'Swatting' becomes a growing concern

Swatting — the dangerous prank of falsely reporting to the police a major crisis that isn’t actually happening — typically involves hardcore video gamers or school settings, but it has also been used to target hospitals.

The name refers to police SWAT or special weapons and tactics teams, which the prankster hopes to lure via false report to the targeted site with guns drawn in anticipation of a dangerous situation like a bomb threat, active shooter or hostage crisis. For a hospital, these incidents can trigger lockdowns, diversion, evacuations or other major disruptions in the hospital’s business. 

After a falsely reported hostage situation at Northwestern Memorial Hospital, one of the largest hospitals in the Chicago area, in April 2022, a police SWAT team rushed to the hospital, triggering a several-hour lockdown of the facility. No threat was found, and police later labeled the situation a hoax. 

Bomb threats called in by telephone have been around for a long time, says Bryan Warren, MBA, CHPA, CPO-I, president of the security consulting firm WarSec Security of Gastonia, N.C. But new communication technology and social media platforms have made such incidents more prevalent and rapidly disseminated on the internet, with potential to inspire copycats.

“That’s part of the complexity of dealing with swatting,” he says. “You can get famous very quickly. And now you even have people swatting for profit, with others paying them to do it.” 

Warren, who has held a variety of positions and roles in health care security for 34 years and also is a past president of the International Association for Healthcare Safety and Security, says he is not aware of databases tracking the number of swatting incidents involving health care facilities. This, he says, is in part because hospitals are not eager to publicize that they have been a target of one, and also because the seriousness of the threats varies so widely. But it happens often enough across the country, with varying levels of legitimacy, that hospitals should institute policies, procedures and training drills to be ready for one, he says. Also, a swatting incident doesn’t have to target the hospital to be disruptive. 

“There are instances where the swatting call goes to a local school, and as part of the school’s response, it puts the hospital on alert, which will impact operations at the hospital for some amount of time,” Warren says.

Sometimes these calls are so amateurish that they may not even trigger an institutional response. 

But that’s the balancing act hospitals need to navigate, figuring out when a phone call merits a serious response or intervention. Warren recommends developing a formal facility threat assessment protocol as a guide for staff. These protocols can be built on the hospital’s existing workplace violence prevention programs, applying what it already does to these newer forms of technological attack.

Those who most often answer phone calls from the public, such as switchboard operators, could benefit from training in the hospital’s protocol and practice in how to evaluate the risk. The operators who take these calls should try to find out as much as they can about the person making the call. 

Ask the caller a number of questions to help evaluate the risk and determine its seriousness, Warren suggests. “These questions include: ‘What is your name? Where are you calling from?’” 

Operators can be coached to be careful witnesses and take good notes during the call to provide a detailed description of the incident later, including exact time, what was revealed by caller ID and any background noises.

“I’m not saying this is easy, but these are some of the things that need to be discussed in training the folks who might take these calls. Because we’re seeing this kind of crime evolve, we have to evolve with it,” he says. 

“I’d also suggest a multidisciplinary threat assessment team that’s part of the hospital’s workplace violence prevention efforts. Part of the work of this team is to determine the legitimacy of a threatening call.” 

A broadly representative team can come together on a medium such as Zoom to quickly gather the facts and, based on some established criteria, analyze the threat, categorize it and decide what to do next. “Do we need to escalate our response at this time, or limit access to our facility?” 

Warren recommends learning from other incidents and how health facilities or schools have responded to them. Finally, contact local police authorities and develop a partnership with them. 

“Work with your police department to understand these situations, and plan meaningful drills and exercises. Call them up and go for a visit, or have police staff come to the hospital for a cup of coffee.”