HVAC Security: Is Your Facility Prepared?

HVAC systems are vulnerable to accidental or intentional biological and chemical threats due to their complexity.

Just as an HVAC system spreads air, it can spread contaminants – and air intakes can introduce toxic chemicals. As Facilitiesnet explains, a terrorist attack is one potential source of airborne chemical or biological attack, but accidental incidents pose just as serious – and probably more likely – risks.

HVAC security attacks can include terrorist or criminal activity, fires, natural disasters or riots, but they can also include bacteria, viruses, mold and chemical fumes from VOCs, smoke, asbestos and carbon dioxide.

According to the EPA, common biological contaminants include mold, mildew, viruses, bacteria or even the droppings from rodents, cockroaches or other pests. HVAC systems can harbor such contaminants and distribute them. Some diseases, including humidifier fever – a respiratory infection – can result from microorganism growth in building ventilation systems.

Other bacteria and viruses such as measles, influenza, tuberculosis and Legionella are transmitted via air and can flow through an HVAC system. The EPA explains that exposure to common biological contaminants may result in allergic reactions or asthma with symptoms including coughing, shortness of breath, fever, dizziness, sneezing and watery eyes. Children, the elderly, and those with pre-existing allergies are more prone to developing symptoms.

Even the American Society of Heating, Refrigerating and Air Conditioning Engineers has recognized the importance of HVAC Security. Chapter 59 of the 2011 ASHRAE Handbook – HVAC Applications is titled “HVAC Security.” The chapter addresses design, construction and building management in relation to the importance of HVAC security awareness.

Building managers must implement measures to prevent contamination. Detecting accidental or deliberate chemical releases quickly is crucial to minimizing exposure to a building’s occupants. Prevention is possibly the most important step in minimizing the chance of a security threat. A security risk assessment is a good place to start, but the best time to protect your system from a threat is during the initial design.

As Engineered Systems Magazine explains, every facility should start with an HVAC security basis of design document, outlining how the system works and any safety or alarm features. The document creation should be followed by a risk assessment to form the groundwork for developing the security plan.

The basis of design is critical to completing a thorough risk assessment as the document ensures you understand how the system functions. Data analysis during the risk assessment should focus on evaluating the vulnerability of the HVAC system. When assessing risk, determine where a contamination could take place, and what actions need to be taken to remedy the situation.

Engineered Systems Magazine suggests developing a risk assessment checklist before collecting information. Consider what potential materials could be hazardous to the HVAC system, mechanisms by which the chemicals could be released and the potential sources of contamination.

The magazine also suggests that you include in your checklist the building’s location to potential security threats, environmental threats both in and outside of the building, and the type of occupants within a building.

A thorough security plan must address every component of the system and how it works specific to the building and HVAC design. Facilitiesnet suggests locating outdoor air intakes above ground level. If intakes are accessible from the roof, access to the roof must be restricted.

Any spaces housing HVAC equipment, particularly access doors, must be secured. Some areas may require additional security measures, including monitors and alarms. HEPA filters can filter small particles to prevent the spread of chemicals.

Facilities may have security plans created for accidents that might occur relevant to the business such as chemical spills, but the plans should also address less obvious threats including unintentional dispersion of hazardous materials carried on someone’s shoe, a truck carrying hazardous waste overturning near the building, or chemicals circulated from nearby buildings.

System maintenance is another aspect of a thorough security plan since there is a greater chance of exposing building occupants to an accidental contamination than a deliberate attack.

A thorough, well-planned maintenance plan is a vital part of security protection, according to Engineered Systems Magazine. The plan should include maintenance of security components including such tasks as regularly changing out air filters, checking that the filters are properly installed, calibrating gas detectors and cleaning screens or grates.

Does your organization have a HVAC security plan in place? Have you had to use it?

Next Steps:

• Subscribe to our blog to receive the full blog series via email and stay informed about the latest HVAC news and insight.
• Stay up to date on facility maintenance tools such as chiller tube cleaners, boiler tube cleaners, hose/pipe cleaners, descaler systems, industrial vacuums, commercial pressure washers, and drain cleaners.