Post-Surgical Recovery Care Center Security Risk Assessment Checklist

Use this checklist to assess how well your post-surgical recovery care center protects patients, staff, medications, and sensitive information. Tailor each control to your facility’s services, patient population, applicable laws, and identified risks; document gaps, assign owners, and track corrective actions.

How should facility access controls be assessed?

Review who can enter the facility, which areas they can access, and how access is granted, monitored, and removed. If your organization is subject to the HIPAA Security Rule, its facility access controls standard addresses limiting physical access to electronic information systems and the facilities where they are housed. HHS guidance includes controlling and validating access based on a person’s role or function, including visitor control. HHS HIPAA Audit Protocol

• ☐ Check that exterior doors, staff-only areas, medication rooms, and spaces containing electronic protected health information have appropriate access restrictions.
• ☐ Review how keys, badges, codes, and credentials are issued, tracked, periodically reviewed, and promptly disabled when no longer needed.
• ☐ Test the access control system, door alarms, and procedures for outages or other failures.
• ☐ Confirm that video surveillance coverage, where used, includes relevant entry points without compromising patient privacy in care areas.
• ☐ Review access logs and investigate unusual activity according to facility policy.

Record each weakness, its potential impact, the corrective action, and the person responsible for follow-up. Choose safeguards based on your risk assessment rather than assuming that one technology, such as cameras or electronic locks, is sufficient on its own.

Are patient identification and visitor verification procedures effective?

Confirm that your visitor management protocol makes it practical for staff to distinguish authorized visitors from people who have not been cleared to enter. The process should balance safety, patient preferences, privacy, and clinical needs; the appropriate steps may vary by patient, unit, and time of day.

• ☐ Define how staff verify a visitor’s identity and whether the visit is permitted, using a consistent process that respects applicable privacy rules and patient preferences.
• ☐ Issue visitor badges or another visible identifier when appropriate, and explain where visitors may go and whether an escort is required.
• ☐ Set procedures for after-hours visits, delivery personnel, contractors, and other non-routine entrants.
• ☐ Establish a process for staff to respond when someone refuses verification or attempts to enter a restricted area.
• ☐ Check that patient identification steps used during care handoffs and other high-risk interactions follow facility policy.

HHS identifies visitor control as one example of facility access validation for entities covered by the HIPAA Security Rule. The rule does not prescribe one universal visitor check-in method for every recovery center, so document the approach that fits your operations and risk assessment. HHS HIPAA Audit Protocol

How are medications and other restricted items secured?

Walk through medication storage, preparation, and handling areas to see whether access is limited to authorized personnel and whether concerns can be identified and escalated. Include controlled substance storage in the assessment, along with other items your facility considers restricted, such as keys, equipment, or sensitive records.

• ☐ Confirm that medication storage areas and containers are secured, with access limited to personnel authorized under facility policy.
• ☐ Review how access credentials and keys are controlled, and whether storage areas are checked for tampering or other signs of unauthorized access.
• ☐ Reconcile medication inventories and records according to applicable rules and facility procedures; investigate and document discrepancies promptly.
• ☐ Check that medication deliveries, transfers, returns, and disposal follow documented procedures.
• ☐ Verify that staff know whom to notify if medication is missing, damaged, or potentially diverted.

DEA regulations specify physical security requirements for controlled substances held by practitioners, including requirements for certain schedules and conditions. Because the precise requirements depend on the registrant and setting, confirm the applicable rules for your facility rather than relying on a general checklist alone. 21 CFR § 1301.75, Physical security controls for practitioners

Can staff detect and respond to unauthorized entry or violence?

Assess both prevention and response: staff should be able to recognize a developing problem, summon help, and follow a clear response plan. OSHA recommends ongoing workplace violence hazard assessment and describes measures such as training, reporting procedures, and appropriate physical or administrative controls. OSHA Hospital Workplace Violence eTool

• ☐ Identify locations and situations that could increase risk, including poorly lit areas, isolated work, restricted-area access, or times when staffing is limited.
• ☐ Confirm staff know how to report suspicious behavior, threats, and incidents, including near misses, without delay.
• ☐ Test the staff duress alarm or other means of requesting urgent assistance, and verify that a designated response is available.
• ☐ Review staff training on de-escalation, emergency procedures, and when to contact security or law enforcement.
• ☐ Check that security equipment and lighting work as intended, and assess whether surveillance placement is appropriate for the identified risks.

OSHA advises employers to continually assess hazards and says its hospital eTool recommends conducting a worksite analysis annually or after an incident that identifies program weaknesses. Treat those intervals as guidance for workplace violence prevention, not as a universal federal schedule for every security risk assessment. OSHA Hospital Workplace Violence eTool

Are emergency communication and incident reporting procedures reliable?

Check whether staff can report an incident quickly and whether the emergency notification system reaches the people who need to act. Include procedures for communication failures, after-hours events, and incidents that require coordination with emergency responders.

• ☐ Post or make readily available clear instructions for reporting security incidents and urgent emergencies.
• ☐ Test that alarms and notification methods can be perceived by staff who need to respond, including when a primary communication method fails.
• ☐ Define what an incident report should capture, such as time, location, people involved, actions taken, and any follow-up required.
• ☐ Set a process for promptly notifying the appropriate supervisor or response team, preserving relevant records, and reviewing incidents for recurring risks.
• ☐ Train staff on whom to contact, what information to share, and how to protect patient information while following emergency procedures.

OSHA guidance emphasizes prompt emergency reporting and alarms that can be perceived by affected workers, with a plan for how they should respond. OSHA: Reporting Emergencies For workplace violence prevention, OSHA also recommends incident reporting, recordkeeping, and program evaluation. OSHA Hospital Workplace Violence eTool

Do evacuation and continuity plans account for patients with limited mobility?

Review whether your evacuation assistance plan reflects the actual care and mobility needs of patients recovering from surgery. Plans should identify who will assist, what equipment or transportation may be needed, where patients will go, and how staff will communicate and maintain continuity of care.

• ☐ Identify patients who may need help moving, communicating, or accessing medications and medical equipment during an emergency.
• ☐ Assign staff responsibilities for assisting patients and identify available mobility aids and transportation resources.
• ☐ Identify primary and alternate evacuation destinations, along with procedures for tracking patients and communicating their location.
• ☐ Plan for sheltering in place, power interruptions, and access to essential supplies if immediate evacuation is not appropriate.
• ☐ Practice relevant scenarios and update procedures when drills, incidents, staffing, or patient needs reveal a gap.

Requirements vary by facility type and certification. For example, Medicare-participating hospitals must address safe evacuation, including evacuees’ care and treatment needs, staff responsibilities, transportation, evacuation locations, and communication with outside assistance. Confirm which specific emergency preparedness rules apply to your center. CMS Emergency Preparedness Rule

A useful security assessment connects identified risks to specific safeguards, staff responsibilities, and follow-up actions. Review the checklist against your facility’s current operations, correct documented gaps, and reassess when incidents or operational changes may affect risk.

FAQs

How often should a recovery center review its security risks?

Set a review schedule based on your facility’s risks, applicable requirements, and internal policies, and reassess after significant operational changes or incidents that expose a weakness. OSHA’s hospital workplace violence guidance recommends worksite analysis annually or after an incident that identifies program weaknesses; this is workplace violence guidance, not a universal review interval for every type of security risk. OSHA Hospital Workplace Violence eTool

What should a visitor verification procedure include?

Define how staff confirm a visitor’s identity and whether the visit is authorized, where visitors may go, when an escort or badge is appropriate, and how to handle after-hours visits or attempted access to restricted areas. Apply the procedure consistently while respecting patient preferences, privacy, and care needs.

How should staff report a security incident?

Staff should use the facility’s designated reporting channel promptly and notify the appropriate supervisor or response team. Procedures should explain how to record relevant details, escalate urgent threats, preserve information for review, and report near misses as well as incidents. OSHA recommends prompt reporting and keeping records that can help assess hazards and evaluate prevention measures. OSHA Hospital Workplace Violence eTool

How should evacuation plans address patients who need mobility assistance?

Specify who will assist each patient, the mobility equipment and transportation available, appropriate evacuation destinations, and how staff will track patients and communicate their needs. Test the plan with realistic scenarios and update it when patient care needs or facility conditions change. Applicable CMS requirements depend on the facility type; hospital rules, for example, address evacuee care needs, staff responsibilities, transportation, evacuation locations, and communication with external assistance. CMS Emergency Preparedness Rule