Compliance 10 min read

Wander management without surveillance.

A resident who walks out is the risk every South African retirement village plans for. The design question is not how closely to watch them — it is which single event you actually need to know about.

By Frank Guo · Technology & Product Leadership, addanode

TL;DR — The instinct is to track the resident. The better design is to monitor the exit, not the person: a wearable tag that is invisible to the system everywhere inside the resident's own home, and raises an alarm only when it crosses an external door or a defined boundary unaccompanied. This is not a technical compromise — it is a legal requirement in disguise. The Older Persons Act gives a resident of a residential facility an express right to privacy, and POPIA names location information as personal information. A system that logs every movement inside a person's home has to justify itself against that right; a system that only knows "left through the garden gate at 02:40, alone" does not face the same question and answers the operational one just as well. The same event log then produces what the operator's annual report to the Minister needs: response times, checks completed, who attended.

Start with what actually goes wrong

Wandering is not a single failure mode, and systems designed for the wrong one are the reason so many alarms get switched off. In South African villages the recurring patterns are these:

The propped door. A fire door or a service entrance held open in summer, or by a contractor carrying material. The building's designed boundary is not the building's actual boundary, and nobody notices until someone uses it.
The follow-through. A resident leaves behind a visitor or a delivery, through a door that opened legitimately. No forced exit, no alarm, no record.
The night exit. Between about 22:00 and 05:00, when staffing is thinnest and the gap between a departure and the next observation is longest. This is the one that becomes a search.
The internal wander that is not an emergency at all. A resident walks the corridors at 03:00 because they always have. Treating this as an incident produces alarm fatigue, and alarm fatigue is how the real exit gets missed.

The last point is the one most vendors skip and most matrons raise first. A system that cannot tell the difference between a person living in their home and a person leaving it will be silenced within a month. The design goal is a small number of alarms that are always worth standing up for.

Monitor the exit, not the person

The architecture that follows from all of this is narrow on purpose. A resident wears a tag — a wristband or a pendant. Reference points are placed at the boundaries: external doors, lift lobbies, the gate, the garden perimeter, the stairwell that leads out. Inside the resident's own unit and the communal areas, the system is deliberately not watching. It has no reason to be.

What the system then knows is a short list: this tag crossed this boundary, at this time, with or without a staff tag in company. That is enough to raise the alarm that matters and thin enough that it does not create a record of a person's day. The rules that make it usable in practice are equally narrow:

Rule	What it does	Why it exists
Accompanied exit	No alarm when a resident's tag crosses a boundary together with a staff or authorised family tag	A resident going to an appointment is not an incident. Without this rule the system cries wolf daily
Per-resident scope	Boundary rules apply only to residents for whom a documented care assessment calls for them	Independent-living residents are adults in their own homes. Blanket rules are both wrong and unlawful
Time-of-day profiles	A garden door that is unremarkable at 14:00 and alarming at 02:40	Risk is a function of time and staffing, not of the door
Door held open	Alerts maintenance when a monitored door stays open beyond a threshold	Fixes the propped door, which is the failure behind a large share of exits
Escalation ladder	Nearest carer first, then the duty sister, then the manager and gate, on a timer	An alarm nobody owns is an alarm nobody answers
Tamper and removal	A wristband cut or removed raises its own notification	Otherwise the commonest failure — a band on a bedside table — is silent

The architecture described above, against the one most buyers ask for. The system is deliberately not watching inside the home — it holds one kind of fact, which is enough for the alarm that matters and too thin to become a record of somebody's day.

The legal frame, which is stricter than most buyers assume

Two instruments govern this, and they pull in the same direction.

First, the Older Persons Act. Section 16 gives an older person residing in a residential facility a list of rights in addition to those in the Bill of Rights, and privacy is expressly one of them, alongside the right to keep and use personal possessions and to have reasonable access to visitation. This is not an abstraction to be waved at in a policy document: it is the standard against which a monitoring design is measured. A system that records a resident's movements inside their own unit is interfering with a named statutory right and needs a correspondingly strong justification. A system that knows only when an external boundary was crossed is a far smaller intrusion for the same protective effect — which is exactly the proportionality argument you would want to be able to make.

Second, POPIA. Location information is named in the Act's own definition of personal information, and in a care setting the processing touches health, which section 26 makes a special category. Section 32 provides the route through for healthcare institutions, facilities and social services where processing is necessary for treatment and care or for the administration of the institution — subject to a confidentiality obligation reaching everyone who can see the data. Our POPIA guide works through lawful basis, retention and the notices you owe residents, families and staff.

One line to hold on to: a wander system is a safety control, not a restraint. It raises an alarm so that a person goes to look. It does not lock a resident in. Where a design starts interlocking doors against residents rather than notifying staff about them, the question has changed from safety engineering to deprivation of liberty — and that is a clinical, legal and family decision, not a procurement one.

The same log answers the annual report

The commercial case for most villages is not the incident that might happen. It is the paperwork that definitely will. Under section 23(1) of the Older Persons Act, the operator of a registered residential facility must, within 60 days after the end of its financial year, submit a report to the Minister covering compliance with the prescribed service standards and the prescribed measures to prevent and combat the abuse of older persons.

Most operators assemble that report from duty rosters, incident files and recollection. A boundary-monitoring system with an escalation ladder produces, as a by-product, the things that report is easiest to make with: how many boundary events occurred, how quickly each was answered, by whom, and how the escalation behaved when the first responder did not acknowledge. The same data answers the question a family asks after an incident — how long was it before anyone knew? — with a timestamp rather than an apology.

It also changes what your insurer and your board are looking at. "We have a policy" and "here are twelve months of response times by shift" are different kinds of statement.

Installing it in a village that cannot be rewired

South African retirement villages are rarely purpose-built for this. They are cottages, converted houses, a frail care wing added in 1998, and a clubhouse — often across a landscaped site, sometimes with heritage constraints, and always occupied. Three practicalities decide whether a project is feasible:

Battery reference points where cable cannot go. Units with a five-year internal cell and a sealed IP68 housing mount on a wall or a gatepost and report over a long-range radio link to one gateway. No conduit, no trenching between cottages, no ceiling work in an occupied unit. This is usually the difference between a quotable project and an abandoned one.
Outdoor boundaries are real boundaries. A garden gate and a perimeter path matter as much as the front door, so the equipment has to survive weather — which is a specification question to settle at survey rather than discover in the first storm.
The wearable has to be worn. This is the true failure point of every such system. It has to be comfortable enough to keep on, washable and disinfectable, tamper-notifying rather than tamper-proof, and — this matters more than the datasheet — introduced to the resident and the family as safety rather than as tagging. Bands that live in a drawer protect nobody.
It has to work when the power does not. Reference points, gateway and server behind backup power, with the system recording locally through an outage. See our load shedding protection guide.

What we would ask you at a survey

Which residents does a care assessment identify as at risk of unaccompanied exit — and who reviews that list, how often?
Where are the real boundaries, including the ones staff use and the ones contractors prop open?
Who is the first responder at 02:40, where are they, and who is second when they do not acknowledge?
What does the family expect to be told, and how quickly — and is that written down anywhere?
What does your section 23 report currently say about service standards, and what would you rather it be able to show?
Who, exactly, will be permitted to see the event log — and has their confidentiality obligation been put in writing?

If those answers are already clear, the technology is the easy part. If they are not, the survey is worth more than the equipment. See what a deployment of this shape looks like in our retirement village case study, how a project runs on our nurse call and staff safety page, what a village installation actually involves in installing in old buildings, or the wider picture on healthcare and retirement living.

This article explains how legislation shapes system design. It is not legal or clinical advice; decisions about an individual resident's care and liberty belong with their clinicians, their family and your legal advisers.

FAQ

Wander management — common questions

Does wander management work in a nursing home or frail care unit?

Yes — wander management in a nursing home, frail care unit or old age home is in some ways simpler than across a village, because the boundaries are fewer and closer together. The design principle does not change: place reference points at external doors, lift lobbies and any stairwell that leads out, and leave the resident's own room and the communal areas unmonitored. What does change is the rules. In a frail care setting a larger share of residents will have a care assessment calling for boundary alerts, night-time profiles matter more because staffing is thinnest then, and accompanied-exit rules do more work because residents leave with carers several times a day.

Is a wander system the same as tracking residents?

It should not be, and a well-designed one is not. The system we build places reference points at boundaries — external doors, lifts, gates, the perimeter — and deliberately does not watch inside residents' own units or communal areas. What it knows is that a tag crossed a boundary, when, and whether a staff tag crossed with it. That is enough to raise the alarm that matters, and it avoids creating a record of a resident's day, which under the Older Persons Act would sit against a named statutory right to privacy.

Do residents or families have to consent?

You need a lawful basis under POPIA and a defensible position under the Older Persons Act, and in practice both are better served by a conversation than by a signature buried in an admission pack. POPIA section 32 permits healthcare institutions, facilities and social services to process health-related information where necessary for treatment and care or the administration of the institution, subject to confidentiality — so consent is often not the operative basis. That does not remove the obligation to tell people: section 18 requires residents and, in practice, their representatives to be told what is collected, why, who sees it, and what rights they have, including the right to object and to complain to the Information Regulator.

Can the system lock doors to keep a resident inside?

Technically yes; we would push back hard on doing it. A wander system is a safety control that raises an alarm so a person goes to look. Interlocking doors against a resident is restraint, and restraint engages questions of deprivation of liberty that are clinical, legal and family decisions — not something to be configured by an installer. There are narrow cases, in registered frail care with documented clinical authority, where controlled egress is part of a care plan. Even then the design should notify and delay rather than simply confine, and fire escape routes are never compromised.

What stops the alarms from becoming background noise?

Three rules, set at design time. Accompanied exits do not alarm, so a resident leaving for an appointment with a carer is not an incident. Boundary rules apply only to residents whose care assessment calls for them, not to everyone in the village. And time-of-day profiles mean a garden door that is unremarkable at 14:00 is alarming at 02:40. Without these, a system generates daily false alarms, staff learn to dismiss them, and the one exit that mattered is missed — which is the commonest way these installations fail.

What happens if a resident removes the wristband?

The band raises a tamper notification when it is cut or removed, so the commonest silent failure — a band left on a bedside table — becomes a visible event instead of an invisible gap. It is worth being clear that this is a notification, not a restraint: the point is that staff know the protection has lapsed and can respond, not that the resident is prevented from taking it off. Comfort and how the band was introduced to the resident and family matter more to adherence than any technical feature.

Can this be installed in cottages spread across a village?

Yes, and it is the normal case rather than the hard one. Battery-powered reference points with a five-year cell and a sealed IP68 housing mount on a wall or gatepost and report over a long-range radio link back to a single gateway — so no conduit is run and no trenching is needed between cottages. Outdoor boundaries such as garden gates and perimeter paths are treated as real boundaries and specified for weather. For occupied units and heritage buildings this is usually what makes the project feasible at all.

How does this help with our annual report to the Minister?

Section 23(1) of the Older Persons Act requires the operator of a registered residential facility to report within 60 days of financial year end on compliance with prescribed service standards and prescribed measures to prevent and combat abuse of older persons. Most operators build that from rosters, incident files and recollection. A boundary-monitoring system with an escalation ladder produces the underlying evidence as a by-product: how many events, how fast each was answered, by whom, and what happened when the first responder did not acknowledge. It turns assertions in the report into records behind it.

Is a GPS tracker not simpler than all of this?

They solve different problems. A consumer GPS tracker is aimed at a person living independently at home and answers "where did they go" once they are already outside and missing. A village system answers the earlier and more useful question — "has someone left, right now, unaccompanied" — while they are still metres from the door and the response can be immediate. GPS also performs poorly indoors and through building fabric, needs frequent charging, and, in a facility, creates continuous outdoor position history about a resident that you would then have to justify holding.

Primary sources

Older Persons Act 13 of 2006 — section 16 (rights of older persons in residential facilities, including privacy), section 18 (registration of residential facilities), section 23(1) (annual report to the Minister on service standards and abuse prevention), sections 26, 30 and 31 (abuse notification, prohibition and register)
Protection of Personal Information Act 4 of 2013 — section 1 (location information as personal information), section 18 (notification), section 26 (special personal information), section 32 (authorisation concerning health)
Information Regulator (South Africa) — supervisory authority under POPIA

This article explains how the legislation shapes system design. It is not legal or clinical advice.

Protect the boundary. Leave the home alone.

Tell us your village layout, your at-risk list and who responds at 02:40. We will design to the smallest system that answers it.

Book a Site Survey Healthcare & retirement living →