- 2/17/2026 - Revised 10. Vendor Access Control and Vest Rules and Regulations
- 7/28/2022 - Added Exclusion 6.1 and Vendor Security Requirement 7.4
- 6/1/2021 - Policy Creation
- 8/10/2021 - Added Reasons Why Doors Can Be Propped Open and Regaining Access After a Violation
- 11/12/2021 - Added Vendor Vest Requirement
1.1. The purpose of this procedure is to provide reasonable assurance that contract, vendor, or consultant company employees, who intend to perform work as a vendor on UHAT property are trustworthy, reliable, and do not provide an undue risk to personnel, intellectual property, or other UHAT or 1CALL assets. The Vendor Access Control Program provides direction and guidance concerning access requirements for contract companies and their employees performing work on UHAT property.
2.1. Access Controlled Points – Doors/Entry Points with selective restriction of access to a restricted space
2.2. Access Card – A plastic card with a chip or magnetic strip containing encoded data that is readily bypassing the card through or over an electronic device, used to provide access to restricted or secure areas or systems
2.3. Access Permissions – permissions that an individual cardholder holds to access secured/restricted spaces
2.4. Cardholder – Person who receives an access card to get into access-controlled points
2.5. Vendor – Person or Company that performs work on a contract basis
2.6. UHAT / 1CALL Vendor Sponsor – UHAT or 1CALL staff member sponsoring the vendor for work performed on UHAT properties
2.7. SOP – Standard Operating Procedure
2.8. Traka Box – Secure box that houses temporary vendor cards
2.9. UHAT – University Hospitals Authority & Trust (Property Owner)
2.10. 1CALL – Services provided by University Hospitals Authority & Trust
2.11. Vendor Access Controls & Vest Rules and Regulations (VACRR) – Security rules and regulations set forth by UHAT for all vendors contracted for work at UHAT properties.
2.12. Principle of Least Privilege (POLP) – The practice of limiting access for vendors, cardholders, to the bare minimum permissions needed to perform the work assigned or contracted.
3.1.1. It is the responsibility of the contract company to ensure that the Vendor Access Card & Vest Request form for access is completed and submitted to the UHAT / 1CALL Vendor Sponsor before work being performed on UHAT property.
3.1.2. It is also the contract company’s responsibility to ensure each vendor working on UHAT property adheres to the Vendor Access Control & Vest Rules and Regulations in Section 10.
3.1.3. The company is required to notify the UHAT / 1CALL Vendor Sponsor immediately in the event one of their employees are no longer employed by the company.
4.1. Vendor Company
4.2. Vendor Employees
4.3. UHAT Staff
4.4. 1CALL Staff
5.1. All UHAT owned property
6.1. Security Service Providers shall adhere to the vendor access control program but are exempt from the vest requirements due to their required law enforcement or security guard uniform visibility requirement.
¶ 7. VENDOR SECURITY REQUIREMENTS AND ADHERENCE THERETO
7.1. All vendors working at UHAT properties must read and abide by the Vendor Access Controls & Vest Rules and Regulations, (VACRR) in Section 10.
7.2. Vendor company must submit a compliance letter on the company’s letterhead, signed by an officer or designee of the company, agreeing to the following:
- 7.2.1. The vendor employee(s) scheduled to perform services at UHAT properties will comply with the Vendor Security Requirements to include the Vendor Access Controls & Vest Rules and Regulations in Section 10.
- 7.2.2. Vendor company will not send employee(s) to perform services who have any prior convictions of the following:
- 7.2.2.1. Active sex offender or sexual predator status.
- 7.2.2.2. Any felony conviction involving violence in the past 5 years.
7.3. A vendor company that changes its name while working for UHAT or 1CALL, will need to resubmit the company compliance letter.
- 7.3.1. If the same vendor employees and/or representatives will be working for the new vendor company, existing vendor employee and/or representative documents will be transferred “as is” to the new vendor company.
7.4. All vendors must cooperate with and comply with campus, local, and federal law enforcement officers and UHT security vendors inquiries, instructions and investigations.
8.1. Signed and completed documents required from the contracted company and their employee
- 8.1.1. Vendor company compliance letter on the company’s letterhead
- 8.1.2. Vendor Access & Vest Request Form
¶ 9. VENDOR ACCESS CARD, VEST And PERMISSION ACQUISITION: TEMPORARY AND PERMANENT
¶ 9.1.Temporary Access Card, Vest and/or Key Permission Acquisition
- 9.1.1. Vendor can be granted access to a temporary vendor card and/or key from one of the four available Traka Boxes
- 9.1.1.1. A Traka box is an access-controlled and network configured cabinet that stores UHAT key and card assets
- 9.1.2. Vendor will go to or contact 1CALL to request a temporary vendor card and/or key and vest
- 9.1.3. 1CALL Dispatch, 1CALL Facilities Maintenance Tech or UHAT Construction Project Coordinator will issue a temporary vendor card & vest to the Vendor
- 9.1.4. Vendor will fill out the Vendor Card and/or Key Check out Form at the Traka Box
- 9.1.5. Vendor will be given a temporary vendor card and or key and will accept the 8-10-hour Curfew time that pops up on the Traka Box Screen showing when the badge needs to be returned
- 9.1.6. When the Vendor returns the temporary vendor card, the Vendor will scan the Card to the Card Reader of the Traka Box and then return the card to the correct slot number as well as returning the vest to 1CALL Dispatch
- 9.1.7. If Vendor is unsure or forgot which slot the card came from, there is a tag number on the tamper-proof key ring that shows the slot number the card should be placed.
¶ 9.2 Permanent Access Card and/or Key & Vest Permission Acquisition Process
- 9.2.1. Vendor is required to read, fill out and turn into the UHAT/1CALL Vendor Sponsor or to the 1CALL Office the Vendor Access & Vest Request Form:
- 9.2.1.1. Vendor Access & Vest Request Form (←Click Link To Download Form)
- 9.2.1.1.1. Fill in the top section only including Company Information and Cardholder Information
- 9.2.1.1.2. Vendor can obtain a Vendor Access & Vest Request Form from one of the following:
- 9.2.1.1.2.1. 1CALL’s Help Website at https://help.271call.com
- 9.2.1.1.2.2. UHAT / 1CALL Vendor Sponsor who is overseeing the contracted work being performed on UHAT property, or,
- 9.2.1.1.2.3. 1CALL Office - Garrison Tower, 940 NE 13th Street, Basement, Suite B100.
- 9.2.2. Once the Vendor Access & Vest Request Form is turned in, a member of the UHAT security team will process the request within one to three, (1 to 3), business days.
- 9.2.3. The Vendor will receive an email notification that the access card and/or key & Vest are Ready for Pick Up to the email address that was included on the Vendor Access & Vest Request Form.
- 9.2.3.1. Access Card and/or Key & Vest Pickup Location and Information
- 9.2.3.1.1. Address – 1CALL Facility Services, Garrison Tower, 940 NE 13th Street, Basement, Suite B100, Monday – Friday 8 am - 5 pm.
- 9.2.3.1.2. Phone - (405) 271-2255
- 9.2.3.2. Vendor employee will bring a valid driver’s license or government-issued ID to be used as verification of vendor listed on the Vendor Access & Vest Request Form.
- 9.2.3.3. Only the vendor employee cardholder or keyholder who is named on the Vendor Access & Vest Request Form is allowed to pick up and sign out the access card and/or key & vest.
- 9.2.4. Upon arrival to pick up the access card and/or key & vest at the 1CALL office:
- 9.2.4.1. Vendor employee will show their driver’s license or government-issued ID to the 1CALL Dispatch or UHAT Security.
- 9.2.4.2. UHAT Security or 1CALL Dispatch will scan driver’s license or government-issued ID of Vendor employee and print out an access card.
- 9.2.4.3. 1CALL Dispatch or UHAT Security will briefly review the Vendor Access Control & Vest Rules and Regulations form with the vendor before the vendor leaves the 1CALL office.
- 9.2.4.4. Vendor will read the Access Card Pickup Disclosure near the bottom of the Vendor Access & Vest Request Form and sign and date the form acknowledging pickup of the access card and/or key & vest.
- 9.2.4.5. 1CALL Dispatch will file away the vendor access & vest request form for future reference.
- 9.2.4.6. Once vendor employee has completed work, they will turn in any key(s) & vest that were assigned and 1CALL Dispatch will find the filed away form and sign and date at time of return.
¶ 10. VENDOR ACCESS CONTROL & VEST RULES AND REGULATIONS
- 10.1.1. The cardholder/key holder/vest holder agrees to to the following terms:
- 10.1.1.1. My access card is to be worn on the torso area and visible at all times while on the Oklahoma Health Center campus for work purposes. My access card and/or key is for access purposes only.
- 10.1.1.2. My vest is to be worn on the torso at all times while on the Oklahoma Health Center campus for work purposes.
- 10.1.1.3. If my access card, vest and/or key is lost, I will report it immediately to 1CALL Facility Services.
- 10.1.1.4. My Vendor Sponsor will need to submit a new request for lost keys and/or cards.
- 10.1.1.5. I will not prop open access-controlled doors. I will not let people into secure areas. Contact your Project Manager if a secure area needs to be unlocked/propped open.
- 10.1.1.5.1. EXCEPTION: For those who work for the same Contracted Company, the Lead, Foreman or Supervisor with General Project Access is allowed to let their team members into a space they may not have access to.
- 10.1.1.6. I will not make/post temporary signs. If signage is needed, contact your Project Manager. They will request through 1CALL.
- 10.1.1.7. I will not remove signage. If signage needs to be removed, contact your Project Manager.
- 10.1.1.8. I am a representative of my company and will conduct myself as such. Loud/offensive music and/or language will not be tolerated.
- 10.1.1.9. I will keep my work area clean. Food/debris must be cleaned by the end of the day.
- 10.1.1.10. Construction sticky mats are provided for most areas. Please use them before exiting the work zone to keep public areas clean. Contact your Project Manager if the mats are low/empty.
- 10.1.1.11. I will park in my designated parking garage and keep the garage clean of trash/debris.
- 10.1.1.12. The Oklahoma Health Center campus is a Smoke and Tobacco-Free campus. This includes garage areas.
- 10.1.1.13. STORAGE: All material laydown and storage locations must be coordinated and pre-approved by UHAT/1CALL staff. Storage of any materials or equipment in mechanical, electrical, or fire control rooms is strictly prohibited. This also pertains to IT Data or Telecommunication closets.s document.
- 10.2.1. Failure to follow any rule listed above is subject to any penalty based on the discretion of UHAT leadership.
- 10.2.2. Failure to return the temporary access card, key, or vest.
- 10.2.3. Failure to report lost access card, key, or vest.
- 10.2.4. Passing/Sharing access card, key or vest
- 10.2.5. Sharing access permissions by badging or opening with a key for an unauthorized person or person without possession of an access card or key into an access-controlled space
- 10.2.5.1. EXCEPTION: For those who work for the same Contracted Company, the Lead, Foreman or Supervisor with General Project Access is allowed to let their team members into a space they may not have access to.
- 10.2.6. Propping access-controlled doors open without approval from 1CALL Facility Services
- 10.2.7. Bypassing card access-controlled doors with a key
- 10.2.8. Altering a secure door in any manner that prevents the door from maintaining its secured state
- 10.2.9. Intentionally blocking the view of a security camera
- 10.3.1. A fee up to $100.00 can be invoiced to the vendor company or deducted from a current vendor invoice for violation(s).
- 10.3.1.1. The access given to the vendor employee/representative can be revoked until the fee is paid or lost card/key/vest is returned.
- 10.3.1.2. If a key is lost or not returned at the end of the project/work duty, the cost to reissue a new key or re-key the affected area(s) will be invoiced to the vendor company or deducted from the amount of the services being provided.
- 10.3.2. If a re-key of an affected area(s) is not paid and is related to a construction project:
- 10.3.2.1. Company will give up the right to participate in any future projects.
- 10.3.2.2. UHAT has the option to file a bond claim on the contracted vendor company.
- 10.3.3. Access Offenses
- 10.3.3.1. 1ST OFFENSE of any one of the Violations listed above for access:
- 10.3.3.1.1. Vendor employee or representative can have their access card deactivated and the company can be charged a fine of $500 or 1% of the total contracted work, whichever is greater; or
- 10.3.3.1.2. Vendor employee or representative access card will be deactivated for 30 days
- 10.3.3.1.3. Once the company pays the fine or the 30 days has expired, vendor employee or representative access will be reinstated.
- 10.3.3.2. 2ND OFFENSE of any one of the Violations listed above for access:
- 10.3.3.2.1. Vendor employee or representative can have their access card deactivated and the company can be charged a fine of $1,000 or 3% of the total contracted work, whichever is greater; or
- 10.3.3.2.2. Vendor employee or representative access card will be deactivated for 60 days
- 10.3.3.2.3. Once the company pays the fine or the 60 days has expired, vendor employee or representative access will be reinstated.
- 10.3.3.3. 3RD OFFENSE of any one of the Violations listed above:
- 10.3.3.3.1. Vendor employee or representative will have their access permanently deactivated.
- 10.3.3.3.2. Vendor employee or representative will be flagged and will receive permanent loss of access eligibility.
- 10.3.4. Vest Offenses
- 10.3.4.1. 1ST OFFENSE of any one of the Violations listed above for vests:
- 10.3.4.1.1. Vendor employee or representative can be charged a fine of $25.00 and a replacement vest issued if needed.
- 10.3.4.1.2. Vendor employee or representative access card will be deactivated and will be required to check out a temporary vendor vest daily until lost/stolen vests is returned or fine is paid and replacement vest issued. Time limit for this not to exceed 30 days. At that point, employee access will be deactivated.
- 10.3.4.1.3. Once the company pays the fine or the 30 days has expired, vendor employee or representative access will be reinstated.
- 10.3.4.2. 2ND OFFENSE of any one of the Violations listed above for vests:
- 10.3.4.2.1 Vendor employee or representative can be charged a fine of $50.00 and a replacement vest issued if needed.
- 10.3.4.2.2. Vendor employee or representative access card will be deactivated 60 days and will be required to check out a temporary vendor vest daily until lost/stolen vests is returned or fine is paid and replacement vest issued.
- 10.3.4.3. 3RD OFFENSE of any one of the Violations listed above:
- 10.3.4.3.1. Vendor employee or representative will have their access permanently deactivated.
- 10.3.4.3.2. Vendor employee or representative will be flagged and will receive permanent loss of access eligibility.
- 10.4.1. If a Vendor employee or representative receives a 3rd strike, access cannot be regained until the start of the next fiscal year.
- 10.4.2. At the beginning of every fiscal year, violations will be removed from each employee/vendor.
- 11.1. All doors have Door Held Open Alarms associated to them. This means if a door is propped open while in the Lockdown Mode (Red) an alarm will be triggered. If a door needs to be propped open at any time, please contact 1CALL at 271-2255 with the description or location of the door and how long the door will be propped open for.
- 11.2. At the end of each business day the UHAT / 1CALL Vendor Sponsor will walk each project to make sure all doors in the project space are secure.
- 11.3. Reasons why a door can be propped open
- 11.3.1. Moving supplies/equipment in or out
- 11.3.2. Ventilation of area
- 11.3.3. Any other reason will need to be approved first by the Security Team
- 11.3.3.1. Propping doors open can cause the doors to warp and/or wear out door hardware, such as a door closer, which potentially causes issues to properly manage & maintain security.