Access is a layer, not a place.
A working security director put it plainly to a professional association, not a vendor: hospital security directors have ninety-nine problems, and access control is involved in nearly every one of them. That is the definition of a layer, not a destination. Which is why most of what brings a director to a page about “access” is really a question about a specific place — the screened corridor, the locked unit, the controlled-substance cabinet, the infant tag, the door a confused patient walks out. Each of those is its own problem with its own answer, and the honest first move is to name which one is actually yours and go there.
What remains when those are subtracted is smaller and quieter, and it is real: the general building envelope. The main entrance, the visitor who signs in or doesn’t, the side door that is chosen-open for convenience during the day. No departmental plan singles this out, because it belongs to no department. It sits between registration, nursing, patient experience, and security, and the daily operator of the front door is often not the security director at all — which is exactly what makes it a governance question rather than a device question.
The core of it is one sentence: how open is the perimeter, who decided that, and could you show the decision later. Openness is not a failure — a hospital has to be enterable, and some doors are held open on purpose and for good reason. The question is whether that openness is a decision someone made and can account for, or a default nobody chose and nobody owns. The first is governance. The second is what a surveyor, or an incident review, turns into a finding.
You make this argument yourself, in other rooms of your own building. You tell your leadership that a policy nobody wrote down is not a policy, it is a habit — that a rule you cannot produce on paper is a rule you cannot enforce or defend. The front door is where that argument comes home. If the reason three side doors stay unscreened lives only in what the day shift happens to know, you do not have an access decision; you have an access habit, and it will be read as one when someone asks.
Our own part here is narrower than in any departmental room, and worth saying flatly: the integrator owns the system at the door, not the decision at the door. We can make an access policy enforceable — badge it, log it, alarm it, and produce the record of who came through and when. We cannot make the policy for you, because the policy is a negotiation among people we are not party to. The technology is downstream of a governance argument, and the value we add is making that argument’s outcome real and auditable once you have had it.
So the instrument at the bottom does not send you to buy anything. It sends you to the front desk to ask how they verify a visitor they do not recognize, to count the ways in and how many are screened, and to find out who decided the unscreened ones and whether that decision is written down anywhere. An “I don’t know” on any of those is the finding — it means the door has been answering a question nobody remembers deciding.
“The question that lands isn’t “is the front door secure.” It’s “who decided how open it is, and can you show me where that’s written.” Most of the time the honest answer is that the openness accumulated — nobody chose it, so nobody can account for it.”
Sources: ASIS professional-association interviews with hospital protective-services leadership (access described as a cross-cutting layer; the security-sensitive-area taxonomy of pharmacy, NICU/maternity, emergency, and behavioral health drawn from a director’s Joint Commission/IAHSS-based plan). Governance/ownership of visitor management as collaborative across registration, nursing, patient experience, and security. The proportion of facilities where security vs. front-of-house owns the door is not publicly determinable and is not asserted. No weapons, screening-efficacy, or grounds/parking material is used here — those belong to other rooms. Standard references verified against the current accreditation manual at publish.
What would change this: IAHSS access-governance guidance updates; any published data on visitor-management ownership; accreditation manual references at publish.
Reviewed July 2026 by the Eagle Systems healthcare practice. The systems referenced are how a facility meets the accountability the regulation creates, not a mandate; the accreditation and compliance determinations belong to the organization and its regulators. Current as of Accreditation 360 (eff. Jan 1 2026).