Which of the following is considered a type of external customer?

• A. Regulated customers
• B. Internal staff
• C. Vendors
• D. Patients inside the hospital

Answer: (A)

In hospital security, the key idea is that external customers are groups outside the hospital who rely on or interact with the organization and whose expectations shape security and compliance. Regulators fit this role because they are external authorities that oversee the hospital, set rules, conduct audits, and require evidence of safety, privacy, and proper procedures. Treating regulators as customers means aligning security practices to meet their standards, preparing for inspections, and ensuring documentation, access controls, and incident reporting support those requirements.

Internal staff aren’t external to the organization; they’re internal stakeholders and part of the hospital system. Vendors are external partners, but their relationship is more about supplying services than being customers in the compliance-and-audit sense. Patients are indeed recipients of care, but the emphasis in this context is on external oversight and regulatory expectations, which is why regulators are the best fit as an external customer.