Online Exclusive: Expanding the Role of Security in Healthcare

• By Don Campbell
• Oct 28, 2016

Security is a vital function that has become a major part of healthcare organizations’ day-to-day operations. Recognizing this reality, hospitals and other providers have invested heavily in video surveillance, access control, visitor management and other technologies and systems to maintain the highest possible level of protection for patients, staff, visitors, prescription drugs and other assets.

Protection is the main function of security, but this is not its only contribution to providers’ operations. Traditional security solutions can also deliver additional value to other areas of an organization using some of the same technologies. This includes the ability to streamline operations and ensure compliance with the many regulations that govern the healthcare industry and more, which can transform security into a valuable organizational partner.

Technology integration plays a role in this transformation, but achieving this goal also requires certain actions, which vary from one organization to another. However, there are common measures all healthcare organizations can take to ensure both the efficiency of the process and ultimately the success of expanding security technology’s role. Each of these actions, discussed below, can be taken immediately to allow security to provide additional value in the near term – and deliver the greatest benefit in the long term as well.

Centralize Identity Management

Manually reviewing, verifying, approving and distributing access privileges is a time-consuming, inefficient, error-prone process. For healthcare organizations with multiple locations, it can often take several days if not weeks for a visiting nurse, for example, to be issued the privileges and credentials needed to work at one of those locations. And that’s just for a single person. Imagine if there are 10 or more people to verify. This complicated, inefficient and error-prone process is simply not acceptable.

To address this issue, healthcare organizations can take steps to centralize identity management across the entire physical security infrastructure. This requires standardizing and automating identity lifecycle management, integrating disparate systems and creating seamless processes for approvals, auditing and reporting. These actions can enable business continuity that leverages existing security organizations to deliver immediate, sustainable and repeatable reductions in operating costs.

Streamline Compliance

Healthcare providers are governed by a number of regulations with which they must routinely demonstrate compliance. Most notable among these are HIPAA, which is focused on the strength and integrity of patient data; the Joint Commission, which accredits and certifies more than 20,000 hospitals in the U.S. through an unannounced survey process; and HL7, a set of internal standards for transfer of clinical and administrative data between software applications.

Compliance with these regulations is an exhaustive process that includes assessing risks and vulnerabilities in a number of areas, keeping up to date with standards that change annually, ensuring staff compliance with safeguards and policies, effectively managing access rights and privileges and much more. Simply collecting the data necessary to demonstrate compliance is a complicated, time-consuming and error-prone process that must often be completed manually because most of the necessary data is stored in siloed systems that are managed separately.

However, non-compliance is not an option, given the potentially devastating costs, including disruption in operations, productivity and revenue losses, and fines or penalties. In light of these factors, demonstrating compliance could benefit substantially from technology integration and automation.

Reduce Risk

To maintain safety and security in a healthcare setting, everyone who enters and exits a facility must be easily identified and have their access limited only to those areas they are authorized to enter. However, this vital need can be compromised by the lengthy delays and errors caused by manual processes. Therefore, it is incumbent upon organizations to minimize manual action and intervention to ensure physical security access is provisioned and de-provisioned correctly in a timely and efficient manner to maintain HIPAA and other regulatory compliance. By implementing tools, policies and procedures, organizations can reduce their risk posture to increase the safety of employees, patients, contractors and visitors while also reducing the risk of compliance violations.

Tools and Technologies

One proven technology that delivers efficiency and helps mitigate the potential for security breaches is a purpose built, intelligent and automated physical identity and access management (PIAM) solution. These solutions allow healthcare organizations to upgrade and enhance their security strategies to streamline the previously complicated, lengthy and error-prone identity management and compliance processes.

PIAM solutions consolidate all the rules and policies that govern a healthcare organization and incorporate them into automated processes. These solutions connect previously disparate security, IT and other systems to automate key processes and workflows to optimize security operations, centralize control and enable compliance with regulatory mandates in real time.

With a centralized PIAM system in place, organizations can easily and efficiently manage the lifecycle of an identity from request through approval and on-boarding for every individual who has a reason to be on the premises. By replacing multi-step manual tasks with automation, organizations can start and finish approval processes in less than a day, rather than weeks.

Compliance with industry, state and federal regulations is not only mandatory but also enables best practices for safety and security – an important element of risk management that can be automated with PIAM software. When PIAM is integrated with a patient’s electronic health record, the combined information provides a holistic view for medical professionals, with all information related to patient identity kept secure and tied together under policy-based workflows. The robust, granular reporting PIAM provides for each identity automatically creates a comprehensive audit trail that eliminates the time, cost, frustration and potential for error in both the identity management and compliance processes.

Healthcare organizations’ safety and security is firmly rooted in the ability to expand the role of security to deliver greater value to overall operations. Policy-based PIAM solutions serve as the foundation for achieving this goal, enabling the necessary complementary actions. By automating manual processes and consolidating data from disparate systems, hospitals can lower costs, reduce the potential for errors and more easily demonstrate compliance with regulations – all while significantly improving the safety of patients, staff, contractors and visitors. Therefore, healthcare organizations should act to accomplish these important actions as soon as possible. After all, the cost of doing nothing could be staggering.