2026-11-05
2026年8月1日，GB/T 31458-2026《医院安全防范要求》正式实施，替代沿用十余年的2015版《医院安全技术防范系统要求》。名称里删掉了“技术”两个字——新版把人力防范、实体防范单独成章，安防从“装什么设备”，变成“人、物、技怎么一起管”。
硬指标也更具体：视频图像信息存储不少于30天，被确定为防范恐怖袭击重点目标的医院不少于90天，麻醉药品和第一类精神药品存储场所不少于180天。这些看着是“存多久”的事，落地时却都压在同一张网上：设备身份认不出来，这段录像是谁拍的、有没有被动过，就说不清；平台不校时，时钟偏出9.1.3允许的5秒，画面就对不上报警和门禁。天数存够了，也可能只是一堆来路不明的画面。
摄像头装得再多，管不住，也等于没装。而在平安医院的实际推进中，最容易被跳过的一环，恰恰是那张承载着全院摄像机、NVR、服务器和上百块大屏的设备网——医院安防专网。它既不归信息科管，也很少进保卫科的技防台账，却直通病房、诊室和药房。
这张网上，常见5个口子
一是存量设备的漏洞难以迭代。老型号IPC（网络摄像机）、NVR长期不升级，漏洞就摆在那里，攻破一台，横向可及一片。而且这类设备多半已过保修期，换不起，也不敢停机换。
二是人的随意性。值班人员随手插一只U盘、私接一台路由器、开一次违规外联，几个逻辑隔离的安全域瞬间被打通。
三是设备身份失控。摄像头被冒用、被替换，往往要等到画面"黑掉"才被发现。
四是数据缺乏保护。本地存储不加密，一次手机拍照、一次随手下发，敏感画面就流到了院外。
五是运维的盲区。成百上千台设备没有统一视图，故障定位靠人跑，处置和闭环无从谈起。
这五条不是经验之谈。安全方案技术要求中明确规定了医院安全防范系统和设备登录密码不应是弱口令，不应存在网络安全漏洞和隐患；不同传输网络联网时，应采取相应的网络边界安全管理措施。
医疗行业解决方案
网络接入控制系统（NACP）管“谁能入网”：网络访问权限按安全区域、来宾区域、隔离区域划分，用户网络行为同步审计。不依赖交换机等网络设备，不改变现有网络拓扑架构。终端进网要过准入控制、身份认证、安全技术评测、策略下发四道关，系统会自动开展深度安全测评，精准识别系统漏洞和违规配置，智能生成修复方案并联动策略自动加固，修不了的先挡在准入之外。私接路由器、无线热点、手机代理等违规外联，实时探测、即时告警，必要时直接锁屏、关机。
前端是医院安防最容易被做文章的地方——把摄像机换成“长得像摄像机”的终端，等于从边界内部开了一个洞。视频安全接入控制系统（TSA）用双引擎探测把全网设备逐个点名：设备类型、IP、MAC、厂商、物理位置、入网状态，一张图看清。每台设备入网前做指纹比对与安全基线核验，只有“验明正身”的才放行，冒用、替换、私接在前端就被拦下。设备离线、陌生设备入侵、设备时间异常、码流延时自动告警，并在地图与拓扑上定位。
医院视频一旦流出就收不回来。视频数据安全防护系统（VDP）把防护落到数据本身：在线浏览自动叠加含IP、MAC、账号、部门的水印，偷拍可溯源；下载的视频强制落入虚拟安全磁盘，驱动级重定向，拷不走、带不出；外发文件须走审批，可设密码、打开次数和使用期限；操作日志全程留痕。它还能配合终端准入，只允许装了客户端的合法终端访问视频业务系统，把“谁能看”也一并管住。事前预防、事中审计、事后追溯，闭环落在最后这一米。
入口决定谁能靠近，设备决定谁能留下，出口决定能带走什么。但这条链压在一个前提上：先得知道网里有什么。网络信息资产安全运维管理系统（VOPS）管资产这本账：全院多少台、在哪、什么版本、现在还有没有在使用。全网在线设备自动扫描，服务器、网络设备、物联网终端逐台识别，按设备类型、操作系统、开放端口提取指纹，自动生成动态资产清单与网络拓扑；摄像机、立杆、设备箱落到GIS地图上，建档口径对齐“一机一档”。漏洞与合规检测、配置基线核查常态跑，风险可自动修复；网络链路、服务器、存储、数据库、业务应用纳入同一套巡检，故障点落到地图上，不必再靠人跑。非法私接和资产变更，不用等人报，扫一遍就露出来。
落地：一套平台，一个页面
落地目标只有一个：重要视频图像信息不失控，敏感视频图像信息不泄露。NACP、TSA、VDP与VOPS统一部署在监控中心，一套平台、一个管理页面；三道口的安全策略和资产台账，在同一个界面里；前端沿用医院现有的摄像机和设备网，不依赖交换机等网络设备，不改变网络拓扑架构。从客户端准入、数据传输、加密存储到外发溯源，每个环节有人管、有记录。
合规是及格线，能用才是答案
2021年八部门印发的《关于推进医院安全秩序管理工作的指导意见》提出“建立完善入侵报警、视频监控、出入口控制、电子巡查系统，并实现互联互通”；到2026年，国标把存储时长、时钟误差、联网接口（GB/T 28181、GB 35114）逐条写死。要求已从“建起来”走到“管得住”。医院真正需要的是日常跑得起来的能力：台账清楚，故障能定位，违规有记录、有闭环。对二级及以上医院沿用原有设备与网络，把入口、设备、出口这三处补齐，就能把平安医院从一次验收，做成一套长期有效的安全机制。
结语
医院不缺摄像机，缺的是能答三个问题：设备谁批准进网？它还是不是原来那台？画面被谁带走过？国标把答案压在这张少有人打理的设备网上。今年若只做一次自查，就从数设备、对台账、翻调阅记录开始。守住三道口，守的是画面背后等结果的人。
On August 1, 2026, GB/T 31458-2026 Requirements for Hospital Security Prevention officially came into effect, replacing the 2015 version Requirements for Hospital Security and Technical Prevention Systems that had been used for more than a decade. The word "Technical" was removed from the title. The new version includes separate chapters on human-based prevention and physical prevention. Security prevention has shifted from "what equipment to install" to "how to coordinate personnel, physical facilities and technology for integrated management".
The mandatory indicators are more specific: video and image data shall be stored for no less than 30 days; hospitals designated as key targets for anti-terrorism prevention shall maintain storage for no less than 90 days; storage areas for narcotic drugs and Category I psychotropic substances require no less than 180 days of storage. These requirements seem to be only about storage duration, but they all rely on the same network. If device identities cannot be authenticated, it will be impossible to verify who recorded the video and whether it has been tampered with. If the platform fails to synchronize time and the clock deviation exceeds the 5-second limit specified in Clause 9.1.3, video recordings cannot be correlated with alarms and access control logs. Even if the required storage days are met, the recordings may still be untraceable.
No matter how many cameras are deployed, they are useless without effective management. During the construction of safe hospitals, the device network that carries all hospital cameras, NVRs and hundreds of large display screens — the hospital dedicated security network — is often overlooked. It is not managed by the information department and rarely included in the technical prevention ledgers of the security department, yet it connects directly to wards, consulting rooms and pharmacies.
Five Common Security Gaps on This Network
First, vulnerabilities of legacy devices are difficult to patch. Old-model IP cameras and NVRs remain unupdated for long periods, leaving vulnerabilities exposed. Compromising one device may lead to lateral movement across the whole segment. Most of these devices are out of warranty, making replacement costly and downtime unacceptable.
Second, human operational risks. On-duty staff may casually insert a USB flash drive, privately connect a router or initiate unauthorized external connections, which can instantly break down isolation between logically separated security zones.
Third, loss of device identity control. Cameras may be impersonated or replaced, and such incidences are often detected only after the video signal goes offline.
Fourth, insufficient data protection. Without encryption for local storage, sensitive video footage can leak outside the hospital through mobile phone snapshots or casual file sharing.
Fifth, maintenance blind spots. There is no accurate inventory for hundreds of devices. Fault location relies on manual inspection, and incident response and closed-loop management become unfeasible.
These five risks are not simply empirical observations. Technical requirements for security solutions stipulate that login passwords for hospital security prevention systems and devices must not be weak passwords, and network security vulnerabilities shall be eliminated. Appropriate network boundary security controls shall be implemented when interconnecting different transmission networks.
Medical Industry Solution
Network Access Control Platform (NACP) manages "who can join the network". Network access permissions are divided into security zones, guest zones and isolation zones, with real-time auditing of user network behaviors. It does not rely on switches or other network devices and will not alter the existing network topology. Terminals must pass four checks before access: admission control, identity authentication, security assessment and policy deployment. The system automatically performs in-depth security scans, accurately identifies vulnerabilities and non-compliant configurations, intelligently generates remediation plans and enforces automatic hardening. Devices that cannot be remediated are blocked at admission. Unauthorized connections such as private routers, wireless hotspots and mobile proxies are detected in real time with immediate alerts; screen lock or power-off can be triggered when necessary.
The front-end layer is the vulnerable link in hospital security. Replacing a camera with a lookalike terminal creates a backdoor from inside the network boundary. The Video Security Access Control System (TSA) adopts a dual-engine detection mechanism to inventory all devices on the network. Device type, IP, MAC, manufacturer, physical location and online status are visualized on a single panel. Each device undergoes fingerprint matching and security baseline verification before access. Only authentic devices are approved, while impersonation, replacement and unauthorized devices are blocked at the front end. Automatic alerts are triggered for device offline status, unknown device intrusion, clock abnormalities and stream latency, with location marked on GIS maps and topology diagrams.
Once hospital video data leaks, it cannot be recalled. The Video Data Protection System (VDP) implements protection at the data level. Watermarks including IP, MAC, account and department are automatically overlaid during online viewing to enable traceability of unauthorized screen capture. Downloaded videos are redirected to virtual secure disks at driver level and cannot be copied or exported. File export requires approval, with configurable passwords, viewing quotas and validity periods. All operation logs are recorded. Coordinated with terminal access control, it only allows authorized terminals with the client installed to access video systems, managing "who can view the footage". It realizes prevention before incidents, auditing during incidents and traceability after incidents, closing the control loop at the final mile.
Access controls who can approach, device verification decides who can stay, and export control determines what can be taken away. This entire chain relies on a precondition: full visibility of all assets on the network. The Network Information Asset Security Operation and Maintenance System (VOPS) maintains the asset ledger: total quantity, location, firmware version and online status of all devices in the hospital. It automatically scans online devices across the network, identifies servers, network devices and IoT terminals one by one, extracts fingerprints based on device type, operating system and open ports, and automatically generates dynamic asset inventories and network topology. Cameras, poles and equipment boxes are mapped on GIS, with filing standards consistent with "one device, one file". Vulnerability scanning, compliance inspection and baseline verification run routinely, and risks can be remediated automatically. Network links, servers, storage, databases and business applications are covered in unified inspection, and faults are pinpointed on the map instead of manual patrols. Unauthorized connections and asset changes are discovered automatically during scanning, no manual report required.
Deployment: One Platform, One Management Portal
The core deployment objective is straightforward: critical video and image information shall not get out of control, and sensitive video information shall not be leaked. NACP, TSA, VDP and VOPS are deployed centrally in the monitoring center on one unified platform and one management portal. Security policies for the three control points and asset ledgers are integrated in the same interface. Existing hospital cameras and security network can be retained; the solution does not depend on switches or modify the original network topology. Every link, from terminal admission, data transmission, encrypted storage to export traceability, is managed and logged.
Compliance Is the Baseline, Practical Usability Is the Goal
In 2021, eight authorities issued the Guiding Opinions on Promoting Hospital Security Order Management, requiring "establishing and improving intrusion alarm, video surveillance, access control and electronic patrol systems with interconnection". By 2026, the national standard has clearly specified storage duration, clock deviation and network interfaces (GB/T 28181, GB 35114). Requirements have evolved from "building systems" to "effective control". What hospitals really need is operable daily capability: clear asset ledgers, fast fault location, and closed-loop records for violations. For Grade II and above hospitals, the solution can reuse existing devices and networks. By reinforcing access, device identity and data export controls, safe hospital construction can shift from a one-time acceptance check to a long-term sustainable security mechanism.
Conclusion
Hospitals are not short of cameras. What they lack is the capability to answer three questions: Who approved this device to access the network? Is this device the original one? Who has exported the video footage? The national standard anchors these answers on this often-neglected security device network. If only one self-inspection is arranged this year, start with counting devices, checking ledgers and auditing access logs. Guarding these three control points means protecting the people waiting for services behind the footage.
