If you run a hospital, you have probably watched the question of who should be responsible for hospital security bounce around your own leadership table. The emergency department director raises it after a nurse is assaulted at the triage desk. Facilities raises it when the guard contract comes up for renewal. Compliance raises it in the months before a survey, and nursing raises it after an infant security drill goes badly. Each of them owns a piece of the answer, and each of them can reasonably say the whole thing belongs to someone else.
I have spent my career in law enforcement, fire service, private security, and federal government, and I have seen this same structure in hospitals of every size. Security is divided among people who already have full-time jobs, and the division is treated as if it were a plan. It is an absence of one. The gaps between those departments are where the serious incidents happen, and the people who work in those gaps, the nurses, the registration clerks, and the contracted officers, are the ones who pay for it.
How Hospital Security Is Usually Divided
The typical arrangement looks like this. A contracted guard force reports to the facilities director, who evaluates the vendor on cost, coverage, and complaints. The emergency department manages its own risk with a mix of local protocols and whatever officers happen to be posted nearby. Human resources owns the workplace violence policy because it is written as an employment matter. Nursing owns the infant abduction protocol because it lives on the maternity unit. Pharmacy owns drug diversion because the controlled substances are theirs. Information technology owns the cameras and the access control system because they run on the network. Parking is either facilities or an outside operator.
Every one of these departments is doing reasonable work inside its own boundaries. The problem is that no one is standing where they can see the whole campus at once. The ED does not know that the same visitor who was escorted out on Tuesday walked in through the outpatient entrance on Thursday. Facilities does not read the assault reports that HR keeps. The guard vendor writes its own post orders, evaluates its own performance, and reports to a manager who has never worked a security post. A hospital with dozens of unlocked entrances and one of the highest workplace violence exposures of any industry is, in effect, being protected by a committee that never meets.
Why Facilities Is the Wrong Home for It
I want to be careful here, because facilities directors are among the most capable people in any hospital and they did not ask for this responsibility. It landed on them because the guard contract looked like a building service and somebody had to sign the invoices. But once security lives inside facilities, it gets managed like a building service. Officer hours are treated like landscaping hours, something to trim when the budget is tight. The vendor is measured on whether posts were filled and whether anyone complained, which says nothing about whether a threat was recognized and stopped.
Security also needs authority that facilities does not have. Telling the emergency department to change its visitor flow, telling behavioral health to adopt a restraint escort protocol, or telling pharmacy that its after-hours access list is too long requires a leader who sits at the same level as those department heads and answers to the COO or the CEO. A facilities director making those requests is asking a favor. A security director making them is doing the job.
Who Should Be Responsible for Hospital Security
One person should be accountable for the security of the whole campus, and that person should be an executive-level leader who reports to the chief operating officer or the chief executive. Their responsibility should run across every area that creates exposure: the emergency department, behavioral health, the maternity unit, pharmacy, parking structures, visitor management, the guard contract, and the technology that supports all of it. The departments keep their operational role. The director owns the program, sets the standard, tests whether the standard is being met, and answers to leadership when it is not.
That last part is the reason the role has to exist. Accreditation and regulatory bodies increasingly expect a hospital to show that it has assessed its workplace violence risk, built a program to address it, trained staff, and reviewed the results. Those expectations assume someone is in charge. When a surveyor asks who owns the program and four people look at each other, the hospital has already answered the question. The same is true when the board asks after an incident. The board does not want a list of departments. It wants a name.
What the Board Should Ask
Board members and executives do not need to become security experts to find out whether the hospital has an owner. A few plain questions will do it. Ask who is accountable for security across the entire campus, and see whether the answer comes back as one name or as a sentence with several. Ask when the workplace violence plan was last exercised, with real staff, in the emergency department. Ask when someone last compared the guard contract to the post orders and the post orders to what the officers actually do on the night shift. Ask when the infant abduction protocol was last drilled without warning and how long it took to lock down the unit.
Then ask the question I built my doctrine around. Ask who has tested the program, as opposed to who has described it. My book Until Tested: Security Is Only Assumed makes the argument at length, but the short version is that a hospital’s security is only as real as the last time someone tried to defeat it. If the answers to these questions are vague, the hospital does not have a security owner. It has a set of assumptions.
What to Do This Quarter
Start by naming an accountable owner, even on an interim basis, and putting that name in writing so that every department head knows it. Have that person build a single inventory of every entrance on the campus, who controls it, and whether it is locked, staffed, or open at each hour of the day. Pull the incident reports that currently live in the ED, in HR, in the guard vendor’s log, and in pharmacy, and put them in one file so that the patterns become visible. Walk the campus at night with the owner and with a charge nurse, and pay attention to what the officers are doing at shift change. Finally, put security on the board agenda as a standing item with a single presenter, so that the accountability you have just created has somewhere to report.
Go Deeper
Many hospitals recognize the gap and still cannot justify a full-time executive security director this year. The fractional model exists for exactly that situation, and I explain how it works in What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director lays out how a part-time executive can own the program, hold the vendor accountable, and give the board one name to call, at a fraction of the cost of a full-time hire.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply