"We had 11 gaps we didn't know existed."

The situation

A 340-bed regional hospital network operating across three campuses engaged WorldSafe after a series of after-hours access incidents that the internal team couldn't fully explain. Their existing security program consisted of badge access infrastructure and a contracted guard service — both of which were functioning as designed. The incidents kept happening anyway.

The VP of Operations had spent two decades in healthcare operations and had engaged security consultants before. He was skeptical that an assessment would find anything the existing program hadn't already surfaced. He was wrong.

What we found

WorldSafe conducted a 2-day on-site assessment across all three campuses, including after-hours observation periods that the previous security reviews hadn't included. Within the first walk-through, the pattern became clear: the badge access system was functioning correctly. The gaps were in the behaviors and physical configurations that the badge access system assumed were being managed.

The 11 gaps documented in the final report included:

• A propped emergency exit on the second floor of the main campus that had been propped consistently for months — visible in CCTV footage that no one was reviewing
• Camera blind spots covering two stairwells that connected the emergency department to upper floors
• A visitor credentialing process that had not been updated since a 2019 facility renovation — after-hours vendor access was uncontrolled
• Active badge credentials for 23 former employees and contractors, including two whose departures had been involuntary
• A pharmacy access point with a shared PIN that had not been changed in 14 months
• No documented protocol for challenging unfamiliar individuals in the after-hours period
• An emergency notification system that depended on a single communication channel with no backup
• A response plan that the current security director had never read — it had been written by their predecessor
• No post-incident review process for the access incidents that had prompted the engagement
• Two loading dock access points with camera coverage that was obscured by seasonal delivery equipment
• A staff parking structure with no coverage during the 11pm–2am shift change window

The remediation

The report delivered a prioritized remediation roadmap with each finding ranked by severity and estimated financial exposure. The client's internal team, now working from a clear action plan rather than an undefined problem, closed 9 of 11 findings within 60 days. The remaining 2 required capital expenditure that was approved in the following budget cycle.

The after-hours access incidents stopped within three weeks of the first remediation actions — before the full 60-day remediation was complete. The propped door and the vendor credentialing gap were the root cause of the incidents the engagement had been triggered to address.

What happened next

The VP of Operations enrolled the network in WorldSafe's RaaS program within 90 days of the initial assessment. The first quarterly reassessment identified 3 new gaps that had emerged during a facility renovation in the intervening period — a finding that, in his words, "justified the entire program cost in a single visit."

The network has maintained WorldSafe Certified Level 1 status since the completion of initial remediation, and is currently on the path to Level 2 following a passed tabletop exercise in Q1 2026.