They were the most unlikely of escape artists – one had Alzheimer’s, the other, dementia. Yet they hacked their way out of the memory-impaired unit of the Tennessee eldercare facility where they lived. They did it by memorizing the sounds emitted by the door’s electronic security keypad used by the staff. Unbelievable, but true.
In early March of 2020, this resourceful senior duo “escaped” their locked unit by repeating the code sequence they’d overheard countless times. They punched in the right combination of beep-beep-beeps and voila! The doors opened. Fortunately, the couple was found, unharmed, strolling in the neighborhood about 30 minutes later. In describing how they did it, the husband attributed his ability to differentiate the key sounds to his training in Morse code when he was in the military.
The Tennessee Board for Licensing Health Care Facilities fined Elmcroft of Lebanon $2000, and the facility has since changed all its access codes. Problem solved? Hardly.
This type of security breach, more common in the world of cybersecurity than physical security, is known as a “side-channel attack.” In this case, the husband in the escape used leaked information – the sound emitted as each key was pressed – to deduce the code. There are plenty of other ways that access control systems can fall short. Keypads, fobs, even smartcards, and mobile credentials can be misused and abused to allow access to unauthorized individuals.
Usually, we think about using access control to keep the wrong people out, but the Elmcroft episode is a stunning example of the opposite – the importance of secure access control to keep the right people in. This is a common challenge for certain medical and healthcare settings.
Memory-care units, acute mental health facilities, involuntary substance abuse rehab programs, maternity wards … all are examples where access control of exits is critical. These facilities face tremendous liability if patients, residents, or newborns leave without permission. Even if nobody gets hurt in these breaches, the cost of legal challenges from angry family members can be crippling. Elmcroft got off extremely easy!
For healthcare facilities grappling with this challenge, replacing traditional credentials with a biometric identity system is a proven solution. For example, Brevillier Village, a non-profit senior-living community just outside Erie, PA, makes use of iris biometrics to allow its memory-impaired residents to mingle with unimpaired residents in common areas. The majority of the facility’s residents and staff may come and go freely by glancing at biometric readers positioned near certain doorways in the building, while those with dementia or Alzheimers cannot. The system does not recognize their irises. This solution creates a seamless, open environment for most residents, while the restricted, impaired residents still benefit tremendously from daily social interactions with the community’s general population.
Unlike the Elmcroft fiasco, at Brevillier Village there is zero chance that an unauthorized resident could “outsmart” the system. Furthermore, the lack of keycodes or fobs makes it much easier and convenient for everyone who is authorized to move about. There are no codes to remember or fobs to carry. From an administrative perspective, once residents and staff are enrolled in the database, the system requires minimal effort to manage. There is never a need to replace lost cards or routinely change the keypad code for security purposes. New residents are easily added to the biometric database as they move in, and their permission status can be changed should their mental functions deteriorate. Furthermore, if a resident’s whereabouts must be tracked, the system provides an accurate log of who has passed through the secured doorways.
The benefits derived at Brevillier Village have wide-ranging applications in other healthcare settings. For medical staff who routinely enter and exit secure areas of a hospital, iris biometrics can be read while wearing a mask, and are hands-free and touch-free. For doctors who spend time at multiple facilities, biometric access control eliminates the need to carry multiple credentials. Ideally, hospitals and care sites within a network can share an identity database, but even if they don’t, the seamless experience for medical staff is the same. They glance at a reader and the door opens.
In maternity wards, registering the biometrics of mother and partner at the time of admission simplifies the ability for the partner to leave and return to the secure ward. It can also serve as a safeguard during discharge to ensure a newborn is with the correct parent. This is particularly important if the baby is ready to go home before mom.
In facilities where patients are involuntarily committed, biometric access control is the most secure method for keeping residents contained. Family members who are allowed to visit can be enrolled in the system, with permissions set so that they can enter and exit during pre-approved hours. Biometric credentials can eliminate the need for them to register each time they arrive. Their visits are automatically logged as they glance at the iris camera. In addition, such a solution allows staff members to open doors hands-free while physically escorting patients in and out.
The conditions leading to the Elmcroft security lapse were highly unusual. The keypad technology in use was truly antiquated. Security keypad buttons haven’t made unique sounds in a long time. Where such devices are still in use, few people would have the auditory skills necessary to translate the sounds into numerical equivalents. And, most Alzheimer’s and dementia patients can’t remember what they had for lunch, let alone an access code. That said, there are still valuable lessons to be learned for the healthcare community at large. Access control systems at healthcare facilities should be carefully evaluated, not only for their ability to provide safety and security but for the experience they provide to those who use them. Changing the code at Elmcroft every week would have been a hassle for management and the staff, so they got lazy. Security suffered as a result. By integrating biometric identity as part of an access control solution, both security and convenience are maximized without compromise. As Brevillier Village demonstrates, it’s an option more healthcare facilities should be considering when their mission requires keeping patients or residents physically onsite.
