Psychiatric Partial Hospitalization Program Security Risk Assessment Checklist

A psychiatric partial hospitalization program (PHP) provides intensive treatment during the day, but it is not a substitute for round-the-clock supervision. A practical security risk assessment should connect the needs of the people served with the facility’s layout, staffing, daily activities, and emergency procedures. Use this checklist as a planning aid, then confirm applicable requirements with your licensing authority and other regulators.

How should a PHP security risk assessment reflect the facility and patient population?

Start with the program’s actual operating model: who it serves, when patients are present, which services it provides, and what parts of the building they can access. Assess risks for the population as a whole, while allowing clinicians to identify when an individual needs additional monitoring or a different level of care.

• Describe the population and services. Consider age groups, mobility or communication needs, common clinical risks, medication-related needs, and whether the program provides services such as meals or recreation.
• Map the patient journey. Follow the route from arrival and check-in through treatment, breaks, restrooms, departure, transportation pickup, and any outdoor activities.
• Review staffing and sightlines. Identify who is responsible for each area, how staff request assistance, and whether the number and placement of staff support the program’s patient observation and supervision protocols.
• Evaluate changing risk. Specify how staff communicate a change in a patient’s condition, reassess safety, and adjust observation or treatment plans.
• Consider visitors and contractors. Review how the facility manages visitor access, deliveries, maintenance work, and the presence of tools or hazardous supplies.

Keep patient-specific clinical decisions separate from the building-wide assessment: a safer room or stronger access control cannot replace clinical evaluation and appropriate care. CMS describes PHP as outpatient treatment, with Medicare coverage available through a hospital outpatient department or a Medicare-certified community mental health center when coverage criteria are met. See Medicare’s overview of partial hospitalization.

Which patient areas and environmental hazards should the checklist cover?

Inspect every space patients may use, not only the rooms where therapy takes place. A ligature and environmental hazard assessment should consider the way patients use each area and the risks identified for the people served; it should not assume that every outpatient space requires the same precautions as a psychiatric inpatient unit.

• Entrances, reception, and waiting areas: Check visitor check-in, visibility, unsecured doors, waiting-room furnishings, and access to staff-only areas.
• Therapy and consultation rooms: Review exits, furniture, windows, cords, accessible objects, and staff ability to summon help while maintaining appropriate privacy.
• Restrooms and changing areas: Assess privacy, staff response arrangements, fixtures, and whether the environment is appropriate for the assessed patient risks.
• Medication, supply, and utility areas: Secure medications, sharps, cleaning agents, tools, and other hazardous items against unauthorized access.
• Hallways, stairs, elevators, and exits: Check for blind spots, unlocked routes to restricted areas, trip hazards, blocked exits, and access to building controls.
• Outdoor areas, parking, and pickup points: Review supervision, lighting, boundary visibility, traffic, and how staff handle a patient who leaves unexpectedly.

CMS’s ligature-risk guidance identifies examples such as door hardware, exposed pipes, windows, cords, unsecured hazardous supplies, and inadequate monitoring as potential safety considerations in hospital settings. The guidance is hospital-focused; use it as a reference for relevant hazards rather than assuming every provision applies identically to every freestanding PHP. See CMS guidance on ligature risk and environmental assessment in hospitals.

How can staff assess group rooms, dining areas, and recreation spaces?

Assess these spaces during realistic program activities, not only when they are empty. Consider how people move through the room, where staff are positioned, what items are available, and whether staff can respond quickly without unnecessarily restricting treatment or patient dignity.

• Group rooms: Check seating layout, visibility of entrances and exits, access to staff support, furniture stability, and whether confidential discussion can occur without compromising safety.
• Dining areas: Review food-service flow, kitchen or serving-area access, storage of utensils and cleaning products, and individualized procedures for items that may pose a risk. Avoid blanket restrictions where a patient-specific assessment and safe handling can address the concern.
• Recreation spaces: Inventory equipment and movable objects, assess supervision and boundaries, and set procedures for activities involving tools, cords, outdoor access, or physical exertion.
• Shared-use spaces: Clarify responsibility when rooms are used by different groups or when patients, visitors, and staff share an area.
• After-use checks: Decide who confirms that supplies are returned, hazards are secured, and the room is ready for the next group.

Document the hazard, who may be exposed, the risk-reduction measure, who owns the follow-up, and when it will be reviewed. A written checklist helps staff act consistently, but it does not replace clinical judgment or a patient-specific safety plan.

What should a written facility security plan include?

A written plan should turn assessment findings into clear responsibilities and repeatable procedures. Keep it specific to the facility, accessible to staff who need it, and consistent with the program’s clinical, emergency, and incident-reporting policies.

• Risk assessment and review: Identify assessment areas, responsible reviewers, review triggers, corrective-action owners, deadlines, and how completed actions are verified.
• Access control procedures: Define how staff manage keys, badges, entry doors, visitor check-in, restricted rooms, deliveries, and access during maintenance or after hours.
• Patient observation and supervision protocols: State how observation needs are determined, communicated, documented, and reassessed, including staff coverage during transitions and breaks.
• Hazard control: Explain how the program secures medications, sharps, cleaning products, tools, and other items identified in the assessment.
• Emergency contacts and escalation: Identify who leads the response, how staff summon internal help, and when to contact emergency services or transfer a patient for urgent evaluation.
• Training and drills: Specify staff orientation and practice for relevant procedures, including how new or temporary staff learn their roles.
• Incident documentation and follow-up: Identify what staff record, who reviews reports, how corrective actions are tracked, and how recurring patterns inform reassessment.

For Medicare-certified community mental health centers, CMS Conditions of Participation address client rights, admission and discharge, treatment, quality improvement, and emergency preparedness. CMS states that a CMHC’s emergency preparedness program must meet applicable federal, state, and local requirements. These requirements apply according to provider status and scope; a checklist should not present every recommended security practice as a universal federal rule. See CMS’s Community Mental Health Center requirements and CMS’s emergency preparedness guidance.

How should staff respond to security incidents?

A security incident response plan should give staff a clear sequence of actions while allowing them to adapt to the immediate danger. Make the response accessible and rehearse role assignments so staff know whom to notify and how to get help.

1. Protect people first. Move patients and staff away from immediate danger when possible, summon the designated response lead, and call emergency services when the situation requires urgent outside assistance.
2. Use the established clinical response. Follow the patient’s current safety plan and facility procedures. Do not rely on environmental controls alone when a patient may need urgent clinical assessment or a higher level of care.
3. Secure the area when safe to do so. Limit access to a hazard, preserve a safe route for responders, and avoid actions that could increase risk.
4. Notify the right people. Follow facility policy for contacting clinical leadership, the patient’s treating clinician, emergency contacts, and external authorities where required.
5. Document and review. Record objective facts, time, actions taken, notifications, outcome, and follow-up. Review whether staffing, access controls, training, or the environment should change.

Include procedures for foreseeable situations such as a threatening or violent event, a patient leaving unexpectedly, a weapon or dangerous item, a medical emergency, fire, severe weather, and interruptions to utilities or communications. Reporting obligations and response details can vary by setting and jurisdiction, so confirm them with the relevant authorities and facility policies.

When may safety or security risks require a higher level of care?

Consider a higher level of care when a patient’s needs cannot be safely met through the PHP’s daytime structure and available support outside program hours. Relevant concerns may include an imminent risk of self-harm or harm to others, inability to maintain safety outside the program, or a need for continuous supervision or urgent medical evaluation.

PHP is not 24-hour inpatient care. Medicare describes partial hospitalization as outpatient treatment and notes that coverage requires a provider to certify that the patient would otherwise need inpatient treatment. The treating clinician should evaluate the patient’s current condition, available supports, and appropriate level of care; the facility checklist itself cannot determine admission or discharge. See Medicare’s partial hospitalization coverage information.

If an immediate threat or medical emergency is present, follow the emergency response plan and obtain urgent help. For non-emergency changes, promptly involve the treating clinician and document the assessment, safety decisions, communication, and disposition in accordance with facility policy.

How do facility setting and state requirements affect the assessment?

The applicable requirements depend on how the program is organized and licensed. A PHP operating as a hospital outpatient department is subject to the requirements applicable to that hospital, while a Medicare-certified CMHC must follow the CMHC Conditions of Participation. A freestanding program may also be subject to state licensing rules, local building and fire codes, and other requirements that depend on its services and location.

Before finalizing the checklist, identify the facility’s legal and certification status and verify current state PHP licensure requirements with the relevant state agency. Confirm which rules address facility design, staffing, emergency planning, incident reporting, patient rights, and required documentation. CMS explains the federal CMHC requirements and the emergency-preparedness obligations applicable to CMHCs in its CMHC guidance; those federal requirements do not replace state or local rules.

In short, a useful PHP security assessment is tailored to the patient population, the actual facility, and the program’s legal setting. It identifies hazards, assigns corrective actions, supports clear response procedures, and prompts clinical reassessment when a patient’s needs exceed what outpatient care can safely provide.

FAQs

Does a psychiatric PHP provide 24-hour supervision?

No. A PHP is an outpatient program and does not provide the continuous supervision associated with inpatient care. Patients need appropriate support outside program hours; if their safety needs require around-the-clock supervision, the treating clinician should evaluate whether a higher level of care is appropriate.

When may a patient’s safety needs require inpatient care?

Inpatient evaluation may be appropriate when the patient needs continuous supervision because of serious risk of self-harm or harm to others, cannot maintain safety outside the program, or needs urgent evaluation that the PHP cannot provide. A qualified clinician should assess the situation and determine the appropriate next step.

Which spaces should a PHP security risk assessment include?

Include all areas patients may use: entrances, reception, waiting areas, therapy and group rooms, dining and recreation spaces, restrooms, hallways, stairs, medication and supply areas, outdoor areas, parking, and transportation pickup points. Also assess staff-only spaces and contractor access where they could affect patient safety.

What security procedures should a PHP facility document?

Document access control procedures, patient observation and supervision protocols, hazard control, incident response, emergency contacts, staff responsibilities, training, incident documentation, and corrective-action follow-up. Tailor the procedures to the facility, patient population, and applicable state and federal requirements.