Category Archives: Threat Assessment

Why Bother with a HIPAA Risk Analysis Anyway?

People tell me all the time that their management doesn’t want them to do a risk analysis, even if it’s a requirement.  Sometime they say that they have no budget
to fix anything – so why bother?

Even if it’s a requirement, like new workplace violence assessments, or a federal law like the required HIPAA risk analysis, there are people who want to do it in 30 minutes in a spreadsheet, without conferring with other staff members, without bothering to do a walk-through of the facility, without management’s enthusiastic support.

Here is a list of good reasons to do a Risk Analysis for HIPAA, even if you are not sure about whether you need it or not:

1.   It’s a Federal law.   It’s possible that no one will know if you don’t do it, but
      what if you have a MassGeneral-style data breach next week?

2.   It saves the organization BIG BUCKS, by doing the cost benefit analysis so
      the IT department can implement controls that actually increase protection
      AND reduce potential threats at the same time.

3.   A Risk Analysis acts like a security awareness training program if you
      involve the entire hospital or healthcare staff.  Many times they aren’t
      aware of the policies and procedures, and having them answer the
      HIPAA compliance surveys is a great no-cost refresher cost.

4.   You can uncover REAL vulnerabilities and fix them right away.  For example,
      you may not know who’s taking your database home on their unencrypted
      laptop.   You may not know that only 20% of the hospital staff took time to
      take the online training!  This lets your IDENTIFY problems and FIX them.

5.   It instantly makes the security analyst/information security officer the
      SMARTEST person in the room.  You know understand everything about
      protection of medical records in your organization!

6.   Regulators are getting CASH BONUSES for finding problems.  Don’t let
      them vacation in the south of France because they found a vulnerability
      in your IT systems!

Start your risk analysis today – and I will make sure YOU get all the credit!

Obesity is Being Subsidized by Federal and County Governments!

Chris Christy is a guy who looks like he is heavy enough to be pre-diabetic, must have high blood pressure, probably high cholesterol, too.

We all know what this fat-syndrome looks like.  Michelle Obama knows, with her emphasis on reducing childhood obesity.  Jamie Oliver knows with his effort to make school cafeterias healthier.

Here’s the DISCONNECT – the federal government is subsidizing unhealthy, bad food that contributes to our national health crisis.  Did you know the government INVENTED high fructose corn syrup to help farmers.  

Local city and county government subsidize bad food in their school cafeterias because it’s easier to let McDonalds make the food, then the ‘cooks’ don’t actually have to cook, just heat up the pre-packaged food.

Watch TV shows like THE BIGGEST LOSER, and see how being overweight causes emotional problems, as well as health problems and you can just go to the local mall to see how prevalent the problem.

It’s SO EASY to eat healthy and get healthy but this healthy message is drowned in government fundings for beef producers, cattle barons, pork producers, chicken farmers and even the salt lobby.

Yes, the SALT LOBBY wants the government to stop telling people they are eating too much salt and to stop setting healthy limits.

I think this country is ready for a nutrition revolution – don’t eliminate the unhealthy choices, but don’t subsidize them!  Take away their free money and food will be right-priced and the country’s energy can go to teaching people about eating healthy.

This is such a frustrating mess, energized by my own lifelong battle with weight –
that some days I want to just walk around the country, door, to door, doing personal health risk assessments – showing people how to eat and cook healthier!

The SALT LOBBY?  Give me a break…

OSHA Starts New Enforcement Initiative for Workplace Violence Issues

On September 8, OSHA issued a new directive about enforcement activity on workplace violence issues.  This directive (CPL 02-01-052) takes effective on Sept. 8, 2011 and is called Enforcement Procedures for Investigating or Inspecting Workplace Violence Incidents.  It details new procedures for the OSHA inspectors, but it is also a valuable document to show employers what they can expect.

The directive follows the shocking news that in 2010, 18% of workplace fatalities were caused by assaults and violent acts, while only 14% were caused by falls, according to the Bureau of Labor Statistics.

Workplace violence incidents are even higher in the hospital and healthcare industries.

The new inspection directive shows how OSHA inspectors are going to look at employers to see whether they have performed a workplace violence analysis.  These assessments follow the security risk assessment model and should take into account the threat level at the organization, the history of incidents and examination of trends, and whether ‘accepted’ controls have been implemented at the place of employment.

Some of the ‘accepted controls’ they will be examining include:

  • Having a recent workplace violence analysis
  • Having a formal workplace violence training program in place
  • Showing the employer had incident reports to identity possible threat levels
  • Methods the employer used to inform employees of the risk of workplace violence
  • Evidence the employer has a workplace violence prevention plan in place
  • Evidence the employer has a current security plan
  • There are also a set of recommended physical controls that include proper lighting, cameras, curved mirrors, etc.

For more information, or a copy of the document, email info@riskwatch.com.

Playing Footsie with the Haqqani Crime Network

I am a risk analyst and risk assessment expert, certainly not a diplomat.  In fact,  my friends might say I am probably really un-diplomatic most of the time.  I like the direct approach.

But watching the U.S. State Department and the Obama administration playing footsie with the Haqqani network in Afghanistan and Pakistan is worse than enduring waterboarding.  What a waste of American dollars — paying off these criminals to finance construction projects that Americans are doing to build up Afghani infrastructure.  

I have watched for years as the U.S. State Department props up brutal dictators, only to see them toppled overnight.  Of course, Mubarak and Quaddfi come to mind right away.

But to try and win a WAR, while paying off criminals and murderers who are launching attacks on our embassy, letting them run our relationship with Pakistan, is just wrong.

What has this got to do with risk assessment?  PLENTY – because the problem here is large amounts of unaccountable cash.  Cash passed out by the State Department, USAID and the intelligence services, theoretically, to ‘grease’ the skids and get something done, but instead, these wholesale PAYOFFS just finance and empower our enemies, while ruining the U.S. reputation and maddening the citizens who provide this money in the first place.

I would vote for anyone who could put REAL ACCOUNTABILITY back into the U.S. spending abroad.  As the Arab spring proved — this kind of diplomacy never works!

How to Correctly Analyze 100-Year Threats for Risk Assessments

Starting a risk assessment in northern Virginia and going through the threat list they say, “You can take earthquakes out – we don’t have earthquakes here”!

Hey, Haiti didn’t have earthquakes!

Vermont didn’t have major floods!

Connecticut doesn’t have tornados!

Like Murphy’s Law, as soon as you discount a threat, and think, “it will never happen here”, it happens!   The earthquake in the mid-Atlantic in August was a wake-up call for those who that they would never have earthquake damage.

One of the reasons that security risk assessment is so highly valued as an analytical took, and why it’s required by so many governments is because it DOES take into account the 100-year flood, the 75-year drought, etc.

Natural disasters can be so overwhelming, and catastrophic, that they must be considered in any proper risk assessment.  This is why some areas are not suitable for building housing tracts, because they are in a 100-year flood plan.

Because human memories are short, just because YOU haven’t experience a flood
along a meandering creek, doesn’t mean it will never happen.  

Always check the long-term probabilities when you start a risk assessment and make the numbers work for you!

Did the 9/11 Tragedy turn us into a nation of mega-consumers?

or  Why 9/11 Turned us into a Nation of MegaConsumers 

Thinking about 9/11, even AFTER the big 10 year anniversay, made me think about what has happened to the United States after that day….. and one thing I thought about was the Wall Street meltdown.

Those traders who unintentionally (giving them the benefit of the doubt) caused the giant bubble, overvaluing of everything, worked right down on Wall Street.  They were probably greatly affected by the 9/11 disaster.   They saw it, they walked by the hole in the ground every day.  Maybe they just over-reacted, too.

WE were all traumatized, so when the President said the best thing we could do for the economy was to go out and SHOP – that was just what we needed to hear.

Drawing on my background in cultural anthropology to analyze human nature,  I think that 9/11 turned us all into hoarders.  We all suffered a terrible loss – not just the people lost, but our loss of our sense of security, and whenever there is a loss – there is a tendancy to fry and fill out the loss with something else.

Do you think it’s a coincidence that the last 6 years have launched over 5 shows about hoarders, both hoarding  possessions, and even animals!  I think that the over-consumption of every material thing, and the hanging on to consumer goods might be
a symptom of our national loss.

After 9/11, I just wanted to stay home and feel safe again in my house.  So I finished the basement, I added a sauna, I redecorated the whole house, I re-tiled the bathroom,
I added a whole-house fan, I re-tiled the pool…… maybe there is a relationship between the giant home improvement boom and attempt to recover from 9/11.  

Maybe it was a gigantic, nationwide nesting reaction to the terrible tragedy. 

We all did what we needed to do to feel safe again.  And safety begans at home.  So we needed to re-finance to get the cash to fund the improvements.    It is possible if you think it over and connect the dots, maybe 9/11 explains most of the things that have happened in the last ten years.

In life, we can’t control what happens, but what we do after the event is what defines us, and 9/11 was certainly a defining moment for us all.

Remembering the Tragedy of 9/11

Today is the 10th Anniversary of 9/11.  Like most other Americans, like the Kennedy assassination so many years ago, the memories are indelibly burned into my soul.

On September 11, I was flying to a conference in Chicago, so I got up at 5 am to catch the 7:45 plane from BWI to Pittsburgh.  I was on the next plane to Chicago and it boarded at 9:35 and pushed out onto the runway.  I was waiting for it to take off when my cell phone rang and it was my son, Michael, who said, “They flew a plane into the Twins Towers in NYC”.   As a security professional, I knew what that meant.

After a confusing 15 minutes, the plane went back to the gate, and they told us the flight would be delayed for 6 hours, but as we walked off the plane, the man next to me got a call on his cell and said, “They hit the Pentagon”.

There was a hotel at the Pittsburgh Airport so I immediately ran over there and checked in because I knew there would be no planes leaving today, I noticed the huge crowd at the bar, watching the TV.   My brother worked in NYC, my sons and friends were in DC, so the phone lines weren’t working, but I signed on to AOL and was able to connect with them to say I was all right.  

They evacuated the airport, but I was up in my mini command center by then.  I must have gotten 400 emails that day and I was watching the coverage on TV and crying, and then I heard about United Flight 93.

It took me about 2 days to get home.  A friend DROVE from the conference in Chicago to Pittsburgh and picked me up at midnight on 9/11.  We drove together through the Appalachian mountains to her home south of Philadelphia.  She had small children and wanted to get home fast.

We arrived at about 9 am on 9/12, after driving all night.  I slept for 4 hours on her son’s bed, and then her husband took me to the Amtrak station at Wilmington and I took the train back to BWI. It felt like I was moving through a bad dream.

Next, I tried to get my car, which was in the parking structure by the terminal, but it was blocked and they said I wouldn’t be able to get my cars for several more days, so I took a cab back home.

I remember driving up my street and seeing the American flags on houses, and I remember thinking about why I didn’t know all these neighbors and how I would change that in the future.  I remember how blue the sky was, not a cloud, not a plane.  It was surrealistically quiet.

I know several people who were killed in the Pentagon, and many in NYC who were dramatically affected, including the children in the NY suburbs who got called out of class one by one, to hear that their father, or mother was gone.

My theory is that people who lived on the west coast didn’t feel the impact quite as much as we did – who had been to the Pentagon every week, and been in the Twin Towers.

A friend of mine in San Diego who was proud of not having a TV, and who got up early that morning to order a sheet set on QVC.  She was in the middle of her order when the operator started crying and could not continue – she kept telling Kathy, “please turn on the TV and call back tomorrow”.

Just for me, I think I am permanently damaged by what happened on 9/11, and I think the whole country shares a continuing sorrow and grief from this event. 

We won’t let it happen again.

Should Hospital Staff Brings Guns to Work with Them?

Should hospital staff bring guns to work with them?

At a time when many hospital security departments have unarmed security officers, and some departments don’t even allow the use of mace, changes in state laws allow hospital staff in some states to bring their guns to work with them.

This turn-around, where the nurses may have guns – and security officers do not, has created a big, contentious debate in the security community.

In a recent paper printed in the Journal of Healthcare Safety and Security, my co-author, Jim Sawyer and I discuss the different elements of this debate and whether this is a constitutional issue, or a real threat-risk issue.

Here’s an excerpt,

Violence is not a concept that people usually associate with hospitals.  For years, hospitals have been seen as almost a sanctuary of care for the sick and wounded in our society.   However, the perception of hospitals has been changing over the last fifteen years due to a variety of factors.

or you can read the entire article (below). 

Critical Issues on Gun Violence in the Hospital Workplace

By James Sawyer and Caroline Ramsey-Hamilton

 Background

 Every reader knows that violence in hospitals is increasing at an increasing rate.  The Joint Commission has issued Sentinel Alerts, the Journal of the American Medical Association, the bastion of the American healthcare system, published an article in October, 2010, written by two doctors about the murder-suicide at Johns Hopkins Hospital in September of 20101.. 

This article started as a guest blog from a security professional at a west coast children’s hospital.  After the blog appeared, we received dozens of notes, letters and angry outbursts, as well as emails arguing for a more reasoned approach.  This article will explore those issues, and includes quotes from the emails themselves.

Why Violence in Hospitals is Increasing

Violence is not a concept that people usually associate with hospitals.  For years, hospitals have been seen as almost a sanctuary of care for the sick and wounded in our society.   However, the perception of hospitals has been changing over the last fifteen years due to a variety of factors.

  1.  Doctors are no longer thought of as “Gods”.  This means they are
          are more easily blamed when a patient’s condition deteriorates.
     
  2. Hospitals are now regarded as businesses.  This perception has been
           been aggravated by television in shows like a recent “60 Minutes”, as well as
           by the effects of the recession on jobs and the loss of health insurance.
  3. Lack of respect and resources (funding) for hospital security departments
       .  Rather than being seen as a crucial protection for the hospital staff and
          patients, many security departments are chronically underfunded and used
          for a variety of non- security functions, such as making bank deposits for
          the hospital gift shop. 

A Dirty Little Secret about Reporting
The U.S. Department of Labor tasks OSHA with workplace violence information, but there is not one sanction against it, it says right on the OSHA web site that this is solely left up to the employer.  It makes it hard for hospitals to justify spending money on workplace violence prevention, if it is not a standard, and a major compliance issue (as it should be).  And here is a dirty little secret for looking at the statistics, OSHA does not count domestic incidents (like homicides) that take place in hospitals as officially “workplace violence incidents”, instead they are counted in another system.  Similarly, many hospitals don’t count staff to patient violence incidents, or patient to patient incidents.  These practices create a false impression of the actual number of violent incidents, by reporting only a fraction of the actual events.

 Gun Violence Represents a Significant Security Challenge

The prevention of gun violence in hospitals and the hospital as workplace may well be the most challenging issue for hospital security professionals in the foreseeable future.  What are some of the reasons for this growing concern?  There are many and they include:

 1.   The sheer numbers and easy availability of guns.  There are over 270 million guns in circulation in theUnited Statesand the numbers continue to grow.  After the 2008 election,  gun ownership surged and in some areas of the country, guns sold at such a pace that retailers literally ran out of ammunition. 

2.  Approximately a 100 people a day die from gunfire in the United States and an individual is shot approximately every twenty-two seconds.

3.  One in four Americans suffer from some form of mental illness, according to the Federal government. 

 4.  The U.S. is living in an era of economic instability, following the 2008 recession and the erosion of the middle class.  The Wall Street-triggered economic meltdown has propelled what was a slow steady decline into economic apocalypse for millions of Americans.  This has resulted in an environment of record home foreclosures, record personal debt, record banktupcy, record unemployment and record numbers of homeless individuals.

5.  The reluctance on the part of many hospitals to install magnetometers and limit entrances to hospitals so that the flow of guns into hospitals can be controlled.

The U.S. gun lobby has been very successful in pushing and supporting state legislation which permits guns in the workplace, and on college campuses.

It is a serious mistake for security professionals to deride,  make light of, or dismiss this surge of pro-gun-at-work-and-school legislation.  These laws are getting passed (see Texas, Indiana, and Tennessee), and the likely result is that we will see an ever greater numbers of guns at work, and if our work is in the hospital, then the guns will be coming to work here, too. 

Guns aren’t just increasing in numbers, but they are getting more lethal and currently 30- shot clips and armor piercing bullets are readily available for the civilian population.  Citizens can now buy weapons that rival what is found in military armories.   These lethal weapons again present a sentinel challenge to security professionals.

 Most security directors remember life when Space Invaders was the only video game around.  Now children are exposed to violent images from a very early age.  Children and teenagers sit entranced watching endless hours of violent programming where gun violence is choreographed in slow motion action scenes where the scripted hero’s miraculously avoid injury even while they are dispatching the prime time  villains while showcasing their amazing gun prowess.  

By the time they show up at your hospital, the average child over 18 years of age will have viewed over 45,000 murders and 200,000 acts of violence just on television! This grim tally does not account for the high octane bloodshed and slaughter that make up the majority of the most popular video games.  

All of these factors suggest that the prevention of gun violence in our hospitals will become our premier challenge.  Many hospitals are already hosting ‘active shooter’ seminars to teach hospital staff how to deal with  “shooters in the workplace”.  This subject promises to become a cottage industry for consultants and violence prevention professionals.

As hospital security professionals, there are some strong, prevention-based practices that we can implement and develop that drastically reduce the chances of gun violence in the workplace.  Some of these best practices include:

 1. Acknowledge the reality and the persuasiveness of the U.S. gun culture.

 2.  Develop a strong, multi-department workplace/domestic violence response team at your facility, and make sure that both Human Resources, and Security are part of this team.

 3.  Develop a written workplace violence plan that is reviewed annually.

 4.  Do an annual  baseline workplace violence assessment that you can build on.

 5.  Have your workplace/domestic violence response team respond and meet within 4 hours of any  reported incident.  Have a response plan/action plan in place within 24 hours.

 6.  Encourage reporting of all workplace/domestic violence incidents to the police – without exception.

 7.  Run background checks of individuals of concern.  Information is light and a background check may provide you with crucial information. Obtain orders of protection – anti-harassment orders against individuals of concern.  Security should take the lead here.

 8.  Flag problem patients – problem families – have a “red alert” or a “red flag” program that alerts – tips off – advises both the care team and security that a potential problem exists.  This is especially important if the patient/family member has a history of violence.

 9.  Build a workplace culture where verbal threats are reported.  Have Security immediately investigate all verbal threats.  Make sure that Human Resources is fully informed of any situation involving threats.

 10.  Post  large, prominent“No-Weapons” signs at your facility – especially in parking lots, perimeter areas and all main entrances.

 11.  Officially prohibit staff from bringing firearms to work.

 12.   Offer annual violence prevention and threat awareness training to all staff.

 13.   Require workplace violence training – either on line or via classroom training for all new staff and annual retraining.

 14.   Have security involved and part of the planning for all “problem” terminations.   Note – Advise Human Resources to never terminate a disgruntled staff without strong pre-planning.

 15.  Screen all hospital patients and visitors.  Develop a major entrance screening program for your institution.  Knowing who is inside your facility is a critical part of any good prevention program.

 These pro-active solutions  will support and enhance a hospital gun violence prevention program.  Let me state again, it is critically important to have a hospital gun violence prevention program in place.

 AND IN RESPONSE

 Here are some of the comments that were received by other hospital security professionals around the country, after the original blog post.

 “Please remove me from your mailing list immediately.  Apparently the letter below blames the firearm and not the person holding it and putting 5-7 lbs of pressure on the trigger with their index finger.  I find it difficult to separate the “Spirit of the Security Community and our commitment to safety and protection” from this attack on my Second Amendment rights.”               

                                                           — Hospital Security Director in the Northwest

“I believe we should focus our attention, and when I say attention I actually mean money, on mental health resources (or the lack there of) and domestic violence issues, which quite often lead to fatal shootings.  Our emergency rooms have become a revolving door for patients with drug abuse, depression and other psychological issues and there appears to be very little our legislators and community/government leaders are doing about it.  To me, that is the real injustice and crime related to the firearm issue!                                              
                                                                   — Hospital Security Director in the Midwest

 “I would agree with the individual that I don’t believe there is a place in hospitals, government buildings and places of worship for guns; however if there had been guns on some of the college campuses, maybe there wouldn’t of been the blood baths they turned into.                                                       
                                                                –  Security Analyst – Washington DC

“As for firearms being banned from the workplace, I agree.  Policies and procedure should dictate along with a severe disciplinary, then handle accordingly.  Just that simple.”
Let’s clean it up, let’s clean up America!  Let’s lessen the need for firearms to be in the hands of thugs as well as those who just want to feel safe.    The FIRST STEP would be to BAN and make it ILLEGAL for businesses to sell paraphernalia, pornographic anything, strip clubs, places that promote alcohol and drug use, etc. 

Let’s Clean That Up!  …something that is tangible and promotes drug and alcohol use as well as many other criminal actions just to run these types of businesses.  Let’s make that illegal.  Let’s get Americans involved in the real issues of illegal firearms and drugs coming into this Country.    All law enforcement know that it takes big money to keep drugs coming into this Country.      Disarming America. RIDICULOUS.    Keeping firearms away from the workplace, understandable.

                                                    — Ex Army, Ex-Police, Hospital Security Officer

 

 Conclusion
While the issue of “gun control” is both a “hot button” and simultaneously,  a topic that is seemingly a forbidden or taboo matter for hospital security professionals.  It should not be this way.  Questioning the wisdom of allowing citizens to buy 30-round clips for semi-automatic handguns and keeping assault rifles at home is not a crazy liberal rant, it is a reasonable, non-political position.

Challenging the wisdom, if not the sanity, of the current flood of legislation that both allows and actually encourages guns in the workplace is neither “liberal” or “radical” – but pragmatic and grounded.   Hospital security professionals are the vanguard for progressive crime prevention education and development in the United States.  This is a mandate and responsibility that we all share.  How we respond and learn to protect our staff, our hospitals and our patients from this senseless violence may prove to be our greatest and most important challenge.

 www.riskwatch.com               www.caroline-hamilton.com

Is $7000 Enough of a Fine for a Young Girl’s Murder?

OSHA workplace safety officials have fined the organization that runs a Revere group home, where a Peabody mental health worker was stabbed in January, for not having adequate safety measures in place despite high probability of an incident occurring.

The Revere mental health clinic where Peabody caseworker Stephanie Moulton was stabbed in January as fined $7000.00 by OSHA for not having adequate safeguards against violence in place for employees at the clinic. OSHA cited the facility for “a serious violation of [OSHA’s] ‘general duty clause’ for failing to provide a workplace free from recognized hazards likely to cause serious injury or death.” 

Moulton, 24, died from her stab wound inflicted by a patient, 27-year-old Deshawn Chappell, after he fled the group home, taking her with him and then dumping her body behind a church in Lynn. Chappell, who had a history of violent behavior, attacked Moulton during a counseling session.

The fine is a piddling amount, but the damage done by the fine is much worse. Because the organization was directly fines by OSHA, that gives the victim’s family solid grounds for a lawsuit for negligence, and they can quote OSHA, that they “failed to provide a workplace free from recognized hazards likely to cause injury or death”.

It will be interesting to see if a lawsuit develops, and if the organization puts stricter controls in place to protect staff members.

OSHA and the Joint Commission have reported for several years that violence against healthcare workers has steadily increased, and the Joint Commission even issued a Sentinel Event about the increase in violence.

7 Hot Weather Tips for People & Pets

Seven Tips to Reduce Heat-Related Health Problems

I grew up in southern California without air conditioning!  I used to jump in the pool and sleep in wet pajamas with a fan running to stay cool. 

And don’t forget to give your pets the care they
need during hot weather!

The best defense is prevention. Here the top 8 tips for coping with hot weather.

1.  Drink more liquids (not alochol) and drink more all day, not just
     when you feel thirsty.

2.  Don’t drink alcohol or sugary drinks – they cause you to lose
     body fluid.

3.  Stay indoors in air conditioning.  If you don’t have a/c, go to
     the library or the mall.  And bring your pets into the air
     conditioning, too.

4.  Cool off with water, take a cool shower before bed.  And make
     sure pets have plenty of cool water, too, add ice to their water
     dishes.

5.   Wear white, or light-colored clothing that doesn’t absorb the heat, it will
      reduce insect bites, too.

6.   NEVER leave children or pets in a closed vehicle during the summer and
      especially during a heat wave.

7.   Reduce strenuous outdoor exercise until the heat breaks.