Dementia Diagnostic Clinic Security Risk Assessment Checklist

Use this checklist as part of security risk assessments to identify security gaps that could affect patients, staff, visitors, facilities, or information at a dementia diagnostic clinic. Record what is in place, note any gaps, and assign each follow-up action to a responsible person with a due date.

Identify Clinic Assets

Start by listing the people, spaces, equipment, information, and services the clinic needs to protect. Include assets that are owned by the clinic and those provided or managed by vendors.

• People: Patients, caregivers, clinical and administrative staff, contractors, and visitors.
• Spaces: Reception and waiting areas, examination rooms, testing rooms, medication storage, staff-only areas, records storage, server or network equipment rooms, and exits.
• Equipment: Workstations, laptops, mobile devices, diagnostic equipment, medication cabinets, security cameras, access-control systems, and emergency equipment.
• Information: Protected health information (PHI), paper records, electronic health records (EHRs), appointment schedules, test results, staff records, and security logs.
• Services: EHR access, internet and phone service, power, medication handling, diagnostic testing, and backup or recovery services.

For each asset, record its location, owner, business purpose, who needs access, and the likely impact if it is lost, unavailable, damaged, or disclosed without authorization.

Assess Physical Access Controls

Walk through the clinic during operating and non-operating hours to see whether access controls match the sensitivity of each area. Check that entrances, doors, keys, badges, and visitor procedures are working as intended.

• Confirm that public areas are separated from staff-only rooms, records storage, medication areas, and IT equipment spaces.
• Review how staff, contractors, and visitors are identified, authorized, escorted, and signed in.
• Check that keys and access badges are issued to specific people, promptly disabled when no longer needed, and periodically reviewed.
• Inspect doors, locks, alarms, lighting, windows, and camera coverage for damage, blind spots, or access paths that bypass controls.
• Verify that paper records and unattended devices are not visible or accessible from public areas.
• Review procedures for securing the clinic at closing and responding to lost keys, badges, or suspicious activity.

Document each access weakness and identify whether it could expose patients, medications, equipment, or confidential information to unauthorized access.

Evaluate Patient Safety Risks

Assess how the clinic’s layout and workflows affect patients who may experience memory loss, confusion, impaired judgment, or difficulty recognizing hazards. Work with clinical staff to identify risks that are specific to the patient population and care setting.

• Review check-in, waiting, testing, bathroom, and discharge workflows to identify times when a patient could be left without appropriate supervision.
• Check whether exits, corridors, stairs, and other potentially hazardous areas are monitored and appropriately controlled without obstructing safe evacuation.
• Assess fall hazards such as clutter, loose rugs, poor lighting, wet floors, and unclear routes between rooms.
• Consider wandering risk mitigation measures, including staff awareness, patient identification procedures, clear handoffs, and prompt escalation when a patient cannot be located.
• Confirm that staff know how to respond to a patient who becomes distressed, leaves an assigned area, or needs assistance during an emergency.
• Review medication security controls, including storage, authorized access, handling, and procedures for identifying missing or improperly stored medication.

Record risks and safeguards without relying on a single control. For example, secure exits should be considered alongside supervision, communication, and safe emergency egress procedures.

Inventory Electronic Health Information

Create an inventory of where PHI is collected, viewed, stored, transmitted, printed, or destroyed. Include routine workflows as well as temporary or less frequent processes, such as testing, referrals, and device servicing.

• List EHR systems, patient portals, scheduling tools, diagnostic applications, billing systems, and other software that may contain PHI.
• Identify devices that access or store patient information, including desktops, laptops, tablets, phones, removable media, printers, scanners, and diagnostic equipment.
• Map how information moves between staff, systems, laboratories, imaging services, referral partners, and vendors.
• Review electronic health record (EHR) access controls, including individual accounts, authentication, session timeouts, and access logging.
• Check whether role-based access control (RBAC) gives each role only the information and functions needed for its work.
• Include paper printouts, handwritten notes, backup copies, archived files, and records awaiting secure disposal.
• Document system owners, approved users, storage locations, backup arrangements, and vendor responsibilities.

Flag shared accounts, inactive accounts, unnecessary access, unencrypted storage or transfers, and devices whose security status is unknown for further review.

Analyze Threats and Vulnerabilities

For each asset and workflow, consider how a security incident could occur and what conditions might make it more likely. Include both deliberate actions and accidental or environmental events.

• Physical threats: Unauthorized entry, theft, vandalism, tailgating, lost keys, or medication tampering.
• Information threats: Phishing, stolen credentials, malware, misdirected messages, inappropriate record access, or lost devices.
• Operational threats: Staff error, unclear handoffs, outdated procedures, vendor outages, or unreviewed user permissions.
• Environmental threats: Fire, water damage, extreme weather, utility failure, or other events that disrupt care or damage equipment.

Identify vulnerabilities that could allow a threat to affect an asset, such as unmonitored entrances, unsupported software, weak account practices, incomplete staff training, or missing backup procedures. Note existing safeguards and whether they are consistently used and tested.

Rate Risks and Assign Remediation

Use a consistent method to rate each risk. Consider how likely an event is, the potential effect on patient safety and operations, and the sensitivity or importance of the affected asset. State your reasoning so that ratings can be reviewed and compared.

Record each finding in a risk register with the affected asset or workflow, threat, vulnerability, existing controls, risk rating, and evidence supporting the assessment. Assign a named owner and a target completion date for each action.

• Address immediate risks to patient safety or access to essential care promptly.
• Prioritize risks that could expose PHI, compromise medication security, or disrupt critical systems.
• Specify a practical corrective action, such as changing permissions, repairing a lock, improving a handoff, or updating staff procedures.
• Define how completion will be verified, such as a permission review, access test, inspection, or documented exercise.
• Track open actions, delays, accepted risks, and any interim safeguards.

Maintain a vulnerability remediation plan that shows priorities, owners, deadlines, progress, and verification results. Reassess a risk when systems, clinic operations, staffing, or patient safety needs change.

Review Emergency Preparedness

Check whether the clinic can protect patients and maintain essential operations during an emergency or service disruption. Review written procedures with staff and confirm that assigned responsibilities are clear.

• Confirm that emergency contacts, escalation steps, evacuation routes, and staff roles are current and accessible.
• Review how staff will account for patients and communicate with caregivers during evacuation, relocation, or an unexpected clinic closure.
• Assess emergency power continuity for essential systems and equipment, including how long backup arrangements can support critical functions.
• Check procedures for securing medications, records, and devices during a disruption or relocation.
• Confirm that staff know how to report a missing patient, suspected security incident, or loss of access to critical systems.
• Review backup and recovery steps for EHR access, communications, and other essential services, and document the results of tests or exercises.

Summarize the assessment by documenting the most significant risks, the safeguards already in place, and the next actions with owners and due dates. Revisit the checklist after a significant incident or operational change, and use follow-up reviews to confirm that remediation is effective.

FAQs

What areas of a dementia diagnostic clinic should have restricted access?

Restrict access to medication storage, records and file storage, staff-only rooms, IT and network equipment areas, and any space containing confidential information or specialized equipment. Use access levels that reflect staff responsibilities, and ensure visitors are identified and escorted where appropriate.

How should a clinic assess wandering and fall risks for patients with dementia?

Review the patient journey from arrival through departure, including waiting, testing, bathroom use, and handoffs. Identify opportunities for patients to become unsupervised, exits that need appropriate monitoring, and environmental hazards such as clutter or poor lighting. Document the safeguards staff will use and how they will respond if a patient is missing or at risk of falling.

Which devices and workflows should be included in a PHI inventory?

Include every system and device that collects, views, stores, prints, or transmits PHI, such as EHRs, scheduling and diagnostic applications, computers, tablets, phones, printers, scanners, removable media, and relevant diagnostic equipment. Map workflows involving paper records, referrals, labs, vendors, backups, and record disposal as well.

How should clinics document and prioritize security risks and remediation actions?

Use a risk register to record the affected asset or workflow, threat, vulnerability, existing safeguards, risk rating, and supporting evidence. Prioritize immediate patient safety concerns and risks to PHI or essential operations, then assign each action an owner, deadline, and verification method. Track progress and reassess risks after changes or incidents.