Who's Impersonating Hospital Inspectors
SOME IMPOSTORS have been pretending to be assessors with the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) to gain access to restricted areas of healthcare institutions. The schemes sounds pretty clever, until you realize that a JCAHO visit to a hospital is akin to an OSHA inspection of a factory; once a person identifies him or herself as a representative of JCAHO, the facility essentially goes on red alert, and that person attracts escorts and the attention of the whole facility.
In the last year, hospitals in Los Angeles, Boston, Detroit, Indianapolis, and elsewhere have been targeted by imitation inspectors, according to alerts issued by JCAHO. In these cases, one or two professionally dressed men arrived and asked to inspect the premises. In each case, hospital staff asked for ID, and the man or men fled.
A policy change unrelated to security issues may have made it easier for fraud artists to get in the door. Before January 1 of this year, JCAHO scheduled inspections well in advance so that hospital administrators knew when assessors were coming. They now do pop inspections, but hospitals can still check JCAHO’s password-protected extranet site every morning to see where the surveyors will be that day.
The fear is that the impostors are terrorists scouting hospitals for vulnerabilities, says Fred Roll, a healthcare security consultant and the president of the International Association for Healthcare Security and Safety (IAHSS). An attack on a hospital —perhaps while it is treating victims of an earlier attack—could be physically and psychologically devastating, he says. Given the concern, hospitals have called on the FBI to look into the issue, though there is no hard evidence that terrorists were involved in the schemes.
In these cases, staff did the right thing by asking for identification. JCAHO officials also urge hospital staff to ask for a letter on JCAHO letterhead, explaining who the inspectors are and why they are there. Of course, points out Roll, IDs and letterhead can be forged.
The best way of verifying JCAHO staff is by contacting the organization directly, by phone or at the organization’s extranet. In addition to the list of hospitals that will get a JCAHO visit that day, the site shows names, photographs, and biographies of scheduled surveyors.
Lessons from JCAHO impostors apply to anyone seeking special access to hospitals, says Roll. That includes people claiming to be from the gas or electric company. “I tell people, set aside the JCAHO stuff,” he says. Hospitals should know the identities of everyone who comes into their facilities.
