If you are a COO or CFO at a mid-sized hospital, you almost certainly have a hospital security leadership gap, and you may not have a name for it yet. You have a guard contract, a camera system, a badge system, a workplace violence policy, and an infant abduction protocol. What you do not have is a single person whose job is to lead all of it. The pieces exist. The leadership does not, and the pieces have been arranged to look like a program so convincingly that the absence is easy to miss until something goes wrong.
I have spent my career in law enforcement, fire service, private security, and federal government, and I have walked into many hospitals where everyone could describe the security program and no one could say who ran it. The people doing the work, the contracted officers, the charge nurses, the facilities managers, are generally doing it well within their own lanes. My critique is never of them. It is of a structure that asks a hospital with dozens of entrances and one of the highest workplace violence exposures of any industry to protect itself without a leader.
What the Hospital Security Leadership Gap Looks Like
The gap has a recognizable shape. The guard force reports to facilities, where it is managed as a building service and measured on filled posts and complaint counts. The emergency department handles its own risk with local protocols because no one else understands its pace. Human resources owns the workplace violence plan because it was written as an employment policy. Nursing owns infant security. Pharmacy owns diversion. Information technology owns the cameras and the access control system because they live on the network, and treats them as equipment rather than as a security capability. Each department is competent and each one sees a fraction of the campus.
What is missing is the person who reads the ED assault reports, the HR complaints, the guard logs, the badge exception reports, and the pharmacy audit findings as one picture. Without that person, the same visitor can be escorted out of the ED on one day and walk into the outpatient tower on the next, and no one connects the two. The guard vendor writes its own post orders and grades its own performance. Findings from the last assessment sit unassigned because no one has the authority to make a department head act on them. The board hears about security once a year, from whoever happens to be presenting, and receives a description rather than a result.
Why the Gap Persists
The gap survives because it is inexpensive to ignore in ordinary times. A full-time executive security director is a significant salary, and in a hospital where margins are thin and clinical needs are endless, the CFO can reasonably ask what that hire would do that the current arrangement does not. The honest answer is that the current arrangement produces activity, and the executive produces accountability, and activity is much easier to see on a budget line. Officers are visible in the lobby. Leadership is invisible until it is absent during an incident.
There is also a candidate problem. Large health systems hire experienced security executives, and the people with that background tend to go where the systems are. A mid-sized community hospital cannot easily recruit one, cannot easily justify one, and so it promotes a capable facilities manager or a senior contracted officer into a coordinator role that carries the responsibility without the standing. That person cannot tell the ED director to change visitor flow or tell pharmacy that its after-hours access list is too long. They can ask. Asking is not leadership.
What the Gap Costs
The cost shows up first in the people closest to the risk. Nurses and registration staff in the ED absorb the violence that a coordinated program would have anticipated, and they leave, and the hospital pays to replace them. Behavioral health patients boarding in the ED for days are managed by staff improvising because no one designed the escort and observation protocol for that scenario. Contracted officers are put in positions they were never trained for and are blamed when the outcome is bad. These are structural failures, and they land on individuals.
The cost also shows up in the survey and in the boardroom. Accreditation and regulatory expectations for workplace violence prevention increasingly assume a program with an owner, an assessment, training, and a review of results. When a surveyor asks who is responsible and four people look at each other, the hospital has failed the question before answering it. After a serious incident, the board will ask the same question, and it will want a name rather than a list of departments. A hospital without a security leader has no one to give.
Security Is Only Assumed Until Someone Tests It
The deepest cost of the gap is that nothing gets tested. Every department describes its controls, and the descriptions are accurate, and no one tries to defeat any of them. The maternity unit has alarms on every infant. Pharmacy has a badge reader. The ED has panic buttons. All of those things are true and none of them tells you whether the unit locks down in time, whether the badge list has been cleaned in a year, or whether the panic button rings anywhere at three in the morning. My book Until Tested: Security Is Only Assumed is built on this idea, and hospitals are the clearest example of it I know. Testing requires a leader with the authority to run an unannounced drill and the standing to report the result to the top of the organization without softening it.
How to Close the Gap
Closing the gap begins with naming an owner, and the owner has to sit at the executive level and report to the COO or the CEO. That person does not need to manage the officers day to day, and should not. Their job is to own the program across every area that creates exposure, set the standard, test whether it is met, hold the vendor to the contract, and report to the board with one voice. The departments keep their operational roles. What changes is that someone is now responsible for the whole.
For most mid-sized hospitals, the way to do this without the full-time salary is a fractional security director, an experienced executive who owns the program part-time. In the first ninety days, that person should build a single inventory of every entrance on the campus and who controls it, pull the incident reports from the ED, HR, pharmacy, and the guard vendor into one file, compare the guard contract to the post orders and the post orders to what officers actually do on nights, and run one unannounced drill on the highest-risk unit. Then they should stand in front of the board with the results. Once that happens, the hospital has a security program. Before it happens, it has a set of departments and a hope.
Go Deeper
The fractional model was designed for organizations in exactly this position, large enough to carry real risk and too small to justify a full-time executive. I explain how it works in What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the full argument for why the leadership gap exists in most mid-sized organizations and how a part-time executive closes it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply