Preoperative Evaluation Center Security Risk Assessment Checklist

How to assess facility-specific security risks

A preoperative evaluation center needs a security assessment tailored to its layout, patient flow, staffing, equipment, and information systems. Begin by mapping how patients, staff, vendors, medications, devices, and health information move through the facility, from the entrance and check-in area to exam rooms, offices, storage areas, and IT spaces.

Walk through the center during normal operations and, where practical, after hours. Look for risks such as unattended entrances, public access to staff-only spaces, hidden or poorly lit areas, unsecured storage, visible patient information, and emergency exits that could also allow unauthorized entry. Consider local conditions and credible threats, including theft, aggressive behavior, fire, flooding, power loss, and network outages.

• Identify assets and sensitive areas, including patient records, medication storage, staff workstations, medical equipment, and network or communications equipment.
• For each potential threat, document the vulnerability, likelihood, potential impact, existing safeguards, and any remaining risk.
• Assign each corrective action an owner, target date, and method for verifying completion.
• Record the assessment and its decisions so the center can track changes and explain why safeguards were selected.

The HIPAA Security Rule requires covered entities and business associates to assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI; the assessment should inform the safeguards selected for the center. See HHS guidance on Security Rule risk analysis.

Which access controls and monitoring systems should the checklist cover

Review every public, staff, service, and emergency access point. Assess whether facility access control is appropriate for each area, rather than relying on one entrance policy for the whole center. Check doors, locks, key and badge permissions, reception procedures, delivery access, and processes for granting, changing, and ending access.

• Confirm that staff identification badge protocols specify when badges must be worn, how lost badges are reported, and how access is promptly removed when a worker or contractor no longer needs it.
• Document how visitors and vendors are identified, signed in, escorted when appropriate, and prevented from entering restricted spaces without authorization.
• Assess security camera coverage at entrances, reception, corridors, and other locations where monitoring is justified by the center’s risk assessment. Check camera views for blind spots, image quality, recording availability, authorized access to footage, and retention practices.
• Review alarms, door sensors, access logs, and after-hours notifications. Identify who reviews alerts and how suspected unauthorized access is reported and documented.
• Check that access controls do not obstruct safe evacuation or interfere with emergency operations.

Cameras and badges are possible safeguards, not a universal HIPAA checklist requirement. HIPAA’s facility access control standard calls for policies and procedures that limit physical access to electronic information systems and facilities while allowing properly authorized access. See HHS guidance on facility access controls.

How to protect patients staff medications and equipment

Include patient privacy and physical safety in the same walkthrough. Review controlled patient intake so reception staff can verify identity and appointment status without unnecessarily exposing patient names, clinical details, or paperwork to other visitors. Check waiting-room sightlines, conversations at check-in, printed schedules, sign-in materials, and how documents are collected and disposed of.

• Keep medication storage locked or otherwise access-restricted according to applicable law, the center’s policies, and the medication’s specific handling requirements. Limit access to authorized personnel and document how keys or codes are controlled.
• Check that medications are stored in appropriate conditions, inventory or discrepancy procedures are defined, and suspected loss or tampering is escalated promptly.
• Secure medical equipment and supplies when unattended. Record equipment identifiers where useful, restrict access to storage areas, and define how missing or damaged items are reported.
• Protect paper records and devices from casual viewing, theft, or removal. Use secure storage and disposal procedures for documents and media that contain sensitive information.
• Assess workstation placement, screen privacy, automatic locking, and the security of devices used in exam rooms, intake areas, and shared workspaces.

HIPAA’s physical safeguards address electronic information systems and related buildings and equipment, including facility access, workstation use and security, and device and media controls. The center should use its physical safeguard assessment to identify protections appropriate to its environment; medication and equipment controls may also depend on other applicable requirements and facility policies.

How to define security roles training and emergency procedures

Name the people responsible for maintaining the checklist and responding to problems. Assign a security official or equivalent lead, and identify operational contacts for facility access, patient safety, medication storage, IT, privacy, and incident response. Make responsibilities clear for each shift, including who serves as backup when the primary contact is unavailable.

• Document who approves staff, contractor, and visitor access; who issues and deactivates badges; and who reviews access logs or camera alerts.
• Provide role-appropriate instructions on badge use, visitor handling, patient privacy, secure workstations, lost devices, suspicious activity, and incident reporting.
• Keep current internal and external emergency contacts, including facility leadership, emergency services, building management, IT support, and relevant vendors and business associates.
• Set procedures for fire, severe weather, power loss, unauthorized entry, missing medication or equipment, system outage, and suspected exposure or loss of information.
• Specify how staff report an incident, who contains or investigates it, how actions are documented, and how leadership decides whether further notifications are required.
• Plan how authorized staff will access facilities and critical systems during emergency operations without creating unnecessary exposure or unsafe entry.

HIPAA requires covered entities and business associates to address security incidents and to establish contingency procedures for emergencies that damage systems containing ePHI. The specific response plan should fit the center’s services and risks. See HHS guidance on Security Rule incident procedures and the HHS HIPAA audit protocol.

How to assess electronic protected health information risks and safeguards

Include every system and device that creates, receives, maintains, or transmits ePHI—not only the electronic health record. Inventory relevant workstations, mobile devices, servers, network equipment, backup systems, cloud services, and third-party services. Trace how information moves through the center and identify who can access it, from which locations, and for what work purposes.

• Identify threats and vulnerabilities that could affect ePHI confidentiality, integrity, or availability, such as unauthorized access, phishing or malware, lost devices, misdirected communications, power failure, or environmental damage.
• Review user accounts and permissions, authentication, workstation access, audit records, backups, recovery arrangements, and processes for removing access when job duties change or employment ends.
• Check that staff know how to report suspicious messages, unexpected system behavior, lost devices, or suspected disclosure, and that incident response steps are documented.
• Assess vendors and business associates that handle ePHI, including how responsibilities, incident reporting, and service continuity are addressed in relevant agreements.
• Document the risk rating, current safeguards, gaps, selected mitigation steps, responsible owners, and planned follow-up. If a particular safeguard is not appropriate, document the rationale and consider an equivalent measure where required.

HHS describes risk analysis as an assessment of risks and vulnerabilities that could affect ePHI and the likelihood of those risks occurring. A documented ePHI threat and vulnerability analysis should cover the organization’s full ePHI environment and guide risk management, not just produce a one-time checklist. See HHS’s explanation of risk analysis and risk management.

When to reassess security after facility changes

Reassess when a change could affect physical access, patient flow, staff responsibilities, equipment, or ePHI. Examples include remodeling, a new entrance or intake workflow, a change in medication or equipment storage, new camera or badge systems, new technology, a vendor change, a security incident, or a significant change in ownership or key personnel.

HIPAA does not set one universal calendar interval for every Security Rule risk analysis. HHS says the frequency depends on the organization’s circumstances and emphasizes ongoing analysis, periodic evaluation, and review when environmental or operational changes may affect ePHI. Set a documented review cadence appropriate to your risks, and perform an additional review when a significant change or newly recognized threat occurs. See HHS guidance on reassessing risk.

To keep the checklist useful, record the assessment date, areas reviewed, findings, action owners, due dates, and evidence that corrective steps were completed. In short, a strong preoperative evaluation center security risk assessment connects facility access, patient and asset protection, staff responsibilities, emergency readiness, and ePHI safeguards—and updates them as the center changes.

FAQs

How often should a preoperative evaluation center reassess its security risks?

HIPAA does not prescribe one fixed schedule for every risk analysis. Set a review cadence based on your center’s risks and operational circumstances, and reassess when changes, incidents, or newly recognized threats could affect security. HHS describes risk analysis as an ongoing process and calls for periodic evaluation.

What access points and security systems should the assessment review?

Review public entrances, staff-only doors, service and delivery entrances, emergency exits, and access to medication, equipment, records, and IT areas. Assess badges, keys, locks, visitor procedures, alarms, access logs, and security camera coverage where used, including who monitors alerts and how access is removed when no longer needed.

How should the center assess risks to electronic protected health information?

Inventory the systems and devices that create, receive, maintain, or transmit ePHI, then identify relevant threats, vulnerabilities, likelihood, and potential impact. Review access permissions, workstations, devices, audit records, backups, recovery procedures, vendors, and incident response; document safeguards, gaps, and corrective actions.

Which staff roles and emergency contacts should be included in the checklist?

Identify the security lead and the people responsible for facility access, badge management, patient safety, medication storage, IT, privacy, and incident response, with backups for each critical role. Keep current contacts for facility leadership, emergency services, building management, IT support, and relevant vendors or business associates, and state how staff escalate incidents and emergencies.