You are approached by an individual who tells you that he is here to work on the computers and wants you to open a door for him or point the way to a workstation. How do you respond to this request?

Providing access or directions to an unverified individual bypasses physical security controls and could enable unauthorized access to systems containing PHI.

Social engineering attacks frequently involve individuals posing as IT contractors or vendors to gain unauthorized physical or system access. The proper security response is to verify identity by referring the individual to the staff member or department that authorized the work, rather than either granting access on their word or escalating immediately to law enforcement. This process ensures that only properly vetted and authorized individuals receive access while maintaining a professional and proportionate response.

Calling the police is a disproportionate first response; verification through the authorizing contact is the appropriate initial action before escalation.