Hospital Emergency Management Department Security Risk Assessment Guide

How to conduct a hospital emergency department security risk assessment

A hospital emergency department (ED) security risk assessment is a structured review of threats, vulnerabilities, potential consequences, and safeguards. Its purpose is to identify practical ways to protect patients, staff, and visitors while supporting timely care. Tailor the process to your facility: OSHA notes that violence risk factors vary by location, size, and type of care.

1. Set the scope. Include the ED’s public and restricted areas, such as entrances, waiting and triage areas, treatment spaces, behavioral health rooms, staff work areas, corridors, exits, ambulance access, and nearby parking or exterior approaches. Consider how risks change overnight, during busy periods, and at shift changes.
2. Assemble a multidisciplinary team. Involve ED clinicians and leaders, security, facilities, emergency management, occupational health, risk management, and staff who work in the areas being assessed. Include patient or visitor perspectives when appropriate.
3. Review available information. Examine security incident reporting, threats, assaults, near misses, response records, staff feedback, relevant injury records, and prior assessment findings. Look for repeated locations, times, circumstances, and control failures.
4. Walk the site and observe workflows. Review entrances, sightlines, lighting, door operation, access procedures, alarm placement, and routes staff may use to get help or exit. Observe how people move through the ED during different shifts.
5. Assess existing safeguards and gaps. Determine whether controls work as intended in real conditions, not just whether equipment or policies exist on paper.
6. Assign and follow up on corrective actions. Document each finding, its risk level, the responsible owner, a target date, and how completion and effectiveness will be verified.

OSHA recommends worksite analysis, employee participation, incident and near-miss reporting, hazard controls, and program evaluation as elements of a workplace violence prevention program. Its emergency department guidance offers examples to consider, rather than a one-size-fits-all checklist. See OSHA’s emergency department workplace violence guidance and OSHA’s hospital-wide workplace violence guidance.

Which security threats and vulnerabilities should the assessment identify

Identify credible threats and the conditions that could make them more likely or harder to manage. For healthcare workplace violence prevention, consider threats or assaults involving patients, visitors, coworkers, or other people on site. Review verbal threats and intimidating conduct as well as physical incidents, because both can signal safety concerns or escalating risk.

Common risk factors OSHA identifies for hospitals include long waits, overcrowded waiting areas, working alone or while understaffed, poor environmental design, inadequate security, unrestricted public movement, and poorly lit spaces. In the ED, also consider the possibility that patients or visitors may be distressed, intoxicated, experiencing a behavioral health crisis, or have access to weapons. Assess the specific circumstances and local incident history rather than assuming a person’s diagnosis or condition predicts violence.

Review vulnerabilities that may undermine emergency department access control or delay a response, including:

• Public access to treatment, staff-only, or other restricted areas without effective screening or authorization.
• Doors that fail to secure, are propped open, or do not clearly distinguish permitted routes from restricted ones.
• Unclear visitor management protocols, including how staff handle visitor limits, disputes, and unauthorized entry.
• Blind spots, poor lighting, isolated work areas, or room layouts that limit staff visibility or exit options.
• Duress alarm systems that are difficult to reach, poorly understood, inadequately tested, or disconnected from a clear response process.
• Gaps in communication, staffing, training, or coordination with security and local responders.
• Loss of power or communications that affects access systems, alarms, surveillance, or the ability to summon help.

Include external and operational hazards that could affect ED security or response. CMS’s emergency preparedness guidance calls for an all-hazards approach that considers risks in the facility’s geographic area and hazards such as power failures, communications interruptions, and loss of part or all of the facility. See CMS’s core emergency preparedness rule elements.

How to evaluate risks to patients staff and visitors

Evaluate each scenario by considering how likely it is, who could be exposed, the possible severity of harm, and whether current safeguards are reliable. A simple likelihood-and-consequence matrix can help teams compare findings, but it is a practical assessment tool—not a substitute for applicable law, professional judgment, or facility policy.

Consider exposure separately for patients, staff, and visitors. For example, a blocked route might affect patient evacuation, while an unmonitored staff entrance could expose employees to unauthorized access. Include people who may need additional assistance, such as children, patients with mobility limitations, or people who cannot easily understand emergency instructions.

Use multiple information sources instead of relying on injury counts alone. Review reported incidents and near misses, staff observations, site walkthroughs, security response times, and whether alarms or other safeguards worked as intended. OSHA recommends a consistent reporting process and regular review of incident information; it also advises protecting worker and patient confidentiality when reports are analyzed or shared. See OSHA’s guidance on worksite analysis and program evaluation.

Record why a risk received its rating, what information informed the judgment, and where uncertainty remains. This makes it easier to compare findings over time and explain why a control or corrective action was selected.

What security controls should be reviewed

Review physical, procedural, and people-focused safeguards together. A control is useful only when it fits the risk, is maintained, and can be used effectively during actual ED operations.

• Access and visitor controls: Check how staff manage public entry, restricted doors, staff-only spaces, visitors, and unauthorized movement. Confirm that the process is clear to staff and workable during busy periods.
• Environmental design: Review lighting, visibility, waiting-room layout, potential objects that could be used as weapons, secure work areas, and staff exit options. OSHA lists controlled access, improved lighting, surveillance, and securing furniture or equipment among examples of controls for hospitals.
• Alarms and communications: Inspect duress alarm systems and other ways to request assistance. Confirm that staff know how to use them, responders know how to receive alerts, and the system is maintained and tested under facility procedures.
• Staffing, training, and response procedures: Review coverage during higher-risk periods, escalation and de-escalation procedures, security response roles, and coordination with local responders. Make sure staff know how to report threats, suspicious behavior, and incidents.
• Incident reporting and follow-up: Confirm that staff can report violence and near misses promptly, that reports are reviewed for patterns, and that corrective actions are tracked. OSHA provides a workplace violence incident report form as a reference.

OSHA identifies options such as controlled-access doors, concealed panic buttons, improved lighting and video surveillance, and staff training. Choose safeguards based on the findings of your assessment, and confirm that they do not create new obstacles to safe care or emergency response. OSHA notes that workplace violence has no specific federal OSHA standard, while employers may have responsibilities under the General Duty Clause and must also consider applicable state requirements. See OSHA’s workplace violence enforcement guidance.

How to prioritize findings and document corrective actions

Address immediate danger promptly, then prioritize other findings using a consistent method. Give greater attention to risks that could cause severe harm, affect many people, occur frequently, or involve safeguards that have failed. Consider the time people are exposed, the number of people who may be affected, and whether a proposed fix could introduce a new risk.

For each finding, document:

• The location, hazard or threat, and people who may be affected.
• The evidence reviewed, including relevant incidents, near misses, observations, and staff feedback.
• The risk rating and a brief explanation of how it was assigned.
• The current controls, any gaps, and the corrective action selected.
• The accountable owner, target completion date, resources needed, and current status.
• How and when the facility will verify that the action was completed and reduced the risk.

Use security incident reporting and follow-up to check whether corrective actions address patterns—not just individual events. Limit access to sensitive records and protect patient and employee confidentiality. OSHA recommends keeping records of incidents, hazard analyses, and corrective actions, and evaluating whether prevention measures are working. See OSHA’s workplace violence program guidance.

How often should the assessment be updated

Review the assessment regularly and revise it when conditions change. Reassess after a serious incident or near miss, a new threat, a change in ED services or patient flow, construction or layout changes, a change to access or alarm systems, or evidence that a control is not working. OSHA describes workplace violence prevention as requiring continual assessment and possible program modifications.

Keep the ED security review distinct from the hospital’s broader emergency preparedness requirements. CMS states that participating providers’ emergency preparedness plans must be reviewed and updated at least annually. That requirement concerns the emergency preparedness plan; use it as a formal review point, but do not assume it replaces additional updates when ED-specific risks change. Check applicable state requirements and facility policies as well.

In short, an effective assessment combines local incident data, staff input, environmental review, and tested safeguards, then turns findings into tracked actions. Regular review helps keep your ED security approach aligned with changing risks and operational needs.

FAQs

What areas should a hospital emergency department security risk assessment cover?

Cover public and restricted ED areas, including entrances, waiting and triage areas, treatment rooms, behavioral health spaces, staff work areas, corridors, exits, and ambulance access. Also consider nearby parking and exterior approaches, different shifts, and the routes people use to enter, leave, or request assistance.

How can hospitals assess workplace violence risks in the emergency department?

Use a multidisciplinary team to review incidents and near misses, gather staff feedback, walk through the ED, observe workflows, and assess environmental and operational conditions. Consider the likelihood and potential severity of harm, who may be exposed, and whether existing controls work reliably. OSHA recommends worksite analysis and regular review of incident reports and program effectiveness.

Which security controls should be reviewed during an assessment?

Review access control, visitor management protocols, lighting, visibility, surveillance, duress alarm systems, communications, staffing, training, response procedures, and security incident reporting. Confirm that staff know how to use controls and summon help, and that the response process is clear.

How often should a hospital update its emergency department security risk assessment?

Review it regularly and update it after significant incidents, new threats, changes to the ED’s layout or operations, or evidence that safeguards are ineffective. CMS requires participating providers to review and update their emergency preparedness plans at least annually; that plan requirement is separate from responding to changes in ED-specific security risks.