Managing points of access

In recent years, hospital leaders have taken a closer look at ways to control access to their facilities for decidedly different security purposes.

To better enforce supply chain protocols, reduce costs and improve patient safety, many organizations began more clearly defining policies about direct vendor access to surgeons in the OR and how to optimize credentialing protocols for vendor sales representatives.

At the same time, many health care organizations started taking a harder look at how to best manage visitor access at all hours in a way that would ensure patient and staff safety while still providing loved ones the ability to visit patients freely.

What hasn't been well-known as these events have unfolded is what specific strategies, policies and technologies hospitals and health systems have put in place to try to deal effectively with these two unrelated, yet often complex, security and policy matters.

So where does the industry stand today?

Tighter control over vendor and visitor access is becoming the standard among hospitals, according to the first-ever survey of Health Facilities Management and Hospitals & Health Networks readers on this topic.

The online survey, completed by 824 respondents across all 50 states (13.1 percent of those polled), revealed that nearly 86 percent of respondents have a formal vendor credentialing program. Of the 14 percent of respondents without a formal program, 35 percent said they would very likely or somewhat likely be implementing one in the next 12 months. Only 30 organizations said they had no plans to implement such policies.

"When looking at vendor access, it is a cost-control issue and a quality issue," says Dale Montgomery, vice president of support services for Hays (Kan.) Medical Center and a survey respondent.

Compliance was the biggest driver in setting formal policies around vendor access, according to respondents. Sixty-three percent of those with a vendor credentialing policy cited compliance with Joint Commission and/or Centers for Disease Control and Prevention as primary drivers. And nearly 56 percent said compliance with laws and regulations was a primary driver.

The Joint Commission requires hospitals to identify individuals entering facilities and their purpose (under EC.02.01.01, Element of Performance No. 7). However, the Joint Commission leaves it up to hospitals to determine the details of identification. The standards-setting organization has additional expectations for nonlicensed, nonemployees who have a direct impact on patient care, such as health care industry representatives. These expectations include making sure infection control and informed consent protocols are followed and that patient safety and patient privacy are protected.

"Like many Joint Commission standards, you have to have a plan in place and follow that plan," says Tim Adams, FASHE, CHFM, CHC, director of leadership development at the American Society for Healthcare Engineering, which participated in the survey research along with the Association for Healthcare Resource & Materials Management (AHRMM). IntelliCentrics, Flower Mound, Texas, sponsored the survey.

Tighter supply management

Supply chain management was also a big driver in setting formal policies on vendor access, according to the survey. Half of respondents with vendor credentialing policies — more than 400 organizations — cited supply chain management as a primary motivation in setting vendor credentialing policies.

In comments, some respondents said formal policies mean that vendors have more limited access to physicians to sell products not first vetted by materials management. Others said that the policies meant fewer products brought into operating rooms without prior approval. Another respondent cited a more effective product recall process as a benefit.

Hays Medical Center requires vendors to call ahead to the materials management department before entering the facility. The medical center uses a vendor management software program to track preapproved vendor check-ins and check-outs and obtain temporary ID badges. Vendors who are at the facility frequently must be credentialed, which includes training on patient privacy laws and regulations. If vendors don't comply with the rules, that information can be entered into the vendor access management database and vendors can be denied access.

The policies "give us the ability to negotiate prices through the supply chain," says Montgomery. "We can do evidence-based research on products and then make purchasing decisions based on cost and quality."

These discussions happen at monthly continuous quality improvement committee meetings. "It allows everyone to have input before making a purchasing decision," Montgomery says. That is a big change from the days when vendors could walk into the facility unannounced and cut deals with individual physicians. "In the distant past, they could go to a physician and that physician would order something for one procedure," he adds. "The item would then come into the loading dock and we would have no idea where it was supposed to go."

For many other hospitals, supply chain management seems to go hand-in-hand with patient safety when it comes to crafting policies on vendor access. More than half of respondents with vendor policies in place cited patient safety and privacy and a safer environment as primary motivations in instituting formal policies on vendor access.

There's a careful balancing act when it comes to hospital access, says Florence Doyle, vice president of strategic sourcing at CHE Trinity Health, an 82-hospital Catholic health system based in Livonia, Mich., with a divisional office in Newtown Square, Pa. Doyle is also an AHRMM board member.

"One of the challenges of a hospital environment is you have to control your access, but it is a public place, in essence, and there are a lot of people coming in and out," Doyle says.

She adds that "vendors need to be managed, recognizing that we live in a world where there are many vendors, and business relationships are key."

Administering policies

Catholic Health East and Trinity Health merged on May 1, 2013. The new organization, CHE Trinity Health, operates across 21 states. Between the two legacy organizations, access is an area that will have to be reviewed.

In contrast, Intermountain Healthcare, a 22-hospital system based in Salt Lake City, has standardized vendor and visitor access policies, says Brent Johnson, vice president of supply chain and support services. Johnson is also an AHRMM board member. A centralized system works for Intermountain, because it allows for clear communication with staff and vendors about policies throughout the organization, he adds.

Policies around vendor and visitor facility access were almost evenly split between the corporate/system level and individual level, according to the survey. While 45 percent of respondents said these policies are created and enforced at the corporate/system level, 44 percent said they were created and enforced at the individual hospital level. Vendor credentialing policy development was split slightly less evenly (44 percent at the corporate/system level compared with 32 percent at the individual hospital level).

Popular components of vendor credentialing included: HIPAA training; immunizations; competency; liability insurance; and national criminal background checks. More than half of respondents (53 percent) used a third-party credentialing company, while just 14 percent of respondents said they created their own credentialing program. Half of respondents said they relied on other hospitals when crafting their policies.

Larry Higgens, regional director of supply chain for the Premier health care alliance, represents eight hospitals in Eastern states. He says that the contracting credentialing service ensures that vendors have the proper requirements to enter individual facilities, such as annual flu shots and HIPAA training. The credentialing service is integrated with vendor access software programs so hospital staff can see right away if a particular vendor is up-to-date on his or her credentials.

"You've got to control who is coming into your house," Higgens says of vendor access. "It protects the hospital."

Having an assigned point of contact for vendors is a key component for nearly all hospitals in the survey, with 91 percent saying they have this policy. Other common policies included formal check-in and check-out procedures; written standards and policies; internal compliance programs; and staff training on enforcement.

But nearly 250 hospitals reported no formal check-in process for nonvendor visitors (35 percent of respondents). A little more than a quarter of respondents required check-in at all hours for nonvendor visitors and another one in five required check-in but only at certain times. Meanwhile, the process for nonvendor visitors also varied widely. While 39 percent of respondents issued a temporary pass or badge, another 35 percent required sign-in at registration and 16 percent required visitors to show photo IDs, according to the survey.

It's not surprising to see such variation across systems and facilities, says Adams of ASHE. "All organizations need to be mindful of security and risk," he says. "But there are differences depending on location, geography and size of the organization."

A small hospital in a tightly knit rural community would naturally have different policies around visitors than a large urban center, he says. "I've seen facilities where anyone from the outside community sticks out," he adds.

Policy matters

The type of organization also matters when crafting policies and procedures, some interviewed said. For instance, Jack Hughston Memorial Hospital in Phenix City, Ala., is a physician-owned hospital. Dave Welch, director of materials management, says physicians have close and long-standing relationships with vendors, and its vendor access policy was revised about two years ago with more enforcement mechanisms.

Most vendors require an appointment to gain access to the facility and must check in with the front lobby as well as check in and out with the vendor management kiosk, Welch says. However, a select few vendors have a special photo ID badge similar to staff badges and are not required to have appointments or check in at the front lobby. There are 12 individuals with this elite status and they are typically at the facilities on a daily basis and require 24-hour access. They have gone through vendor credentialing and have signed contracts with the hospital and primarily require access to the operating room, Welch says.

Enforcement of vendor policies is a hot topic, according to those interviewed for this article. More than 200 organizations in the survey described implementation and enforcement of vendor credentialing policies as a "major challenge." And 72 percent of respondents said vendors "usually" comply with policies, while just 10 percent checked "always" for compliance. Another 14 percent said compliance happens "half the time."

Johnson says the Intermountain system has a 95 percent compliance rate from its 2,100 vendors registered, largely due to formal check-in policies, staff training and communication. "Our own employees will question people walking around without badges," Johnson says. "They are our best enforcers."

Montgomery of Hays Medical Center says the facility has a two-strike policy banning vendors who don't comply with check-in and credentialing policies more than once. Higgens of Premier says his hospitals have a "donation" policy where unapproved medical devices and other equipment used at facilities won't be reimbursed. "You only have to do that once or twice for people to get the message," Higgens says.

Enforcement depends on everyone being on the same page, those interviewed say. "You've got to make sure all stakeholders understand the 'why' of it," says Doyle.

Rebecca Vesely is a freelance health care writer based in San Francisco and Suzanna Hoppszallern is senior editor of data and research for Health Facilities Management's sister publication, Hospitals & Health Networks.