How Zone-Based Access Control Transformed Patient Safety at a Montreal Hospital

When a 400-bed acute care hospital in the Greater Montreal area approached Tawy Systems, they faced a challenge familiar to healthcare administrators across Canada: how do you maintain the open, welcoming environment patients and families expect — while ensuring that restricted clinical areas remain genuinely secure?

The answer, as it turned out, was not more locks. It was smarter ones.

The hospital's legacy access control system was a patchwork of standalone card readers installed over more than a decade. Different wings used different credential formats. The pharmacy, ICU, and surgical suites each had their own access management process — none of which were integrated. Security staff spent hours each week manually auditing access logs that existed in three separate systems.

The consequences were measurable. In the 12 months prior to the Tawy engagement, the hospital recorded 47 documented incidents of unauthorized access to restricted areas. Staff credential management was consuming an estimated 18 hours of administrative time per week.

Tawy's engagement began with a comprehensive site assessment — mapping every access point, documenting existing credential types, and interviewing department heads to understand workflow requirements. The goal was not to impose a standard solution, but to design one that fit the hospital's specific operational reality.

The resulting design called for a unified access control platform built on a leading enterprise access management system, with zone-based permissions that reflected the hospital's actual security hierarchy:

• Public zones: Main lobby, outpatient waiting areas, cafeteria — open access
• Staff zones: Administrative offices, staff corridors, break rooms — single-factor badge access
• Clinical zones: Patient wards, nursing stations, diagnostic imaging — badge + PIN
• Restricted zones: ICU, pharmacy, surgical suites, server rooms — badge + biometric

All zones were integrated into a single management platform, giving the security team a unified view of access events across the entire facility in real time.

The project was completed in four phases over 14 weeks, with careful scheduling to avoid disruption to clinical operations. Tawy's project team worked overnight and on weekends for installations in active clinical areas, coordinating closely with nursing leadership and facilities management.

Credential migration was handled through a parallel-run period: existing cards continued to function while new credentials were issued, eliminating the risk of staff being locked out during the transition.

Staff training was delivered in department-specific sessions, with role-based guides developed for clinical staff, administrative staff, and security personnel.

Twelve months after go-live, the results were clear:

• 94% reduction in documented unauthorized access incidents (from 47 to 3)
• Administrative time savings of 16 hours per week through unified credential management
• Audit compliance improved from 67% to 99% on quarterly access reviews
• Staff satisfaction with the new system rated 4.6/5 in post-implementation survey

The hospital's Chief Security Officer noted: "We now have a system that actually reflects how our facility works. The Tawy team understood healthcare — they didn't just install technology, they solved our problem."

Healthcare access control is not a commodity. The difference between a system that works and one that truly protects patients and staff lies in the design — in understanding the clinical environment, the workflow requirements, and the compliance obligations that are unique to healthcare.

Tawy Systems brings that understanding to every healthcare engagement. If your facility is operating on aging or fragmented access infrastructure, we would welcome the opportunity to assess your environment and discuss what a modern, integrated solution could look like.