Workplace violence, EMTALA, the Joint Commission and HIPAA all shape what a hospital security programme is allowed to look like.
The threat picture, specifically
Healthcare is the one sector where the primary security risk is not theft. It is violence against staff, and it is overwhelmingly generated by patients and visitors rather than intruders. Emergency departments and behavioural health units carry most of it: people in pain, in withdrawal, in psychiatric crisis, or waiting far longer than they expected to be told something they did not want to hear. Nurses absorb the first contact almost every time.
Around that sit the risks specific to a hospital campus. Patient elopement, where a person at risk leaves a unit unaccompanied, is a time-critical search with a clinical clock on it. Infant and paediatric abduction is vanishingly rare and catastrophically consequential, which is why it is drilled rather than discussed. Drug diversion moves controlled substances out of the building through staff, not strangers. Property crime concentrates in parking structures at shift change, in the dark, at the exact moment a lone clinician walks to a car. And the emergency department is a public entrance that cannot be locked, which makes access control a matter of posture and observation rather than doors.
In Arizona, campus geography adds to it: sprawling single-storey layouts with many exterior doors, detached medical office buildings, long surface lots, and summer heat that turns an outdoor incident into a medical one quickly. Post plans written for a compact urban tower do not survive contact with a Phoenix campus.
The regulatory frame around the post
Healthcare security sits inside more compliance than almost any other sector. The Joint Commission carries explicit workplace violence prevention requirements covering worksite analysis, reporting systems, training and follow-up, and a contracted security programme is evidence within it. CMS Conditions of Participation reach patient rights and the physical environment. EMTALA constrains what an officer may do at an emergency department entrance: the obligation to screen and stabilise does not pause for a security concern, and an officer who turns someone away creates federal exposure for the hospital. Our emergency department officers are briefed on that specifically.
OSHA‘s General Duty Clause, together with its guidance on preventing workplace violence for healthcare and social service workers, sets the expectation that the employer has assessed and controlled the hazard. HIPAA reaches us because an officer in a clinical corridor will see and hear protected health information; officers are trained to minimum-necessary handling, and where your compliance office requires a business associate agreement, we sign one.
In Arizona, guard services are licensed under A.R.S. Title 32, Chapter 26 and regulated by the Department of Public Safety. Honeybadger holds Security Guard Agency licence 1759798 and Private Investigations Agency licence 1759795. Our officers are not sworn peace officers: no arrest power beyond that of a private citizen, no authority to search a patient or their belongings outside your policy, and no authority to detain. Most healthcare posts are unarmed by design, and we will tell you plainly when we think armed coverage is the wrong instrument for a clinical environment.
What Honeybadger Solutions provides
Honeybadger Solutions is an Arizona-licensed security guard and private investigations agency — Guard 1759798, PI 1759795 — with investigations, digital forensics and cyber work delivered nationwide. This article is background on the problem. For what we actually provide, see Healthcare & Hospital Security, or book a confidential consultation.