Security in Hospitals & Healthcare Facilities

Introduction

All over the world, high-profile violent incidents in healthcare facilities, schools, malls, governmental offices & social gatherings heighten awareness of the possibility of violence in virtually any setting. It is practically impossible to anticipate & mitigate potential acts of violence when there is no single variable capable of predicting violence.

Not many people are aware that the largest hostage-taking event in modern history occurred inside a public hospital. Launching "Operation Jihad" in 1995, 142 Chechen & Arab militants held 1,648 hostages - doctors, nurses, patients, visitors & security personnel - at a hospital in Budennovsk, Russia.

Healthcare Facilities

Hospitals are places of healing, secure places to recuperate & recover from illness. Unfortunately, hospitals have also become prime targets for crime. This includes opportunistic criminals, staff who see no wrong in helping themselves & experienced criminals who see healthcare facilities as soft targets.

Hospitals are open to the public 24/7 & usually have multiple entrances, meaning that the identification & baggage of visitors is almost never checked or screened. Hospital staff have been conditioned to allow scores of people from all walks of life to enter unchallenged. This leaves hospitals open to attacks by the criminally inclined.

Hospitals typically include multiple or isolated buildings, high-risk patient areas, remote parking decks, rotating/unusual shifts with varying levels of security & protection. Hospitals contain highly sensitive patient information, narcotics, expensive equipment & other resources that make them attractive & vulnerable. Overworked staff are responsible not only for protecting themselves, but also for protecting the lives & safety of patients who are unable to take care of themselves due to illness or injury.

The shortage of trained manpower makes it difficult for hospitals to provide decent security to protect their assets & most importantly, the people who work there & those who come for medical assistance. As a matter of fact, most hospitals have little or no reasonable means of protecting employees, visitors or patients from armed attack. Escape from armed assault is almost impossible in long hallways & passageways.

Patient safety is of paramount concern for regulatory agencies. Written plans, proactive risk assessments, controlling access to & from security-sensitive areas as well as protecting the sick & vulnerable are among the requirements of every healthcare facility. Courts have also established that patients have the right to receive health care in safe environments & that healthcare facilities are responsible for the physical & personal security of patients, staff & visitors.

Violence in Healthcare Facilities

There are trends in healthcare violence driven by patient or family member frustration, heightened anxiety over diagnoses & poor communication. Disgruntled employees & increased domestic violence situations increase risks of violence.

From 2000 to 2014, there was an increase in hospital-based shootings in the US. These are increasing in frequency & complexity, involving more weapons & IEDs with the shooters targeting more victims. Motivations for hospital shootings include grudges, revenge, suicide, ending the life of an ill spouse or relative & escape for prisoners brought in for medical care. The fatality rate was 55%. The victims were primarily the shooter & the intended target. 91% of hospital shooters are male.

Hospitals are unlike other venues when violence erupts. At other venues, lockdown & evacuations are ordered at the 1st sign of violence. Hospitals are different because staff must not only consider the risks to their own lives but must also consider the lives of patients who are unable to run, hide, fight or evacuate. Security officers & hospital staff must balance their own need for safety & security while continuing their mission to provide quality patient care. Patients are often defenceless due to illness or injury, dependant on life-saving equipment, or in the midst of medical procedures. Hospital staff have a duty to provide medical services & protect the vulnerable 24/7 while in their care, thus creating personal, moral & ethical dilemmas. Even in the midst of an active shooter event, hospital staff deal with the moral dilemma of leaving the sick, injured & vulnerable behind, or provide protection & medical care while increasing their own risks of injury or death. The "run, hide, fight" strategy clearly does not apply in a hospital. Ensuring continuous operations before, during & after a violent attack are absolutely essential.

There is need for hospitals to manage the risk of external threats, including active shooters & terrorism. However, hospital administrators view these non-clinical threats as beyond the scope of their jobs. Analysing & managing such threats are part of risk management. Hospital administrators should address the risk of external attack by active shooters & terrorists by preparing for the eventuality of such events.

The absence of lockdown procedures to restrict the movements of an active shooter indicates that healthcare managers are less aware than their peers in other sectors of this potential threat, especially when large commercial spaces are implementing these types of measures in addition to normal fire safety procedures.

Healthcare managers & hospital administrators urgently need help from security professionals experienced in hardening vulnerable facilities & training personnel.

Soft Targets

Terrorists will take into consideration the potential payoff in terms of propaganda, its economic value, disruption caused or the opportunity to cause mass casualties. They are increasingly selecting soft targets because there are so many & they present the greatest possibility of success in terms of overall destruction & mass casualties.

Soft targets are those where large numbers of people congregate regularly, with numerous entrances, making them vulnerable to attacks resulting in a high number of casualties.

Most soft targets have little money to spend on hardening & must often blend security with aesthetics & positive experiences for patrons & customers. Soft targets are where people expect to feel safe. When attacked, it causes more outrage, shock & fear that terrorists crave.

Every soft target is different & requires a customized security solution that is tailored to that specific site. Consulting a security expert allows a site to blend the best security practices while maintaining the positive aesthetics & end user experience.

Terrorist Threat

For terrorist, the attractiveness of the facility as a target is a primary consideration. The type of terrorist action may vary, based on the potential adversaries & method of attack most likely to be successful. Terrorists wishing to strike against the government would be more likely to attack a large government facility than to attack a multi-tenant office building containing a large number of commercial tenants but only a few government tenants. However, if security at the large government building makes mounting a successful attack too difficult, terrorists may be diverted to a nearby facility that may not be as attractive from an occupancy perspective but has a higher probability of success due to the absence of adequate security. In general, the likelihood of terrorist attacks cannot be quantified statistically since terrorism is, by its very nature random.

Terrorist attacks are less likely to occur than other disasters, but they can have greater impact on hospital operations. Until the 9/11 & anthrax attacks, hospital emergency preparedness programs had not included provisions for terrorist action because people do not normally view hospitals as terrorist targets.

Hospitals are seen as potential targets for 2 main reasons. Healthcare is a key component of any country’s contingency planning & hospitals form part of its critical infrastructure. Invariably, hospitals are core elements in any civil contingency planning process for mitigating the effects of any mass casualty crisis. Any disruption or erosion of this service acts as a force multiplier for the damage caused elsewhere - the generation of a wider crisis following a mass-casualty event.

Approximately 100 terrorist attacks have been perpetrated at hospitals worldwide, in 43 countries on every continent, killing approximately 775 people & wounding 1,217 others.

Terrorists do not differentiate between military & civilian personnel, which explains why attacks on soft targets like hospitals are more frequent. While there are many soft targets, hospitals have unique vulnerabilities. Hospitals are public places with large numbers of people in confined spaces, many too sick or incapacitated to easily evacuate, thereby making them vulnerable.

The sad reality is that some of the deadliest terrorist bombings in recent years have occurred in the healthcare industry. In order to dramatically increase casualty numbers & demoralize the enemy, numerous terrorist groups have detonated one device in the community & then exploded a second IED near the emergency room when first responders deliver the casualties to the hospital. Terrorists are using variations of the "double bomb" & "unwitting accomplice" tactics.

Terrorists & assassins have donned white lab coats, draped stethoscopes around their necks to appear as doctors & nurses to roam hospitals unquestioned. From 1970 to 2014, at least 54 terrorist groups worldwide have been known to utilize some form of impersonation for operations inside & outside a hospital environment.

Terrorists targeting hospitals have also pretended to be sick & injured patients, worried relatives, delivery personnel, hospital janitors, members of the press, workmen, police & security guards. The prevalence of female suicide bombers has greatly increased the threat of terrorism in industries with high numbers of female employees. The number of female employees in healthcare facilities are significant which makes hospitals an inviting avenue for terrorists to recruit females who are sympathetic to their cause.

For terrorists wanting to kill & injure people, the most familiar environment to attack & the easiest one that is least defended is the hospital.

Hospitals often contain hundreds of employees, patients & visitors at any given time – making an attack on a hospital an easy way to produce mass casualties, outrage, shock & media attention.

Police statistics show that a single shooter can locate, target & shoot a victim every 5 seconds. Combat data indicate that most fatalities from penetrating wounds occurred within 30 minutes. 42% of deaths occurred immediately, 26% occured within 5 minutes & 16% occured within 30 minutes.

A crowded emergency room provides much easier targeting as victims with infirmities are less likely to get away. Furthermore, emergency rooms often have easy access to the entire hospital, so the carnage would be worse. From 2000 to 2011, there were 154 hospital-related shootings in the US, 60% of which were inside the hospital & the remainder on hospital grounds. 

Terrorists realize that hospitals are attractive primary & secondary targets.

Scenario - An individual walks into a hospital with a wheeled suitcase. He is assumed to be a patient coming in for a procedure & an overnight stay. At about the same time, 2 other individuals with ubiquitous backpacks walk into the hospital to visit a relative/friend who has been warded. The patient & the 2 visitors proceed to the nuclear medicine department to detonate the 20kg IED in the suitcase & the 10kg IEDs in each of the backpacks in a sympathetic explosion. They then roam the hospital attacking patients, visitors & medical staff with their AK-47’s & fragmentation grenades to cause maximum panic & casualties, to render the hospital incapable of dealing with the aftermath of simultaneous terrorist attacks planned across the city. As the hospital was designated a major trauma centre in emergency plans, this attack would effectively prevent it from receiving casualties from the other attacks. Thus this hospital attack was part of a wider strategy to destabilize the city & its infrastructure.

As the primary target, hospitals may be hit by suicide attackers, IEDs, kidnapping & negotiation attacks as well as shooting attacks. The large number of patients, visitors & medical staff on hand guarantees that an attack on a hospital will generate many casualties. Besides, a primary attack on a healthcare facility will receive extensive media coverage.

As a secondary target, an attack on a hospital will distract security & response staff from the primary attack & also complicate the removal & treatment of the wounded from primary attack site. An IED detonation in a hospital or at the hospital entrance will interfere with the ability of emergency rescue teams to bring the wounded from the location of a terrorist attack to the hospital emergency room. This causes the loss of precious time which greatly increases the damage inflicted by the primary attack.

Since hospitals serve entire populations, an attack on a hospital is more anxiety-provoking than an attack on almost any other site, because of the “personalization” factor. Prior personal familiarity with a hospital would cause anyone to fear that such an attack could easily have involved him or those close to him.

The killing of substantial numbers of caregivers, patients & others in a hospital also produces a Terror Multiplier Effect by the horror of the event & the secondary effect of destruction of pre-planned facilities expected to treat casualties.

Hospitals also make attractive targets because

• they are repositories of materials (medications, poisons, radioactive materials & biological cultures)
• contain knowledge about preparing poisons or hazardous biological materials that could be put to dastardly use.

Hospital store rooms & laboratories are treated as sensitive security areas.

Terrorist organizations can obtain these materials & knowledge by physically infiltrating a hospital & breaking into its store rooms & laboratories. They can also blackmail staff into passing them sensitive information. The Islamic State has stated their interest in acquiring & using radioactive material in a dirty bomb.

Hospitals are also far less secure than nuclear facilities but house some radioactive materials that are needed for medical procedures.

Nuclear medicine is a medical specialty involving the application of radioactive substances to provide diagnostic information about the functioning of specific organs & the treatment of disease. Diagnostic procedures using radioisotopes are now routine. About 30% of patients admitted to hospitals are diagnosed or treated with radiation or radioactive materials. Some procedures call for radiopharmaceuticals - a small amount of radioactive material to be administered by mouth, injected or inhaled. These materials gather in an area of the body & emit “photons” that are picked up by gamma cameras. The cameras provide images of the organ which helps doctors identify tumours or other problems.

All healthcare facilities have x-ray machines & other scanning devices, such as Single Photon Emission Computed Tomography (SPECT) & Positron Emission Tomography (PET) scans, which allow for quicker & more accurate diagnosis. These x-ray machines & scanning devices contain radioactive material.

Radiotherapy is also used to treat cancer, using radiation to weaken or destroy particular targeted cells. Over 40 million nuclear medicine procedures are performed each year & demand for radioisotopes is increasing at by up to 5% annually. Sterilization of medical equipment is also an important use of radioisotopes.

According to the International Atomic Energy Agency (IAEA), over the past 50 years, millions of radioactive sources have been distributed worldwide. They are dispersed across thousands of commercial, industrial, medical & research sites in more than 100 countries. Unfortunately many of these sites are poorly secured, particularly during transport when they are vulnerable to theft. 

The same isotopes (Cesium-137, Cobalt-60 & Iridium-192) used for life-saving blood transfusions & cancer treatments could be used to build a bomb. 

A 2012 report released by General Accountability Office found that only 1 out of 5 hospitals that use high-risk nuclear isotopes for diagnosis & treatment have the recommended safeguards to secure the materials. GAO inspectors found several incidents where radioactive isotopes were left unsecured & easily accessible to terrorists. Inspectors found 2,000 curies of Cesium-137 stored on a wheeled pallet next to the loading dock at one facility, where it could easily have been wheeled down the hall & out the door. At another location, 1,500 curies of Cesium-137 were kept behind a locked door but the combination was clearly written on the door frame.

According to the US National Nuclear Security Administration (NNSA), over 1,500 hospitals in the US use radiological sources that could be turned into dirty bombs. A study conducted by the James Martin Center for Nonproliferation Studies found 170 instances where nuclear or radiological material was lost, stolen or outside regulatory control in 2014 alone. In 2018, radiography device containing Iridium-192 was lost in Malaysia. This isotope can be used as a weapon if combined with a conventional explosive device.

Cesium-137 is an isotope used medical equipment such as blood irradiators which are used in many countries around the world. It is the most dangerous of all radioactive isotopes. If used in a dirty bomb, the highly dispersible powder would contaminate an area for years, costing billions of dollars in evacuation, demolition & clean-up.

Cobalt-60 is a synthetic radioactive isotope of cobalt which is produced artificially in nuclear reactors. The main advantage of Cobalt-60 is that it is a high intensity gamma-ray emitter with a relatively long half-life compared to other gamma ray sources of similar intensity. The main uses for Cobalt-60 in hospitals are for sterilization medical equipment & a radiation source for medical radiotherapy. Cobalt is considered a "salting" element to add to nuclear weapons to produce a cobalt bomb, an extremely "dirty" weapon which would contaminate large areas with nuclear fallout, rendering large areas uninhabitable. 

Iridium-192 does not typically occur naturally. It is manufactured by putting Iridium-191 in a nuclear reactor & bombard it with neutrons. The Iridium-191 then takes up an extra neutron to become Iridium-192 which is classed as a Category 2 radioactive by the IAEA. A Cat 2 classification means it can be fatal to anyone in close proximity to it in a matter of days or even hours. 

The most important nuclear material to keep away from potential nuclear terrorists is highly enriched uranium (HEU). HEU has a 20% or higher concentration of Uranium 235 (235U). The fissile uranium in nuclear weapon primaries usually contains 85% or more of weapons grade 235U, though theoretically for an implosion design, a minimum of 20% could be sufficient (weapons-usable).

If a terrorist group managed to acquire 50 kgs of weapon-grade uranium (≥90-percent Uranium 235), it could cause a nuclear explosion by using a simple gun-type device to assemble 2 sub-critical masses into a supercritical mass - the design used in the Hiroshima atomic bomb.

According to the International Atomic Energy Agency (IAEA), a common civilian application of HEU is for the production of isotopes for medical diagnostics. In 2016, Belgian investigators discovered terrorists monitoring an employee at a highly enriched uranium reactor that also produces medical isotopes for a large part of Europe. Most radioactive materials are stored in secluded areas to limit the risk of accidental contamination. However, this also allows for the unauthorised removal of inventory unobserved. Hospitals keep very close watch on these materials because of safety & disposal requirements.

Hospitals are at critical risk of cyber attacks from terrorists & other malicious hackers. It would not be difficult for terrorist organizations to hack into a hospital’s database. Many security experts believe that hospitals & healthcare facilities face the biggest threat of all critical infrastructure due to the ease with which such attacks could be carried out & the high number of lives that would be put at risk

Individuals & small groups of hackers are mainly motivated by profit & notoriety. They usually choose their targets according to opportunities & make use of unsophisticated means.

Political groups & paparazzi are motivated by hacktivism but also political & financial gain. They aim to embarrass, discredit, blackmail or sell information about high profile individuals.

Criminal organizations are motivated by financial gain & more broadly criminal activities such as extortion, blackmail, coercion. They obtain medical records about target individuals, threatening them or causing physical harm to them. They may also profit from the exploitation of untargeted Electronic Health Records (EHRs) in volume.

Nation-state attackers present the greatest threat. Enemy nations may aim at harming or threatening individuals. They also may want to obtain Personally Identifiable Information (PIIs) &/or EHRs of groups of individuals for mass exploitation. In 2018, the most serious breach of personal data in Singapore’s history took place when 1.5 million SingHealth patients had their records accessed & copied while 160,000 of these also had their outpatient dispensed medicines’ records taken. The attackers specifically & repeatedly targeted Prime Minister Mr Lee Hsien Loong's personal particulars & information on his outpatient dispensed medicines. Cyber security experts suggested the attack could be the work of nation-state actors, given the scale of the breach & the targeting of government leaders.

The cybersecurity situation in healthcare facilities is alarming. In July 2013, IT security firm Red Spin reported that

● Almost 30 million patient health records have been affected by breaches since 2009.

● An increase of +137.7% in the number of patient records breached was noticed in 2012-2013.

● More than one third of attacks were due to the loss or theft of an electronic device, raising the question of employees’ cyber-awareness.

● More than 4 million records were breached in a single attack in 2014 revealing how massive an attack towards a healthcare facility can be.

● In 2015 around 100 million health care records were stolen.

One of the most popular cyber-attack is ransomware. The list of hospitals hit by this type of attack keeps getting longer. In 2015, experts estimated ransomware attacks to be close to 1,000 per day, which is 35% more than the previous year. In 2016, Symantec reported that on certain days, the number rose to 4,000 attacks. These attacks are quite similar & show the following pattern:

● Hackers gain access to the facility information system using diverse methods: physical presence (USB drive), exploitation of vulnerable & expired software, theft of staff’s mobile devices & phishing or malicious emails.

● Once hackers have access, they use a special virus that holds the system hostage by encrypting the data it contains, making it completely inaccessible & unusable until hackers are paid a ransom - usually in Bitcoin as it is untraceable.

● The nature of healthcare requires that sensitive patient data be kept on file. Doctors need to have this information quickly to make informed decisions about patients. The ability to easily share this information within a healthcare network has resulted in significant advancements in the way patients are treated. However, housing this kind of personal information poses severe risk. Hospitals are easy targets because of time sensitivity. Without quick access to patients’ health record, patient care may be delayed resulting in serious consequences. Personal & medical details are also used by staff who handle post care activities, from post-op follow-up to billing. Hospitals do not want to take any risks & elect to pay the ransom.

Physician Terrorists

Insider threats are a significant issue for hospitals. The role of doctors in the attacks on the Tiger Tiger nightclub in London & Glasgow Airport leaves little room for doubt that staff working within hospitals cam be involved in terrorism.

There have also been instances where individuals claimed bogus qualifications & experience to obtain employment as doctors. This reinforces the importance of robust screening & background checking processes at the point of recruitment. Another concern is staff who become malicious in their intent after they have satisfied pre-employment checks around qualifications & expertise. The human component generates significant vulnerability for hospitals because of the central role played by people in service organizations.

There have been many doctors who have become “radicalized” by extremist ideologies. A list of some of the doctors who have engaged in terrorism are:-

Dr. Bashar Assad - Ophthalmologist & President of Syria. State sponsor of terrorism.

Dr. Ayman al-Zawahiri - Paediatrician who took over leadership of Al Qaeda upon the death of Osama bin Laden.

Dr. Mohammad Rabi Al-Zawahiri - Pharmacologist & professor at Air Shams Medical School. Father of Ayman Al-Zawahiri & supporter of the Muslim Brotherhood.

Dr. Nadal Hassan – Army psychiatrist, US Army Major & Fort Hood military installation shooter. Killed 13 people & wounded 32.

Dr. Abu Hafiza - Physician, psychiatrist & commander of a terrorist cell in Morocco who helped provide logistics for the Twin Tower attacks.

Dr. Rafiq Sabir - Boca Raton ER physician convicted in an Al Qaeda terror plot.

Dr. Abdel Aziz Al-Rantisi – Pediatrician & co-founder of HAMAS

Dr. Mahmoud Al-Zahar - Surgeon & co-founder of HAMAS

Dr. Fathi Abd Al-Aziz Shiqaqi - Surgeon & co-founder & Secretary-General of the Islamic Jihad Movement in Palestine

Dr. George Habash - Pediatrician & founder of the Popular Front for the Liberation of Palestine (PFLP)

Dr. Wadih Haddad - Physician & leader within the PFLP

Dr. Mohammed Jamil Abdelqader Asha - Neurologist & London bomb plotter

Terrorist Attacks on Hospitals

In 2016, there were calls for attacks on hospitals in the West by media outlets sympathetic to IS. This highlights terrorists’ perception of hospitals as viable targets. Targeting hospitals & healthcare facilities is consistent with IS’s tactics in Iraq & Syria. The terror group did call for attacks in the West using “all available means.”

Attacks on hospitals challenge the very foundation of the laws of war & are unlikely to stop as long as those responsible for such attacks get away with it. Attacks on hospitals are insidious because when you destroy a hospital & kill its health workers, you are also risking the lives of those who will need hospital care in the future.

Highlighting the Risks to Hospitals

November 2002 - FBI issues an alert to hospitals in San Francisco, Houston, Chicago & Washington, DC., warning of a vague, uncorroborated terrorist threat

August 2004 - FBI & DHS issue a nationwide terrorism bulletin that Al-Qaeda may attempt to attack VA Hospitals throughout the US

November 2005 - Police in London arrest 2 suspected terrorists accused of plotting a bomb attack. One of the suspected terrorists was found to have a piece of paper with the words in Arabic, “Hospital = Target”

April 2005 - FBI & DHS investigate incidents of imposters posing as hospital accreditation surveyors. Joint Commission on Accreditation of Healthcare Organizations (JCAHO) sends security alert to hospitals.

July 2007 - 8 individuals, all of them either physicians or other medical professionals associated with Britain’s National Health Service, were taken into custody in relation to an attempted car-bomb attacks in London & a car-bomb attack at Glasgow Airport in Scotland.

June 2017 - The National Counter Terrorism Security Office in the UK released an updated ‘Crowded Places Guidance’ document, which tells medical professionals they could be the target of a terrorist incident. The worst-case scenario would be staff, patients & visitors killed or injured & having their premises destroyed or damaged in a ‘no warning’ multiple & co-ordinated terrorist attack. Hospitals are warned that the nature of such an attack may be covert, “through interference with vital information” or “enabled by an insider or someone with specialist knowledge or access to your venue.”

Some recent attacks on hospitals will show the seriousness of this issue.

• March 08, 2017 - Dr Nashir, a doctor at Sardar Mohammad Daud Khan Hospital - Afghanistan’s biggest & best-equipped medical facility (near the US Embassy in Kabul), created the opportunity for terrorists disguised as medical personnel to enter the building to carry out the attack. Nashir was a military doctor in Kandahar & transferred to Kabul. The attack commenced when a suicide bomber blew himself up at the south gate of the hospital. Attackers dressed as medical staff then entered the building & began going from floor to floor, firing on guards, patients & doctors. Subsequent reports indicated that the terrorists stabbed bed-ridden patients, throwed grenades into crowded wards & shot people in the head from point-blank range, including women & children. A total of 51 people were killed & 90 were injured in the 6-hour siege before Afghan security forces killed the attackers.
•  August 08, 2016 - A suicide bomber attacked a government hospital in the city of Quetta, Pakistan. The explosion killed 70 people & wounded more than 130. Many of the victims were lawyers. Both ISIS & an offshoot of the Pakistani Taliban has claimed responsibility for the attack.
• April 24, 2014 - Sneaking past security at the Jibla Baptist Hospital in Yemen, a man supposedly seeking medical attention for his child, cradled an assault rifle beneath his coat as if he was holding a baby in his arms. Upon entering an office where a meeting was taking place, the man unwrapped his "baby" & assassinated 3 American medical workers.
•  April 15, 2014 - Terrorists burn a Christian worship center & hospital in Nigeria, killing 9 people.
•  December 12, 2013 - Terrorists rammed a military complex in Yemen with a vehicle, then stormed a hospital using guns & grenades targeting doctors, nurses & patients. 56 people were killed. Security forces took several hours to regain control of the healthcare facility.
•  October 18, 2013 - the 5th floor of Jaramana Hospital in Syria was bombed.
•  June 15, 2013 - In a complex, well-coordinated attack by Lashkar-al-Nusra, a female suicide bomber detonated her explosives on a bus in Pakistan. When the injured began arriving at nearby hospital, a 2nd suicide bomber detonated explosives at the emergency room, before gunmen entered the hospital to kill 25 people & injure 19 others.
•  June 03, 2011 - In a sophisticated attack, a suicide bomber detonated his explosives at a mosque during prayers in Tikrit, Iraq. When family & dignitaries began arriving at a nearby University Public Hospital, a 2nd suicide bomber blew himself up near the emergency room. 11 people were killed & more than 30 were injured.
•  August 01, 2003 - Chechen suicide bombers in an explosives-laden truck drove past security to detonate in the Russian Military Hospital in Mozdok. Parts of the hospital collapsed, killing 56 & injuring 80.
•  June 14-19, 1995 - Around 50 Chechen rebels in a column of trucks stormed a police station in Russia, then retreated to nearby hospital taking approximately 2,000 hostages. At least 140 people were killed & 415 others were injured in this attack.
•  1994 - The Banyamulenge (Tutsi subgroup), killed 50 patients & hospital staff at 2 missionary hospitals at Zaire-South Kivu, Democratic Republic of Congo.
•  November 04, 1991 - An IRA bomb at the Musgrave Park Hospital in Belfast, Ireland, killed 2 soldiers & injured a number of people, including 2 children.

Priorities in a Terrorist Attack on a Hospital

In a terrorist attack on a hospital, clinical operations at the site would be placed on hold. Law enforcement & security operations would take precedence to ensure the safety of the staff, visitors & patients. The decision on whether to resume clinical operations or order a medical evacuation is only required after the situation has stabilized.

The open & permeable nature of hospitals & healthcare facilities will remain its main vulnerability. Despite a range of vehicular mitigation measures that have been introduced during the last 20 years, such vulnerabilities remain.

Patients with wheeled bags walking through hospital foyers without being challenged by security regarding the contents of their bags.

Individuals managed to enter restricted areas of hospitals, courtesy of staff who assumed they were going to meetings with hospital administrators. No one asked for their identification nor sought to check with the individual(s) hosting the meeting.

It is difficult to raise awareness of risks among staff, patients & the local population while simultaneously ensuring that patients & staff feel safe. 

One of the greatest challenges to healthcare managers & governments in an evidence-based world is to plan for events that have a low probability of occurrence - when resource allocation is contingent on rational business sense.

Perhaps the biggest mistake is a false sense of security. Never confuse good luck with good planning. The fact that nothing has happened in the past does not mean that nothing will occur in the future. Think of security measures as a form of insurance. It is better to have them & never need them, then need them & not have them. Always go over all of your plans with a proven security expert with experience in healthcare facilities.

--------------------------

Endro Sunarso is an expert in Security Management, Physical Security & Counter Terrorism. He is regularly consulted on matters pertaining to transportation security, off-shore security, critical infrastructure protection, security & threat assessments, & blast mitigation.

Endro has spent about 2 decades in corporate security (executive protection, crisis management, business continuity, due diligence, counter corporate espionage, etc). He also has more than a decade of experience in Security & Blast Consultancy work, initially in the Gulf Region & later in SE Asia.