title: Agent of opportunity risk mitigation: people, engineering, and security efficacy.
abstract: BACKGROUND
  Agents of opportunity (AO) are potentially harmful biological, chemical, radiological, and pharmaceutical substances commonly used for health care delivery and research. AOs are present in all academic medical centers (AMC), creating vulnerability in the health care sector; AO attributes and dissemination methods likely predict risk; and AMCs are inadequately secured against a purposeful AO dissemination, with limited budgets and competing priorities. We explored health care workers' perceptions of AMC security and the impact of those perceptions on AO risk.
  
  
  METHODS
  Qualitative methods (survey, interviews, and workshops) were used to collect opinions from staff working in a medical school and 4 AMC-affiliated hospitals concerning AOs and the risk to hospital infrastructure associated with their uncontrolled presence. Secondary to this goal, staff perception concerning security, or opinions about security behaviors of others, were extracted, analyzed, and grouped into themes.
  
  
  RESULTS
  We provide a framework for depicting the interaction of staff behavior and access control engineering, including the tendency of staff to "defeat" inconvenient access controls. In addition, 8 security themes emerged: staff security behavior is a significant source of AO risk; the wide range of opinions about "open" front-door policies among AMC staff illustrates a disparity of perceptions about the need for security; interviewees expressed profound skepticism concerning the effectiveness of front-door access controls; an AO risk assessment requires reconsideration of the security levels historically assigned to areas such as the loading dock and central distribution sites, where many AOs are delivered and may remain unattended for substantial periods of time; researchers' view of AMC security is influenced by the ongoing debate within the scientific community about the wisdom of engaging in bioterrorism research; there was no agreement about which areas of the AMC should be subject to stronger access controls; security personnel play dual roles of security and customer service, creating the negative perception that neither role is done well; and budget was described as an important factor in explaining the state of security controls.
  
  
  CONCLUSIONS
  We determined that AMCs seeking to reduce AO risk should assess their institutionally unique AO risks, understand staff security perceptions, and install access controls that are responsive to the staff's tendency to defeat them. The development of AO attribute fact sheets is desirable for AO risk assessment; new funding and administrative or legislative tools to improve AMC security are required; and security practices and methods that are convenient and effective should be engineered.
authors.affiliation: Department of Emergency Medicine, New York University School of Medicine, USA.
authors.forename: Margaret E
authors.initials: ME
authors.lastname: Graham
authors.forename: Michael G
authors.initials: MG
authors.lastname: Tunik
authors.forename: Brenna M
authors.initials: BM
authors.lastname: Farmer
authors.forename: Carly
authors.initials: C
authors.lastname: Bendzans
authors.forename: Aileen M
authors.initials: AM
authors.lastname: McCrillis
authors.forename: Lewis S
authors.initials: LS
authors.lastname: Nelson
authors.forename: Ian
authors.initials: I
authors.lastname: Portelli
authors.forename: Silas
authors.initials: S
authors.lastname: Smith
authors.forename: Judith D
authors.initials: JD
authors.lastname: Goldberg
authors.forename: Meng
authors.initials: M
authors.lastname: Zhang
authors.forename: Sheldon D
authors.initials: SD
authors.lastname: Rosenberg
authors.forename: Lewis R
authors.initials: LR
authors.lastname: Goldfrank
mesh_terms: D000046:Academic Medical Centers / Q000458:organization & administration* / Q000592:standards; D003695:Delivery of Health Care / Q000379:methods / Q000458:organization & administration*; D004189:Disaster Planning / Q000379:methods / Q000458:organization & administration; D014943:Global Health; D006761:Hospitals / Q000592:standards; D006801:Humans; D036301:Qualitative Research; D018570:Risk Assessment / Q000379:methods*; D040242:Risk Reduction Behavior; D012637:Security Measures; D023481:Terrorism / Q000517:prevention & control*