The New Landscape
Visitor identity management in healthcare takes a turn for the better
Managing access privileges for visitors, contractors and vendors
in hospitals is a significant challenge for healthcare institutions.
There are numerous reasons for this, such as the
physical layout of hospitals, the complexities of the population
of individuals within the facilities at any given time and
the current growing requirements of compliance for the industry. The typical visitor
management system is standalone and not designed to serve multiple lobbies
within the same location, or scattered over several locations. Often they only serve
as badging systems with limited tracking capabilities. Moreover, they sometimes
provide only partial or no integration with Healthcare Information Management
systems, such as EPIC, which restricts the ability for the visitor management solution
to correlate with patient status and location in real time.
Fortunately, the growth of intelligent and purpose-built, automated visitor
identity management (VIM) software provides a solution to address these challenges.
A ready-made solution for healthcare organizations, centralized VIM solutions
can add depth to the hospital’s overall administrative safety and security
operation by ensuring that each identity has only the right access to the right areas
for the right length of time.
VIM software systems can additionally enable hospital management to perform
important identity and access control functions in the context of meeting
regulatory requirements with adherence to specific regulatory guidelines built into
the rules of the software. This open platform identity management solution also
can be integrated with other hospital systems—HR, PACS, parking and other
physical assets—for added physical safety as well as with external databases, such
as watch lists, to ensure thorough background vetting.
Adding Depth to Hospital Security
Hospitals are open 24/7, so at any time, an individual can enter the building. In
this open door environment, security officers are often the first line of defense for
maintaining a safe and secure environment by managing situations and preventing
incidents. However, someone intent on stealing narcotics or attempting a patient
abduction can easily avoid public areas of the hospital where the security guards
tend to be located. Without some control system, it is almost impossible to ensure
that each individual has a valid, approved purpose for being where they are.
Requiring visitors or contractors to manually sign in and out or wear a visitor
badge is a difficult procedure to enforce. While employee badging systems help
identify those authorized to be in the hospital, in some cases, badges can be forged.
If the badging system is not integrated with other hospital security systems it is
significantly less effective as an access control solution.
Centralized VIM systems allow the healthcare organization to create an identity
for every person who has reason to be on the premises and gives hospital
security management the ability to track visitors and record all visitor activity.
The identity data can be used to track visitors who are visiting patients. It can be
used to provide VMOs (visitor management operators) with the ability to restrict
someone, unless that person has the authority to visit a patient via a family and
friend list. It’s an automated system that has the potential to optimize security
operations and help reduce or eliminate the challenge of controlling unauthorized
visitors.
Out-of-the-box templates automate a wide range of security operations, and
with a single point-of-control, errors are less likely to occur, allowing management
of the information to be more precise. Using these templates, time-consuming
and inefficient processes, such as issuing ID badges or assigning access
privileges across multiple physical access control systems, can be streamlined.
Access can be granted for specific types including family, guardian or contractor,
and lengths of visits such as overnight or multi-day. This information can remain
in the system for return visitors or contract workers. In all cases, access cards and badges are automatically disabled by the system after visiting hours or when
access permission has expired.
Meeting Regulatory Requirements
The sweep of American healthcare regulation is wide and imposing. Few other
industries are governed by such a range of different regulations and regulators,
and the situation often leads to complexities that create challenges for hospital
administrators.
The Joint Commission for the Accreditation of Healthcare Organizations
(JCAHO), for example, oversees the industry’s accreditation process to ensure patient/
personnel safety and standards compliance. Among other stipulations, accreditation
requires that health care facilities identify sensitive security locations
within the hospital—birthing centers, pharmacy or emergency—that may require
unique security protection. Hospitals without controlled access rights to sensitive
areas are at risk of losing accreditation, along with funding. Furthermore, the
Centers for Medicare and Medicaid Services (CMS) conduct their own inspections,
the results of which can affect the facility’s accreditation.
Centralized VIM software can help ease the pain points by automating, in real
time, compliance initiatives such as HL7 which refers to specific standards for the
exchange, integration, sharing and retrieval of electronic health information. When
VIM software is integrated with a patient’s electronic health record (EHR), the
combined information provides a more holistic view for the medical professional.
All information pertaining to patient identity, such as visitors, dietary restrictions,
medical attendees and so on, are tied together under policy-based workflows.
Enterprise-wide Management
Across the enterprise, VIM software systems can streamline time-consuming and
inefficient processes, from managing databases to assigning access privileges across
multiple physical access control systems. For instance, when a hospital is affiliated
with or physically part of a university’s school of medicine, various access levels
and permissions can be programmed onto a single ID badge for physicians and
students. In addition, any activity, event or status, at any point in the identity lifecycle,
is reportable and auditable. If vulnerability is identified, hospital administrators
can review and take the necessary action to rectify procedures or activities.
Identity-based visitor management software is ideal in an enterpise environment
because it more easily enables hospital administrators to expand parameters
for permissions, integrate new databases, add rules and increase interoperability
with other security and business operational systems. Because these solutions are
open platform, this allows users to take advantage of physical identity and access
management (PIAM) benefits whenever they are ready to add this functionality.
Other conveniences of the system that enhance administrative operation include
daily, weekly and monthly operational reports to provide security practitioners
with information to optimize staffing, budgeting and other resources. Further,
by integrating the identity management system with operational systems, cost reductions
can be seen in the elimination of duplicate work efforts across multiple
systems; reductions that are sustainable and repeatable year after year.
While the configuration of many modern hospitals may still reflect the practice of
healthcare from a bygone era, visitor identity management solutions address today’s
concerns. VIM software solutions provide hospitals with the ability to manage all of
the physical identities that come into contact with their organization, meet compliance
mandates, and ensure timely and secure access while simultaneously lowering
operating costs and risk—regardless of the facility’s age, size or
layout. Equally important, by offering a secure environment that
is still open and welcoming to patients and their families, hospitals
can build customer satisfaction and brand loyalty—a growing consideration
in the increasingly competitive healthcare field.
This article originally appeared in the September 2014 issue of Security Today.