Layered Systems in an Acute-Care Hospital
A 240-bed acute-care hospital handles 62,000 ED visits a year and runs a 24-bed locked behavioral health unit and a pharmacy holding controlled substances. In 90 days there were three elopements (one through a stairwell door a visitor held open), two ED workplace-violence events (one involving a weapon), and one pharmacy door found ajar after hours. The site has 14 analog cameras with roughly 8-day retention and no written retention policy, a standalone nurse call system, standalone access control on 40 doors, and duress buttons in the ED that ring a phone at a front desk that is frequently unstaffed. Capital available is $600,000. Infection control and patient-privacy rules restrict ceiling work in several areas.
1. Map the four incidents to specific system capabilities. For each, name the layer that failed or was missing, what you would deploy, and identify one capability you would explicitly not deploy, with the reason.
Read the worked answer
| Incident | Layer that failed | Control |
|---|---|---|
| Elopement via a stairwell door held by a visitor | Access control existed, but nothing monitored door state or constrained the visitor | Door position switch plus forced/held alarm annunciating at the unit's staff station; delayed egress with local alarm; unit visitor log with badge and escort rule; anti-passback so one badge cannot admit two people |
| ED weapon event | No screening layer, and no usable alerting path - the duress ring went to an unstaffed phone | Duress redesigned for location-based annunciation to a monitored point; lockdown capability on the ED entry; 30-day video retention; radio interoperability with local police |
| Pharmacy door found ajar | Access control with no door-state monitoring and no audit review | Ajar alarm at 60 seconds, door position monitoring, camera at the door with 90-day retention, and a scheduled audit of access events |
| Recurring theme across all three | Detection without a defined response | Written alarm response matrix naming who answers what, and how fast |
Not deploying: facial recognition at entrances. Accuracy varies across demographics, the legal exposure in a healthcare setting is severe, and there is no response plan that would justify it. Also not deploying: cameras in patient rooms. Neither buys anything the incidents above actually demand.
Order of work. The incidents are dominated by response failure, not sensor shortage. The duress redesign and the alarm response matrix come before any camera expansion, because every other control depends on someone acting on the signal.
2. Behavioral health and ED staff want cameras everywhere, including patient rooms and sally ports. How do you decide, and what must accompany any camera in a patient-accessible area?
Read the worked answer
Decide by purpose, not by request volume. For each proposed location ask: what specific incident does this prevent or resolve, and who acts on what it shows?
- Sally ports and unit entries - defensible. They are the control point where the elopement and the weapon both originated.
- Corridors, nursing stations, pharmacy, ED treatment bays - generally defensible, subject to local law and labor agreements.
- Patient rooms - off the table in nearly every jurisdiction. The privacy intrusion is disproportionate, staff will be recorded in clinical moments, and it does not address any of the four incidents. If a specific patient requires observation, that is a clinical decision with a clinical tool.
Conditions that must accompany any camera in a patient-accessible area:
- A written statement of purpose and a defined retention period, with automatic deletion.
- Signage at the entrance.
- Viewing restricted by role - security and unit leadership, not every logged-in user.
- An audit log of who viewed what, reviewed monthly.
- No audio recording; no view through a doorway into a treatment space.
- A governance group including legal, compliance, nursing and security that approves each location and reviews the list annually.
- A documented record of alternatives considered, in case the decision is challenged.
Make the trade explicit to the requesters: what you are buying with a corridor camera is post-incident reconstruction and a deterrent effect; what you are not buying is prevention. Staff who believe the camera will protect them will change their behavior around it, so the response plan must be real before the camera goes up.
3. Define acceptance criteria for the duress system so that 'it works' is objectively demonstrable. Include measurable targets and the test method.
Read the worked answer
Targets
- 100% of devices tested - every ED duress button and every pull station, not a sample.
- Annunciation at the monitoring point within 3 seconds for at least 95% of activations, and within 5 seconds for 100%.
- Correct location descriptor displayed for 100% of activations. Mislabeled zones are the most common failure and the most dangerous.
- Acknowledgement by a named responder within 30 seconds during staffed hours; on-scene response inside the policy target (for example, 3 minutes in the ED).
- Supervisory fail state: a device with a dead battery or a disconnected access point raises a visible trouble alarm. Silent failure is a failed test.
Test method
- Activate each device in place, at worst-case locations - stairwells, lead-lined imaging rooms, the far end of the corridor.
- Record timestamps at the device, at the console, and at acknowledgement, with a stopwatch or synchronized log export.
- Verify the displayed text matches the physical location.
- Pull a battery and disable a network path; confirm the system reports trouble rather than going quiet.
- Retest quarterly on a rotating sample and annually in full; keep the signed test record per device.
Note the dependency: the duress system's performance is capped by whatever answers it. If the console is unstaffed at 0300, a 3-second annunciation is a 3-second annunciation into an empty room. Acceptance criteria must cover the response side, or you have tested a bell.