A hospital that locks every door slows care. A hospital that leaves every door open invites harm. Good protection sits between those extremes, and it has to work at 2 a.m. with tired staff, distressed families and a trolley coming through.

That's why healthcare security systems shouldn't be judged by how many cameras you can count or how many officers you can see. Judge them by whether a duress call gets a fast, calm response, whether verbal aggression gets reported and acted on, whether repeat incidents fall, and whether care continues when a door, a network or an alarm path fails.

What Healthcare Security Systems Are For

In the Australasian College for Emergency Medicine's 2025 Breaking Point report, 91% of surveyed Australian emergency-department medical directors said violence by a patient or accompanying person had occurred in their department during the previous week. Physical violence was reported by 79%; 55% said it happened daily or frequently, defined as at least once a week. 90% reported verbal violence daily or frequently.

Security coverage was uneven. Only 60% of responding emergency departments had access to ED-based security staff. Among those departments, 44 reported access to hospital security officers around the clock.

These figures point to a standing safety system, not a plan reserved for rare emergencies. Its job is to support staff early, reduce the chance of repeated incidents and keep treatment moving when a situation becomes unsafe.

A Working Definition You Can Use

Healthcare security systems join licensed people, electronic detection and written escalation to identify trouble early, manage entry to clinical areas and support staff without delaying treatment. The system works like a safety net beneath a busy ward: it is ready before someone needs it, but does not obstruct care.

A camera grid alone cannot prevent or stop an incident. An officer called only after an assault arrives too late to support early de-escalation, and staff may stop reporting behaviour they believe will not receive a response.

A working system connects five parts. Detection comes from duress points, alarms and staff who know when and how to escalate. Access control manages who can enter clinical areas and when. CCTV gives the monitoring desk and responding officers a shared view. People attend, de-escalate and stay with staff. Records capture what happened, so the service can identify patterns and address them.

If one part is missing, the others have to carry its load. Cameras cannot replace attendance, officers cannot detect every incident, and clinicians should not have to provide both care and security.

The same logic applies beyond large city emergency departments. Regional hospitals usually work with thinner rosters and longer response distances, so controls need to fit those conditions while the underlying design stays the same.

Figures reported from AIHW data on assault hospitalisations among healthcare workers show assault-related hospitalisations increased from 49 in 2015-16 to 126 in 2024-25, with the rate rising from 4.3 to 8.1 per 100,000 workers. Assault became the second-leading cause of injury hospitalisation for healthcare workers, compared with seventh for the general population.

That makes security a workplace safety and clinical continuity decision as well as a property protection decision. A structured healthcare security risk assessment can help turn national figures into a picture of risks at your own site.

The table translates the emergency department figures into practical design questions. Use it to test whether the proposed response matches the reported exposure.

Emergency department violence and security coverage

Verbal violence deserves early attention because it is reported so frequently. A clear route to report it helps services see repeat incidents and respond before behaviour escalates. The round-the-clock coverage figure also makes after-hours response worth testing, not just the day roster.

Controls and Staffing by Clinical Area

Hospitals fail at security in specific places, not in general. A door wedged open for a trolley, a pharmacy badge that still works after a resignation, a car park path nobody walks after dark. So specify by area, name the failure you're designing against, and match a people model to each one.

The staffing logic starts with behaviour, not headcount. In Safe Work Australia's workforce profile drawing on the 2024 People at Work Survey, 50% of health-care and social-assistance workers reported angry or hostile behaviour, compared with 41% across all industries. 41% reported shouting or swearing, compared with 35% overall, and 35% reported intimidation or insults, compared with 28% overall.

Those gaps explain why de-escalation comes before physical response in this sector. Most of what your officers will meet is hostility, swearing and intimidation from people who are frightened, in pain or waiting too long. Train for that first, and assault response second.

Healthcare security controls by clinical area

Where Each Row Earns Its Keep

Start with the emergency department, because harm concentrates there. Put duress points at triage and in resuscitation, where staff can't leave a patient to find a phone. Use privacy-masked CCTV in waiting areas so you can see a crowd forming without recording clinical detail you don't need. Control the ambulance entry, because it's a fast, legitimate route in and an easy one to tailgate. Then test the obvious failure: a door held open for a trolley while an agitated person walks through behind it. Dedicated emergency department security planning should rehearse exactly that moment.

Mental health units need a different temperament. Doors should be clinically justified, documented in the care model, not installed because a security catalogue suggested them. Staff need an egress route that doesn't require passing the person they're retreating from, and alarms should be quiet at the point of activation so patients aren't treated as offenders in front of other patients. A dedicated response officer who knows the unit, the staff and the regular patients will resolve more than a rotating stranger will.

Pharmacy and medication rooms focus on diversion prevention and quiet after-hours entry, not confrontation. Specify dual control for high-risk stock, an after-hours alarm that is monitored, and badge access that is logged and reviewed. Purpose-built narcotic cabinets for healthcare facilities are a useful reference point when you're comparing physical storage standards for controlled medicines against what your current cupboards provide. A patrol check confirms the door is shut and the alarm is set. It doesn't replace either control.

Public reception and outpatients suit Concierge Security because the first job there is welcome, directions and visitor identification. Good sightlines let one officer see the queue, the entrance and the waiting seats. A panic point under the counter, monitored rather than local, gives reception staff a way to ask for help without escalating in front of a room.

After dark, Mobile Patrols cover what static posts can't: car parks, paths between buildings and isolated clinics on the same campus. Give them timed beats tied to shift changeover, not a vague instruction to drive around. Staff walking to a car at 10 p.m. care about a predictable presence, not a vehicle they saw once at 7 p.m.

Vehicle docks and campus edges suit Gatehouse Security with set delivery windows, so an out-of-hours truck is a question rather than a shrug. Records and communications rooms need the opposite of a visible presence. Restrict the cards, alarm the cabinets and keep people from loitering nearby, including your own patrols.

Staffing Rules That Follow From the Table

Two rules hold across every row. First, keep a dual-officer minimum wherever one officer may need to stay with staff while another deals with the person causing harm. A single officer forced to choose between those tasks will do neither well.

Second, place controls where the risk sits. Visible security everywhere distresses patients, slows clinicians and spreads your roster so thin that the emergency department still ends up short. Concentrate people at triage, reception and after-hours access points, and let electronics and patrols carry the quieter areas.

Borrow crowd skills deliberately. Open days, vaccination surges and major incident arrivals need queue management and calm public communication, which is where Event Security experience translates well into a hospital forecourt.

Legal Duties and Clinical Integration

Nearly 40% of respondents in health and community services had experienced violent or traumatic events at work, including threats, assault and abuse, according to Safe Work Australia's data on work-related violence and aggression. Security controls should help staff get support quickly, reduce repeat incidents and keep care moving when a door or network fails.

For each duty, name the record that shows how your service meets it. A policy describes the intended response; a completed drill, access log or incident report shows how the control works in practice.

Work Health and Safety Comes First

Work health and safety law treats violence and aggression as workplace hazards to assess and control. For high-risk areas, keep a written risk assessment, training records and a reporting process that captures verbal abuse and intimidation as well as assault.

If an incident form only records physical injury, the figures will miss conduct that still affects staff and patient care. Across Australian workplaces, about 46% of workplace violence incidents over the preceding 10 years were formally reported as workplace or on-the-job incidents, approximately 80,900 out of 176,100.

Make reporting quick, share findings with the ward and act on repeat locations. Complete reporting matters because it helps reveal patterns that a response-time measure alone can miss.

Licensing Is a Document, Not an Assurance

Every officer performing guarding, monitoring or control-room work must hold the correct state or territory licence for that activity. Licensing categories and conditions differ between jurisdictions, so a licence valid for one role or state may not cover another.

Ask the provider for a register listing each worker's name, licence number, category and expiry date, along with the process for preventing an expired licence holder from being rostered. Verify each licence directly with the relevant state or territory licensing regulator. Ask who checks the register and how often.

A register is useful only if it stays current and covers everyone assigned to the site.

Code Black Is a Drill, Not a Poster

A Code Black response depends on the time between a duress call and help arriving. Test that pathway during a night shift, when staffing levels differ from the day. Regional hospitals need the same practical rehearsal. Reporting on SA Health figures for South Australian regional hospitals recorded 668 Code Black incidents involving violence or threats in 2024, compared with 385 in 2023.

Route a duress press to a monitored desk that owns the incident log and to a nearby clinician who can begin helping before security arrives. Agree who speaks with the person, who moves other patients, who calls police if needed and who ends the response. Then drill the procedure, time attendance and record the gaps.

Practical rule: If the procedure has never been tested after 10 p.m., you do not know how it works with night-shift staffing.

Privacy Sits Beside Safety

Patient footage and access logs need a named owner, a defined viewer list and a retention limit. Decide who may view footage, for what purpose, and how each viewing is logged. Keep security evidence separate from the clinical record so each can be managed appropriately.

Long retention and unrestricted remote viewing increase the harm if accounts are compromised. Set a retention period that allows time to investigate a late report, then delete footage on schedule and keep evidence that deletion occurred.

Written healthcare security policies should explain these rules in plain language, so a nurse unit manager can apply them during an overnight shift.

Where Physical Security Meets Cyber Risk

In the OAIC's reporting period from July to December 2024, health service providers were among the most frequent notifiers, with 121 notifications, representing 20% of all notifications. Cyber incidents accounted for 247 notifications overall. The median number of people affected per cyber incident was 182, while the average was 15,357.

The difference between the median and average shows how a small number of incidents can affect far more people than most. Physical access is part of the same risk: someone who reaches an unattended workstation, communications cabinet or server room may be able to interfere with systems or information.

Connect physical controls to cyber processes:

• Cancel cards when staff leave: Link badge deactivation to the HR termination workflow rather than a monthly spreadsheet.
• Restrict technical rooms: Limit access to named people, alarm cabinets and keep contractor access records.
• Control administrator accounts: Use individual, logged accounts for CCTV and alarm platforms, not a shared password.
• Record visitor and contractor entry: Keep public reception access separate from records storage, so a delivery does not gain access to restricted areas.

Keep CCTV, access control, alarm and building-management systems separate from identity services, electronic medical records, imaging, pathology and medication systems. Set deny-by-default rules between them. Ask the integrator to show the network diagram and explain which systems can communicate.

Connected medical devices need an owner, an asset record, a software baseline, a network location and a risk class. If clinical or contract limits prevent patching, use dedicated network segments, strict access rules, disable unused services and monitor vendor access that is time-limited and protected by multifactor authentication.

Decide in advance when a suspect device must be taken out of service, how clinicians will be told and when a safety-impacting cyber event must be reported to the Therapeutic Goods Administration and the Australian Cyber Security Centre. Restricting access to equipment rooms also helps protect devices from unauthorised physical access.

Three Documents to Request Before Contract

Request these before signing:

1. The site risk assessment, naming areas, hours and controls.
2. The licence register, covering every officer and monitoring operator assigned to the site.
3. The Code Black drill record, including dates, times, attendance and actions closed out.

How to Brief Vendors and Go Live

A facilities lead can run this rollout without a project office. Seven steps, in order, each producing something you can file.

The diagram below sets out the sequence before the detail.

1. Map incidents by area, hour and role. Pull twelve months of incident reports, duress activations and workers compensation claims. Add the verbal aggression that never became a Code Black, because that's where your pattern usually hides. If your reporting is thin, run a four-week simple tally at triage and reception before you brief anyone.
2. Agree the clinical rules with nursing and medical leads. Decide which doors must fail safe for egress and patient movement, which searches need a clinical witness, who can authorise a lockdown of one area, and what officers must never do. Get those rules signed by clinical leadership, not just facilities.
3. Write a short specification. Two or three pages is enough: duress points, door groups, privacy masks, retention period, viewer list, monitoring hours, who is on call. Short specifications get comparable quotes. Forty-page specifications get priced assumptions. Include your healthcare visitor management requirements here, because visitor flow shapes reception staffing.
4. Interrogate each vendor the same way. State licences, hospital references you can ring, monitoring hours, the response promise in minutes, relief arrangements when an officer calls in sick, and how CCTV and access networks stay off clinical systems. Ask who owns the footage and the configuration if you change provider.
5. Score privacy and downtime, not only price. Points for a viewer audit trail, same-day card cancellation, an alarm path that still works when the main network is down, and a practised procedure for a door that fails. A cheap system that goes blind during a network outage is expensive on the one night you need it.
6. Pilot one area for four to six weeks. One emergency department or one clinic. Log duress response time, false alarms, incomplete reports and staff comments. Fix the door that alarms every time a bed passes, because alarm fatigue will kill the whole system faster than any intruder.
7. Train, go live, then review at 30 and 90 days. Clinical staff need hands-on duress and reporting training, not an email. At each review, compare results with your baseline and retire controls that aren't earning their friction.

This short video walkthrough is worth watching with your clinical leads before the vendor meetings, so everyone starts from the same picture of what a joined system looks like.

One Scale Example, Not a Budget to Copy

Shared monitoring can cover distance when individual sites can't justify a control room. A Western Australian Government media statement reported that the state invested AUD 484,000 in 2024 to establish a dedicated 24/7 CCTV security hub supporting seven regional hospitals and health services.

Don't lift that figure into your business case. A single Melbourne hospital or a Perth day clinic doesn't need a state hub. What transfers is the principle: one monitored desk, consistent escalation, and local responders who know the site. A small clinic can buy that as a monitored service. A regional network can share it across sites. Either way, someone awake owns the alarm.

ROI and Case-Study Examples

A security investment is easier to assess when you compare it with your own starting point. Record incidents by area and shift, duress response time, false alarms per week, and verbal aggression reports. Set 90-day targets, then review the results alongside clinical incidents.

Two reference points show why local trends matter. Assault-related hospitalisations among healthcare workers climbed from 49 to 126 over the period covered earlier in this article. South Australian regional hospitals recorded 385 Code Black incidents, rising to 668 in a year, an increase of about 74%. Use figures like these as context, not as a forecast for your facility. Segment security networks from clinical systems as part of planning for disruption.

An Illustrative Calculation

Treat this as a worked example with assumed numbers, not a promise. A mid-sized site records 12 repeat assaults a year in its emergency department. After adding duress coverage, a dedicated response officer and better reporting, it records 8. Duress attendance moves inside a target of two minutes for most calls.

Compare the cost of four fewer assaults with the monitoring and guarding contract. Include possible costs such as an injured nurse's absence, agency backfill, an incident investigation and staff turnover. These costs help make the trade-off visible, alongside the effect on staff safety and continuity of care.

Compare every quote against the same baseline and targets. A low hourly rate without a response measure is difficult to assess.

Ask the provider to set out its written response measures, including how it will record duress attendance and repeat incidents. Use those measures in the 90-day review, rather than relying on impressions. See the provider's service delivery standards for further detail.

Decide the Scope Before You Sign

Set the scope before requesting prices. If each vendor designs a different system, the quotes will be difficult to compare. First agree on the risks, response measures and operating needs. Then ask vendors to price the same brief.

Two Scopes That Cover Most Facilities

A single clinic or day procedure centre may need a reception concierge during opening hours, well-placed duress points, monitored intruder and duress alarms, and access controls for medication and records areas. An after-hours patrol can check doors and respond to alarms. Keep cameras focused on areas where they support a clear safety or operational need.

A campus with an emergency department, mental health unit, pharmacy and after-dark staff movement needs coordinated controls across buildings and shifts. These may include integrated security guarding, 24/7 monitoring, a rehearsed Code Black response, segmented electronic systems and mobile patrols after dark. Retail Security experience may help with public concourses and food courts. Construction Security can support staged building works. Neither replaces healthcare-specific de-escalation training.

Set the response roles as carefully as the equipment. Cameras can help identify and review incidents, while staff and monitoring teams act on alerts. A system works like a clinical safety net only when people know who responds, how quickly, and what happens if a door or network fails.

Four Measures to Demand at 90 Days

Put these measures in the contract, with definitions agreed before go-live:

• Repeat incidents in the same area, to show whether changes are reducing recurrence.
• Duress attendance time, measured from activation to an officer arriving at the scene and reported by shift.
• Completeness of verbal aggression reporting, tracked as a reporting rate. It may rise at first as staff report incidents more consistently.
• Clinical continuity during failure, recorded by noting what happened when a door, alarm path or network segment failed, and how long care was affected.

A rise in verbal aggression reports after go-live does not necessarily mean conditions have worsened. Read it alongside repeat incidents and response times. The aim is to improve reporting completeness while repeat incidents and duress attendance times fall.

Choosing a Partner You Can Defend

Ask bidders to show licensed staff, electronic monitoring capability, healthcare references and coverage for your site. Check which office supplies relief officers, how far they travel and how they respond when two sites need assistance at once.

ABCO Security Services Australia offers licensed guarding, mobile patrols and monitored electronic security for healthcare sites, with offices in Melbourne, Sydney, Adelaide, Perth and Brisbane. Assess its staffing depth, relevant references and coverage against the same requirements as other bidders.

Finish with a site walk. Take each shortlisted provider through the emergency entrance at a busy time, to the pharmacy approach and along an after-hours staff route to the car park. Ask what they would change and what they would leave alone. Look for practical observations, such as a wedged door or blind corner, and a clear reason for each proposed control.

ABCO Security Services Australia provides licensed Security Guarding, Mobile Patrols, Concierge Security and monitored electronic security for hospitals, clinics and medical centres, with teams serving Melbourne, Sydney, Brisbane, Perth and surrounding regional areas. To arrange a site walk and request a written brief for your risk committee, visit ABCO Security Services Australia.