By Ronnie Wendt

The University of Virginia Medical Center has many reasons to boast.

In June, U.S. News & World Report ranked UVA Children’s, part of UVA Medical Center, as the No. 1 children’s hospital in the state in its Best Children’s Hospitals guide. Five UVA Children’s specialties rank among the top 50 nationally. 

This award follows recognition in 2020 as the No. 1 hospital in Virginia, marking the fifth consecutive year UVA Medical Center received this honor. The U.S. News & World Report Best Hospitals guide also named eight of its specialties among the best in the nation. 

The 696-bed acute care hospital comprises a Level 1 trauma center, a Level 3 NICU, an oncology unit, and robust transplant, heart and vascular, and neuro centers. Its children’s hospital devotes 111 beds to acute care for infants and children. 

The quality of medical care delivered by this facility generally captures the spotlight. But behind the scenes, there’s an equally impressive group at work keeping buildings secure and safe for patients, visitors, medical and support staff. 

“Safety is our No. 1 priority,” says Bush Bell, administrator of hospitality and support services for UVA Medical Center. “Whether it’s keeping our patients safe as they receive care, safeguarding family members while they visit or protecting employees as they work, it’s something that’s critically important to us, and something we think a lot about.”

Plan for safety and security

In 2018, the American Society for Health Care Engineering’s Hospital Security Survey shared some alarming trends. The survey of U.S. hospitals revealed a rise in violent incidents at healthcare facilities, particularly emergency departments. 

Responding hospitals shared they saw a 57 percent increase in violent incidents in their emergency departments and a 52 percent increase in other areas. The same hospitals reported higher incidences of trespassing and property crimes. 

The survey painted a clear picture of the need for strong hospital security — a need UVA Medical Center identified some time ago. 

Recognizing rising trends for violence and for active shootings, UVA Medical Center added an emergency lockdown feature to its access control system. Now the facility can quickly and easily lock down all entrances amid security threats. 

The medical center remains open to the public during normal business hours, keeping main entrances unlocked for patients and visitors. But if a threat arises, officials can lock entrances in seconds. 

“If the ER gets someone with gunshot wounds and the suspect is at large, we can push a button and lock down our entrances so that it’s only possible for authorized personnel to enter or leave,” says Sally LeBeau, manager for patient experience and support services. 

The hospital’s threat assessment team, comprising security and intelligence professionals, university police officers, psychiatrists and psychologists, and other key employees, monitors behaviors for threats. 

“Whenever a person exhibits unusual or threatening behavior, we do a threat assessment and put an action plan in place to ensure we provide the safest environment possible,” Bell says.

Every successful security program must consider threats to people. UVA Medical Center organized a situational awareness violent event (SAVE) group to set security policy and procedures for staff to follow to ensure the safest place to provide care is provided. This group “looks at how we can ensure we’re not creating an environment where team members are injured by patients,” says Bell. 

It’s also important to keep a pulse on security technology advancements and collaborate with partners across the organization to keep security high, LeBeau says. Here, a security working group considers security technology upgrades or additions for the most secure environment possible. 

“Our close relationship with the university police department helps us thoughtfully add technology,” she says. “For instance, our police department wanted to bring in metal detectors. We evaluated them and added them to our emergency department entrances.”   

Control access with technology

Safety planning is but one step toward hospital security. Security technology also plays a vital role in mitigating risk, providing quality of care, and ensuring compliance. 

Every hospital needs a proper security and surveillance system to protect patients and employees, sensitive medical information, valuable pharmaceuticals, and medical equipment. UVA Medical Center employs a mix of security technologies that includes CCTV cameras, electronic access control systems, metal detectors, and biometric access controls.

The operation supports such technology installations to keep egress and ingress points secure, and to control access to restricted areas. 

“There are doors security staff lock and unlock. We have door greeters that serve as the eyes and ears at entrances,” LeBeau says. “But access becomes more restricted inside the facility through technology. For example, we have biometric access control for research labs and card readers that authorized badge holders must swipe to access areas holding medication or supplies.” 

UVA Medical Center secures its facilities with a state-of-the-art, auditable, electronic access control system that carefully manages employee credentials.

“We have a very collaborative relationship with our health information technology department to maintain our database,” LeBeau says. “This department provides near real-time data flow of active employees, contractors or vendors who are authorized for an ID badge. We also receive termination records.”

The system allows security personnel to manage employee credentials every day. They can upgrade access when an employee’s role changes, or the employee leaves their job.

“Integrating our access control system with worker credentials so that it’s an automated process when new employees start or leave is a best practice I’d recommend,” LeBeau adds. “Information gets entered once and flows into the access control system, whether at hire or upon termination. We don’t have to rely on someone returning their ID badge when they leave.”

If an employee forgets their badge, it’s also easy to supply a new one. 

“There are a lot of places they cannot access without an ID badge. They can clock in and out and access a computer with their ID badge,” LeBeau says. “By automating the badging process, we can replace their badge and deactivate their old one.”

The role-based system limits access to areas employees use to perform their jobs. There’s basic access and restricted or safety-sensitive access levels. For instance, a pharmacist gets a higher level of access than a greeter at the front door or someone doing COVID-19 screenings at the front desk. 

“Basic access allows employees to enter exterior doors, corridors and non-safety sensitive areas,” LeBeau says. “Areas that are safety-sensitive require another level of access. These could be servers for computing services, pharmaceutical areas, radiology, operating rooms, medical records, or mechanical areas.”

Employees undergo enhanced scrutiny to gain access to restricted areas. 

“One of our biosafety labs, for example, requires additional background screening and training,” LeBeau says. The auditable system stores access records for five years. 

“Every time an employee swipes their badge, the system records it. We archive these records on a server we can pull from,” LeBeau says. 

Manage visitor access

Every healthcare facility needs a visitor management system, says Bell. Some hospitals invest in complex visitor management systems with check-in kiosks that query the visitor management system to see whether the hospital has discharged a patient. If not, the kiosk prints a sticker that admits visitors to the unit treating the patient. These systems can automatically tie visitors to watch lists and set up silent alerts to protect patients. 

Although these systems offer a high level of technological advancement, they can be expensive and more than what hospitals actually need, says Bell. UVA Medical Center uses a more basic system, having used more complex visitor management systems in the past. 

“We rely on our electronic medical records system as our trusted source of truth for visitor management,” he says.

When visitors arrive, a greeter at the door pays close attention to their arrival and notes anything suspicious. Visitors then must pass a COVID-19 screening. Finally, they receive a visitor pass at one of the information desks. 

“We validate if they have the ability or right to come in, meaning the patient has not prohibited their visit,” Bell says. “We also look for patient restrictions that limit visits.”

Once validated in the system, visitors receive a sticker visitor pass to wear. They need a new pass every time they visit. 

UVA Medical Center places video intercoms at locked unit entrances. When visitors arrive outside, they must press a “call bell” that notifies the nursing station. The system allows two-way video communication that enables employees to see visitors and their visitor badges before buzzing them in. 

Security officers provide another layer of security. 

“Besides being our first line of response when something happens, they provide a passive level of security by observing what’s going on in public spaces,” Bell says.

Security camera systems comprise an essential part of a healthcare facility’s overall security plan. These systems protect patients, safeguard sensitive personal records, and safeguard hospital equipment, supplies, and medications from theft. 

When coupled with video management software (VMS) on a camera or as a separate software system, users can record and view live video from multiple surveillance cameras. UVA Medical Center pairs IP cameras with VMS. 

“We use several types of video cameras, and place them in public corridors and hallways, waiting rooms, retail point of sale areas, etc. But we do not put video cameras in patient care areas or integrate the cameras with our access control system,” LeBeau says. “We connect our video cameras to our campus police department. The VMS lets officers access video footage in real time or view recorded footage after an incident.” 

Keeping security strong 

Security technology means little if systems fail when needed. Redundancy, regular maintenance, and robust policy ensure security levels stay high. UVA Medical Center injects redundancy into its system to always maintain protection, then follows a strong maintenance plan to keep systems running. 

“We take maintaining these systems seriously,” LeBeau says.

Besides applying all firmware updates on schedule, “we have an access tree for our access management system that shows all our devices and alerts us if one goes offline,” she says. “Our systems have battery backups so that if we lose connectivity or power, they keep operating.”

Preventive monthly maintenance ensures all systems receive regular attention. 

“For example, we service six access control panels a month. Each of these panels can handle many individual card readers,” LeBeau says.

She adds even the best technology will fail without robust security policies. 

“We have policies that pertain to employee behavior, policies about access control, policies about security cameras, policies about visitor management, and we have policies that pertain to employees, visitors, vendors and contractors,” she says. “These policies set the stage for everything we do.”

Ronnie Wendt owns In Good Company Communications, a business focused on writing for facilities management and other industries.