Independent Pediatric Hospital Security Risk Assessment Checklist

An independent pediatric security risk assessment examines whether your facility’s policies, people, and physical safeguards work together to protect children, newborns, families, and staff. Use this checklist to identify vulnerabilities, test response procedures, and prioritize corrective actions. It is a planning aid—not a substitute for applicable law, state requirements, accreditation standards, or your hospital’s own policies.

How to assess security risks in pediatric units and newborn nurseries

Start by defining the assessment’s scope: pediatric inpatient units, neonatal and newborn nurseries, neonatal intensive care, emergency and imaging areas, entrances, elevators, parking areas, and routes used to move patients. Review written policies and floor plans, observe normal workflows, and speak with staff who work on each shift.

• Map access and movement: Identify public entrances, unit doors, elevators, stairwells, loading areas, exits, blind spots, and routes between care areas. Check whether a person could enter or leave without being noticed or challenged.
• Consider child-specific risks: Assess risks related to infant abduction, unauthorized release, a child leaving without supervision, custody disputes, visitor conflict, and children who may not be able to communicate or protect themselves.
• Review incidents and near misses: Examine security calls, access-control failures, missing-child events, alarm activations, complaints, and previous corrective actions. Look for recurring locations, times, or process gaps.
• Assess operational and community hazards: Consider staffing patterns, construction, nearby public areas, local emergency response, power or communications interruptions, and threats identified in the hospital’s broader all-hazards planning.
• Document each finding: Record the location, observed condition, potential consequence, existing safeguards, evidence reviewed, and recommended corrective action. Assign an accountable owner and a target completion date.

Assessments should reflect the facility’s layout, patient population, visitor access, and community risks. The American Academy of Pediatrics’ hospital-care recommendations specifically identify these factors and support multidisciplinary input into pediatric security risk assessments.

Which disciplines should participate in the assessment

Include people who understand both security controls and pediatric care. A security-only review may overlook how a proposed safeguard affects bedside care, family access, or a child’s safe movement through the hospital.

• Hospital security leadership and frontline security staff.
• Pediatric, neonatal, nursery, and emergency nursing leaders, plus bedside staff from different shifts.
• Facilities, engineering, fire and life-safety, and environmental services representatives.
• Emergency preparedness, risk management, quality, and patient-safety staff.
• Registration, visitor services, and staff responsible for patient identification and release.
• Information technology or electronic security-system personnel.
• Social work, child protection, child life, and other staff who support children and families.
• Hospital leadership and, where appropriate, local law enforcement, emergency medical services, or emergency management partners.

Define each participant’s role before the review. Invite staff to describe actual workarounds, after-hours conditions, and situations where a written process is difficult to follow. The AAP recommends multidisciplinary assessment, with staff contributing expertise relevant to their responsibilities.

How to evaluate security programs and staff readiness

Review whether written policies are current, accessible to the staff who need them, and consistent across units. Check that procedures address routine security operations as well as escalation, system failure, and emergencies.

• Policies and accountability: Confirm that responsibilities are clear for reporting concerns, responding to alarms, restricting access, and escalating unresolved risks. Check whether prior findings were corrected and whether the changes were verified.
• Security systems: Inspect access-control readers, door hardware, cameras, infant-protection equipment, alarms, communications, and backup processes. Review maintenance and test records; verify that failures are reported, responded to, and resolved.
• Staff readiness: Check orientation and role-specific training records for employees, temporary personnel, contractors, and volunteers who may enter pediatric areas. Assess whether staff know how to identify an unauthorized person, report a concern, and follow the relevant procedure.
• Security staff credentialing and training: Verify that required credentials, background checks, role qualifications, and training are current under applicable law and hospital policy. Assess practical readiness through scenario questions or exercises rather than relying only on completion records.
• Communication and coverage: Confirm that staff know how to reach security and supervisors on every shift, including when normal communication systems are unavailable. Review whether staffing and response arrangements match the unit’s risks.

Separate legal or accreditation requirements from the hospital’s own standards and recommended practices. Federal emergency-preparedness requirements for participating hospitals include a documented, facility-based and community-based risk assessment, staff preparedness training, and testing of the emergency plan. See 42 CFR § 482.15 for the applicable requirements; do not treat a training record or certificate by itself as proof that the organization’s security program is effective.

How to assess infant and child abduction response procedures

Review the infant abduction response protocol alongside procedures for a missing child, unauthorized removal, and suspected custody-related removal. Confirm that staff can quickly find the current procedure and understand who takes command, who notifies security and law enforcement, and what actions each unit should take.

• Check that the procedure defines activation criteria, reporting channels, command roles, and how staff receive and acknowledge alerts.
• Verify that staff can describe how to protect the child, notify security, monitor relevant exits, and follow instructions without obstructing emergency egress or patient care.
• Review infant and child identification, matching, transport, and authorized-release processes, including how staff respond when a band, tag, alarm, or other safeguard is missing or not working.
• Confirm that procedures address visitor and staff identification, suspicious behavior, handoffs between departments, and communication with the child’s caregiver.
• Check that staff know how to preserve relevant information and direct media or external inquiries to the designated hospital contact.
• Review how the hospital documents the event, supports the family, investigates contributing factors, and tracks corrective actions.

If the facility uses an electronic infant-abduction system, review its testing, maintenance, staff training, and failure-response procedures. New York State Department of Health guidance recommends integrating such systems into a broader infant and pediatric safety program and having procedures for identifying people and reporting unauthorized individuals if the system fails. These are state guidance recommendations, not a universal federal checklist; confirm the requirements that apply to your facility. See the New York State Department of Health’s infant-abduction-system guidance.

Use exercises to test whether staff can recognize the scenario, communicate, follow their assigned roles, and coordinate across units. Record delays, confusion, system problems, and corrective actions. A pediatric abduction exercise can help validate the security response, as noted in the AAP recommendations for pediatric hospital care.

What to inspect in pediatric safe areas

Inspect each designated pediatric safe area in the context of how it will be used—for example, during a lockdown, security response, or temporary relocation. Include staff who understand the unit’s clinical needs and facilities or life-safety requirements.

• Check doors, locks, access controls, observation points, windows, and communication equipment. Confirm that staff can secure the area while following applicable fire and life-safety requirements.
• Look for blind spots, unsecured access points, stored equipment, and objects that could interfere with supervision, movement, or response.
• Check age-appropriate hazards, including accessible medications, sharps, cleaning products, small objects, cords, and unstable furniture.
• Assess the space for children with mobility, sensory, communication, or medical-support needs. Confirm that essential equipment and staff can reach them safely.
• Verify that the area supports communication with caregivers and staff, preserves appropriate family access where feasible, and provides a way to account for children and staff.
• Check the route into and out of the area, including whether equipment or patient beds could block movement during an emergency.
• For behavioral-health spaces or other areas with specific patient risks, assess additional hazards according to the hospital’s clinical policies and applicable safety requirements.

Record each hazard, its likelihood and potential impact, existing protections, and the person responsible for correction. Reinspect after renovations, changes in use, or significant changes to the patient population.

How to evaluate visitor access controls and emergency evacuation plans

Review the visitor identification and sign-in protocol from arrival through departure. Observe how it works during busy periods and after hours, and consider how staff handle exceptions without unnecessarily disrupting family-centered care.

• Check whether visitor identity, destination, authorization, and any required restrictions are verified consistently.
• Confirm that visitor badges or other access permissions are visible, time-limited or otherwise controlled, and returned or disabled as appropriate.
• Review how staff manage lost badges, tailgating, visitors who do not follow instructions, and attempts to enter restricted pediatric or newborn areas.
• Assess whether the process accounts for authorized caregivers, custody or safety restrictions, language access, and urgent clinical needs.
• Check how the hospital communicates access rules to families and visitors and how staff report concerns or request help.

For evacuation, confirm that the plan accounts for children’s ages, mobility, acuity, equipment, and supervision needs. Identify primary and alternate routes, assigned staff roles, communication methods, patient tracking, and a pediatric evacuation staging area where children can be accounted for and care can continue safely.

• Verify that routes and exits remain usable for infants in bassinets, children using mobility devices, and patients dependent on medical equipment.
• Check how staff will prioritize and move children, maintain identification, bring essential equipment, and hand off patients if transport to another location is needed.
• Confirm that the staging area can support supervision, communication, patient tracking, and reunification with authorized caregivers.
• Review arrangements for assistance from local emergency responders and receiving facilities, including how staff share patient information as permitted by applicable law.
• Test the process through exercises and document observations, barriers, and follow-up actions.

For hospitals subject to 42 CFR § 482.15, the emergency plan must use an all-hazards approach, include a documented facility-based and community-based risk assessment, and address the hospital’s patient population. The regulation also requires hospitals to conduct exercises to test the emergency plan at least twice per year. These emergency-preparedness requirements do not by themselves specify a universal frequency for a separate, independent pediatric security assessment.

In summary, an effective assessment connects pediatric-specific risks to workable safeguards, trained staff, tested response procedures, and documented corrective actions. Reassess when conditions change, and verify that improvements work in practice.

FAQs

How often should a pediatric hospital security risk assessment be conducted?

Conduct an initial assessment and review it regularly—at least annually is a practical schedule—and after significant changes such as renovations, major incidents, or changes to unit operations or patient populations. Treat this as a recommended security-program practice, not a universal federal annual requirement for an independent assessment. For hospitals subject to 42 CFR § 482.15, the emergency plan must include a documented risk assessment and be reviewed and updated at least every two years; the hospital must also test its emergency plan at least twice per year. Check applicable state, local, and accreditation requirements.

Who should participate in a pediatric hospital security risk assessment?

Include security, pediatric and neonatal nursing, facilities and life safety, emergency preparedness, risk management, patient safety, registration or visitor services, information technology, social work or child protection, and hospital leadership. Add relevant external emergency-response partners when appropriate. Participants should contribute expertise from their roles and care settings.

What should an infant abduction response exercise evaluate?

Evaluate whether staff recognize and report the scenario promptly, activate the correct infant abduction response protocol, communicate clearly, follow assigned roles, coordinate across units, and respond appropriately to alarms or system failures. Also review patient identification and accounting, family communication, security and law-enforcement coordination, and the documentation and follow-up process.

Which hazards should be checked in pediatric safe areas?

Check access points, doors and locks, observation and communication, blocked routes, unsafe storage, accessible medications or sharps, cords, small objects, unstable furniture, and risks specific to children’s age, mobility, medical needs, or behavior. Confirm that the area can be secured without compromising applicable life-safety requirements and that staff can account for and safely supervise the children inside.