The heterogeneous cellular network (HCN) is a promising approach to the deployment of 5G cellular networks. This paper comprehensively studies physical layer security in a multi-tier HCN where base stations (BSs), authorized users and eavesdroppers are all randomly located. We first propose an access threshold based secrecy mobile association policy that associates each user with the BS providing the maximum \emph{truncated average received signal power} beyond a threshold. Under the proposed policy, we investigate the connection probability and secrecy probability of a randomly located user, and provide tractable expressions for the two metrics. Asymptotic analysis reveals that setting a larger access threshold increases the connection probability while decreases the secrecy probability. We further evaluate the network-wide secrecy throughput and the minimum secrecy throughput per user with both connection and secrecy probability constraints. We show that introducing a properly chosen access threshold significantly enhances the secrecy throughput performance of a HCN.