coming from – to walk in their shoes, and have some empathy. The training is very important in understanding different cultures and people’s disabilities and so forth. You have to diffuse the situation, whatever it may be.”

Lancaster keeps an eye on the pharmacy with a camera in the vault area where “high-end, expensive drugs” are kept. That room has card access “so we can monitor and safeguard the pharmaceutical drugs and make sure nobody is tampering with them or stealing them.”

Such incidents are rare, Michelman says, but hospitals nonetheless need to have proactive programs and solid investigative protocols in place that include documentation review, carefully monitored drug dispensing systems and multidisciplinary teams.

“That has a huge deterrent effect,” she says. “If there is any kind of shortage, review it and have a comprehensive investigation right away. There’s good drug dispensing equipment with software programs and reporting systems that help identify [suspicious patterns].”

Cummings says the pharmacy at Aurora can be a target because of individuals seeking either product or cash, which has led to training on how to handle robberies.

Labor and delivery requires a heightened alert due to infant abduction issues, he says, which necessitates “tighter controls for visitations, cameras and access control, and other technology we use such as ‘banding’ the infants to notify us in case they get close to an exit.”

The ICU can be another problem spot because families are under stress and sometimes issues bubble up. “Two of them have been drinking and siblings get into a fight about, ‘Why didn’t you support Mom better,’ ” he says. “We’ve had a number of those sorts of family feud issues going on.”

Hauk says that in addition to the ED and behavioral health, labor and delivery is a focus at Memorial Healthcare. In many cases it’s younger, unwed couples with what he terms “baby-mama drama. That’s exacerbated by social media because they can post pictures and give a play-by-play, to instigate. The dad is waiting at home, and the boyfriend is waiting up with mom.”

Rich rates behavioral health second behind the ED in terms of security concerns, but he says Mayo also has been focused on initiatives to protect those in its C-suites. “The fact is, they’re on the news, they’re making $1 million plus per year, they’re in the national limelight,” he says. “It’s our job to make sure we have controls in place that do not impede their performance, but that we’re still performing the function of protecting and safeguarding them.”

Mass General also keeps an eye on labor and delivery for issues ranging from kidnapping to family squabbles, pediatrics to ensure that no children are suffering from abuse – or wandering away unsupervised – and VIP floors to make certain that people in the public eye are protected, Michelman says.

“I always talk about the need to ensure that people who work in the hospitals I’m responsible for are not complacent about security, but they’re not living in fear, or overreacting – being in the correct place in the continuum,” she says. “The vulnerabilities are constantly changing and constantly challenging, but the good news is there’s been a lot of changes in healthcare security, and progress made. It’s a far more sophisticated field, and it’s done very well in many hospitals.”