The New Landscape

Visitor identity management in healthcare takes a turn for the better

Managing access privileges for visitors, contractors and vendors in hospitals is a significant challenge for healthcare institutions. There are numerous reasons for this, such as the physical layout of hospitals, the complexities of the population of individuals within the facilities at any given time and the current growing requirements of compliance for the industry. The typical visitor management system is standalone and not designed to serve multiple lobbies within the same location, or scattered over several locations. Often they only serve as badging systems with limited tracking capabilities. Moreover, they sometimes provide only partial or no integration with Healthcare Information Management systems, such as EPIC, which restricts the ability for the visitor management solution to correlate with patient status and location in real time.

Fortunately, the growth of intelligent and purpose-built, automated visitor identity management (VIM) software provides a solution to address these challenges. A ready-made solution for healthcare organizations, centralized VIM solutions can add depth to the hospital’s overall administrative safety and security operation by ensuring that each identity has only the right access to the right areas for the right length of time.

VIM software systems can additionally enable hospital management to perform important identity and access control functions in the context of meeting regulatory requirements with adherence to specific regulatory guidelines built into the rules of the software. This open platform identity management solution also can be integrated with other hospital systems—HR, PACS, parking and other physical assets—for added physical safety as well as with external databases, such as watch lists, to ensure thorough background vetting.

Adding Depth to Hospital Security

Hospitals are open 24/7, so at any time, an individual can enter the building. In this open door environment, security officers are often the first line of defense for maintaining a safe and secure environment by managing situations and preventing incidents. However, someone intent on stealing narcotics or attempting a patient abduction can easily avoid public areas of the hospital where the security guards tend to be located. Without some control system, it is almost impossible to ensure that each individual has a valid, approved purpose for being where they are.

Requiring visitors or contractors to manually sign in and out or wear a visitor badge is a difficult procedure to enforce. While employee badging systems help identify those authorized to be in the hospital, in some cases, badges can be forged. If the badging system is not integrated with other hospital security systems it is significantly less effective as an access control solution.

Centralized VIM systems allow the healthcare organization to create an identity for every person who has reason to be on the premises and gives hospital security management the ability to track visitors and record all visitor activity. The identity data can be used to track visitors who are visiting patients. It can be used to provide VMOs (visitor management operators) with the ability to restrict someone, unless that person has the authority to visit a patient via a family and friend list. It’s an automated system that has the potential to optimize security operations and help reduce or eliminate the challenge of controlling unauthorized visitors.

Out-of-the-box templates automate a wide range of security operations, and with a single point-of-control, errors are less likely to occur, allowing management of the information to be more precise. Using these templates, time-consuming and inefficient processes, such as issuing ID badges or assigning access privileges across multiple physical access control systems, can be streamlined. Access can be granted for specific types including family, guardian or contractor, and lengths of visits such as overnight or multi-day. This information can remain in the system for return visitors or contract workers. In all cases, access cards and badges are automatically disabled by the system after visiting hours or when access permission has expired.

Meeting Regulatory Requirements

The sweep of American healthcare regulation is wide and imposing. Few other industries are governed by such a range of different regulations and regulators, and the situation often leads to complexities that create challenges for hospital administrators.

The Joint Commission for the Accreditation of Healthcare Organizations (JCAHO), for example, oversees the industry’s accreditation process to ensure patient/ personnel safety and standards compliance. Among other stipulations, accreditation requires that health care facilities identify sensitive security locations within the hospital—birthing centers, pharmacy or emergency—that may require unique security protection. Hospitals without controlled access rights to sensitive areas are at risk of losing accreditation, along with funding. Furthermore, the Centers for Medicare and Medicaid Services (CMS) conduct their own inspections, the results of which can affect the facility’s accreditation.

Centralized VIM software can help ease the pain points by automating, in real time, compliance initiatives such as HL7 which refers to specific standards for the exchange, integration, sharing and retrieval of electronic health information. When VIM software is integrated with a patient’s electronic health record (EHR), the combined information provides a more holistic view for the medical professional. All information pertaining to patient identity, such as visitors, dietary restrictions, medical attendees and so on, are tied together under policy-based workflows.

Enterprise-wide Management

Across the enterprise, VIM software systems can streamline time-consuming and inefficient processes, from managing databases to assigning access privileges across multiple physical access control systems. For instance, when a hospital is affiliated with or physically part of a university’s school of medicine, various access levels and permissions can be programmed onto a single ID badge for physicians and students. In addition, any activity, event or status, at any point in the identity lifecycle, is reportable and auditable. If vulnerability is identified, hospital administrators can review and take the necessary action to rectify procedures or activities.

Identity-based visitor management software is ideal in an enterpise environment because it more easily enables hospital administrators to expand parameters for permissions, integrate new databases, add rules and increase interoperability with other security and business operational systems. Because these solutions are open platform, this allows users to take advantage of physical identity and access management (PIAM) benefits whenever they are ready to add this functionality.

Other conveniences of the system that enhance administrative operation include daily, weekly and monthly operational reports to provide security practitioners with information to optimize staffing, budgeting and other resources. Further, by integrating the identity management system with operational systems, cost reductions can be seen in the elimination of duplicate work efforts across multiple systems; reductions that are sustainable and repeatable year after year.

While the configuration of many modern hospitals may still reflect the practice of healthcare from a bygone era, visitor identity management solutions address today’s concerns. VIM software solutions provide hospitals with the ability to manage all of the physical identities that come into contact with their organization, meet compliance mandates, and ensure timely and secure access while simultaneously lowering operating costs and risk—regardless of the facility’s age, size or layout. Equally important, by offering a secure environment that is still open and welcoming to patients and their families, hospitals can build customer satisfaction and brand loyalty—a growing consideration in the increasingly competitive healthcare field.

This article originally appeared in the September 2014 issue of Security Today.


Featured Cybersecurity


New Products

  • Camden Door Controls ‘SER” Surface Boxes and Extension Rings

    Camden Door Controls ‘SER” Surface Boxes and Extension Rings

    Camden Door Controls has introduced new ‘SER” surface boxes and extension rings that provide a complete solution for new construction. In addition, they provide a simple and robust solution when replacing round wired and manual push plate switches with either Camden’s wired or wireless SureWave™ no-touch switches or Kinetic™ no-battery wireless switches. 3

  • PDK IO Access Control Software

    PDK.IO Access Control Software

    ProdataKey now allows for "custom fields" within the interface of its software. Custom fields increase PDK's solutions' overall functionality by allowing administrators to include a wide range of pertinent data associated with each user. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3