The New Landscape

Visitor identity management in healthcare takes a turn for the better

Managing access privileges for visitors, contractors and vendors in hospitals is a significant challenge for healthcare institutions. There are numerous reasons for this, such as the physical layout of hospitals, the complexities of the population of individuals within the facilities at any given time and the current growing requirements of compliance for the industry. The typical visitor management system is standalone and not designed to serve multiple lobbies within the same location, or scattered over several locations. Often they only serve as badging systems with limited tracking capabilities. Moreover, they sometimes provide only partial or no integration with Healthcare Information Management systems, such as EPIC, which restricts the ability for the visitor management solution to correlate with patient status and location in real time.

Fortunately, the growth of intelligent and purpose-built, automated visitor identity management (VIM) software provides a solution to address these challenges. A ready-made solution for healthcare organizations, centralized VIM solutions can add depth to the hospital’s overall administrative safety and security operation by ensuring that each identity has only the right access to the right areas for the right length of time.

VIM software systems can additionally enable hospital management to perform important identity and access control functions in the context of meeting regulatory requirements with adherence to specific regulatory guidelines built into the rules of the software. This open platform identity management solution also can be integrated with other hospital systems—HR, PACS, parking and other physical assets—for added physical safety as well as with external databases, such as watch lists, to ensure thorough background vetting.

Adding Depth to Hospital Security

Hospitals are open 24/7, so at any time, an individual can enter the building. In this open door environment, security officers are often the first line of defense for maintaining a safe and secure environment by managing situations and preventing incidents. However, someone intent on stealing narcotics or attempting a patient abduction can easily avoid public areas of the hospital where the security guards tend to be located. Without some control system, it is almost impossible to ensure that each individual has a valid, approved purpose for being where they are.

Requiring visitors or contractors to manually sign in and out or wear a visitor badge is a difficult procedure to enforce. While employee badging systems help identify those authorized to be in the hospital, in some cases, badges can be forged. If the badging system is not integrated with other hospital security systems it is significantly less effective as an access control solution.

Centralized VIM systems allow the healthcare organization to create an identity for every person who has reason to be on the premises and gives hospital security management the ability to track visitors and record all visitor activity. The identity data can be used to track visitors who are visiting patients. It can be used to provide VMOs (visitor management operators) with the ability to restrict someone, unless that person has the authority to visit a patient via a family and friend list. It’s an automated system that has the potential to optimize security operations and help reduce or eliminate the challenge of controlling unauthorized visitors.

Out-of-the-box templates automate a wide range of security operations, and with a single point-of-control, errors are less likely to occur, allowing management of the information to be more precise. Using these templates, time-consuming and inefficient processes, such as issuing ID badges or assigning access privileges across multiple physical access control systems, can be streamlined. Access can be granted for specific types including family, guardian or contractor, and lengths of visits such as overnight or multi-day. This information can remain in the system for return visitors or contract workers. In all cases, access cards and badges are automatically disabled by the system after visiting hours or when access permission has expired.

Meeting Regulatory Requirements

The sweep of American healthcare regulation is wide and imposing. Few other industries are governed by such a range of different regulations and regulators, and the situation often leads to complexities that create challenges for hospital administrators.

The Joint Commission for the Accreditation of Healthcare Organizations (JCAHO), for example, oversees the industry’s accreditation process to ensure patient/ personnel safety and standards compliance. Among other stipulations, accreditation requires that health care facilities identify sensitive security locations within the hospital—birthing centers, pharmacy or emergency—that may require unique security protection. Hospitals without controlled access rights to sensitive areas are at risk of losing accreditation, along with funding. Furthermore, the Centers for Medicare and Medicaid Services (CMS) conduct their own inspections, the results of which can affect the facility’s accreditation.

Centralized VIM software can help ease the pain points by automating, in real time, compliance initiatives such as HL7 which refers to specific standards for the exchange, integration, sharing and retrieval of electronic health information. When VIM software is integrated with a patient’s electronic health record (EHR), the combined information provides a more holistic view for the medical professional. All information pertaining to patient identity, such as visitors, dietary restrictions, medical attendees and so on, are tied together under policy-based workflows.

Enterprise-wide Management

Across the enterprise, VIM software systems can streamline time-consuming and inefficient processes, from managing databases to assigning access privileges across multiple physical access control systems. For instance, when a hospital is affiliated with or physically part of a university’s school of medicine, various access levels and permissions can be programmed onto a single ID badge for physicians and students. In addition, any activity, event or status, at any point in the identity lifecycle, is reportable and auditable. If vulnerability is identified, hospital administrators can review and take the necessary action to rectify procedures or activities.

Identity-based visitor management software is ideal in an enterpise environment because it more easily enables hospital administrators to expand parameters for permissions, integrate new databases, add rules and increase interoperability with other security and business operational systems. Because these solutions are open platform, this allows users to take advantage of physical identity and access management (PIAM) benefits whenever they are ready to add this functionality.

Other conveniences of the system that enhance administrative operation include daily, weekly and monthly operational reports to provide security practitioners with information to optimize staffing, budgeting and other resources. Further, by integrating the identity management system with operational systems, cost reductions can be seen in the elimination of duplicate work efforts across multiple systems; reductions that are sustainable and repeatable year after year.

While the configuration of many modern hospitals may still reflect the practice of healthcare from a bygone era, visitor identity management solutions address today’s concerns. VIM software solutions provide hospitals with the ability to manage all of the physical identities that come into contact with their organization, meet compliance mandates, and ensure timely and secure access while simultaneously lowering operating costs and risk—regardless of the facility’s age, size or layout. Equally important, by offering a secure environment that is still open and welcoming to patients and their families, hospitals can build customer satisfaction and brand loyalty—a growing consideration in the increasingly competitive healthcare field.

This article originally appeared in the September 2014 issue of Security Today.


  • Live From ISC West 2023: Day 1

    ISC West 2023 in Las Vegas, Nevada, has officially begun! Make sure to keep an eye on Security Today’s ISCW Live 2023 page, as well as our associated Twitter accounts—@SecurToday and @CampusSecur—for the latest updates from the show floor at the Venetian Expo. Read Now

    • Industry Events
    • ISC West
  • It Happened Again

    Just yesterday (as of this writing), it happened again. A 28-year-old woman shot her way into a Christian elementary school in Nashville, Tenn., on Monday and killed three children and three adults, according to national news. AP News reports that the victims were three 9-year-old children, a top school administrator, a substitute teacher, and a school custodian Read Now

  • Let's Get to Work

    You are standing at the conference center doors just waiting to get into the exhibit hall. I know you are because I’m standing next to you. This week at ISC West has been three years in the making. Last year was encouraging, and here we are waiting for the Big Show. Read Now

    • Industry Events
    • ISC West
  • Using Modern Technology

    Using Modern Technology

    Workplace violence is a serious and growing challenge for many organizations — including those in the healthcare industry. Read Now

Featured Cybersecurity

New Products

  • PACE® Long Range Ethernet Solutions

    PACE® Long Range Ethernet Solutions

    Altronix introduces the newest addition to its portfolio of PACE® Long Range Ethernet Solutions. 3

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3

  • Paxton10 CORE Cameras

    Paxton10 CORE Cameras

    The new CORE Series cameras feature edge processing for ultimate scalability, built-in edge storage, and plug-and-play installation. The addition of the CORE Series gives installers new hardware, better choice, and more value than ever before. 3