If you are a hospital executive, you probably have a physical security program that reports to facilities and a cybersecurity program that reports to the chief information officer, and the two of them rarely sit in the same room. That arrangement made sense when locks were mechanical and the network was a separate world. It no longer describes your hospital. The badge reader on the pharmacy door is a network device. The cameras in the parking structure are network devices. The infusion pumps, patient monitors, and imaging equipment are network devices with wheels. Physical security and cybersecurity in a hospital have quietly become the same problem, managed by two departments that do not talk to each other.
I have spent my career in law enforcement, fire service, private security, and federal government, and I have watched this seam open in every kind of organization. Hospitals are the clearest case, because they combine an open campus that anyone can walk into with a network that carries patient lives. The IT team is doing careful work on its side of the line and the security officers are doing careful work on theirs. My concern is the line itself, because that is where the exposure sits, and in most mid-sized hospitals no one owns it.
Where the Two Programs Overlap
The badge system is the most obvious overlap. Access control decides who can enter the pharmacy, the maternity unit, the data center, and the server closets scattered across the campus. The system that makes those decisions is software, running on servers, administered by someone in IT, with an access list that is maintained by a mix of HR, department managers, and the vendor. When a nurse leaves the hospital, IT disables the network account and someone is supposed to disable the badge. When a contractor finishes a project, the same thing is supposed to happen. Often it does not, and the badge that opens the door to the medication room keeps working for months.
Cameras are the second overlap. Video systems are on the network, which means they can be accessed from outside the building if they are poorly configured, and they can be disabled from inside the network by anyone who reaches them. Medical devices are the third and most serious. A device that is left in a hallway, wheeled between units, and plugged into any available port is both a physical asset that can be stolen and a network endpoint that can be compromised. Physical security sees it as equipment. Cybersecurity sees it as a device with an operating system. Neither program is usually responsible for the fact that it was sitting unattended in a public corridor.
How Physical Security and Cybersecurity in a Hospital Fail Each Other
The failures run in both directions. A physical weakness becomes a cyber weakness when someone walks onto an open campus, finds an unlocked network closet or an unattended workstation in a nursing station, and plugs in a device. Hospitals are full of unattended workstations, because clinical staff move constantly and logging out every time is unrealistic. A cyber weakness becomes a physical weakness when the access control system can be reached from the internet, or when a compromised account lets someone add a badge to the pharmacy access list without ever entering the building. A camera system that goes down during a network incident leaves the parking structure and the ED unwatched at exactly the moment the officers are distracted.
The most common failure is simpler than any of that. When IT reviews the badge system, it reviews the server, the patches, and the network segment. When facilities reviews the badge system, it reviews whether the readers work and whether the doors close. Nobody reviews whether the list of people who can open the pharmacy door is correct. The system is technically sound and physically functional and it lets the wrong people in, and both departments can truthfully say that part was not theirs.
What Working Together Actually Requires
The first requirement is a shared inventory. Physical security and IT should hold one list of every device that controls or observes access to the campus, including badge readers, controllers, cameras, intercoms, and alarm panels, with a record of who administers each one, what network it sits on, and who is responsible for its access list. Most hospitals have never built this list, and building it is the fastest way to discover the closets and readers that neither program knew were there.
The second requirement is a joint process for people. When someone joins, changes roles, or leaves, the network account and the badge should be handled in the same workflow, and the high-risk access lists, pharmacy, maternity, behavioral health, and data center, should be reviewed together at least quarterly by someone outside both departments. The third requirement is joint incident response. A network outage should trigger a physical security response, with officers moved to the areas that cameras and door alarms were covering. A physical incident, such as a stolen laptop or a stranger found in a nursing station, should trigger a cyber response that assumes the network may have been touched.
Test the Seam, Because No One Else Will
The doctrine I built my book Until Tested: Security Is Only Assumed around applies to this seam more than anywhere else, because it is the place where each department assumes the other has it covered. Pull the pharmacy access list and check every name against the current staff roster. Find out how many badges belong to people who no longer work at the hospital, and how long that has been true. Have someone walk the campus looking for open network closets and unattended workstations, and count how many they can reach from public corridors. Ask IT to identify every camera and badge controller that can be reached from outside the hospital’s network and have them explain why.
Then run a combined exercise. Simulate a network outage that takes down access control and video, and watch what the officers do. If they do not know the doors have failed to a state that leaves the pharmacy open, or that the cameras in the parking structure are dark, the two programs have never actually met. That is the single most revealing test I know for a hospital, and it costs almost nothing to run.
Who Owns the Seam
None of this happens without a person whose job is the whole picture. The chief information officer owns the network and should keep owning it. The facilities director owns the building and should keep owning it. What the hospital needs is a security executive who sits beside them, owns the physical program, understands enough of the cyber side to ask the right questions, and is accountable to the COO for the places where the two overlap. In a large health system that is a full-time chief security officer. In a mid-sized hospital it is usually no one, and the badge list quietly grows.
If you want to start this quarter, put the CIO, the facilities director, and whoever manages the guard contract in one meeting with a single agenda item, which is the list of every access-controlled door on the campus and who can open it. The conversation that follows will tell you how wide the seam is, and it will tell you whether you have anyone positioned to close it.
Go Deeper
A fractional security director is often the practical answer for a mid-sized hospital that needs someone to own the seam between physical and cyber without hiring a full-time executive. I explain the role in What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director describes how that leader works alongside IT and facilities and reports the combined picture to the board.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply