Public Health Emergency Preparedness

Chapter 6. Security

Under Scenario 1, security needs and goals at the surge facility would be comparable to those at any suburban hospital under normal conditions of operation. These include general safety of patients, staff, and visitors, and protection of pharmaceuticals and other assets. However, typical measures to achieve security would be more complex at a newly-opened surge facility for the following reasons:

• Since this is a new and temporary facility; the facility itself and security procedures will be unfamiliar and not yet routine to the security staff. Therefore, protocols will be more difficult to maintain and unusual events will be more difficult to identify.
• Hospital personnel will not be known to security staff or to one another, therefore unauthorized persons will be more difficult to identify.
• Mechanical and electronic security controls would be quickly retrofitted onto this structure and may not be of optimal design and function for this facility.
• All personnel, patients, and visitors will be under heightened stress due to the catastrophic event that necessitated opening of a surge facility.
• If the surge facility is affiliated or identified with a major hospital, protestors and demonstrators who typically target the major hospital (for example, animal rights activists) may target the surge facility.

6.1 Security Needs

To achieve the security goals for both scenarios, the following measures must be undertaken:

• Controlling access into the building.
• Controlling access within the building.
• Identifying and tracking of patients, staff, and visitors.
• Securing of pharmaceuticals and other assets.
• Communicating with the base facility (the major hospital) and local, State , and Federal emergency officials.

Under Scenario 2, there are significant additional security concerns and risks beyond those mentioned above. If the surge facility is to serve as an isolation/quarantine hospital for infectious patients, there could be a strong not-in-my-backyard reaction from the community surrounding the surge facility, generated by fear of the infectious agent. This could cause community members to object and try to prevent the facility from opening and receiving patients, and might lead to disruption of facility operations. If there is widespread perceived risk from the infectious agent, and if vaccinations and medical prevention and treatment are in short supply, there could be aggressive attempts to obtain or steal medications from the surge facility. These are serious and real security risks, and they will be difficult to manage under the conditions of a quickly opened temporary surge facility.

Recommendation: Discussions with local police will be necessary prior to opening an isolation/infectious surge facility, to address potential community hostility.

To achieve the security goals for Scenario 2, the following additional measures should be considered:

• Providing security for incoming and outgoing vehicles (for roadways between site perimeter and major corridors through the community), in particular those transporting infected patients.
• Controlling access to the grounds.
• Heightened access control into and around the building.
• More stringent identification and tracking of patients, staff, and visitors.

For both scenarios, it is assumed that the entire region will be operating under heightened security alert status if the catastrophic event was caused by a terrorist attack, but it is not assumed that the surge facility will have particular status as a potential target for a second attack. In fact, the selected surge facility should be well outside the primary target zone.

6.1.1 Access Control

Control of access to the site and the building would be achieved through security personnel, physical barriers such as fencing and Jersey knees, and mechanical and electronic devices such as locks, card reader systems on doors, and security cameras. There is a strong interplay between these security methods. As an example, if doorways cannot be locked or secured with electronic card readers, additional security staff will be needed at each doorway.

General Location and Roadway Access to the Site

Both facilities we assessed are located outside of the core metropolitan area of the city, and thus would be likely outside of the area of impact of a catastrophic terrorist event. We thus anticipate that roadways between major thoroughfares and the facility would be open and usable.

The facilities are also relatively close to the city (30 minutes driving time, 10 miles) and there are multiple routes to each location from the metropolitan area. In other cities, surge facilities should be selected with these location attributes in mind.

It would not be feasible to close all roadways leading to the facilities as there are multiple routes to the site and accesses onto the site. Therefore, if there is negative community reaction to an isolation/quarantine facility such that transport of patients is impeded, security vehicle escorts might be needed.

Controlling Site Access

Currently, there are no security staff, physical barriers, or mechanical or electronic devices in place to control access to entrance roadways or other portions of the site perimeter at either of the former hospitals we assessed. Both facilities have more than one roadway access, two in one case, three in the other. Both facilities are located at a slight distance from the regular thoroughfares, being sited on elevated portions of relatively large land sites. This requires long, connecting roadways that go only to the hospital property; a common design of hospitals constructed in suburban areas. In these circumstances, it would be easy to establish traffic stop points at the roadway entrances to limit access and check personal identification or vehicles if necessary. In particularly difficult security situations, all roadways except one could be blocked with Jersey knees or other barriers, and traffic access could be limited to one checkpoint using physical traffic barriers plus security staff. Facility access roadways are also wide enough to create zigzag pathways to prevent a hostile vehicle from approaching the facility at high enough speeds to cause damage.

Aside from the roadways discussed above, both facilities we assessed have soft perimeters. Large, open land areas surround each facility with no fencing or other barriers at the border between the hospital site and adjacent properties. Significant installation of physical barriers as well as security staff would be needed to control access onto the site. It is not likely that this type of site control would be needed under Scenario 1, but it could be needed under Scenario 2.

Controlling Building Access

At the facilities assessed, exterior windows, doors, and other structural components are in place with no breach in the building envelope allowing for building access other than in normal doorway entrances. Locks on doors and windows are in place and functional. Both facilities have a limited number of building entranceways (approximately a half dozen or fewer). Some exterior doorways have exit alarms in place. Both facilities have maintained operational life safety systems such as fire alarms, but do not appear to have comprehensive building alarm systems in place. Neither facility has doorway card readers in place or functional security camera systems. Both facilities have security staff to control building access, but staff is very limited compared with what would be needed for surge use. These security staff are uniformed and unarmed. If exterior doorways could be controlled with locks and electronic card readers, security experts estimate that three to four security personnel would be needed per shift to control building access and monitor the building. If doorways could not be secured via use of such technology, additional security personnel would be needed to control these doorways.

Controlling Internal Facility Access/Movement

At both facilities we assessed no controls were in place to limit movement within the facility or to control access to specific building areas. All interior spaces are fully connected via walkways and cannot readily be segregated via existing lockable doors. There are no physical or mechanical barriers or devices in place restricting or monitoring movement within the facility, nor are security personnel present anywhere in the facility except at the building entranceways.

Under Scenario 1, on-going monitoring of movement within the facility is recommended as a general security measure, but specific area restrictions are likely not needed. Under Scenario 2, it will be necessary to prevent access to isolation rooms, wards, or floors and to ensure that required isolation protocols are maintained. In addition, more stringent monitoring for unauthorized and hostile persons is recommended. Limiting movement and access to smaller zones within the facility would improve security and reduce the need to track movement and identify unauthorized persons.

Securing Pharmaceuticals

Both facilities assessed have a lockable pharmacy area, although there currently are no pharmacies operating in either facility. Aside from the lockable doors, there is no additional security in place at the pharmacy location such as alarms, cameras, or security personnel. Installation of some of these additional security controls may be needed to protect the pharmacy area under the isolation/quarantine scenario if there is a general shortage of vaccines or preventive or curative medications as described in the introduction.

6.1.2 Other Security Issues

Other miscellaneous issues are discussed below.

Identification and Tracking of Patients, Staff and Visitors

Comprehensive identification and tracking efforts will be needed and security experts recommend issuance of staff identification badges, use of security personnel and/or electronic card readers, computerized patient tracking if feasible, and identification and tracking or limitation of visitors. This identification and tracking would be conducted in concert with other access control measures as described above.

Monitoring and Prevention

Neither of the facilities we assessed is conducting on-going security monitoring. There are no active security cameras or other remote monitoring in place, nor are there patrols or sweeps conducted by security personnel. Under Scenario 1, regular patrols by security personnel would be needed to continually identify and de-escalate potential security problems. Under Scenario 2, significant monitoring efforts would be needed as the security risks are much greater. Ideally, remote security monitoring devices such as door alarms and security cameras would be used in combination with patrolling security personnel. If remote monitoring is not feasible, a significantly higher number of security personnel will be needed.

Security Communications

Effective execution of security protocols will require that on-site security personnel to communicate with one another and be able to call in outside emergency personnel if needed. In addition, if a tertiary hospital is acting in an oversight or coordinating role, there may be need to communicate with personnel there. The facilities we assessed typically have only one security person on-site; both facilities simply use the "911" system to call in outside emergency personnel if needed. During surge use, security teams will need to communicate with each other, possibly with the tertiary hospital overseeing operations, and possibly with the local police department.

6.1.3 Security Management and Protocols

No comprehensive security management plans or protocols are in place at the assessed facilities, as this is not needed with the very limited and low risk uses of these facilities. A comprehensive security management plan and action protocols need to be developed by security experts for any planned surge facility use.

6.2 Preparing to Open a Shuttered Facility

The major gap noted in the security assessment was the need for additional security personnel to control access to the site and the building and movement within the facility. Systems for identification and tracking of staff, patients, and visitors, protection of people and assets, and on-going security monitoring and communication are also needed.

6.2.1 Security Staffing

Under Scenario 1, approximately four to six security staff per shift would be needed, and perhaps more at a larger facility. This includes three to four staff for building access control and security, and one to two staff for site access control and security. This level of staffing assumes that a reasonable level of physical barriers and mechanical and electronic security controls can be installed so that doors can all be locked and that physical traffic barriers are in place. If this is not the case, additional staffing will be needed. For example, an additional security staff person would be needed at each entrance door that could not be locked or otherwise secured.

Under Scenario 2, a higher level of staffing will be needed as security risks are greater. Approximately 8 to 12 security staff would be needed, 4 to 6 each for both building access control and security and site access control and security. Again, this level of staffing assumes that physical and mechanical controls can be installed for site and building access control. If these controls cannot be put in place, a higher level of staffing would be needed, including two to four additional security staff per shift to patrol and secure the site perimeter.

Sources of Security Staff

It is possible that one of the major metropolitan hospitals will take responsibility for setting up security at the surge facility. If this occurs, the major hospital may be able to supply security staff for the surge facility from within their own ranks of security personnel. This is ideal as these personnel will be trained and equipped. If sufficient security staff cannot be spared, other hospital personnel could potentially serve, such as staff from support services or administration. These personnel would have the advantage of familiarity with general hospital operations and procedures. They could be selected, trained, and managed by the existing major hospital security management. However, all major tertiary hospitals will be in 24/7 full-response mode and may have no personnel of any sort to spare.

The next option would be to contract with a private security firm; these exist in every city. Some of these firms specialize in the types of emergencies that would necessitate opening a surge facility. A contract would have to be set up in advance with a firm, to specify the following:

• Number of security personnel needed and by when. (It should be readily feasible to get up to 10 security personnel from a private firm within 24 hours.)
• Security protocols to be followed and exact parameters of responsibility.
• Level of training needed.
• Gear and equipment specifications.
• Number of personnel who need to be armed.
• Chain of command and communications issues.

The firm under contract should specify how (and how quickly) personnel will be made available given the needs of their permanent client list and should assess if they can truly deliver the needed staff.

If other staffing attempts are not successful, it may be possible to hire officers from the local community police department in the town where the surge facility is located to serve as paid police details. This cannot be set up in advance or guaranteed. Depending on what else is happening in the community, all officers may be fully utilized conducting their regular duties and will only be available to respond to active security or civil unrest situations.

Under Scenario 2 it may be more difficult to obtain security personnel, as many will not wish to serve at an isolation/quarantine facility. Armed security staff may be needed under this scenario if civil unrest threatens to disrupt facility operations. Staff might also need protective gear against the infectious agent, such as respirators for which medical screening, training, and fit testing are required. Private security firms and/or their staff will likely be unwilling to serve at the isolation/quarantine surge facility. Local police officers might have the necessary skills and training and are likely to be fitted with respirators under DHS preparedness efforts (powered air-purifying respirator or air-purifying respirator fitted with HEPA cartridges at a minimum are recommended) but may be unwilling to serve at the isolation/quarantine surge facility.

As a last resort, security personnel may have to be called in from public police or military entities such as: local police, State police, National Guard, military police, or security members of Federal DMATs or DMRTs (only under a Federal emergency). Personnel from these organizations cannot be arranged for in advance, but can only be called in to respond to an existing emergency situation.

Security Staff Training, Equipment, and Preparation

Under both scenarios, security personnel should be uniformed and have a reflective vest if they are conducting traffic control. Security staff coming from the hospital, a private security firm, or the public policing authority would be uniformed.

Ideally, security staff serving at the proposed surge facility would receive advance training in the security protocols developed for the surge facility. Under Scenario 2, training in crowd control and negotiation would be important, as there could be strong community response to the surge facility presence.

6.2.2 Security Equipment and Technology

Traffic Control Barriers

Significant traffic control measures could be needed under Scenario 2. These include traffic stop/checkpoints and zigzagged traffic pathways to prevent high-speed vehicle access to the facility. Physical traffic control barriers such as cones, stanchions, and jersey barriers can be obtained readily within a few days, thus prior to the proposed opening schedule for the surge facility. Public local, county, and State highway departments typically have supplies of these barriers on-site, as well as the vehicles and staff to transport and set up the barriers at the surge facility. During an emergency event scenario, however, there may be competition for this equipment or staff. Private vendors of these barriers can typically deliver the quantity of these items as would be needed at the surge facility within the 7-day opening timeframe. The major trade organizations for the Jersey barriers can be found at pci.org and precast.org. The closest supplier can be located through these Web sites.

Site Perimeter Control Barriers

Physical site perimeter barriers may be needed under Scenario 2. Fencing is the most practical and readily available site control barrier. For a site of up to 20 acres, fencing contractors and fencing trade association officials indicated that chain link fence could be installed around the full perimeter within 3 to 7 days, even within a day if needed. This can be accomplished through the use of temporary chain link fence, which is typically in stock in more than sufficient quantities in any major city. This temporary chain link fence is typically 6 feet in height, and is of the same strength as permanent fencing, but the posts are not set as permanently in the ground. To locate a fencing contractor a geographic search of the trade association Web site, www.americanfenceassocation.com, can be conducted, or a commercial/industrial contractor can be located through the phone directory.

Building Access Control Devices

We expect that partially-shuttered hospitals will have functional locks on exterior doors and windows. Under Scenario 1, it could be sufficient to limit access to one or two manned entranceways, with all other exterior entranceways locked. Under Scenario 2, an increased level of building access control will likely be needed. Additional devices could be used to increase the flexibility and control of exterior doorway access while maintaining security. These include door card reader systems and remote door controls. We contacted vendors of this equipment who indicated that door card reader systems and door controls vary depending on the existing door hardware. Depending on which system is compatible with the door hardware, these systems may be in stock or may take up to a few weeks to be delivered. Once the vendor has the system, it will take anywhere from 1 to 8 days to install. The card reader systems are stand-alone wireless and battery-operated systems that can be programmed on-site with a laptop. The access cards can be programmed within a few minutes. If it is not feasible to install these types of door control systems, security personnel could man each doorway where identification checking is needed or that cannot otherwise be secured.

Interior Building Access/Movement Control Measures

Under Scenario 1, there is likely no need to control access and movement once proper identification checks and access control have occurred at building entranceways (i.e., only authorized personnel, patients, and allowed visitors have gained entrance). The only exception is to areas of the building that are physically unsafe, the pharmacy, and the morgue. Unsafe areas can be partitioned or walled off prior to the opening of the surge facility as long as there are still two viable means of egress. Pharmacy and morgue spaces can be locked or assigned a guard. Under Scenario 2, there is greater need to control access within the facility. First, isolation rooms, wards, and floors must be secured. Locked doors with remote opening capability, as described above, can be monitored and controlled by security personnel. Lacking these physical or mechanical controls, additional security personnel would be needed at key locations inside the facility.

Monitoring Devices

Under Scenario 1, it may not be necessary to employ significant monitoring efforts beyond security personnel manning key entranceways and conducting facility patrols. Under Scenario 2, monitoring of all access points as well as general site and facility monitoring will be needed under the higher security threat. In lieu of having security personnel stationed at every entranceway and at other key areas of access or activity, remote monitoring devices can be used, in particular, security cameras. Vendors for security cameras indicated that both wireless and wired security camera systems are available, and sufficient equipment to set up the surge facility would typically be in stock. This includes cameras, viewing monitors, recording devices, mounts, wires, and batteries. A wireless camera system may not be able to penetrate all areas of the facility, and this would need to be tested in advance. If it is not feasible to have the vendor do this advance testing, a wired camera system could be used. Vendors estimate that it would take four to five of their staff 1 or 2 days to install a full security camera system at the surge facility. Cameras would require power, but as outlined in the physical plant assessment, it is expected that electrical service would be available at the surge facility. If power is not available, batteries can be used, but these would only last for 8 to 24 hours before replacement is needed.

Personal Identification and Tracking

Since the facility will be newly opened, entirely new staff will be brought in who will be unfamiliar to security staff. Under both scenarios, a means must be created to clearly identify authorized staff. Identification badges can be issued to all authorized personnel and if a door card reader system is being used, the vendor for this equipment can readily program badges on site. If this is not feasible, unique identification badges can be created and issued on-site. Cameras, printers, and laminating equipment are readily available at a wide variety of retail outlets and could be obtained immediately.

Security Communications Equipment

A key component of maintaining security under both scenarios at the surge facility will be the ability to communicate within the on-site security team, back to the base facility (whether a major hospital or a public emergency authority), and to outside emergency responders.

Hand-held radios will be an important communications tool for on-site security personnel to communicate with each other as they are stationed at or patrol different areas of the building and site. Vendors for this equipment indicate that dozens of hand held radios are typically in stock, and that these could be programmed and delivered within a few days. With the hand-held radios, however, there will likely be radio "dead zones" within the surge facility unless the signal is strengthened through the use of a repeater (amplifier). A repeater may not be necessary in all locations for successful radio communications, but our assessment of two former hospitals indicates that it will probably be needed. Vendors indicate that a repeater will not typically be in stock because it must be ordered based on the frequency to be used for the radios and then programmed and installed. This could take from a few days to up to a month (in the event that the vendor must run cable to ensure blanket radio coverage for the facility). Vendors indicate that they would need to conduct an advance walkthrough of the facility and test radio coverage within the facility to identify and execute an appropriate radio system at the surge facility.

In order to obtain use of a frequency for the radios, a license must be requested from the FCC. The FCC then assigns a frequency. This typically takes 30 days, so this would need to occur in advance for the planned surge facility. Ideally, the potential surge facility would be selected, then a frequency assigned for this specific location given range protection, i.e., there are no other close frequencies assigned in this area. If it is not possible to select one potential surge facility location, a license for a nationwide frequency can be requested. However, a repeater cannot be licensed for this frequency; only radio-to-radio use is allowed for this frequency.

In the event that all of the above systems fail, the most foolproof option is the use of satellite phones with fully satellite-based technology. We were only able to locate one such service provider (available for orders at sales@iridium.com), as it appears that many of the major telecommunications manufacturers have dropped or are in the process of dropping their satellite lines, and competitors use partially earth-based technology, as described below. This one satellite phone service indicated that they have received inquiries for purchase of these phones from State emergency officials in more than half of the States, as well as from numerous local emergency officials. Therefore, it is possible that local or State officials may have satellite phones available for use at the surge facility.

If these satellite phones are not already available through local or State officials, the phones would need to be obtained in advance to ensure their availability for use at the surge facility.

The phones are not always in stock, and often are sold out in anticipation of or during emergencies such as severe hurricanes. When phones are in stock, they must be ordered, shipped, and activated. Once phones are obtained, it typically takes about 24 hours to activate them. These satellite phones will work outdoors with auxiliary antennas that can be placed outdoors or indoors if there is a clear line of sight to the sky, such as in a window. For full indoor use, an external antenna must be installed on the structure. Installation of an external antenna on the facility does not seem feasible or necessary for the proposed surge facility, as the phones can still be used outdoors and at windows.

Many satellite phone services use "bent-pipe" technology whereby the signal is transmitted from the satellite to a point on earth then back to the satellite then back down to another point on earth. This system is at risk of failure if the towers being used come down as a result of the catastrophic event. Ham radio uses a tower-to-tower relay approach. While ham radio may still be workable if a relay series of existing towers can be located, there is still some risk of blackout areas where all towers are down. For this reason, the fully satellite or completely earth-free system is recommended.

Security Management Planning and Protocols

Security management officials from whomever is managing the facility will need to devise a security plan in advance. These officials will conduct a walkthrough of the facility and review possible scenarios under which the surge hospital will be used. From this, they will determine needed security staffing levels, staff training and equipment requirements, physical barriers and mechanical/electronic security controls, and security protocols. They will also identify the best source for security staffing of the surge facility, and will execute needed contracts and other advance planning and preparedness efforts with the staffing source.

Return to Contents
Proceed to Next Section