If a hospital can only afford to do access control well in a few places, it should start with three: the pharmacy, the newborn intensive care unit, and the behavioral health unit. Access control for the pharmacy, NICU, and behavioral health unit deserves its own standard because the consequences of failure there are different in kind. A theft in the lobby is a loss. A breach in these areas can mean a diverted narcotic, a missing infant, or a patient harmed or lost. Leaders should be willing to spend more, enforce harder, and test more often in exactly these places.
Each area has its own risk, its own culture, and its own way of failing. The common thread is that the controls have to hold when the unit is busy, short staffed, and full of people with good reasons to be there.
Start with consequence, not convenience
A common mistake is to secure these areas to the same standard as everything else, with a card reader on the door and a policy in a binder. The right question is what the worst day looks like in each place and what would have to be true to prevent it.
In the pharmacy, the worst day involves controlled substances leaving the building or being taken by someone who should not have them. In the newborn unit, it is an infant leaving with someone who has no right to take that child. In behavioral health, it is a patient hurt, a patient who leaves unsafely, a staff member assaulted, or a ligature or weapon risk that nobody addressed. These are different problems, but all three start at a door and all three depend on who is allowed through it.
The pharmacy: access, accountability, and diversion
Pharmacy access control has two jobs. It keeps outsiders away from medications, and it keeps insiders accountable for what they handle. The second job is the harder one. Drug diversion, the movement of medication from its intended patient to someone’s personal use or sale, is most often an insider problem. It is often a staff member in distress, not a criminal mastermind, and it hurts patients who receive less medication than they were ordered.
Good access control supports diversion prevention by creating a record. Limit pharmacy and medication room access to people whose jobs require it. Use stronger hardware on the doors that matter, including solid construction and frames that resist forcing. Require two forms of authentication for the highest-risk spaces, such as a credential plus a PIN or a biometric, so a lost or borrowed card is not enough. Tie the door logs to dispensing and cabinet records so that patterns can be seen: who entered, when, and what was removed.
Controlled substances are subject to federal and state rules, and your pharmacy leadership and compliance team own those obligations. Confirm requirements with them and with counsel. As a security leader, my concern is that the access system, the dispensing system, and the investigation process work together so that an irregularity is noticed quickly and handled fairly.
The newborn unit: knowing who belongs
The newborn unit relies on a particular combination: restricted entry, positive identification of every person who handles an infant, and a staff culture of challenge. Industry guidance on preventing infant abduction exists, and a number of hospitals follow recommendations developed with national child protection organizations. I will cover the failure chain in detail in a separate article. Here the point is the door.
Entry to the unit should be controlled and monitored, with a clear process for admitting parents and approved visitors and a firm rule that unfamiliar people are identified before they are admitted. Staff identification should be distinctive and consistently worn, so that an unfamiliar badge stands out. Exits, including stairwells and service doors, matter as much as the main entrance, because the path out is as important as the path in. Many units use electronic infant tagging that can alarm on a door or lock an exit when an infant approaches it. Those systems help only if they are maintained, tested, and understood by the people who work around them.
Above all, make challenge normal. Staff should feel supported, not awkward, when they ask a stranger who they are and whom they are with.
Behavioral health: protect the patient and the staff
Behavioral health units have the opposite problem from the others. The door must keep people in as well as out. Patients may be at risk of harming themselves or leaving unsafely, and staff may face aggression. Access control here is part of a larger safety environment that includes room design, observation, and clinical practice, and the clinical team must lead the design.
From the security side, the priorities are controlled entry and exit, a secure vestibule or similar arrangement so doors do not open to the unit and the outside at once, reliable emergency egress for staff, and a way for staff to summon help quickly. Think about the visitor path too. Items brought in by visitors can be a safety issue, and a consistent, respectful process for what may enter the unit protects everyone. Details of the hardware and layout depend on the building and your clinical program, so involve behavioral health leaders, facilities, and safety officers together.
Audit more often where the stakes are higher
The same rule applies to all three: security is only assumed until it is tested, and the higher the consequence, the more often you test. Review who holds access to each area at least monthly and remove anyone whose role has changed. Look for credentials used at odd hours or in patterns that do not match a person’s schedule. Review door alarms for held-open conditions and forced entries and confirm that someone responded. Check that the hardware works: that doors latch, that readers respond, that tagging systems alarm when they should.
Drill the response, not just the equipment. A tabletop exercise for a missing infant, a diversion report, or an elopement from behavioral health shows whether the people involved know their roles, whether the phone numbers work, and whether the first ten minutes are handled well. Run these with leadership present, and document what you learn and what you fix.
Who should own these areas
Each of these units has a clinical owner, and each should have a security counterpart. The pharmacy director, the newborn unit manager, and the behavioral health director should each know their access list, review it on schedule, and sign it. Security supports with hardware, monitoring, and audit. An executive above them should receive the results and resolve conflicts, because the pressure to loosen access for convenience never stops.
When leaders invest first where the consequences are highest, the whole security program becomes easier to defend. These three areas are the right place to start.
Go Deeper
Prioritizing the highest-consequence areas across a whole enterprise takes experienced judgment. What Is a Fractional Security Director? The Complete Guide shows how that judgment can be brought in part time, and Fractional Security Director explains the method behind it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply