Hospitals are not secure buildings. They are buildings with restricted areas inside. The cameras saw what happened. They cannot say who. Digital Tripwire logs every device that crossed the threshold, with a tamper-evident record that protects the patient, the nurse, and the institution.
A hospital is a 24-hour public building with restricted areas inside it. Visitors, contractors, agency nurses, and patients move through constantly. Staff turnover is high enough that nobody on the night shift knows everyone on the day shift by sight. The cameras at the nursery door, the pharmacy intake, the morgue, and ED triage capture everyone walking past. They cannot identify them, link them to other locations they were seen, or hand a defensible record to a federal investigator the next morning.
Every high-stakes hospital security failure shares that single gap. The camera caught the event. It did not produce evidence. Digital Tripwire was built to do exactly that, and it does it without changing how clinicians work.
Digital Tripwire nodes are embedded inside every restricted-access threshold across the hospital. Nothing on the patient floor changes. Nothing in the clinician workflow changes.
When a node detects motion or proximity, it scans every Bluetooth and Wi-Fi device within 10 feet. MAC address, signal strength, timestamp. Uploaded over LTE-M cellular, independent of hospital network and EMR systems. The log is HIPAA-aware: it captures device proximity, never patient health information. Exactly what a federal investigator or a Joint Commission auditor needs, and nothing more.
Strategic node placement covers the federally regulated, clinically restricted, and operationally sensitive zones across the hospital. Designed in coordination with security directors, pharmacy leadership, and risk management. Tap a node to see what it protects — or run the demo and watch a 2am threshold crossing get logged.
Behind the Pyxis
DEA Schedule II diversion documentation. Every override, every count discrepancy, and every wastage event gets a hash-signed record of the devices that were standing at the cabinet.
DEA Schedule II · override correlation
Inside the door frame
The most critical node in the building. Logs every device crossing the threshold regardless of whether an infant tag was present, working, or defeated.
Independent of infant tag · FBI export
Inside the OR door
Instrument counts and never-event records. When the count is off after closing, the room knows who was in it.
Instrument count · never-event record
Inside triage
The highest workplace-violence-incident location in the building. The device cluster of an assailant surfaces in seconds, not after a records request.
Assault event · repeat-actor match
Inside the dock frame
Equipment and supply shrink investigations. Roughly $4,000 per bed a year walks out of hospitals, and almost none of it is on camera in a usable way.
Equipment shrink · dock chain
Inside the cold room frame
Body and specimen chain of custody. The zone nobody audits until the one time it matters enormously.
Specimen custody · access log
Inside the unit door
Elopement and contraband documentation. Who crossed the threshold, when, and what device came in with them.
Elopement · contraband threshold
Inside the contrast cabinet
NRC radiopharmaceutical custody. Regulated isotopes with a federal paper trail and no device-level record behind it.
NRC custody · isotope handling
Modern L&D and nursery units rely on infant security tags that trip the door alarm if a tagged baby crosses the threshold. The catastrophic failure mode is when the tag is tampered with, removed prematurely, or defeated by an abductor who knows the system. Post-incident reviews almost always identify the same gap: the alarm worked, the camera caught a person walking out, the staff could not identify them in time, and the FBI investigator showed up to a hospital that could not produce defensible records of who was present during the abduction window.
Digital Tripwire is the independent record. The node inside the L&D and nursery door frame logs every device that crosses the threshold, every time, regardless of whether an infant tag was present, working, or tampered with. When the worst happens, the FBI gets a hash-signed proximity log of every person who entered or left the unit during the relevant window, cross-referenced against every other node in the building.
DEA Schedule II handling requires controlled substances be stored in a securely locked cabinet with strict accountability for every dose dispensed and wasted. Most hospitals satisfy the letter of the law with a Pyxis or Omnicell, a witnessed waste log, and a quarterly inventory. The DEA Diversion Investigator who walks in for an unannounced audit wants more: defensible, timestamped, tamper-evident records of who was present at every override, every count discrepancy, and every wastage event.
Diversion is almost always internal, almost always by a clinician with authorized access, and almost always documented for months in subtle Pyxis transaction patterns the hospital cannot prove. Digital Tripwire produces the proof: hash-signed proximity logs of every device present at every Schedule II event, exportable to DEA, the State Board of Pharmacy, and the hospital's diversion task force.
The ED is the epicenter, with triage staff, charge nurses, and physicians absorbing the bulk of the assault, threat, and intimidation events. Most of these end with a stitched-up nurse, a filed incident report, and no documented identification of the assailant beyond a badge photo if they were a registered patient. If they were a visitor or a non-registered companion, the camera might have a face. It almost never has a name.
Digital Tripwire logs every device present at every ED event. When a charge nurse is assaulted at triage, the proximity log surfaces the device cluster of the assailant within seconds, cross-referenced against lobby, parking, and elevator nodes to produce a complete movement record. The same device cluster appearing at a second hospital across the system the next month flags the repeat threat actor before they reach the triage desk again.
We asked former FBI forensics investigators, federal prosecutors, and family court judges. They'd never seen BLE proximity data used as evidence. Until now.
The system is purpose-built to be HIPAA-aware. It captures device proximity (MAC address, signal strength, timestamp) only. It does not capture, store, or transmit any patient health information, clinical content, audio, video, or identifying patient data. Because it does not handle PHI, it does not fall under the Business Associate framework the way an EMR or billing vendor would. The deployment is reviewed alongside the hospital's privacy officer and risk management team, and a standard policy disclosure framework is provided for visitor and contractor signage.
No. Nodes are passive sensors hidden inside door frames, behind cabinets, and inside hardware clinicians do not interact with. There is nothing for nurses, physicians, or pharmacy staff to scan, badge, or remember. The system is intentionally invisible to the clinician, which is also why it produces a defensible record: the people being logged do not know they are being logged at the device level, which is exactly what a diversion investigation requires.
It runs alongside your existing infant-tag system as an independent backup record. The infant tag remains the primary alert mechanism. The Digital Tripwire node at the L&D and nursery threshold is the forensic record that survives tag tampering, malfunction, or a workflow gap. In the catastrophic-failure scenario where the tag system fails, the proximity log is what hands the FBI the device cluster of every person who crossed the threshold during the abduction window. The two systems are complementary, not redundant.
The export is designed specifically for regulatory and federal evidentiary use. Each log entry is hash-signed at the moment of capture, the upload chain is documented, and the export package includes chain-of-custody metadata showing every transformation between capture and delivery. Digital Tripwire is built around the same evidence-handling standards used in digital forensics. DEA diversion investigators, Joint Commission auditors, and CMS surveyors review supplemental electronic logs as part of standard practice, and the export is structured to fit that review.
The intended deployment is in restricted-access zones (pharmacy, L&D, OR, behavioral health, materials management, morgue) where patients and visitors already operate under documented monitoring frameworks including cameras, badge access, and signage. The system does not capture identity, content, or any data outside MAC address proximity. This is functionally similar to the proximity logging hospital Wi-Fi infrastructure already performs for network management and asset tracking, and it falls under the same disclosure framework.
Standard hospital pilots run 90-120 days, focused on the highest-stakes zones first: pharmacy with Pyxis, L&D and nursery, and the ED. Six to nine nodes plus a hub. Installation is non-invasive and is typically done by hospital facilities during a routine maintenance window. The pilot is structured as a formal evaluation with security, pharmacy, risk management, the privacy officer, and nursing leadership at the table. Most hospitals expand from a single-unit pilot to a system-wide deployment within twelve months.
Hospital pricing scaled to bed count. Pilot a single unit in 90 days. DEA-grade chain of custody, infant security backup record, ED workplace violence documentation, hash-signed forensic export packets.
Request a Hospital Pilot