If you run a hospital, you already know that open campuses create unique hospital security problems, because you live with them every day. Your building has to welcome a woman in labor at two in the morning, a family rushing to the emergency department, an outpatient arriving for dialysis, a vendor delivering supplies, and a visitor who does not remember which tower the patient is in. Every one of those people expects to walk in. The building was designed to let them, and any security measure that gets in their way will be removed by the next complaint.
I have spent my career in law enforcement, fire service, private security, and federal government, and I have worked in facilities where the answer to a threat was to lock the door. A hospital cannot do that and remain a hospital. That single fact changes everything about how the campus has to be protected, and most hospital security programs have never been redesigned around it. They borrow their thinking from office buildings and corporate campuses, where access control is the foundation, and then they apply it to a building with dozens of entrances that cannot be closed. The result is a program that is correct in theory and defeated in practice every hour of the day.
The Entrance Problem
Ask your facilities director how many entrances the campus has, and then ask how many of them are locked, staffed, or monitored at each hour of the day. In my experience, the first number is far higher than anyone at the leadership table expects, and the second question has no reliable answer. Hospitals grow by addition. A clinic wing gets built, a loading dock is added, a skybridge connects to the parking structure, a construction project opens a temporary door that becomes permanent. Each entrance made sense to someone at the time, and each one is now a way in that the security program may not know about.
The practical consequence is that a visitor who is escorted out of the emergency department can walk around the building and come back in through outpatient registration, and no one will know. A person who has been told to leave the maternity unit can take the elevator to the cafeteria and wait. Perimeter control, which is the foundation of most corporate security, barely exists on a hospital campus, and any program that assumes it does is assuming something that is not true.
Why Open Campuses Create Unique Hospital Security Problems Inside the Building
Since the perimeter cannot be held, the real security work in a hospital happens in layers inside the building, and this is where the open campus creates its most serious problems. The emergency department is the highest-risk point on the campus, and it is also the most open. Patients arrive in crisis, families arrive frightened and angry, people in behavioral health emergencies arrive with no place else to go, and all of them come through the same doors as everyone else. The triage desk, the waiting room, and the ambulance bay are where the majority of assaults on nurses and staff happen, and they are places the hospital has deliberately kept accessible.
Beyond the ED, the open campus means that the units which most need controlled access, the maternity unit, behavioral health, the pharmacy, and the intensive care units, are sitting inside a building that anyone can enter. Their security depends entirely on the door to the unit, the badge system behind it, and the staff who decide whether to hold the door for a stranger. Infant abduction protocols, visitor management, and drug diversion controls all rest on those inner layers, and those layers are only as strong as the last time someone tested them. Parking structures are a version of the same problem turned outward, a space the public must be able to use that staff cross alone at the end of a night shift.
What Borrowed Corporate Thinking Gets Wrong
The typical hospital security program was built by taking a corporate model and softening it. A visitor management desk is placed at the main entrance, which is one of many entrances. Badge readers are installed on unit doors and then propped open by staff who need to move quickly. Cameras are installed everywhere and monitored by no one in particular, because the guard force reports to facilities and facilities does not have a monitoring function. The guard contract specifies posts, and the posts are at the main lobby and the ED, and the rest of the campus is covered by a roving patrol on a schedule that everyone on the night shift knows.
None of this is wrong in isolation. It is wrong as a system, because it treats the open campus as a corporate building that happens to be busy. Officers cannot turn a stranger away at the front door of a hospital, so they need to be people who can recognize a problem in a waiting room and de-escalate it before it becomes an assault. Cameras do little to deter anyone on an open campus, so they need to be a tool someone is actually using to track a person who was asked to leave. Badge systems do not form a perimeter, so the access lists behind them need to be short, current, and audited.
Designing Security for a Building That Has to Stay Open
The right approach accepts the open campus and builds around it. Start by deciding which entrances the hospital actually needs open at each hour, and closing or alarming the rest, because a campus with forty ways in during the day may only need six at night. Move officers away from fixed posts in the lobby and toward the places where harm actually happens, which means the ED waiting room, the behavioral health boarding area, and the parking structure at shift change. Give the officers who work in the ED training that matches what they will face, which is a person in medical or psychiatric crisis, rather than training built for a corporate lobby.
Then build a way to communicate across the open campus. When a visitor is removed from the ED, the maternity unit, outpatient registration, and the officer in the parking structure should all know within minutes, with a description. Most hospitals have no such capability, and the open campus makes it essential. Finally, treat every inner-layer control as unproven until someone has tried to defeat it. Send someone who does not belong to walk onto the maternity unit behind a staff member and see how far they get. Try to enter the pharmacy after hours with a badge that should have been deactivated. This is the doctrine at the center of my book Until Tested: Security Is Only Assumed, and an open campus is the environment where it matters most, because the perimeter you might otherwise rely on is not there.
Who Should Own This
Managing an open campus is a leadership problem before it is a technology or staffing problem. Someone has to decide which doors close, move the officers, change the training, build the communication path, and run the tests, and that person has to have the authority to make department heads cooperate. In most mid-sized hospitals no one holds that role. Facilities manages the doors, nursing manages the units, the vendor manages the officers, and the campus stays open in the gaps between them. Naming a single accountable security leader, even part-time, is the step that makes everything else in this article possible.
Go Deeper
Hospitals that recognize the open campus problem and cannot fund a full-time executive to solve it have another option. I explain it in What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director describes how a part-time executive security leader takes ownership of a campus like this and gives the board someone accountable for it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply