Disaster Medical Assistance Team Security Risk Assessment Guide

A secure operating site helps a Disaster Medical Assistance Team (DMAT) protect people, medical resources, sensitive information, and its ability to deliver care. Use this guide to organize a facility vulnerability assessment, identify practical safeguards, and coordinate decisions with the facility owner and local emergency partners.

Treat the assessment as a planning tool, not a substitute for site-specific advice from facility engineers, emergency management, public health, law enforcement, or hazardous-materials specialists. Record who is responsible for each safeguard and revisit the assessment when the site, mission, or threat and hazard assessment changes.

How to assess assets, threats, vulnerabilities, and security risk

Start by identifying what the DMAT needs to protect and what must keep working. Include people—team members, patients, visitors, and contractors—as well as clinical equipment, medications, supplies, vehicles, communications devices, patient-care records, power, water, ventilation, and access to the facility. Consider both physical assets and digital systems that support triage, treatment, logistics, and coordination.

Next, list credible hazards and threats for the mission and location. Consider severe weather, flooding, fire, hazardous-materials incidents, infectious disease, violence, theft, utility outages, communications failures, and cyber incidents. FEMA’s risk assessment guidance recommends using assessment results to inform planning; its framework can help a team organize local hazards and capability gaps.

For each scenario, identify vulnerabilities: conditions that could make an asset more exposed or make the team less able to respond. Examples include unmonitored entrances, an unprotected generator, a single internet connection, unsecured medical supplies, or no tested alternate work location. Then estimate potential consequences for life safety, patient care, operations, information, and property. Prioritize risks that combine serious consequences with meaningful exposure or weak safeguards.

Document the assessment in a simple risk register with the scenario, affected assets, existing controls, remaining gaps, action owner, deadline, and status. FEMA describes risk-informed planning in its planning guidance; the DMAT can use that approach without treating any one scoring method as universally required.

What building and site security questions should DMATs ask?

Before setting up, walk the site with the owner or facility representative and ask:

• Where are the public, staff, ambulance, delivery, and emergency entrances, and who controls each one?
• Can the team establish a clear boundary between public areas, patient-care areas, medication and supply storage, staff-only spaces, and command functions?
• Are doors, windows, loading areas, roofs, utility rooms, and outdoor air intakes secured or monitored as appropriate?
• Are access routes, parking, lighting, signage, accessible paths, and emergency exits suitable for the expected patient volume and operating hours?
• Could nearby roads, rail lines, industrial sites, flood zones, wildfire areas, or other local conditions affect access, evacuation, or sheltering?
• What hazards could interrupt water, electricity, fuel, heating, ventilation, communications, waste handling, or medical-gas supplies?
• Are surveillance cameras operational, and is someone assigned to monitor them when monitoring is necessary?
• How will staff report suspicious activity, request assistance, and receive instructions during an incident?

For temporary or repurposed sites, do not assume that an existing building security plan covers the DMAT’s mission. CISA recommends that temporary-facility operators assess vulnerabilities, coordinate emergency action planning with responders, and exercise plans where feasible. Its Physical Security Considerations for Temporary Facilities also discusses access points, lighting, surveillance, and protective measures.

How to plan access control, surveillance, and incident response

Use physical access control to make it easy for authorized people to reach the areas they need while limiting entry to restricted spaces. Set up an identifiable check-in point, issue visible credentials, define visitor and contractor procedures, and assign staff to control sensitive entrances. Keep an accurate record of who is authorized, and establish a process to recover credentials and promptly remove access when assignments end.

Divide the site into practical zones—for example, public reception, triage, treatment, staff-only operations, and secure storage. Decide how a person moves between zones, who can approve exceptions, and how staff will respond if a door, badge system, or staffing post fails. CISA’s healthcare facility security guidance describes measures such as controlling restricted areas, validating temporary access, and monitoring entrances.

Use security surveillance systems to support situational awareness, not as a substitute for access control or a response plan. Confirm camera views cover relevant entrances and approaches, verify that equipment works, and decide who can view recordings and when they should be escalated. Account for privacy, applicable law, and facility policy when positioning or using cameras.

Write down response steps for foreseeable incidents, including unauthorized entry, violence, suspicious items, fire, hazardous-materials exposure, and loss of a critical utility. Identify who can call 911, who alerts the incident lead, how to shelter or evacuate, where staff and patients should regroup, and how responders will be guided to the right entrance. Coordinate the plan with facility management and local responders, then exercise it so people understand their roles.

How to harden facilities against chemical, biological, radiological, and cyber threats

For chemical, biological, radiological, and nuclear protection, begin with the site’s location, building systems, and incident-specific plans. Restrict access to mechanical rooms, roofs, chemical storage, and outdoor air intakes. Ask facility engineers who is authorized to assess ventilation and what actions are appropriate for different hazards; do not make improvised changes to HVAC systems. CDC guidance on protecting building environments from airborne chemical, biological, or radiological attacks identifies physical security, ventilation and filtration, maintenance, administration, and training as relevant planning areas.

Plan how to separate clean and potentially contaminated activities, manage patient movement, and obtain specialist support. For radiation emergencies, CDC describes separating operational areas and limiting movement between contaminated and uncontaminated zones to help control contamination. Use the incident’s official protective-action guidance and coordinate with public health, fire/HAZMAT, and facility experts rather than relying on generic procedures.

Match respiratory protection and other personal protective equipment to the hazard, task, and worker training. Respirators are not interchangeable, and selection and use should follow the applicable respiratory protection program and manufacturer instructions. The NIOSH Chemical, Biological, Radiological, and Nuclear Respiratory Protection Handbook provides specialized information on respirators intended for CBRN hazards.

For cyber resilience, inventory the devices and services the team depends on, including laptops, mobile devices, electronic medical records, radios connected to digital systems, network equipment, and vendor services. Restrict accounts to necessary users, use multifactor authentication where appropriate, keep systems updated, protect sensitive data, and maintain tested backups and a downtime workflow. HHS describes its healthcare cybersecurity performance goals as voluntary practices that organizations can prioritize; they include measures such as multifactor authentication and vulnerability management. See the HHS Healthcare and Public Health Sector Cybersecurity Performance Goals.

How to maintain operations with backup sites, emergency power, and communications

Identify the DMAT’s essential functions and the minimum people, equipment, supplies, and utilities each one requires. Select an alternate site that can support those functions, has workable access and accessibility, and can be activated without depending on the same vulnerable systems as the primary location. Confirm responsibilities with the site owner and partners in advance, and exercise the transition when practical.

For emergency power resilience, determine which loads are essential for patient care, communications, refrigeration, lighting, and information systems. Confirm generator capacity, transfer arrangements, fuel availability, refueling access, and who is responsible for inspection and testing. Consider whether fuel, controls, or other components could be disabled by the same hazard that causes the outage. FEMA’s Healthcare Facilities and Power Outages guide highlights the importance of evaluating generator components, fuel systems, transfer equipment, and capacity.

Plan interoperable emergency communications with primary, alternate, contingency, and emergency methods. Depending on local plans and available equipment, those methods may include landlines, mobile phones, radios, satellite devices, runners, or in-person check-ins. Agree on channels, call signs, contact lists, message formats, and check-in intervals with incident management and response partners before deployment. CISA recommends planning for multiple communication options and interoperability in its Emergency Communications resources.

Keep paper or offline procedures for critical tasks that cannot stop when power, networks, or electronic records are unavailable. Define who can authorize a switch to downtime operations, how records will be protected and reconciled later, and how the team will communicate if usual systems are lost. CMS emergency preparedness requirements apply to specified Medicare- and Medicaid-participating provider and supplier types, with requirements varying by type; a DMAT should confirm whether any requirements apply to the organization or facility it is operating. See CMS’s core emergency preparedness rule elements.

How to deliver mass notifications during hazardous conditions

Plan notifications for team members, patients, facility staff, partner agencies, and the public as separate audiences. Assign who can approve and send each type of message, who verifies information, and how updates or corrections will be issued. A DMAT should coordinate public warnings with the jurisdiction’s designated alerting authority rather than assume it can issue public alerts itself.

Use more than one delivery method when feasible, such as public-address systems, text or phone trees, radios, digital signs, and direct staff briefings. Messages should state what happened, who is affected, where the hazard is, what protective action to take, and when the next update is expected. For hazardous conditions, make instructions clear and consistent with incident command and public health or emergency management guidance—for example, whether people should evacuate, shelter, avoid an area, or await further direction.

Make messages usable by people with disabilities, people with limited English proficiency, and people who may not hear or see standard alerts. FEMA’s IPAWS 101 guide describes public alerting channels and accessibility features, while FEMA’s accessible alert content guidance recommends putting essential protective information directly in the alert. Test notification procedures during exercises and keep contact lists current.

Conclusion

A useful DMAT security risk assessment connects assets and hazards to specific vulnerabilities, assigns practical safeguards, and prepares the team to continue care if the site or its systems are disrupted. Review access control, surveillance, CBRN and cyber protections, alternate operations, communications, and notifications with facility and response partners, then test and update the plan as mission conditions change.

FAQs.

What assets should a DMAT include in a security risk assessment?

Include team members, patients, visitors, and contractors; clinical equipment, medications, supplies, vehicles, and patient-care areas; sensitive records and digital systems; and essential services such as power, water, ventilation, communications, and access routes. Consider what must be protected, what must remain available, and what could disrupt those functions.

How can a DMAT assess building and site security vulnerabilities?

Walk the site with the owner or facility representative, map entrances and restricted areas, inspect access procedures and surveillance, and consider nearby hazards, utilities, evacuation routes, and emergency access. Compare existing safeguards with plausible scenarios, document gaps and responsible owners, coordinate findings with local responders, and exercise the plan where feasible.

Which security controls help protect against chemical, biological, radiological, and cyber threats?

Useful measures include securing access to mechanical areas and air intakes, coordinating ventilation decisions with qualified facility personnel, planning for contamination control, and selecting appropriate PPE through trained safety personnel. Cyber controls can include asset inventories, restricted accounts, multifactor authentication where appropriate, system updates, protected backups, and tested downtime procedures. Controls should be selected for the site and mission; no single measure addresses every threat.

How can DMATs maintain communications and operations during hazardous conditions?

Define essential functions, prepare an alternate work location, identify critical power loads and fuel responsibilities, and maintain tested primary and backup communication methods. Keep offline procedures for essential clinical and operational tasks, coordinate communications with response partners, and exercise how the team will act if the site, power, network, or usual communication channels become unavailable.