Acute Care for Elders Unit Security Risk Assessment Checklist

How to assess security risks specific to an acute care for elders unit

Assess how the unit’s layout, routines, equipment, and access controls interact with the needs of the older adults receiving care. Individual patients may have different mobility, sensory, cognitive, or behavioral needs, so evaluate risks in the context of the patient population and specific care environment rather than relying on a one-size-fits-all checklist.

CMS guidance identifies security of care locations, access to medications and hazardous materials, furniture and medical equipment, and increased fall risk as age-related safety considerations. It also advises hospitals to use environmental assessments appropriate to the unit and its patient population. See the CMS State Operations Manual guidance on age-related safety considerations and CMS guidance on hospital ligature risk and assessment.

• Walk the unit with nursing, facilities, security, and other relevant staff; include different shifts when practical.
• Review entry and exit points, patient pathways, staff sightlines, emergency response access, and locations where patients may be alone or out of view.
• Consider how confusion, delirium, dementia, impaired vision or hearing, limited mobility, or an individualized risk of self-harm could affect safety.
• Check whether controlled access protocols protect patients without unnecessarily restricting appropriate movement, care, or dignity.
• Review existing safety procedures, patient observation requirements, maintenance records, and security incident trend analysis.

CMS does not require a particular environmental risk assessment tool. Its guidance says assessments should fit the care setting and patient population; a checklist can support, but does not replace, clinical judgment or applicable facility policies.

Which environmental hazards should the checklist cover?

Check patient rooms, bathrooms, common areas, supply spaces, entrances, and outdoor routes used by patients. Look for hazards that could cause a fall, injury, unauthorized access, or delayed response, and record the exact location so the responsible team can address the finding.

• Falls and mobility: wet or uneven floors, loose mats, clutter, poor lighting, blocked walking routes, unstable furniture, missing or damaged handrails, and difficult bathroom or transfer access.
• Equipment and utilities: unsecured medical equipment, cords crossing walkways, malfunctioning call systems, exposed or damaged fixtures, and equipment that could obstruct egress or staff access.
• Hazardous materials: unsecured medications, sharps, cleaning agents, hand sanitizer, and carts or supplies left where patients or visitors can reach them. Secure hazardous nonclinical rooms, such as electrical and HVAC rooms, from unauthorized entry.
• Exits and external routes: doors that do not latch or alarm as intended, obstructed exits, poorly lit entryways, and unsafe walkways or driveways.
• Potential ligature hazards: evaluate specific attachment points and accessible cords or materials when a patient’s assessed risk makes them relevant. CMS discusses ligature risk particularly in psychiatric settings and for patients at risk of self-harm; do not treat every older adult or every elder-care unit as automatically requiring a psychiatric-unit ligature-resistant environment.

CMS guidance for hospitals identifies falls, access to hazardous items, furniture, and equipment among age-related safety considerations. It also calls for environmental risk assessment strategies suited to the care environment and patient population. These findings can guide environmental hazard mitigation, but the assessment should be adapted to the unit’s actual risks.

How to review access controls and visitor management

Trace how a patient, visitor, contractor, or staff member enters the unit and reaches patient-care areas. Test the expected workflow against normal operations, including shift changes, deliveries, emergencies, and times when the unit is busy.

• Confirm that doors, badges, intercoms, alarms, and other access controls work as intended and that staff know how to report a failure.
• Check that public routes do not provide unintended access to patient rooms, medications, supplies, or hazardous nonclinical areas.
• Review visitor management procedures for identification, sign-in or other tracking used by the facility, visitor guidance, and escalation when a visitor’s access is restricted.
• Confirm staff know how to honor a patient’s stated visitor preferences and direct questions or disputes to the appropriate clinical or administrative lead.
• Review how staff respond when a patient with diminished capacity may be at risk of leaving an area without support; use appropriate individualized safeguards rather than relying on door controls alone.

Visitor processes should support both safety and privacy. HIPAA permits hospitals to maintain specified directory information, but patients must be informed and given an opportunity to restrict information or opt out, subject to the rule’s provisions for emergencies or incapacity. See the HHS guidance on hospital directories and visitors. That guidance does not make a visitor log or a particular screening process a universal HIPAA requirement.

How to assess staff and patient safety risks

Review patient risks and staff risks together: an intervention intended to protect a patient should also allow staff to provide care safely. Ask staff what makes it difficult to observe patients, respond to urgent needs, maintain safe routes, or get help quickly.

• Check that individualized patient observation requirements are clear, assigned, feasible for the unit layout, and handed off between shifts according to facility policy and clinical direction.
• Identify blind spots, rooms or corridors with limited visibility, and situations where staff may be isolated or unable to summon assistance.
• Review procedures for wandering or attempted elopement, falls, confusion, aggression, and patients assessed to be at risk of self-harm or harm to others.
• Confirm staff know how to report threats, activate alarms, request security support, and use de-escalation procedures consistent with their training and facility policy.
• Consider whether staffing patterns, visitor volume, unit design, or delays in response could increase risk.

CMS says hospitals can demonstrate safe-setting practices through appropriate patient assessments, adequate staffing and monitoring, and environmental risk mitigation. OSHA recommends that healthcare employers assess workplace hazards, involve employees in safety planning, and evaluate and improve controls. See CMS safe-setting guidance and the OSHA hospital workplace violence prevention guidance.

What incident and near-miss records can reveal

Review security and safety reports alongside staff feedback and environmental inspection findings. Near misses can reveal access, layout, communication, or response weaknesses even when no one was injured.

• Look for repeat events such as unauthorized entry, missing patients, attempted elopement, falls, visitor conflicts, threats, assaults, and delayed security responses.
• Compare patterns by location, time, shift, type of event, and contributing conditions, such as a faulty door, poor lighting, or an obstructed line of sight.
• Check whether reports identify what happened, who was notified, immediate actions taken, contributing factors, and whether follow-up was completed.
• Use security incident trend analysis to prioritize corrective actions and check whether previously implemented measures reduced recurrence.
• Limit access to reports containing patient or employee information according to facility policy and applicable privacy requirements.

OSHA recommends prompt reporting, recordkeeping, review of incidents and close calls, and program evaluation to identify trends and improve workplace violence prevention. Its hospital guidance recommends worksite analysis annually or after an incident that identifies a weakness in the program. Treat that interval as OSHA guidance for workplace violence prevention—not as a universal federal schedule for every acute care for elders unit security assessment.

How to document findings and mitigation measures

For each finding, record enough detail to support prompt action and later verification. Use the facility’s approved reporting and escalation process; urgent hazards should be reported and controlled immediately rather than waiting for the written assessment to be finalized.

• Finding: describe the hazard or control gap, its exact location, and the patients, staff, or visitors potentially affected.
• Risk and existing safeguards: explain the likely harm, relevant patient or operational factors, and controls already in place.
• Mitigation: note any immediate protective steps and the longer-term correction, such as repair, access changes, staff communication, or a policy review.
• Accountability: assign a responsible person or department and a target completion date based on the risk and facility process.
• Verification: document when the action was completed, who confirmed it, and whether reassessment showed the risk was reduced.

Share relevant findings with the teams responsible for patient care, facilities, security, and safety, while protecting confidential information. Reassess when the unit layout, patient population, access procedures, or relevant incidents change, and follow any applicable facility, state, or accreditation requirements. In short, a useful assessment connects an observed risk to a documented mitigation, a named owner, and a verified follow-up.

FAQs

How often should an acute care for elders unit complete a security risk assessment?

CMS guidance calls for an environmental risk assessment appropriate to the care environment and patient population but does not specify one universal interval for this type of unit assessment. Set a routine schedule under facility policy and reassess after significant changes, incidents, or near misses. OSHA recommends annual worksite analysis or reassessment after an incident that reveals a weakness in a workplace violence prevention program; that is guidance for that program, not a universal federal schedule for all unit security assessments.

Which environmental hazards should staff check during an assessment?

Check fall hazards, lighting, clear pathways, handrails, bathrooms, furniture, medical equipment, cords, call systems, access to medications and cleaning supplies, secured hazardous rooms, exits, and entry controls. Consider ligature hazards when relevant to an individual patient’s assessed risk and the care setting.

How should staff document identified security risks and mitigation measures?

Record the hazard’s location and potential impact, existing safeguards, immediate actions, planned mitigation, the responsible person or department, a target completion date, and follow-up verification. Escalate urgent risks promptly under facility policy and document whether reassessment confirmed that the risk was reduced.

How can incident and near-miss records inform unit security planning?

Review reports for recurring event types, locations, times, contributing conditions, and delays or gaps in response. Use those patterns to prioritize environmental changes, access-control improvements, staffing or workflow review, and staff communication, then check later records to see whether the changes helped.