While serving on the New Hampshire State Police SWAT team, I responded to a shooting at a large hospital in New Hampshire.
Our job was to secure and clear the hospital. Clearing a facility that size isn't a simple task, especially when you have patients who can't be moved, medical staff trying to do their jobs, and a lot of people who aren't sure what's happening.
By the time we got there, the shooting had already happened. Our responsibility was to make sure the building was safe and there wasn't an ongoing threat.
Today, I work in technology and have the opportunity to speak with security leaders across different industries, including healthcare. Those conversations have gotten me thinking about some of the situations I dealt with in law enforcement, but from a different perspective.
As a trooper, we were usually called when something had already happened or a situation had reached the point where someone needed immediate help. What interests me now is what organizations can do before things reach that point.
I don't know what information was available before that shooting or whether it could have been prevented. My perspective comes from responding afterward. What interests me now is how a concern gets reported and acted on before a situation escalates.
But when I think about workplace violence in healthcare more broadly, there's a question I keep coming back to.
Workplace violence is a serious issue in healthcare, and it doesn't always involve the kind of incident that makes the news.
It could be a patient threatening a nurse, a visitor becoming aggressive with staff, an issue between employees, or a domestic situation that carries over into the workplace.
In many cases, the first person to notice something concerning isn't a security officer. It's a nurse, a physician, someone working registration, or another employee who interacts with patients and visitors throughout the day.
Healthcare security teams are working hard to help employees recognize concerning behavior and know when to report it. That's important work, especially when clinical staff have so much else to manage.
But even when someone knows they should report a concern, the process can get in the way. If they have to stop what they're doing, find a separate system, and figure out which form to complete, reporting becomes another task competing with patient care.
Education and awareness matter. So does making the reporting process practical for the people expected to use it.
Can someone raise a concern from where they're already working?
And once they do, can they tell that it reached someone who can help?
Getting the report submitted is one challenge. What happens next is just as important.
Who receives it? Who decides how serious it is? Does security need to get involved immediately? Should a department manager be notified? Is this something that requires HR, a patient advocate, or another team?
Depending on the situation, several people or departments may need to be involved.
In a large healthcare organization, those teams aren't necessarily working in the same systems or even following the same processes.
A nurse might tell a supervisor about a concerning interaction. That supervisor might send an email to security. Security may document the incident in its own system, while another department has information about previous interactions involving the same person.
Now you have several people working on what may be the same issue, but not necessarily with the same information. Someone may need to reenter details, forward an email, or call another department to fill in the gaps.
Each manual handoff can create a delay or leave out a detail. An email can sit in an inbox while the sender assumes someone is acting on it. A previous report may be in a different system, unavailable to the team assessing the new concern.
The people involved may all be doing their jobs. The process still needs to make it clear who has the next step and give them the information they need to take it.
One thing I learned in law enforcement is that what you're initially called to deal with isn't always the whole story.
Domestic disputes are a good example.
You might get dispatched to a couple arguing, but once you're there and start talking with everyone involved, you find out there's a lot more going on. Financial problems, family issues, mental health concerns, or any number of things that contributed to the situation.
None of those circumstances excuse someone threatening or hurting another person. But understanding what's going on can make a difference in how you approach the situation and what resources might be appropriate.
I think there's a connection to healthcare here.
Imagine a family member who has become increasingly confrontational with hospital staff. Maybe their loved one is seriously ill. Maybe they're dealing with financial problems, struggling with a medical decision, or just overwhelmed by what's happening.
That doesn't mean security shouldn't get involved if someone is being threatened. Of course they should.
But depending on the circumstances, involving a patient advocate, social worker, or someone else who can help address the underlying issue might make a difference.
Other situations may require immediate intervention from security or law enforcement.
The challenge is figuring out what you're dealing with and getting the right people involved.
And that's a lot harder when relevant information is scattered across different departments or never gets reported in the first place.
Of course, healthcare organizations also have to be careful about how sensitive information is shared. The goal isn't to give everyone access to everything. It's making sure the people responsible for addressing a concern have the information they need and are authorized to use.
Hospitals invest significant time and resources into emergency preparedness. Active shooter training, lockdown procedures, emergency communications, and coordination with local law enforcement are all important.
Having been on the responding side of those situations, I understand why.
Security teams are also working to address concerns before they become emergencies. That work can be harder when it depends on chasing emails, checking separate systems, and manually coordinating with other departments.
How long does it take for someone to act on a concern after it's reported?
If several departments need to get involved, who makes sure that happens?
If there have been previous incidents involving the same person, is that information available to the people assessing the situation?
And once something has been addressed, how does the organization know the process worked?
These are questions about how the process supports the people doing the work. A security team can be committed to addressing a concern and still spend too much time gathering information or figuring out whether another department has acted.
Understanding where those delays happen seems like a useful place to focus.
We tend to measure things like incident volume, response times, and the number of cases closed. Those are useful metrics.
I'd also be interested in understanding how long it takes to get from the first reported concern to someone taking appropriate action.
Because in certain situations, that time could make a significant difference.
I don't work inside a hospital, and I wouldn't tell a healthcare security leader that they haven't thought about these issues. The question I'd want to ask is where the process makes their job harder than it needs to be.
Is it getting a report from a busy employee? Finding the details needed to assess it? Or getting several departments involved without spending the day sending emails and making calls?
Those problems put more work on security teams that already have a lot to manage.
Making reporting easier and reducing the manual work afterward could give those teams more time to assess the concern and decide what needs to happen.
It would also help to know whether the next step was taken, rather than having to chase someone for an update.
I don't think there's one process that's going to work for every hospital or health system.
But I do think making it easier to report concerns, getting the right information to the right people, and having a clear process for acting on it are areas worth examining.
My experience with workplace violence comes primarily from ten years in law enforcement. I'm now getting the opportunity to look at some of these challenges from the perspective of the organizations responsible for protecting their employees, patients, and facilities.
I certainly don't have all the answers, and I recognize that healthcare presents challenges I haven't personally dealt with.
But I do believe there's an opportunity to improve how concerns are reported, assessed, and addressed before situations become more serious.
For those working in healthcare security, I'm curious where you see the biggest challenges today.
Is it getting employees to report concerns? Making sure the right people have the information? Or coordinating what happens after a report is made?
I'd be interested in hearing your perspective, including where you might disagree with mine.
Erik Willett is a former New Hampshire State Trooper and SWAT team member who now works in enterprise security technology.
