Hospitals face unique security challenges thanks to their high traffic volumes and complex staffing requirements, their rigorous compliance environment and their diverse community ranging from patients, staff and affiliated physician to students, contractors, visitors and volunteers. It is increasingly critical that administrators ensure the highest levels of both physical and IT security, each of which can be particularly challenging. Challenges become even more complex as institutions undergo mergers and acquisitions that introduce demanding badging and identity management requirements.
In the physical access control arena, institutions must keep pace with security threats, support ongoing improvements and contain or reduce costs while securing more and more doors. Hospitals are also carefully examining how to maximize their investments so that users don't simply open doors with their ID cards, but can also use them for applications ranging from cashless payment to accessing IT resources, all with a single, convenient and cost-effective solution. On the IT side, the access control system must employ strong authentication and adequate security so that patient health information is protected in an increasingly digital world. With the right infrastructure in place, healthcare institutions can meet today's needs while continually improving physical and IT security and convenience, protecting patient privacy and increasing the ongoing value of their investment.
Ensuring security at the door
Implementing a physical access control system in a hospital environment is complicated by the typically large campus size and often geographically dispersed nature of many facilities. In an urban setting, there is the added challenge of making patients and visitors feel comfortable and welcomed, and also confident about their safety and security. Additionally, hospitals must support affiliated physicians who may work with many different institutions, requiring them to carry multiple badges for all the locations they visit.
Meeting all of the aforementioned needs is difficult with legacy systems, which are based on static technologies and can't easily be upgraded to new features and capabilities. This is why many hospitals are moving to new PACS solutions that are based on dynamic technologies, ensuring they are adaptable to the changing hospital needs and the latest best practices as security threats evolve.
One of the biggest benefits of the latest PACS solutions is the improved security of contactless high frequency smart card technology. Today's solutions feature mutual authentication and cryptographic protection mechanisms with secret keys and employ a secure messaging protocol that is delivered on a trust-based communication platform within a secure ecosystem of interoperable products. This approach gives hospitals the confidence that they can deliver the highest levels of security. The latest systems also include features like the Open Supervised Device Protocol and its companion Secure Channel Protocol for bidirectional, multi-dropped reader communications. OSDP and SCP replace legacy, unsecured Wiegand technology to extend security from the card reader to the access controller and also enable users to re-configure, poll and query readers from a central system, which reduces costs and makes it easier to monitor and service readers. In the future, OSDP will also give readers new capabilities, like displaying real-time evacuation information in the event of an active shooter crisis.
The latest solutions also make it easy to add new applications, like infant protection systems or biometrics to deliver strong, multi-factor authentication in laboratories, research centers and other sensitive areas. Another benefit is the ability to support many more access control applications on the same smart card. For instance, today's PACS platforms enable physicians, nurses and administrative staff to carry a single card that provides access to the main door, emergency room and pharmacy, and can also be used for visual ID verification, time-and-attendance logging, payroll transactions and cafeteria purchases.
Hospitals should also ensure that visitor management is an integral part of their facility security strategy. Replacing manual paper logs, today's visitor management systems enable hospitals to screen, badge and track all visitors — or, at a minimum, only those visiting labor and delivery floors, pediatric wards and other critical areas, as well as during "after hours" periods. Systems should support real-time patient feeds using Health Level 7 integration so the system has all patient status and room information. This ensures that no visitor is sent to the wrong location or to see a patient that has already been discharged. Systems should also feature Status Blue integration so they can pre-register approved vendors and temporary employees. They also should support integration with access control systems for the most efficient badging.
Effective access control can play a major role in implementing key policies and procedures that apply to staff and physicians as well as patients and visitors. For instance, during flu season, many cities require that healthcare facility workers be vaccinated. This is most often visually tracked on the ID badge with a sticker, which unfortunately can become worn and fall off. A better approach is to print a visual element on the card or, better yet, use a holographic foil card that embeds the element on or below the card surface, beyond the reach of counterfeiters. Compliance can be tracked using the database management capabilities of the credentialing system. To further protect the institution during flu season, hospitals can expand visitor management capabilities by installing systems at all entrances, minimizing unauthorized access that could further spread viruses.
Many institutions also want a path to IP-based PACS solutions that are easier to operate and that simplify expansion, customization and integration with other solutions that can share the same network. Networked access control simplifies infrastructure enhancements and modifications because hardware platforms aren't tied to proprietary software. It's also easier to add wireless locksets that connect with the online access control system, reducing wiring costs and eliminating the problems of easy-to-lose keys while providing near-online and near-real-time control of the opening. IP-based solutions also provide a single, integrated system for combining security, access control, video surveillance and incident response, perimeter detection and alarm monitoring systems. Hospitals can invest in a single, unified IP network and logically control multiple technologies that previously co-existed only on a physical level. Plus, they can leverage their existing credential investment to seamlessly add logical access control for network log-on and achieve a fully interoperable, multi-layered security solution across company networks, systems and facilities.
Protecting data and IT resources
With today's growing focus on patient privacy protection, it is increasingly important that hospitals pay as much attention to logical access control as they do to physical access control. A good model for data security is that used in the online banking industry. As in online banking, patient data protection and health record security requires a layered system approach so that appropriate risk mitigation levels can be applied.
The first layer is user authentication. The use of strong, multi-factor authentication ensures that individuals are both who they say they are, and authorized to access data. Software tokens held on a mobile device improve speed and simplicity of the authentication process, but have security vulnerabilities. A better approach uses emerging Near Field Communications technology and enables users to carry a smart card or smartphone with an authentication credential stored on its secure element or subscriber identification module chip. With this approach, users can simply "tap in" to gain access to hospital facilities, VPNs, wireless networks and cloud- and web-based applications. An affiliated physician who might carry as many as 20 OTP tokens could now replace them with a single mobile soft token.
The second layer is device authentication. A common approach is to ensure that authenticated users within the hospital — as well as affiliated physicians who are visiting the facility or logging in remotely — may only access their own health records, or those of their patients, from a known and properly registered device. This can be accomplished with contactless cards or with tap-in log-on.
The third security layer is transaction authentication with pattern-based intelligence, which is used to validate transactions as well as sessions. This can be implemented in a layered fashion. For instance, users and physicians conversing about systems might only require a lower-level security check. In the case of celebrities or other high-profile users, or those downloading sensitive documents, however, there might be multiple strong authentication security checks during the session.
The fourth and fifth layers are browser protection and application security. The former is most effectively implemented using a proactive hardened browser with a mutual secure socket layer connection to the application. The latter protects applications on mobile devices that are used to deliver sensitive information. Data theft is significantly more complex and costly for hackers if the application is architecturally hardened and capable of executing mutual authentication.
Hospitals have a variety of tools for achieving a strong and versatile PACS solution while also solving strong authentication challenges for IT security and patient information privacy. Increasingly, the healthcare industry is moving toward converged solutions that can be used to secure access to everything from the hospital’s doors to its computers, data, applications and cloud-based services. Truly converged access control will ultimately consist of a single security policy, one credential and one audit log. The goal is a fully interoperable, multi-layered security infrastructure that is based on a flexible and adaptable platform. Such a platform will enable hospital administrators to preserve their access control system investments as they grow, evolve and continually improve their security capabilities in the face of ever-changing threats.
Sheila L. Stromberg is the director of vertical market strategies for HID Global, and focuses mainly on the healthcare industry. She is responsible for educating healthcare providers, payers and medical manufacturers on the full portfolio of secure identity solutions in addition to incorporating industry feedback, trends, gap analysis and best practices back into the HID organization. Ms. Stromberg specializes in transition planning and migration strategies to upgraded and innovative technologies for healthcare organizations. She has spent the past nine years serving in various roles at HID Global. She holds a Bachelor degree in Business from Concordia College.