After flying like 10,000 miles on four cross-country flights in the past two weeks, I’ve finally slept enough to write a (mostly) coherent newsletter. Might have to change that banner from “every Tuesday” to “most Tuesdays… and sometimes Wednesdays”.

Cal/OSHA released a discussion draft on September 14 proposing amendments to Title 8 Section 3342. The proposed changes to California's healthcare workplace violence standard put weapons screening at every unrestricted entrance of a general acute care, acute psychiatric, or special hospital. Comments close October 12, the Standards Board is working against a March 1, 2027 deadline to adopt something, and hospitals get 90 days after that.

California hospitals already screen under AB 2975, but only at 3 specific doors: the main public entrance, the emergency department, and labor and delivery. The draft drops the list and asks instead whether a door is one anybody can walk through with no lock and no access control. Every door that meets that description is an unrestricted entrance, so a hospital covers each one of them. Ambulance entrances are excluded.

At an unrestricted entrance a hospital can screen with any of 5 methods: walk-through metal detectors, x-ray and CT systems, millimeter-wave, AI-assisted weapons detection, or magnetic anomaly detection. Handheld wands can only supplement one of those and can't be the whole screen. The draft sets no performance floor and names no testing standard for any of the 5.

Three exemptions let a hospital work an entrance with wands alone: small and rural hospitals, entrances with no room for a walk-through unit, and certain long-term care hospitals.

The equipment has to be operated by trained personnel whenever the entrance is open to the public, and the draft says those personnel can't be healthcare providers. Every unrestricted entrance needs a screener posted on it for as long as the door is unlocked.

Training is at least 8 hours across 17 topics, covering weapons and threat recognition, equipment limitations, safe searches, de-escalation, implicit bias, and disability awareness. Refreshers are annual, and more training is required when the equipment or the hazard changes. Whether to screen the hospital's own badged employees and providers is left to each hospital.

When a device alarms, the draft doesn't permit confiscation. The person has to be allowed to leave with the object and come back without it, and the hospital can't deny entry because they had it.

Signage at every unrestricted entrance has to say that screening happens and that nobody gets refused medical care. EMTALA requires a hospital to screen and stabilize anyone who presents at an emergency department, so a weapons checkpoint can't become a reason a patient doesn't reach care.

SCC Spectrum Security Almanacs

Patrol routes run the perimeter inward, which is the opposite of the direction anybody leaves a building in an emergency. Walking it the other way, starting somewhere deep inside and heading out, turns up different things.

Anything on that path that needs a key or a good shove is a finding. A door can be correctly secured and still be an egress violation, since the two rules were written by different people solving different problems and both of them apply to the same piece of hardware.

Most of what turns up has a reason behind it. Somebody zip-tied a crash bar because product was walking out that door, and they fixed a real problem with what they had on hand. The answer there is usually a better solution to their problem, not an instruction to stop.

NFPA 101 covers this as means of egress. Security programs get written against security standards, life safety applies to the same doors, and reconciling the two is rarely anybody's assigned job. Then again if you had SCC Spectrum for Hospitals, that would be an easy task...

Apex AI: Join the waitlist

A DOJ and DHS interim final rule (interim final?) that took effect July 1 gives counter-drone authority to local police and leaves facility owners where they were. This builds on what I wrote in Issue 9 about the FAA's Part 74 fixed-site restriction, where the conclusion was that a site owner has no authority to act. That hasn't changed.

The rule allows state, local, Tribal, and territorial law enforcement and correctional agencies to detect, track, and in some cases disable or seize a drone that poses a credible threat to a public safety facility, critical infrastructure, a correctional facility, or a major public event. Detecting or bringing down a drone over your own property still runs into the federal aircraft piracy, destruction-of-aircraft, computer fraud, Wiretap Act, and pen register statutes, and the rule waives those for certified agencies only.

A facility that wants the capability has to get it from a police department that has certified, and certification runs through the FBI. Tier 1, detection and warning, is an online assessment that certifies automatically on a pass. Tier 2, mitigation, takes in-person training at the FBI's National Counter-UAS Training Center. The NCUTC is the only body that can certify either tier, so a course from a vendor or an association doesn't count.

Equipment is restricted the same way. DOJ, DHS, DoD, FAA, FCC, and NTIA jointly review counter-drone products, and an agency can field only what appears on the resulting list of approved systems. A product that sits in an approved category but not on that list can't be used.

SCC Spectrum Security Almanacs

Slow. Walked the building backwards for Mikey.

Backwards meaning I started in the middle and walked out, which is a stupid way to walk a building. I've walked this building the correct way for 11 years. You go around. That's how it works.

So I go out through the stockroom and there's a pallet jack and about 6 skids of paper towels in front of the far door. Not near it. In front of it.

Now I know why. Kevin has been getting hit through that door for months, people propping it and coming back at night, and he put the skids there because nobody would give him anything better. He was solving his problem, he just built a wall in front of an exit doing it.

Got maintenance to put a proper alarm contact on it and moved the skids. Kevin is happier than I am about it.

The part I don't love is that I've walked past those skids probably 40 times. From the other direction they're just skids. You have to be coming at the door to see it's a door.

The door you never approach from the inside is the one nobody checks.

SCC Spectrum Security Almanacs. www.strategiccommandcenters.com/products