Implementing effective access control in a busy budget-stretched NHS hospital
Hospitals are busy places: as well as patients and staff moving around, large groups of transient visitors are also in and out all day long, and the activity continues on a 24/7 basis. Controlling the movement of people within hospital buildings to create a safe and secure environment represents a significant challenge for facilities and estates managers.
Unless a hospital is brand new, it’s likely to have grown organically over a number of years. Hospital trusts change and add to their buildings on an ad hoc basis, and, as a result, a hospital can end up as a sprawling complex. For the facilities or estates manager, it’s a task which is similar to managing an estate the size of a small village.
Hospitals have many hazardous and vulnerable areas, housing very expensive equipment or materials that can be dangerous in the wrong hands. Access control acts as a red light and deters unauthorised entry in areas that need to be kept off limits to the public. Often facilities and estate managers will add a range of access control solutions to keep certain areas safe. But how do they balance the need for access control in such a complex environment and with so many determining factors, without turning the hospital into a prison? Also, how can this be achieved on a tight budget with limited resources, as is so often the case in the NHS.
Determine ‘at risk’ areas
When new hospitals are commissioned, it’s likely that all of the elements of access control are installed to work together in the most effective way. Where hospitals have grown over time, access control is often added on at a later date and in some cases can be very out of date and costly to maintain. Whatever the circumstances, estates managers should consider access control as part of the overall security plan and carry out risk assessments regularly.
The main entrance and exit doors on the outer perimeter of the buildings will have open access during the day. Once inside the buildings there will be a mix of both high and low risk areas that need access control. Research labs and operating theatres, for example, will need more stringent restrictions than access to generic consultation rooms, and children’s wards will have a higher priority than the cleaning or linen cupboards. The continuing threat of theft has put greater emphasis on the need to secure access to drugs, medication and chemicals. Restricting access to areas containing IT systems is important to protect patient confidentiality. While staff and patients need somewhere safe for their personal belongings while they are working or when they are staying overnight.
There are many different areas to consider and part of the role of the facilities and estates manager is to assess them all and prioritise accordingly. This might be achieved with the help of a building control officer, who can also advise on regulations concerning fire doors and escape routes. Cost is often the biggest consideration given to the lowest priority areas, and of course what works in one area or in one hospital will not necessarily work in others, as no two hospitals are alike. Selecting a range of access control solutions and using them in combination will help achieve the best result.
The access control systems available today range from technologies that can combine ID cards with entry systems, right through to good old fashioned locks and keys. The use of biometric systems is becoming more widespread where identity access is essential for security reasons, like, for example, gaining entry to a top research facility or path lab. These systems use fingerprint or iris recognition and are very effective, but are generally too expensive to use in all areas of the hospital.
Before purchasing any system or product, the facilities and estates manager needs to consider how much budget is available, what the products will cost, how much disruption the installation will cause, how easy the product will be to use and maintain and above all, how effective the product will be.
Card-based access control
There are many options available for electronic card-based access control. Card access can be added to a single door or to several doors either in the same location or in multiple buildings. Staff members need to swipe the card on the door to gain access to an area. Single door kits can be purchased for as little as £400 plus the installation cost on top of that. Depending on the wiring involved, this could easily double the initial purchase cost.
One advantage of card-based access control is that it can also be used to track employee time and attendance. This requires software that enables the system to be managed via a PC. Adding together the different component costs for the control unit, card reader, cards and software, a multi-door system could cost upwards of £600 per door. The installation of a multi-door system could easily run into multiple thousands of pounds depending on the complexity of the wiring, and the installation would certainly cause some disruption.
Access cards can also double up as ID badges for staff. Card-access systems will require someone to manage the cards on a regular basis. Some will inevitably get lost or stolen, so new cards have to be issued and will incur a cost. The cards can be programmed to only allow access to certain areas at certain times, so access can be selective and time sensitive. Depending on the numbers of cards issued and the number of doors involved, card-based access control can be time consuming to manage. As there are very few moving parts to wear or break, card-based systems are fairly low maintenance and should work reliably for many years. Most hospitals use some form of card-based system as a primary method of access for staff. The systems are expensive, but offer an effective way of combining several functions in one system.
Card-based access control is very effective on main access doors; however, it’s often not financially viable to use card-based solutions to cover all the areas identified at risk. Facilities and estates managers need to be able to secure other areas with the minimum amount of disruption, and the flexibility to add further access control one door at a time. Installing standalone access control products, such as push-button door locks, is one solution. The locks can be added to secure store cupboards or treatment rooms for example, very quickly and cost-effectively without impacting the main access system.
Push-button locks are either mechanically or electronically operated and can be used as primary locks on most internal and external doors. There are also push-button locks that can be easily fitted in place of locks and keys supplied on lockers, cabinets and cupboards. In hospitals there are many applications where these push-button locks can be used. A bedside cabinet is one example, where a patient can safely store his/her belongings overnight. In locker mode, the patient enters a code that will lock and open only once, and then be erased. If a patient forgets their code, then someone from the facilities or estates department is able to use a technician’s master code that will allow the locker to open. Other applications include staff lockers, medicine cupboards and trolleys.
Access code management
Regular code changes will ensure that push-button locks remain an effective solution for restricting access, for example, when a member of staff leaves. Codes should also be changed whenever it is felt that security has been compromised. Most mechanical push-button locks have to be removed from the door before the code can be changed, which takes 5 to 10 minutes to complete. Codes on electronic push-button locks can be changed while the lock is in situ on the door, which takes only a few seconds.
In hospitals, access to certain areas will also be time sensitive, so there might be some areas that need to be locked at night but need to be freely accessible during the day. This could be a waiting room or an entrance to an out-patient facility. Push button locks have a ‘code-free’ mode, whereby a member of staff can open the lock in the morning by entering the code and then put the lock into ‘code free’ mode so that patients and staff can come and go during the day. At the end of the day access to that area can once again be restricted.
Invest in saving time
The cost of push-button locks will depend on the functionality and quality of manufacture. A basic entry-level mechanical push-button lock can cost anything upwards of £30. Top of the range electronic push-button locks will cost several hundred pounds. Looking at value for money over the lifetime of the product, facilities and estates managers should consider the cost of on-going maintenance. For example, if you have 50 entry level mechanical locks in one hospital, it will take just under 10 hours to update all of the codes, which may need changing every couple of months. Although an electronic lock is more expensive to buy, the codes can be changed in minutes without having to be taken off the door, saving a great deal of time in maintenance.
The issue with keys
The main advantage of push-button locks is that they negate the need to use keys. Key management can be a major concern for facilities or estates managers. Keys inevitably get lost or stolen, so new keys have to be issued and locks have to be changed, which takes time and money to manage on a large scale. Inevitably there will always be some doors on-site where a lock and key is required to provide security, bolting a door against forcible entry; one example would be access to staff accommodation where the issue of keys is restricted to the resident.
Balancing cost and function
Hospital buildings have complex access control needs. The key to implementing successful access control is to balance cost and function, achieving a safe and secure environment that doesn’t impede on the ability of people inside the building to do their jobs. Facilities and estates managers need to assess the specific access requirements of different areas throughout the hospital, and identify the most cost effective solution for each application. When considering costs, estates managers need to look at capital, installation and on-going maintenance costs, bearing in mind that retrofitting wired systems can incur substantial additional fitting and redecoration costs.
In practice, most facilities and estates managers use a combination of the three main approaches described here: card-based systems for monitoring and control; push-button locks for flexibility, ease-of-use and low-cost; and traditional keys and locks in areas where only a small number of keys need to be issued.
Grant Macdonald, Managing Director, Codelocks