Risks of Physical Security Infrastructure in Healthcare

---

The Vulnerability of Hospitals

Why Hospitals Require Strong Physical Security Infrastructure

Hospitals hold sensitive, critical and high-value proprietary information—patient records, medical devices, life-saving medications and years of research and cures—making them a prime target for malicious actors. Their 24/7 operations and large, open environments increase the risk of physical and cyber attacks. Hospitals are required to protect patient data and privacy, however protection extends beyond digital patient records and fundamental cyber security and the physical security infrastructure is often overlooked or an afterthought compared to other hospital spending and support needs. Effective physical security is required to protect patients, data and the enterprise. It is not just about locked doors—it’s about enterprise risk management focused on safeguarding all of the valuable patients, staff, assets, and the hospital’s brand integrity.  A single incident of physical breach or system bypass can have significant life-altering consequences and devastating business impact.  This article will explore the common infrastructure vulnerabilities and how to remediate them.

Legacy Devices and Communication Protocol Risks

Outdated physical security systems—such as legacy badge readers, controllers, and software—can be a dangerous liability:

• Outdated Card Reader Technology:

o   Replace Magstripe and Prox cards with high-security credentials:

o   Bad actors can walk near a staff member, copy their badge, and gain unauthorized access.

o  Video Example: Easily Cloning Prox Cards - YouTube

• Weigand Protocol Vulnerabilities:

o   Still widely used between door readers and controllers.

o   Allows for “sniffing” devices to be hidden behind wall plates to capture and manipulate credential data.

o   Video Example: Weigand Sniffing Hack - YouTube

• Outdated Firmware on Devices:

o   Card readers, controllers, and cameras with outdated firmware may have known vulnerabilities.

o   These can be exploited to disable systems, view camera feeds, or unlock doors remotely.

o   Case Study: Cyberattack Hits U.S. Hospital Systems – WSJ

• End-of-Life (EOL) Software Platforms:

o   Old security platforms no longer supported by manufacturers can’t be patched and secured.

o   These become easy and exposed attack vectors, especially if open to networks or the internet.

o   Security Insight: Physical Security Software Vulnerabilities - SecurityInfoWatch

---

Risk Mitigation - The Path Forward

The Risk Landscape

Every point in the security infrastructure is a potential threat when not maintained properly: ignored alerts from old monitoring systems, non-encrypted communication lines and systems unable to support modern integrations.

The Path Forward: Building a Secure Healthcare Infrastructure

Step 1: Migrate to OSDP Protocol

·       Replace outdated Weigand communication with Open Supervised Device Protocol (OSDP).

• Offers bi-directional encrypted communication between card readers and controllers.

• May require hardware upgrades including modern OSDP-compatible card readers and access control panels.

• Benefits: Device authentication, data encryption, better tamper detection.

Step 2: Upgrade Access Credentials

• Replace  Magstripe and Prox cards with high-security credentials. for example:

  • HID iCLASS SE®

  • HID Seos®

  • DESFire® EV2/EV3

• Provides secure key management and encrypted transmission.

• Helps prevent cloning, skimming, and replay attacks.

Step 3: Regular Firmware Updates

• Maintain a firmware management schedule for all security devices.

• Update access panels, readers, and video devices as part of ongoing preventative maintenance.

• Partner with IT and security integrators for scheduling and rollout.

Step 4: Stay Current with Software & Manufacturer Support

• Use only platforms with active support contracts and patching cycles.

• Regularly check for critical updates from vendors.

• Up-to-date software ensures system uptime, protection from exploits, and compliance for manufacturer support.

---

Conclusion: Strong Partners Make Safer Hospitals

The evolution of threats in healthcare security infrastructure demands an expert partner that understands the high stake impact to patients and the environment of care services. Selecting the right security integrator partner is critical.  Utilize a trusted security partner such as Security Solutions NW who specializes in healthcare risk expertise, including deep knowledge and experience in the unique needs and challenges faced by hospitals, research divisions and clinics.   The trusted partner should be collaborative and proficient at developing a healthcare specific security roadmaps, structured specification standards, system health monitoring measures, service level agreements and ongoing upgrade and life-cycle plans.  The right partner will be an extension of the hospital risk team and focus on proactive strategies, tools and support.  The partner should provide quarterly or semi-annual business reviews to assess and prioritize emerging risks, provide insight into firmware and software health and develop action plans for continuous security improvement.

Importance of Real-Time System Health Monitoring

Solutions like AiRGUS® and SecuriThings®  offer:  continuous visibility into system health, alerts for outdated firmware, vulnerable devices, and inactive hardware, device performance metrics and simplified password rotation. These efficient tools improve system performance, equate to fewer failures and proactive risk reduction.

---

Quick Action Summary Chart

Step	Action	Goal	Benefit
1	Migrate to OSDP	Replace Weigand	Secure reader-controller comms
2	Upgrade Credentials	Remove Magstripe/Prox	Prevent cloning attacks
3	Update Firmware	Plan quarterly checks	Mitigate known vulnerabilities
4	Current Software	Ensure vendor support	Secure platform functionality
5	Monitor Systems	Use Ai-RGUS, Securithings and enterprise tools	Real-time system and device health detection

Final Note: Don’t wait for an incident to occur. Healthcare security must be proactive,  and focused on system health and treatment regimens just the same as patient care needs.  After all, patient lives depend on it.  Connect with Dylan Hayes, Security Solutions NW’s Healthcare Specialist, to collaborate and take advantage of a complimentary consult and system assessment.

Free Consultation

Dylan Hayes is a 25 year physical security technology expert and previously acted as the physical security program leader for Seattle Children’s Hospital and Research Institute. He managed teams, operations and technology that transformed the culture of safety and experience for staff, visitors and patients.  Today, he is the Healthcare Specialist for Security Solutions NW, a 120 year-old Washington based security and fire life-safety integrator partner.  He is passionate about delivering healthcare efficiencies and better outcomes for safety, security and workplace violence prevention.