A Security Risk Assessment Guide for Hospital-Based Violence Intervention Programs

A security risk assessment helps a hospital-based violence intervention program (HVIP) identify and reduce threats to participants, staff, community partners, and the people they serve. Because an HVIP works across clinical and community settings, its assessment should connect the hospital’s workplace violence prevention plan with the program’s own outreach, safety-planning, communication, and emergency procedures.

Use this guide to organize a practical assessment—not as a substitute for your hospital’s policies, legal advice, or a trained threat-assessment professional. The FBI recommends that health care organizations use multidisciplinary behavioral threat assessment and management approaches as part of violence-prevention planning. FBI guidance for health care organizations

Which security risks should a hospital-based violence intervention program assess?

Assess risks across the full course of program activity: hospital intake and bedside engagement, discharge, follow-up, community outreach, transportation, and communication with participants and partners. Consider the possibility of threats from people involved in a conflict, retaliation, unwanted contact, intimidation, theft, or violence, without assuming that any participant or group is inherently dangerous.

• Participant safety: threats connected to the incident that led to care, ongoing disputes, retaliation, coercion, stalking, or unwanted disclosure of a participant’s location or involvement in the program.
• Staff and partner safety: threats, harassment, assault, unsafe solo visits, travel risks, and exposure to volatile situations while working in the hospital or community.
• Facility and site security: access to program offices or private meeting areas, visitor access control, lighting, visibility, exits, parking, and routes used by participants and staff.
• Information and communication: inappropriate access to or sharing of schedules, addresses, contact details, medical information, case notes, or plans for a participant’s visit.
• Operational continuity: staffing gaps, unclear escalation roles, unavailable communication devices, and disruptions that could leave a participant or staff member without agreed support.

Include threats and close calls, not only incidents involving injury. OSHA recommends workplace violence programs that continually assess hazards, encourage prompt reporting, maintain incident records, and review prevention measures. OSHA’s hospital workplace violence guidance

How can staff assess threats to participants and program staff?

Establish a clear way for participants, staff, and partner organizations to raise concerns. A behavioral threat assessment should consider the reported behavior and circumstances, the specificity and timing of a threat, access to the intended target, changes in contact or conduct, and factors that may increase or reduce immediate risk. Avoid treating a diagnosis, identity, neighborhood, or past involvement in violence by itself as proof that someone poses a threat.

Use a multidisciplinary review process appropriate to the concern. Depending on the situation, the team may include HVIP staff, hospital security, clinical or behavioral health professionals, social work, risk management, and community partners. Identify who can receive reports, who assesses urgency, who contacts the participant, and who has authority to activate hospital or community response procedures. The FBI’s health care guidance describes multidisciplinary behavioral threat assessment and management as an approach for identifying and managing potential targeted violence. FBI health care threat-assessment guidance

Work with the participant to develop trauma-informed safety planning that reflects their priorities, circumstances, and choices where feasible. Discuss safe ways and times to communicate, whether a meeting location or transportation plan should change, and who the participant wants involved. Explain the limits of confidentiality and avoid promising absolute secrecy. When health information is involved, follow applicable privacy rules and organizational policy; HIPAA permits certain disclosures to help prevent or lessen a serious and imminent threat, subject to applicable law and ethical standards. HHS guidance on HIPAA and serious threats

What hospital and community factors affect program security?

Hospital conditions can change the level of risk. Review where program conversations take place, how visitors enter the building, whether staff work alone, the availability of security support, and whether participants can reach the program without being unnecessarily exposed. OSHA identifies factors such as inadequate security, unrestricted public movement, poor lighting, understaffing, and poorly designed spaces as possible workplace violence risks. OSHA’s hospital hazard overview

Community conditions also matter. Consider current conflicts that may affect a participant or outreach site, travel between the hospital and community locations, public transportation or parking, partner capacity, and whether a visit could reveal a participant’s whereabouts. Use reliable, current information and assess specific circumstances rather than relying on stereotypes or broad assumptions about a community.

Coordinate the HVIP’s assessment with the hospital’s security and emergency plans, while recognizing that community partners may have separate procedures and responsibilities. Agree in advance on how staff can contact hospital security, local emergency services, or partner organizations and what information can be shared. Protect participant information and limit access and disclosure according to applicable privacy requirements and organizational policy. HHS guidance on the HIPAA minimum necessary requirement

How should teams document and prioritize identified risks?

Use a consistent assessment form or secure tracking system so that concerns can be reviewed, assigned, and followed up. Record the date, setting, source of the report, observed or reported behavior, people or locations potentially affected, immediate actions taken, and the rationale for the team’s next steps. Separate confirmed observations from unverified reports and document uncertainty rather than presenting it as fact.

Prioritize risks according to factors such as seriousness, imminence, likelihood, exposure, and the availability of practical protective steps. Assign an owner and due date to each action, then document whether the action was completed and whether it reduced the identified risk. Keep records in approved systems, limit access to people with a work-related need, and follow retention, reporting, and privacy rules that apply to your organization.

Define incident reporting procedures for threats, assaults, attempted contact, access-control problems, and close calls. OSHA provides a workplace violence incident report form that organizations can adapt to their own reporting process. OSHA’s workplace violence incident report form

What security measures can reduce risks to participants and staff?

Choose controls that respond to the risks you identified and preserve access to care and support. Measures may include meeting in an appropriate private area, arranging staff accompaniment or check-ins for higher-risk visits, reviewing visitor access control, improving lighting or communication access, and changing a meeting time or location when a specific concern warrants it.

Set clear protocols for how staff share safety-relevant information across shifts and with authorized partners. Explain what information may be shared, with whom, and for what purpose. Keep participant-facing communications discreet when needed, and avoid sending sensitive details through channels not approved for that information.

Train staff on how to report concerns, seek assistance, use de-escalation within their role, and follow the hospital’s workplace violence prevention plan and emergency procedures. Practice the handoffs between HVIP staff, hospital security, clinical teams, and community partners. OSHA recommends a comprehensive prevention program that includes employee involvement, worksite analysis, hazard controls, training, recordkeeping, and evaluation. OSHA’s workplace violence prevention program components

How should programs respond to immediate threats and security incidents?

When a threat appears immediate, follow the hospital’s emergency procedures, contact hospital security or emergency services as appropriate, and notify the designated program lead. Do not ask an untrained staff member to investigate or confront a potentially dangerous person alone. If someone is in immediate danger, use the organization’s established emergency number or call 911, consistent with local procedures.

Give the responding team concise, relevant information: where the threat is, who may be at risk, what is known about the behavior, and what action has already been taken. Coordinate with the hospital incident lead and community partners as needed, while sharing participant information only as permitted by law and policy. OSHA’s emergency-planning guidance emphasizes activating established procedures, notifying appropriate responders, and communicating incident conditions and affected occupants. OSHA emergency preparedness guidance

After the immediate danger has passed, arrange medical or emotional support as appropriate, check in with affected participants and staff, and complete the required incident report. Preserve relevant records according to organizational procedures, review what worked and what did not, and update the safety plan. Offer support without pressuring a participant or staff member to provide unnecessary details immediately after a distressing event.

What limitations should programs consider when conducting an assessment?

A risk assessment is a structured way to guide decisions, not a guarantee that violence will occur or that it can be predicted with certainty. Information may be incomplete, circumstances can change quickly, and no checklist replaces professional judgment, participant input, or emergency response when danger is imminent.

Hospital policies and legal duties vary by organization and location. OSHA guidance can help inform prevention planning, but it does not by itself determine every hospital’s or community partner’s legal obligations. Review applicable state and local requirements with your organization’s safety, privacy, risk management, and legal teams.

HVIPs also need to balance safety with trust, access, privacy, and participant choice. Avoid overly broad information sharing or measures that stigmatize participants without a specific, documented safety rationale. Revisit the assessment when there is a significant change, after an incident or close call, and on the schedule required by hospital policy or applicable law. Taken together, a multidisciplinary process, practical controls, careful documentation, and regular review give your program a workable foundation for protecting participants and staff.

FAQs

Who should participate in a hospital violence intervention program security risk assessment?

Include people who understand the program’s hospital and community work, such as HVIP leadership and frontline staff, hospital security, clinical or behavioral health staff, social work, risk management, and relevant community partners. Involve participants or people with lived experience where appropriate and safe, and clarify each person’s role in reviewing concerns and carrying out protective steps.

How often should the assessment be updated?

Set a regular review schedule consistent with hospital policy and applicable requirements, and update the assessment sooner after a significant incident, close call, change in program activities, or new information that affects safety. OSHA advises ongoing assessment and possible modification of workplace violence prevention programs. OSHA’s hospital workplace violence guidance

How should staff handle an immediate threat to a participant?

Follow the hospital’s emergency procedures, contact security or emergency services as appropriate, and alert the designated program lead. Prioritize the participant’s immediate safety, avoid confronting a potentially dangerous person alone, and share only relevant information through authorized channels. When a person is in immediate danger, use the established emergency number or call 911, consistent with local procedures.

What should programs document after a security incident?

Document the time and location, the behavior or event reported, who was affected or potentially at risk, the source of the information, actions taken, notifications made, and follow-up steps assigned. Distinguish firsthand observations from reports, record uncertainties, and store the report in an approved system with access limited under organizational policy.