Biometrics in healthcare: openness and security in one package
How can security and openness in access control be reconciled in modern healthcare institutions? The answer lies in new technologies that no longer require healthcare institutions to make unfavorable compromises between openness to patients and their safety.
By: Mirza Bahic; E-mail: mirza.bahic@asmideast.com
Access control in the healthcare sector is burdened with a paradox. In other sectors, this aspect of security restricts access to protected areas without the need for special accommodation for users, except for maintaining basic accessibility. On the other hand, hospitals, health centers, and clinics are places that maintain a practice of round-the-clock openness and accessibility to a wide range of users.
Invisible yet uncompromising access control
Hospitals are institutions for the protection and preservation of life, which is why both patients and medical staff rightfully expect the same dedication to be applied to protecting their privacy and security. At the same time, most medical institutions must also uphold the principle of accessibility because you must be able to seek and receive help at any time of the day. On the other hand, an overly intrusive and strict system of patient and visitor control can cause discomfort and lead them to seek a more comfortable environment elsewhere.
However, the threats to these institutions are real and frequent enough to warrant systematic attention. Security issues in healthcare institutions encompass a wider range of risks, from compromising health through injuries, abductions, and blackmail to threats of violence, compromising patient privacy, data theft, equipment and drug theft, and the presence of unwanted visitors. Ultimately, hospitals are places where human lives are often at stake, and additional forms of endangering lives and physical integrity are the last thing patients, staff, and management want to have as an additional concern.
In addition to patients, the protection of medical staff, including doctors, nurses, and maintenance workers, is no less important, with the first two groups being the most frequent targets. According to research, healthcare workers are five times more likely to face violence in the workplace compared to employees in other sectors, underscoring the urgency of addressing these security challenges.
Healthcare workers are five times more likely to face violence in the workplace compared to employees in other sectors
Data from the World Health Organization shows that nearly 40% of healthcare workers experience physical violence in the workplace. In the United States alone, violence against medical staff increased by 67% between 2011 and 2018. Operating rooms, examination rooms with expensive equipment, and staff lounges therefore need to be strictly separated from areas open to the public such as waiting rooms and triage stations. Access control must exist here as an invisible yet equally robust barrier that separates two worlds.
Challenges of a round-the-clock work regime
The work regime in hospitals is one of the reasons why flexibility in access control in these institutions is as important as the level of protection. Healthcare is a round-the-clock business that is inherently dynamic and unpredictable. Staff schedules often follow unforeseen patterns that rely not only on shifts but also heavily depend on emergencies, epidemics, natural disasters, and the like. Therefore, modern access control systems in these facilities must offer flexibility to adapt to the unpredictable work regime while simultaneously allowing smooth access to specific zones for authorized personnel.
Additionally, there is the unique institution of patient visits that the access control system user must take into account. Risks to staff and patients are reduced by limiting potential threats through managing entry approval and access to facilities and rooms, thereby encouraging the creation of a safer environment. This is achieved through simplified shift coordination, access restriction based on user groups and visitation times, and advanced visitor management.
Not all departments are the same
Access control in healthcare does not face identical challenges within the same sector. Certain medical institutions have unique security needs that require a focus on specific aspects of access control. This is particularly true for psychiatric facilities and institutions for drug and other addiction rehabilitation. In a study on violence in the UK, for example, one-third (36%) of psychiatric patients experienced violence, and nearly half (46%) witnessed violence during their hospital stay. Such institutions require significantly stricter control at entrances and exits, with more detailed visitor control through integration with staff alert alarms, video surveillance, and motion detectors.
In maternity wards, on the other hand, access control must include systems oriented towards preventing infant abductions or baby switching. Access control systems need to be integrated with security systems for proper identification and linking of babies with the appropriate parent, as well as for their monitoring and protection from intentional and unintentional security threats.
In hospital pharmacies, similar systems need to monitor access to areas for storing medications, including cabinets and refrigeration units. This is done to prevent theft or unauthorized use of drugs, especially those with the potential for addiction. Integration with inventory management systems can help track drug distribution and expiration dates, and facilitate easier ordering of new supplies.
Unauthorized access to property jeopardizes lives
Modern healthcare institutions are also places where valuable and expensive property is kept. This includes medical examination equipment, medications in hospital pharmacies, and patient’s medical records that are treated as confidential documentation. All of this emphasizes the need for access control solutions that will be flexible in terms of supporting seamless interaction between staff and patients, but also uncompromising when it comes to protecting valuable property in these institutions.
Compromising the security of property significantly impacts the quality of healthcare and the social reputation of healthcare providers. Incidents range from theft of items such as stethoscopes and thermometers to the loss of much more valuable medical equipment. Culprits are typically staff members, patients, or contractors.
The International Association for Healthcare Security and Safety (IAHSS) stated in its 2022 study that intrusion into medical centers is the third most common form of crime in these facilities after disturbances of public order and assaults. According to this data, due to inadequate access control, thefts in hospitals increased by almost 6% per 100 beds compared to just one year earlier.
However, theft of medical equipment is a much more complex problem than the mere loss of items. While these criminal acts can indeed cause significant material damage to healthcare institutions, the ‘invisible’ healthcare and service expenses are magnified as organizations often pass on the incurred costs to future patients. Additionally, this form of security threat has an intangible component through the potential to directly harm patients themselves in cases where equipment theft occurs in the most urgent medical situations.
Protecting hospital property through improved access control is achieved by implementing an advanced system that will protect medical equipment and patients’ personal belongings based on the application of privilege hierarchy, visitor management, and event logging.
The theft of equipment also has an intangible component through the potential to directly harm patients themselves if it occurs during emergency medical situations
Data Theft
In healthcare, access control encompasses physical access to facilities such as hospital wards and administrative offices, as well as digital access to electronic health records and other sensitive information.
Ensuring adequate access control to data in healthcare institutions is essential for protecting patient privacy. Equally important is compliance with regulations such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States or the General Data Protection Regulation (GDPR) in the European Union. These regulations require the implementation of measures such as user authentication, encryption, role-based access control (RBAC), and logging to restrict access to patient information based on the principle of least privilege. This protects the confidentiality of patient health information and reduces the risk of data breaches through unauthorized access.
What does the healthcare sector require from access control?
Given all the mentioned factors, access control systems in modern medical facilities must address a much broader spectrum of security needs related to the specificity of their operations.
One of the fundamental prerequisites is a sophisticated systemic design that will serve both public and secure spaces equally well. Hospitals need access control solutions that seamlessly integrate into their architectural layout while offering robust security measures. Reliability is another crucial aspect because hospitals are institutions that do not operate on a nine-to-five schedule – instead, they are open 24/7 to provide timely care to every patient.
Access control in healthcare is further complicated by the fact that clinical centers often comprise complexes with multiple buildings. Access control must, therefore, be integrated with other systems used in these facilities, such as video surveillance or fire alarms. As these systems play a crucial role in emergencies, access control systems in hospitals must ensure seamless integration with fire alarms and video surveillance. In emergencies, access control systems must also support rapid evacuation procedures, with the ability to offer real-time customized updates for first responders in the field.
How to control excessive access points?
In other sectors, building spaces are often inaccessible to the general public, so their protection with a standard credential system usually yields satisfactory results. Conversely, medical facilities typically have numerous access points open to the public, with a limited number of security staff and a policy of general openness to all seeking assistance.
A temporary option is to reduce access points to avoid security incidents such as unauthorized access, patient elopement, or abductions. Unfortunately, this is only possible in the initial phase of building construction, as the facility’s capacities inevitably expand over time. Since denying access to the main entrance is not an option, hospitals must prioritize only the most sensitive areas and implement appropriate role-based access control. For example, patients should not be able to freely access the hospital pharmacy or rooms containing the medical records of other patients.
Privilege-based access control can reduce the likelihood of theft by means of having an appropriate visitor processing system. In case of unforeseen accidents, access point usage records are important as a source of valuable data to help identify perpetrators. Additionally, it is useful to categorize access points in the facility into standard and security-sensitive areas, departments, or zones where there is a higher likelihood of security issues. These areas require stricter access control if it is assessed that unauthorized intrusion could seriously impair the healthcare facility’s ability to provide high-quality patient care.
Considering all of the above, the most favorable option for access control in such facilities is advanced systems that grant access privileges based on roles throughout the day, along with flexible access restriction options. Simultaneously, such access control should offer long-term cost-effectiveness through scalability and flexibility in configuring access zones.
Access control systems in hospitals must ensure seamless integration with fire alarms and video surveillance
AI supports access automation for a seamless experience
Trends in healthcare reflect global shifts in the access control market. Following the pandemic, it has recovered and experienced strong growth during 2021 and 2022, with an estimated value of $13.3 billion. However, the most crucial aspect for healthcare is the foundation on which this growth is built, which is technological advancement enabling the creation of more tailored and better-integrated solutions. This primarily includes mobile access management, biometrics, integrations within the Internet of Things (IoT) framework, and contactless solutions.
In addition to integration with fire and evacuation systems, access control in hospitals must go a step further and offer equally successful integrations with CCTV systems, intrusion alarms, and other technological platforms. Therefore, facial recognition has been spreading rapidly in the healthcare sector in recent years. Driving factors include enhanced security, workplace access automation, and seamless user experience.
One of the new solutions in the market recognizing the importance of this strategy is the BioStation 3 system by Suprema, supporting integrated management of the entire access control system. For hospitals, this brings benefits in visitor and patient management as key segments of access control.
Access management is facilitated by integration with VoIP intercom and RTSP (Real-Time Streaming Protocol) video surveillance from any location. VoIP intercom allows seamless communication with all doors, while real-time video surveillance enhances security and enables round-the-clock monitoring for all access points. This level of control is brought down to the level of individual doors which are abundant in all healthcare facilities. BioStation 3 connects to them as a terminal with a set of functions designed to facilitate authentication and user classification.
BioStation 3 utilizes contactless authentication options, offering hospitals important hygiene benefits in terms of preventing the spread of infectious diseases. There is also flexibility in choosing the most suitable method for access filtering tasks, ranging from facial authentication and mobile access using QR codes to barcodes and RFID cards. For easier installation and scalability, this system can be deployed on almost any type of door in healthcare facilities, including the external perimeter, with support for IP65 and IK06 standards for dust and mechanical impact resistance.
Hospitals whose emergency services benefit from the agility of access control systems are always in search of technology that will significantly expedite authentication processes for various user profiles of these facilities.
In the realm of access control, artificial intelligence has emerged as a sufficiently fast solution, such as the one used by BioStation 3. AI optimization for authentication purposes achieves unmatched recognition speed, coupled with the ability to recognize different ethnic groups and facial variations, making it an attractive option for access control in healthcare. These systems must also possess a fraud prevention platform, alongside seamless self-enrollment and registration functions by presenting a face or photo on a mobile device, as Suprema’s BioStation 3 system does.
AI optimization for authentication provides unmatched recognition speed, coupled with the ability to recognize different ethnic groups and facial variations, making it an attractive option for access control in healthcare
Finger as an inalienable credential
The story of biometrics as the cornerstone of a new access control strategy in healthcare doesn’t end with artificial intelligence, which should, supposedly, retire other technologies prematurely. Even without AI, estimates suggest that the global market for facial recognition technology reached a value of $6.3 billion in the past year. This figure is expected to reach $13.4 billion by 2028, with an annual growth rate of 16.3%, as cited by Marketsandmarkets.
In addition to facial recognition, access control in hospitals will benefit the most from multimodal authentication, combining fingerprint, facial recognition, RF cards, and PINs. This allows for the diversification of authentication methods based on the specific security needs of institutions, from access points to public areas that are more intertwined in hospitals than in other buildings.
Therefore, fingerprint verification has long played an important role in the biometric component of access control. Besides security, fingerprint authentication means healthcare workers can quickly and easily access secured areas without the need for physical keys or access cards. This streamlined process saves time and reduces the risk of lost or stolen credentials.
Moreover, fingerprint-based access control systems create a digital record of each access attempt, including the individual’s identity and access time. An important advantage is that, unlike traditional access control methods such as cards or PIN codes, fingerprints represent an irreplaceable “personal” proof of identity that cannot be shared among individuals.
These advantages served as the basis for Suprema to develop its BioEntry W2 fingerprint-based access control system. With a new fingerprint authentication algorithm combined with a quad-core CPU for live fingerprint detection, BioEntry W2 offers high-speed database verification and precise lock control in hospitals. With the increasing number of incidents in hospital environments, managers of these institutions will appreciate the robust design of the BioEntry station housing according to the IP67 standard. With dual-frequency RFID technology, BioEntry W2 supports both LF (125Khz) and HF (13.56MHz) RFID, including all RFID standards supported by HID multiCLASS readers. In addition to fingerprint credentials, BioEntry W2 supports most RFID card standards, including MIFARE, HID iCLASS, DESFire, FeliCa, HID Prox, EM, and NFC. Ultimately, individuals attempting unauthorized access to prohibited areas within hospitals will face a unique system of infrared and white light that detects attempts at fraud with artificial fingerprints and blocks all imitations made from materials such as clay, rubber, glue, paper, or film.
In conditions where hospitals cannot be forced to compromise on security at the expense of service quality, BioEntry W2 comes bundled not only with a TCP/IP interface but also with more traditional interfaces (RS-485, Wiegand) to offer medical institutions greater installation flexibility for different environments at lower installation and maintenance costs and simpler cabling.
In addition to facial recognition, access control in hospitals will benefit the most from multimodal authentication, combining fingerprint, facial recognition, RF cards, and PINs
Quick staff localization can save lives
RFID devices also play a crucial role in access control within hospital environments. This mature technology enables swift and seamless access to various zones, as authorized personnel can easily move between different departments without the need for physical keys or manual authentication processes. The result is a reduction in administrative burden and saved time in facilities where seconds can often be the thin barrier between life and death.
RFID devices support the placement of special tags on staff credentials, allowing management to more easily track employee movements within the facility. In addition to the standard advantages of ensuring regulatory compliance with security protocols and monitoring productivity, this technology offers another key benefit in medical institutions: the quick localization of staff during admissions and emergency treatments.
Similarly, RFID bracelets or tags can be used for patient identification and monitoring during their hospital stay. This includes the ability to track the administration of medications, ensure proper patient routing, and provide timely medical interventions.
Access control must encompass the perimeter
Access control systems in medical facilities don’t begin and end in waiting rooms and security booths. There’s also the external perimeter of hospitals as the first line of defense against unwanted guests, in combination with the existing surveillance systems. This is especially important in areas of hospital complexes where clinical trials take place and rarely interact with visitors or patients. The same treatment applies to spaces where medications are stored or to facilities housing potentially violent patients with mental illnesses.
As an almost textbook example of technology for this purpose, there’s the XPass 2 RFID device from Suprema, which comes in a format suitable for mounting on poles, in boxes, or in combination with a keypad. The XPass 2 features dual-frequency (125kHz/13.56MHz) RFID technology, allowing it to read mobile cards using NFC and BLE. Communication with smartphones is ensured via Suprema Mobile Access technology, enabling the use of a smartphone as a key and access credential for doors and facilities within the hospital. This makes everything cheaper and more secure, practically eliminating the possibility of credential loss. The device offers resistance to dust and water according to IP65/IP67 standards, as well as to unauthorized handling or vandalism. This makes it suitable for outdoor installations in medical facilities in environmentally demanding settings.
RFID technology has another key advantage in medical facilities: rapid staff location during admissions and emergency treatments
Integration of access control and fire alarms
As hospitals are facilities with a large number of occupants, especially those with limited mobility, the integration of access control systems with fire alarms is another trend that attracts the interest of industry professionals and users. Companies like Suprema, for example, are aware of the importance of facilitating coordination between access control and fire protection measures. They have made both components part of their access readers and BioStar 2 systems, which can be configured for integration with fire alarm zones.
Suprema’s fire roll-call software enables organizations to track individuals’ presence in individual zones during emergencies. This technology is particularly useful in hospitals and nursing homes because, in the event of a fire, it automatically generates a report with key information about who is where in the building. To perform this task, all that is needed is a smart access control card or a key fob that employees use to access or exit the building.
Furthermore, integrating fire sensors into edge devices and access control units allows real-time detection of fire hazards, while warning signals provide immediate alerts to staff, facilitating quick countermeasures.
This serves as an illustration of the trend toward the evolution of access control into a hybrid model, where technical and digital systems intertwine. Healthcare institutions serve as a suitable litmus test for assessing the effects of this trend because holistic access solutions inherently offer greater openness and flexibility, which are crucial for these institutions.
More than just security: enhancing service quality
As healthcare institutions strive to offer personalized and efficient care to patients, biometric access control technology can also serve as a tool to improve the quality of services provided. With biometric authentication, hospitals can simplify patient registration with an unprecedented level of accuracy and minimize identification errors.
This helps prevent medical errors, such as misdiagnoses or incorrectly directed treatments for patients, which can have serious consequences for the safety of healthcare service users and the quality of care.
In addition to the facial recognition offered by access control systems, biometric systems streamline the check-in process by automatically recognizing patients upon arrival through their unique biometric characteristics. This reduces wait times and administrative burden on staff, enabling medical professionals to focus more effectively on providing quality care rather than paperwork or slow identity checks. The same applies to other security technologies such as iris recognition or fingerprint scanning, which, in addition to rapid identification, also reduce the possibility of misidentification of patients or theft of health records, cases of which number in the millions worldwide annually.
Biometrics help prevent medical errors, such as misdiagnoses or incorrectly directed treatments for patients, which can have serious consequences for the safety of healthcare service users and the quality of care
No tension between accessibility and security
Access control in medical facilities involves finding a delicate balance between security and accessibility, which is crucial for the well-being of both staff and patients. Effective control of individuals entering and exiting hospitals not only protects the safety of all occupants but also preserves the institution’s reputation and assets.
Access control systems were originally designed to regulate access to rooms and facilities, but today, they have evolved beyond their conventional role, even in healthcare. Biometrics has emerged as a revolutionary technology within the healthcare sector because it significantly speeds up the identification of patients and staff with an unprecedented level of accuracy. Additionally, it has become a flexible tool for creating added value as it streamlines the daily operations of hospitals, increases the efficiency of care delivery, and facilitates compliance with privacy regulations. With further refinement of these and related technologies, access control will offer patients a more personalized, accessible, and secure service to the satisfaction of all stakeholders in the healthcare chain.
Access control for clinical trials
In addition to protecting patients and staff, access control in healthcare facilities has another important component: safeguarding data related to clinical trials and research and development (R&D) activities. By safeguarding data related to clinical trials, medical institutions protect confidential research findings on new medical products and the associated intellectual property. Adequate access control thus becomes the only way for medical institutions to maintain their status as secure environments for clinical trials and medical innovation.
Biometrics plays an important role in this segment by allowing staff to quickly access accurate data on all participants in the clinical trial without compromising patient privacy. With biometric technology for precise identification and tracking of trial participants, researchers can be confident that only selected individuals will end up in the appropriate groups and cohorts.
Biometric technology also helps researchers securely manage the obtained data and ensure that only authorized individuals have access to strictly confidential study results.
