Cracking the Code on Cabinet Locks

When it comes to locking cabinets, you have mechanical-lock options and electronic-lock options … and that’s all you need to know, right? Not really. Not all cabinet locks are the same, particularly with respect to government regulations.

Yes, regulations.

Sure, you’re familiar with regulations that pertain to the Americans with Disabilities Act (ADA), but what about the Health Insurance Portability and Accountability Act (HIPAA) or The Joint Commission or … ?

It turns out that government regulations typically don’t address cabinet locks specifically as they do, say, fire doors. But because cabinets are included under the category of areas that must be secure under multiple regulations, it’s important for locksmiths to identify cabinet locks that help customers adhere to the spirit of those various and sometimes overlapping regulations.

“There are multitudes of types of cabinets,” says Benjamin Williams, director of product management for ASSA ABLOY ESH, which includes the HES line of cabinet locks among others. “There is something to secure every one of those, and 9 times out of 10, one particular lock may not be the preferred method. All cabinet locks are not created equal.”

Matt Welty, general manager of Codelocks, agrees.

“You can spend a lot of money” on cabinet locking solutions, he says, “but it doesn’t give you any more benefit, or it might not give you enough—either way, it’s a waste of money.” Locksmiths should be familiar not only with any regulations that might apply to cabinet locks but also what products meet those regulations. “And what product to choose that will meet the [customer’s] budget. It’s not the same solution for every situation.”

Know the Rules

As you might suspect, most government regulations that involve cabinet locks are aimed at the health-care industry:

ADA: This is the lone regulation that has specific guidelines. To be ADA-compliant, a cabinet lock must have all operable parts operable by one hand and can’t require tight grasping, pinching or twisting of the wrist. All operable parts must require a force of no more than 5 pounds.

HIPAA: Most of the law is concerned with ensuring patient privacy, but security is an important part of that. However, all HIPAA has to say is that a facility that operates under the auspices of the law must have “policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering and theft.” That’s it. In fact, those policies and procedures are left entirely up to the facility itself and that “any security measures” that allow the facility to comply with this standard are acceptable.

The Joint Commission: The organization known colloquially as JCAHO oversees hospital accreditation. As such, it has rules in place for a wide range of categories, including pharmaceutical cabinets and emergency carts. The security of the contents of those cabinets is required, but, again, that doesn’t mean that a lock is required. However, if a lock WERE used, The Joint Commission says the lock should be easy and quick to open, and it should allow a facility to detect tampering. (As such, it mentions a combination padlock as a device that might create delays in delivering immediate emergency care and thus not be acceptable.)

DEA: The Drug Enforcement Administration is clear that controlled substances and medications must be in a “securely locked, substantially constructed cabinet.” However, although DEA lays out what it considers to be “a substantially constructed cabinet,” it says nothing about the cabinet lock itself.

SOC 2: This isn’t a regulation so much as a compliance standard. It deals primarily with auditing financial records, but it has relevance to health-care facilities in that facilities that don’t separate their financial and medical-records data systems must ensure that their servers are secure. As elsewhere, specific locking guidelines aren’t mandated.

The takeaway from all of this is, again, no one solution fits every situation. All that’s really required in most cases is that a standard operating procedure is in place and that the procedure is followed, says Lou Galvao, distribution channel manager at CompX.

“If you have a standard operating procedure, and it requires mechanical locks and you don’t give out keys, that’s fine,” he says. “There’s nothing telling you, ‘You have to have THIS.’ ”

The Locks Themselves

Although government regulations about cabinet locks might not be specific, aside from ADA, the regulations leave clues as to what lock features would help facilities fall under compliance, as well as serve the demands of the facility. These clues point to advantages that electronic locks can provide.

One such clue, indicated by The Joint Commission, is that a cabinet lock should allow for easy and quick access. The easier and quicker the access provided, the better, because if anything is clear about cabinet-lock rules, it’s that the cabinet should be locked when it isn’t in use.

Welty concocts a scenario where a nurse, for example, who must go to a medication cabinet, enter a series of codes on a keypad and turn a latch to relock the door repeatedly might find that to be a nuisance and perhaps defeat the lock. A self-locking lock and a prox credential are convenience features that would prevent that scenario. “As a user, if [the lock is] less of an inconvenience and less of a hassle, the more likely I am to lock it,” Welty says.

(Of course, if a cabinet lock unlocks simply by waving, say, a fob or your cellphone in front of it, that lock complies with ADA, too.)

Another clue is suggested more explicitly in the regulations—access control. Simply, if the point of regulations is to ensure security and a lock isn’t required, then it’s necessary to control access to certain cabinets and the contents and ensure that only authorized personnel have that access.

Murray Lewin, senior product manager/site lead for dormakaba RCI, puts it this way regarding cabinet locks and compliance with government regulations—they’re part of a solution and not necessarily the entire solution. He mentions a computer server rack, which might be vulnerable to theft and, thus, potentially, a violation of HIPAA (among other problems), having multiple layers of security protocols in place.

“By the time someone gets to the rack, the person gaining access to it will have been very likely to be approved” by the lock on the server cabinet, he says. “That’s the whole intent: Make people get through levels of security before they get to the lock.”

Nevertheless, today’s electronic or electric cabinet locks help a customer stay on top of access control in two ways:

• By quickly assigning or canceling credentials.
• By monitoring the actual access.

Although none of the federal regulations noted above explicitly uses the word “rekey” in its wording, the idea is definitely there. In each regulation, it’s mandatory for a facility to make sure that access remains under control in case of a personnel change—either a temporary one based on duties or the time of day, or a permanent one in case of a resignation.

Obviously, it’s far easier to cancel a key card and reprogram an electronic lock, for example, than it is to rekey a mechanical lock. Plus, depending on the lock, a customer might be able to handle multiple electronic locks remotely. Some locks even will allow the customer to program the lock so only certain people have access at certain times and on certain days.

Customers will want to know who accessed those cabinets and when, particularly if something were to go missing. That long has been a concern with medications, but now because of the COVID-19 pandemic, facilities also want to prevent the loss of, say, gloves or masks.

Audit-trail capability that provides a list of the past number of times a lock was accessed has become a widespread feature on electronic locks in general, and more cabinet locks are adding this capability.

What’s Next?

Speaking of COVID-19, no one interviewed for this article believes that any new regulations that might involve cabinet locks will stem from the pandemic. Welty points out that ADA and HIPAA, for example, came about because they were aimed at long-term issues—people who have disabilities and patient privacy—rather than as a reaction to a particular event or circumstance.

There likely will be more of a demand for cabinet locks to lock items that previously weren’t considered to be valuable, at least in the short term, and Williams suggests that the demand might produce a new type of cabinet lock, if not rules that govern the product.

“What’s next? That is the million-dollar question,” he says, noting a newfound interest in touchless access. “We can change the product, provide coating that’s antimicrobial, or we can change the experience, so that when someone approached the cabinet, that cabinet pops open for them.”

Stay tuned. For now, here’s a roundup of a few of the electronic cabinet locks that could provide compliance with “the spirit” of government regulations:

Codelocks KitLock KL1050

The ease of use and accessibility on the KitLock KL1050 got an upgrade with the introduction of two new means of access. Now, in addition to a MIFARE keycard, users can wave their arm or practically any other product in front of the lock to unlock it. That’s because Codelocks added wristband and sticker credentials to its lineup.

The rubber wristband has a prox credential built inside it for the lock reader to identify. The round sticker is about 1 inch in diameter, and it can be affixed to the back of a cellphone case or even another key card.

Welty says this is an excellent solution for a facility that has an HID access system in place but doesn’t want to issue two cards or collect and reissue a series of cards for a lock.

“A locksmith in a lockshop can enroll the sticker in the lock and can issue it to the user; the user can put the sticker right on the HID card,” he says. The two technologies operate at different frequencies, so they won’t interfere with each other.

As for the lock itself, a notable feature is its private/public function. In private mode, the lock can be unlocked by anyone who has a proper credential (and relocks automatically after 4 seconds). In public mode, it can be unlocked only by the last credential that locked the lock. A red LED flashes every 5 seconds to indicate the lock is locked.

Features:

• Retrofits or new applications
• Any orientation in 45-degree increments
• Slam latch accessory available
• Up to 50 users
• 2 AAA batteries, 15,000 cycles
• Low-battery warning
• 5-3/8 in. (h) x 1-5/16 in. (w) x 1-1/8 in. (d)

More info: www.codelocks.us

FJM Security Combi-Cam E miniK 10

FJM Security loves to tout the small profile of its Combi-Cam E cabinet locks, but don’t let the tiny size fool you. A recent upgrade added management of multiple locks through your cellphone.

Several models in the Combi-Cam E line are compatible with the Hopinlock Manager mobile app for Google Android devices that have near field communication (NFC) technology. (Nearly all recent models do.) When held next to a lock, the app allows customers to program multiple locks at once as well as lock and unlock the lock itself. The app also allows customers to pull an audit trail from the lock of as far back as the past 500 transactions, and an optional feature activates an audible warning if a cabinet door were left open.

As of press time, FJM was working on allowing the locks to be programmed remotely, including sending out time-dated passcodes.

Features:

• Retrofits standard 3/4-in. cam locks
• Semi-flush or surface mount
• Left- or right-hand operation
• 3.0V Lithium CR2450 battery, up to 10 yrs. use
• Low-battery warning
• 3-1/4 in. (h) x 1-1/4 in. (w) x 5/8 in. (d)

More info: www.fjmsecurity.com

RCI 3590 Lock ’N’ Prox

If you’re looking for a cabinet lock that has a really low profile, how about a lock that you can’t even see? The venerable 3590 Lock ’N’ Prox by dormakaba brand RCI is installed inside a cabinet, with no exterior face. A prox card or fob unlocks the lock through a wood door that’s up to 1 inch thick, and an optional wired reader extends the range to 5 feet. (The reader is required for a metal cabinet door.)

The 3590 Prox ’N’ Lock has no cam but rather a pin-type strike, and a spring-loaded right-angle door release pin is available. Lock installation is quick and simple, and card or fob programming doesn’t require a computer.

An optional alarm function beeps if a door is left open for more than 30 seconds, and the alarm sounds continuously if the cabinet door were forced open. The alarm option is notable, because that model (3590A) has a holding force of 450 pounds.

Features:

• Up to 50 users
• 3V lithium battery, up to 30,000 cycles (3.6V plug if external reader is used)
• Low-battery warning
• Lock: 2-3/8 in. (h) x 2-3/8 in. (w) x 7/8 in. (d)

More info: www.dormakaba.com

Lowe & Fletcher Horizon Real Time Clock 3951

An update to the Horizon cabinet lock, the Horizon Real Time Clock 3951 has an upgraded processor that includes a real-time clock. The clock makes several new features available through Lowe & Fletcher’s optional RAS electronic access control system. Perhaps the most notable is that a customer or locksmith can set up the lock so certain people (up to 50 per lock) have time-controlled access.

“Whoever buys the lock, the locksmith can program the lock to work Monday through Friday, 7 a.m. through 3 p.m. if you use ‘this code’ on it,” says Vince Regan, sales director of Lowe & Fletcher. “If you try [the same code] at 5 on Tuesday, it won’t unlock. You can give a different code to the second-shift team and make that be permanent.”

He provides another example about contractors working in a facility who require access to tools locked in cabinets. “You could say, ‘For two weeks, you’ll have access from this time to this time at night on weekdays.’ Those are a few of the things a real-time clock inside the lock will do for you.”

Another thing is audit trail. Although the Horizon 3951 doesn’t have that capability yet, Regan tells us it’s coming soon.

As with the Horizon 3950, the 3951 has a pop-out turn handle that’s flush when locked and comes in white as a standard color option, which is worth noting for health-care applications.

Features:

• Retrofits standard cam locks
• Vertical, left or right fixing
• Flush or surface mount
• Lithium CR123 battery
• Low-battery indicator
• Keeps time during battery change up to 30 sec.
• 4-3/4 in. (h) x 1-13/32 in. (w) x 1-3/32 in. (d)

More info: www.loweandfletcherinc.com

CompX eLock 200/300 Series

Access control is the name of the game for the eLock 200/300 Series. Through the optional LockView software, the eLock 200/300 reports time, date and user name audit-trail data of up to the last 15,000 times a cabinet lock was opened, or attempted to be opened.

Further, the eLock 300 lets customers do just about anything with the information the lock collects because of its network capability, either through Wi-Fi or Ethernet connectivity. (The eLock 200 doesn’t have network capability but is otherwise identical to the 300.) Galvao uses the example of the lock signaling that its battery power is low.

“If the battery is getting low, [the lock] will send a notification, and I can send that to maintenance,” he says. “Or the locksmith guy will get the email that the battery is low, and he can swap out the battery the next time he’s in the area.” Unauthorized-entry attempts could go straight to security in such a system, Galvao adds.

Network capability also allows the customer to program access to the lock remotely for as many locks as are in the network. Access itself is provided by the lock’s keypad, an HID or HID iCLASS prox card, a magstripe card or dual authentication via a card and PIN, and the eLock 200/300 automatic relocks when the cabinet is closed.

The eLock 200/300 is a built-in component of the CompX Narcotics Box, which is a specially designed cabinet aimed at use in emergency medical services vehicles.

Features:

• Installs on new or existing cabinets
• Up to 3,000 codes
• Six AA batteries or dedicated power supply
• 9V battery backup available
• Controller: 3-1/2 in. (h) x 5 in. (w) x 3/4 in. (d)

More info: www.compxelock.com

HES KS100

Ensuring the security of computerized health records doesn’t just mean making sure that computer systems are hackerproof. They also have to be theftproof. The HES KS100 from ASSA ABLOY is aimed at protecting dedicated server cabinets, and the lock takes monitoring to an extreme.

Simply, the KS100 uses wireless connectivity to an Aperio-based access control hub to monitor the lock for up to four conditions: that the handle is nested in the lock body, that the cam hasn’t been rotated, that the tamper switch hasn’t been activated and, optionally, that the cabinet door itself is closed. If any one of these conditions isn’t met, a facility administrator will know about it.

The result is that “you’re in a position to know that server cabinet door is closed, latched and secure, all in the same state, all at the same time,” Williams says.

The lock’s audit-trail capability is limited only by the electronic access control system in place, and access can be managed remotely and granted through a variety of card technologies, including HID, MIFARE and DESfire, as well as any NFC-capable mobile device. The KS100 has a mechanical-key override and can include a Medeco X4 small-format interchangeable core. The lock itself has a holding force of 350 pounds.

Features:

• Installs on cam-activated swing handle cabinets, 150 mm x 25 mm (6 in. x 1 in.) lock prep
• Nonhanded
• 2 AA lithium batteries, up to 50,000 cycles
• Battery voltage monitoring
• microUSB port for emergency power
• Face: 9 in. (h) x 1-3/4 in. (w) x 1-5/16 in. (d)

More info: www.assaabloyesh.com