The person that contaminated the saline of three patients who later died at a Greater Manchester hospital may still be on the site, police have said.
Tracey Arden, 44, George Keep, 84, and Arnold Lancaster, 71, have all died at Stepping Hill Hospital in Stockport in the past month.
Detectives believe insulin was injected into saline containers which were used by at least two wards at the hospital.
Hospital staff have been told to work in pairs to check and administer drugs.
A single key holder also has to be asked for access to locked drugs cabinets. Names and the times that each drugs are given to patients are also being recorded.
Insulin was always kept in a locked treatment room, the hospital said. Saline has now been locked away.
A fourth patient is also critically ill. The man, in his 40s, now forms part of the huge police investigation.
Officers have ruled out making quick arrests in the case, which involves 60 detectives.
They are focusing on two acute medical wards involved, A1 and A3.
There is a core staff of medics on the wards but also occasional agency staff, a press conference at the hospital was told.
Security has been increased and senior police officers and NHS bosses have started daily review meetings.
Greater Manchester police said they could not rule out the person responsible still being at the hospital.
Assistant Chief Constable Ian Hopkins said the investigation was starting with 14 patients who may have come to harm, including the three who died.
"Our investigation in the initial stages is concentrating on people that work within the hospital or [have] visited the hospital," he said.
"Clearly that is where you would expect us to start.
"We are not ruling out it could be someone outside the hospital but our focus has been on staff and visitors to the hospital at this stage."
He said once officers had a "clear suspect", they would then look at "historic deaths".
Detectives are still waiting for the results of further post-mortem tests by the pathologist, to establish a definitive cause of death for Ms Arden, Mr Lancaster and Mr Keep.
Until then, their deaths are being treated as unexplained.
Chris Burke, chief executive of Stockport NHS Foundation Trust, said staff were "shocked, horrified and angry" at the situation.
"They are alarmed that a place that should be for care has become a crime scene.
"This is a criminal act, perpetrated by someone with malicious intent. We do not believe it could have been anticipated.
"This is a bad person doing a malevolent thing.
"This is about someone wanting to inflict harm, pain and, possibly further, as a deliberate malicious act," he said. "That is nothing to do with care."
He said he could understand why patients would be worried about going to the hospital.
"But I can say that it is safe. We hope to stop further incidents like this happening," he said.
He said he could not see a reason why relatives should be concerned about previous deaths.
South Manchester coroner John Pollard briefly opened inquests into Ms Arden, Mr Lancaster and Mr Keep earlier.
They were adjourned until a later date at the request of Supt Julian Ross, who is leading the inquiry into the deaths.