Visitor management has long been one of the primary security concerns for healthcare facilities; however, the COVID pandemic has certainly brought the need for this technology into much sharper focus for these organizations. In this environment, healthcare facilities need tight control over incoming patients, their families and visitors, and outside contractors – both to protect those already inside the facility from the virus, but also for contact tracing and much more.
“Visitor management systems are adapting,” security consultant and advisor Michael Gips of GIPS Insights, said in a recent article in our sister publication Security Technology Executive. “They are going touchless; they can assist in contact tracing; moreover, providers are adapting their solutions to ask questions about a visitor’s health, travel, and possible exposure to COVID-19.
Today’s cutting-edge visitor management systems incorporate COVID-critical features such as facial recognition (for contact tracing), mask detection, health questionnaires, and temperature checks. Some systems include – or integrate with – employee COVID screenings that feature inventory and allocation management of personal protective equipment, employee scheduling for staggered shifts, and capacity planning for social distance enforcement.
“New options can require guests to verify their responses with a signature,” Gips adds. “Pre-registration can also inform and update visitors about new procedures for arrival, health check, distancing, elevator occupancy, etc., and these latter features can also be implemented for staff.”
A Balancing Act
The key to a successful visitor management system in a healthcare environment – either during COVID or post-virus – is its ease of use. These systems will be public-facing, and it will often be administered by healthcare professionals themselves.
“I know security directors are probably more Draconian in their desire for screening and visitor management,” admitted Lauris Freidenfelds, a Senior Project Manager for Telgian Engineering & Consulting, during a recent GSX+ educational session outlining a visitor management project he recently worked on.
“We needed a balance,” he continued. “I wanted to make sure that we got (buy-in from) nursing, the physicians, risk management, and legal. The patient experience folks didn’t want to hear complaints about it taking 15 minutes waiting in line like TSA in an airport, and the operations people wanted to make sure that all of this was consistent with the focus of what the institution wanted. So, I brought this team together we worked on this project as a team to address the operational implementation issues.”
Putting a System Together
With all these requirements, creating a successful system and integrating it with an access control system becomes a challenge for integrators and consultants.
“Once we selected a system, I took all the features it was capable of and created a checklist (for the customer to select) what we want it to do and what we do not,” Freidenfelds explained.
This is obviously key for consultants and integrators, and with this clarity, a system that actually meets the needs of the end-user can be created and integrated. For his particular project, Freidenfelds outlined several key features the security team wanted; however, many of these features and considerations will be integral to any healthcare visitor management implementation.
Badge Design: Key areas to consider include the use of barcodes, QR codes, color schemes and whether a photo will be included for visitors. “Badges should include the date, time period, and name of the person so staff knows whether and when a person unknown to them should be allowed on campus,” Gips says.
“We wanted a photo and we wanted the location on the badge,” Freidenfelds said. “We decided that we wanted the room number to be very prevalent and eliminate color coding and so forth. Also, one of the things that we learned about our past visitor management system was that once you issue a visitor pass, many people just use the same one every day after that – so we wanted self-expiring badges.”
Government IDs: Freidenfelds explained that the efficiency of scanning a driver’s license barcode really helped with the speed and accuracy of the system. “We took only the name and a birthdate off the driver's license, and then we took a live photo of the person, because we felt that the photo on the driver's license just wasn't good enough quality.”
Additional considerations include exceptions for people – especially minors who do not have a driver's license. Freidenfelds recommends working with the healthcare provider to create policies specific to minors. For undocumented adults, they developed alternative documentation processes to make sure that these visitors could be accommodated.
Integration Options
When integrated with an access control system, visitor management tools can establish acceptable areas to travel as well as no-go zones, Gips explains. They should also be able to identify when a visitor tailgates through a door behind a user with access rights. Some systems also provide guests with secure WiFi access. Here are some other key integrations and features that healthcare providers desire:
People Counting and Location: In the event of a security incident, threat, evacuation, or disaster, the organization will know which visitors are on-premises. A digital timestamp is recorded when the person departs the property. This feature can also identify violations of physical distancing rules.
Contact Tracing: A key feature in today’s systems is the ability to support and enhance contact tracing. The system should integrate with access control and subsequently any functions integrated with access control, such as video and intercoms, to identify who might have been exposed to someone with COVID-19.
Data Analysis: Visitor management databases allow organizations to examine their cumulative data, including common times of arrival and departure, frequent guests and hosts, and average time spent in specific areas on site. This allows for efficient allocation of resources such as security officers and receptionists.
Watchlists and Database Search: An organization may have banned individuals from its facilities or be wary of certain guests. For example, an ex-spouse, a troublesome vendor, or a disgruntled and threatening customer may all be personae non grata.
Whether a healthcare facility wants to cross-check a visitor with a database of restricted individuals, wanted criminals or sexual predators, for example, is something that should be discussed prior to implementation. “(The choice goes back to) balancing efficiency and effectiveness,” Freidenfelds explains. “(For example), the sexual predator list may have a lot of people named John Smith on it, so if you have a visitor named John Smith, there will need to be a significant amount of time to compare and eliminate that John Smith from being the one on the list.”
Electronic Medical Record Integration: When implementing a visitor management system in a healthcare environment, it should interface with electronic medical records on a real-time basis. “Visitor management systems not designed for healthcare implementation are generally a simplistic screening tool,” Freidenfelds said. “If you are visiting an attorney, for example, that attorney is always going to be in the same office of that building – they will change very rarely, but for the most part, you know where they are going to be when you go to see them. This is not the case with patients, and patients are going to move with the environment, and may go from one unit to another. They may be there for a couple of days; they may be gone. The medical record interface is a key (to tracking them).”
Healthcare facilities use Health Level Seven or HL7 – a set of international standards for transfer of clinical and administrative data between software applications used by various providers and departments. “There are visitor management systems out there now that utilize the HL7 interface,” Freidenfelds said. “It is a secure interface, and we established that it was going to be one-way communications. We used only very simplistic, necessary information from the electronic medical record – the name and room location – (to comply with) HIPAA requirements.”
Read Michael Gips’ full article from STE magazine at www.securityinfowatch.com/21152100.
Paul Rothman is Editor in Chief of Security Business magazine. Access the issue archives and subscribe at www.securitybusinessmag.com and follow us on linkedin (www.linkedin.com/company/security-business-magazine) and Twitter, @SecBusinessMag.
