Lab security: From risk assessment to calming nerves

Biological agents are often necessary tools in clinical and research laboratories. These same agents, however, could prove devastating if they fall into the wrong hands or are treated carelessly - which is why proper risk assessment and security measures have become such a vital part of biomedical lab procedures.

In a report presented to the Center for Disease Control, Jonathan Y. Richmond, Ph.D. pointed out that traditional laboratory biosafety guidelines have emphasized use of optimal work practices, appropriate containment equipment, well-designed facilities and administrative controls to minimize risk of unintentional infection or injury for lab workers and to prevent contamination of the outside environment.

Lab security in new construction becomes part of the process almost immediately, experts say.

"It really almost starts at the beginning as a program requirement," said Lou Hartman, Principal and Sr. Mechanical Engineer with Harley Ellis Devereaux.

Hartman and Ken Mohr, Principal and Sr. Forensic Laboratory Planner with HERA, Inc., formed a strategic alliance called Crime Lab Design, which provides full A/E services for forensic and medical examiner facilities.

"Security itself is a site planning issue as well as a building design issue," Hartman said. "In the projects we're working on it's not the first question - but it's right up there."

Kevin Tuohey, director of security at Boston University Medical Center (BUMC), and the university's planned National Emerging Infectious Diseases Laboratory - a biosafety-4 facility, said lab managers should be thinking about security from the very beginning.

"I think a risk assessment is very important during the planning stage," Tuohey said. "It allows you to identify issues and include the mitigation of those issues in the design and eventually in the construction of the facility."

However, since individual labs have specific needs, what may be acceptable in one facility may not be sufficient for another. Laboratories require security measures based on their intended uses, Tuohey said. If select agents are to be used then there are security measures that need to be in place as a matter of regulation.

Hartman said the security measures needed depend entirely on what the function of the facililty will be.

"Security is comprised of a number of different components," he said. "From access control, the ability to get close to a building - now we worry about car bombs and things like that - to issues related to access control like surveillance on key pieces of the building and intrusion alarms."

Animal facilities carry with them their own specific set of needs, Tuohey said.

"If there are animal facilities then there need to be other considerations specific to those areas," he said. "Security measures must include both access control and audit systems and must be coordinated with life safety and building automation systems. Labs require fairly intense mechanical systems and those systems need to be monitored for functionality, safety and security."

There is a definite way to go about selecting which security system would best fit a particular facility, Tuohey said.

"The selection of security systems and technologies should be one of the outcomes of the risk assessment," he said. "And the selection of systems relies on the type of work being done and the conditions it will be done in, the size and complexity of the space being addressed, the needs of the rest of the campus or facilities and the ability to integrate that technology with other systems."

The most effective programs use a combination of staff, mechanical locks, access control devices and protocols, experts say.

"BUMC uses a variety of these approaches including biometrics and given the need to wear extensive personal protective equipment in high containment laboratories we selected biometric access control devices that provide identification through the eye," Tuohey said.

Most modern labs use a combination of these approaches, while many are using or are moving toward biometric technologies. While biometric security takes advantage of the highest level of technological security, others say there's still something to be said for the low-tech approach: An alert employee, constant awareness and a good set of eyes.

"The low tech approach has benefits as the chance of electrical or mechanical failure is greatly reduced," Tuohey said.

But there are problems with relying on the human element. The 'access and audit' approach relies on human record keeping and is more susceptible to human error.

"I am a firm believer that there is a balance and that the most successful programs can stand alone on both high tech and low tech approaches but are much better off with a program that uses both," Tuohey said.

Lab administrators are often concerned by a worst-case scenario wherein lax security would result in damage or an attack. Hartman said that while the events including and since the Sept. 11, 2001 terrorist attacks may have heightened public awareness, these concerns have always been part of lab security planning.

"If you think about federal projects, there are requirements that pre-existed 9/11," he said. "But there certainly is a heightened awareness of it."

Tuohey has dealt with concerns by meeting one-on-one with community members to discuss security.

"I have attended many community meetings and have been asked to address a variety of concerns over the years," he said. "We deal with the community by communicating openly, educating people on our initiatives and most importantly by listening to community concerns and addressing them."