Every facility will have unique security risks and challenges to address, even in the same industry. Hospitals are busy environments with strict standards for safety, privacy, and security. Every healthcare facility will vary in what it needs for comprehensive and effective security. A site review and building vulnerability assessment are essential for accurately identifying and addressing risks. Here are some critical elements of a hospital security assessment:

1. Conduct a robust physical site assessment.
2. Review access control systems.
3. Evaluate security cameras and coverage.
4. Address asset tracking and management.
5. Check regulatory compliance.
6. Assess cybersecurity preparedness and information security protocols.
7. Conduct risk assessment and analyze historical incident data.
8. Review emergency response procedures.
9. Go over current policies and procedures.
10. Perform vulnerability tests.
11. Set up a schedule for reassessments.

1. Conduct a Robust Physical Site Assessment

It can be easy to focus on internal security systems and overlook perimeter security and the area around a facility. Comprehensive security does not stop at the walls of your facility. It needs to extend beyond the perimeter for full monitoring and protection.

A site visit with a robust physical site assessment is essential for getting an accurate assessment of risks across a property. You need to be able to take environmental considerations into account during a physical security assessment. Some basic areas to start with should include:

• Inspection of the building.
• Evaluation of perimeter security.
• Review of parking lot security.
• Evaluation of lighting around the building, across the property, and around the property.
• Review of all potential access points across the property.
• Inspection of potentially overlooked access points, like loading bays, delivery points, back alley access, parking garages, etc.

A building vulnerability assessment checklist is a good starting point. Working with a security systems integrator with hospital security experience will ensure security risks are accurately identified and gaps are closed with a comprehensive security solution tailored uniquely to your facility and your needs.

2. Review Access Control Systems

Access control is a foundational element of hospital security. Different departments, wards, and more require hospitals to have varying levels of access throughout the facility, between wards, within wards, etc. Being able to set up varying levels of access and manage and monitor them all effectively are components of effective hospital access control systems.

Current access control systems, authorized credentials, rules, and more all need to be evaluated and reviewed as part of a hospital security assessment. Access needs will change and evolve over time, along with your facility. Your access control system needs to be able to upgrade as needed to keep up.

When reviewing access control systems, consider the following areas:

• Current coverage of access control systems
• Customizations for high-security areas (pharmacy, maternity wards, neonatal labs, server rooms, etc.)
• Capabilities of the current access control systems
• Available access control readers
• Availability of biometric and multi-modal authentication
• Current authorized credentials and block lists
• Current rules and triggers for granting or denying access
• Current methods to identify and prevent biometric spoofing
• Current incident response protocols for instances of unauthorized access

3. Evaluate Security Cameras and Coverage

Video surveillance is an essential layer of security. But it’s only effective if you have:

• The right types of security cameras
• The capabilities you need from a video surveillance system
• The right security camera placement
• Correct installation
• Maintained and properly working components and systems

Evaluating the current security cameras, coverage, footage, system capabilities, and more, as well as gaps in monitoring and coverage, is a critical element of a hospital security assessment.

4. Address Asset Tracking and Management

Between equipment, records, supplies, and more, there are a lot of high-value assets in hospitals. Being able to track, monitor, manage, and protect these assets, many of which are mobile, is a benefit of effective asset management in healthcare.

Identifying these high-value assets, where they are in the facility, how they move throughout the facility, who uses them, and more is another critical element of a hospital security assessment. This is one of the ways to use RTLS to improve healthcare asset management. This information also provides valuable insights for mapping potential threats and identifying potential security vulnerabilities and gaps around asset tracking and management.

5. Check Regulatory Compliance

Healthcare facilities are held to strict standards and must comply with specific regulations. A good security systems integrator will be familiar with compliance standards for your industry and facility and will work to ensure your systems are set up and configured to meet them appropriately.

Common compliance regulations that hospitals must meet include:

• Local building codes for structural safety and security.
• Fire safety laws for safety and emergency preparedness.
• Occupational Safety and Health Administration (OSHA) standards for workplace and staff safety.
• Health Insurance Portability and Accountability Act (HIPAA) regulations for patient information protection and privacy.
• Centers for Medicare & Medicaid Services (CMS) standards for patient care and emergency preparedness.
• Drug Enforcement Administration (DEA) laws for the storage, management, and dispensing of controlled substances.

6. Assess Cybersecurity Preparedness and Information Security Protocols

A hospital security assessment must also address cybersecurity and information security. Healthcare facilities deal with private information and high-value data targets. This makes hospital systems prime targets for bad actors and makes data breaches one of the common security threats and vulnerabilities of hospitals.

Insecure systems or poor information security processes are key mistakes that lead to HIPAA violations at a minimum and leave hospitals vulnerable to serious data breaches. Privacy and security around records and data are paramount.

Any hospital security assessment should include a review of digital infrastructure and current cybersecurity protocols, including:

• Network security
• Encryption standards
• Endpoint protections
• Access management
• Security patch and update processes
• Backup and recovery plans
• Secure messaging systems
• EHR/EMR system protections
• Security system training for teams
• Data breach protocols

7. Conduct Risk Assessment and Analyze Historical Incident Data

Another one of the critical elements of a hospital security assessment is to conduct a risk assessment and analyze historical incident data. Reviewing past incidents can provide insights into current gaps, emerging security risks, and iterative improvements that can be made to improve current processes. These are reasons why you need an incident management system, and the benefits it can provide for your facility.

Robust reporting and analytics are some things to look for in incident management software. You should have a system that collects and combines data from your systems into a central place for a single source of truth and a full view of all incidents. It should allow you to analyze past incidents and historical data to gain invaluable insights for how to improve the security and processes in your hospital, whether that’s minor improvements to patient care that can help the hospital improve HCAHPS scores or identifying a security gap before it causes a problem.

8. Review Emergency Response Procedures

Having plans in place should an emergency occur is part of comprehensive facility security. Your security solution should be configured to facilitate rapid emergency response and assist in any emergency communications or evacuations.

Reviewing the current emergency response procedures for your facility is a critical element of a hospital security assessment. In addition to identifying any gaps in emergency response plans, reviewing current procedures in the context of your security solution will help identify friction points, updates, or new configurations that your systems need to support and facilitate effective emergency response.

9. Go Over Current Policies and Procedures

In addition to reviewing emergency plans, you also want to go over all of your current policies and procedures for your facility, including evaluating your hospital’s staff protection. Comprehensive hospital security solutions are integrated, layered systems that incorporate:

• Nurse call systems
• Patient protection systems
• Patient engagement systems
• Asset tracking systems
• Other facility management systems

They encompass everything your facility does to facilitate patient care, which includes your current policies and procedures.

• Simplify overcomplicated processes with strategic system updates and integrations.
• Address missing steps with system updates or additions.
• Reduce incidents and increase efficiencies with regular staff training.

Reviewing your current policies with security in mind can identify these gaps and opportunities and allow you to leverage your security technology to benefit your facility, your staff, your patients, and your outcomes.

10. Perform Vulnerability Tests

Other critical elements of a hospital security assessment are vulnerability tests. This is where your security solution and procedures are put to the test. Can your current security technology protect your facility from a threat?

Vulnerability testing can include security drills, threat models, technical testing, and penetration testing to see how systems react to an attempted threat. All of the different tests will identify vulnerabilities and weaknesses in your current facility security that need to be addressed.

11. Set Up a Schedule For Reassessments

Security risks evolve over time, and your security technology needs to evolve to keep up with them. Outdated security is one of the biggest risks and challenges of legacy security systems. If your systems have not been updated or configured to combat emerging and evolving risks, your facility is vulnerable.

This is also why security assessments should occur regularly, and why you shouldn’t skip vulnerability assessments. One of the critical elements of a hospital security assessment is the schedule of reassessments that will be in place to regularly revisit and reassess risks.

At a minimum, assessments should be done annually and also immediately after an incident or major facility change occurs. Depending on your facility, industry, and incident history, you may want a more frequent schedule for assessments not triggered by a specific incident.

Improve Your Hospital Security With Northeast Protection Partners

These are a few critical elements of a hospital security assessment. The right mix of security products, integrations, and customizations for an effective and comprehensive hospital security solution will depend on your facility and its specific risks and needs. An experienced, reputable security systems integrator will help ensure you have the security you need. Contact Northeast Protection Partners at 1-800-736-1456 to get started and improve your hospital security!