Public Safety-Net Hospital Security Risk Assessment Checklist

A security risk assessment helps you identify where people, property, care, or hospital operations could be harmed—and whether current safeguards work in practice. Use this checklist across the hospital and its associated clinics, considering each site’s services, hours, patient population, staffing, neighborhood context, and available resources.

How to assess facility-specific security risks

Start with a walk-through of every location, including emergency and behavioral health areas, inpatient units, outpatient clinics, pharmacies, loading docks, parking areas, and spaces shared with partner organizations. Review conditions during different shifts and busy periods, not only during a daytime inspection.

• ☐ Map public, staff-only, restricted, and security-sensitive areas, along with entrances, exits, and routes between them.
• ☐ Identify who uses each area, when it is occupied, and what care or essential services depend on it.
• ☐ Review security incident reporting records, near misses, injury logs, calls for assistance, property losses, and prior assessments for recurring locations or patterns.
• ☐ Ask staff, patients, and community partners where they experience unsafe conditions, confusing procedures, or barriers to getting help.
• ☐ Consider risks associated with crowding, long waits, limited staffing, isolated work, after-hours services, and open or shared-use spaces.
• ☐ Record each hazard, who could be affected, existing safeguards, remaining gaps, and the person responsible for follow-up.

Use incident histories and employee input alongside direct observation. OSHA recommends ongoing hazard assessment and describes worksite analysis, employee involvement, hazard controls, training, and program evaluation as components of a workplace violence prevention program. See OSHA’s hospital workplace violence guidance.

Which threats and security incidents should the checklist cover

Include intentional security incidents and conditions that could compromise safety or disrupt care. A useful assessment considers how each threat could arise at your specific facility, who might be affected, and how staff would detect, report, and respond to it.

• ☐ Workplace violence prevention, including threats, assaults, harassment, stalking, weapons, and escalation in waiting rooms, emergency departments, or care units.
• ☐ Unauthorized entry, theft, vandalism, property damage, trespassing, and disruption of hospital operations.
• ☐ Infant abduction prevention and security incidents involving children or other patients who cannot independently protect themselves.
• ☐ Medication security, including theft, diversion, unauthorized access, inventory discrepancies, and suspicious handling of controlled substances.
• ☐ Risks to staff traveling to and from parking areas, working alone, or responding to incidents outside the main building.
• ☐ Security consequences of power, communications, alarm, camera, or access-control failures.
• ☐ Threats or disruptions affecting nearby clinics, entrances, public areas, and shared facilities.

Maintain a reporting process for incidents and near misses, and make sure employees and contractors know how to use it. OSHA recommends prompt reporting, recordkeeping, and review of incidents to identify hazards and assess prevention measures. The Joint Commission’s overview of a secure and safe physical environment also identifies violence, theft, infant abduction, and unrestricted medication access as examples of security risks.

How to evaluate access control and security monitoring

Assess whether access rules match the risk of each area while allowing patients to reach necessary care. Review access control systems as an end-to-end process: authorization, credential use, monitoring, response, and periodic review.

• ☐ Check that restricted-area access is limited to people with a current work-related need and is removed promptly when roles or employment change.
• ☐ Review badges, keys, visitor sign-in, staff identification, delivery procedures, and temporary access arrangements.
• ☐ Test doors, locks, alarms, duress buttons, cameras, and other monitoring equipment; document outages and corrective actions.
• ☐ Identify blind spots and confirm that monitoring procedures cover areas without camera visibility.
• ☐ Review how staff respond to alarms, suspicious activity, unauthorized entry, and lost or shared credentials.
• ☐ Confirm that downtime procedures describe how to verify identity and control access when electronic systems fail.
• ☐ Check that camera and access logs are handled under hospital policies for appropriate access, retention, and privacy.

Test safeguards during realistic conditions, including shift changes, busy entry periods, and system outages. A functioning device alone does not show that a control is effective: confirm that alerts reach the right people and that staff can respond promptly.

How to protect patients and visitors in vulnerable care settings

Identify patients and visitors who may need additional safeguards because of age, disability, medical condition, behavioral health needs, communication barriers, or inability to leave or seek help independently. Choose measures that protect people without creating unnecessary barriers to care or treating vulnerability as a security threat.

• ☐ Review infant and pediatric identification, authorized caregiver verification, transport procedures, unit entry, and response plans for suspected abduction.
• ☐ Check whether patients at risk of violence, exploitation, elopement, or unwanted contact have individualized safety measures and clear staff handoffs.
• ☐ Evaluate privacy and safe-access arrangements for patients experiencing domestic or interpersonal violence.
• ☐ Ensure visitors can find help, understand basic safety directions, and access appropriate interpretation or communication support.
• ☐ Confirm that staff can request assistance discreetly and that escalation procedures account for clinical needs.
• ☐ Review how security measures are coordinated with clinical teams so they do not unnecessarily interrupt treatment or emergency access.

For infant abduction prevention, include both routine procedures and contingencies for equipment or network outages. The Joint Commission’s 2025 Cyber Resilience Readiness guide raises practical review questions about manual access control, infant tracking, staff identification, communication, and drills during outages.

What facility and infrastructure risks should be reviewed

Assess the building, grounds, and systems that support safe care. Include hazards that could create an unsafe environment directly or make security controls unavailable during an emergency.

• ☐ Inspect lighting, sightlines, landscaping, waiting areas, parking lots, entrances, doors, windows, and routes used by staff and patients.
• ☐ Check whether reception areas and workspaces allow staff to summon help and leave safely during a threatening incident.
• ☐ Review the physical security of medication storage, sensitive records, equipment, and supplies.
• ☐ Identify dependencies on electricity, telecommunications, network access, alarms, cameras, and electronic locks.
• ☐ Review emergency evacuation planning, sheltering, lockdown, and continuity procedures for people who may need assistance moving or communicating.
• ☐ Confirm that response plans address coordination with local emergency management and public safety partners where appropriate.

For hospitals participating in Medicare or Medicaid, CMS emergency preparedness requirements include an all-hazards risk assessment and emergency planning, communications, policies and procedures, and training and testing. CMS guidance says the emergency plan is reviewed and updated at least annually; that requirement should not be confused with a universal federal schedule for every separate security assessment. See CMS’s core emergency preparedness rule elements.

How to assess staff, vendor, and security training needs

Training should match job duties, likely risks, and the procedures staff are expected to use. Include employees, contractors, temporary workers, volunteers, and vendors according to their access and responsibilities.

• ☐ Confirm staff know how to report security incidents and near misses and how to request an urgent response.
• ☐ Assess training needs for de-escalation, workplace violence prevention, emergency alerts, evacuation, lockdown, and downtime procedures.
• ☐ Include role-specific practice for staff in emergency, behavioral health, pediatric, pharmacy, and other higher-risk settings.
• ☐ Review vendor credentialing, identity verification, access limits, escort requirements, and how staff recognize authorized service providers.
• ☐ Check whether onboarding, job changes, and policy updates trigger the appropriate training and access review.
• ☐ Use drills or exercises to test whether staff can carry out procedures under realistic conditions, then document gaps and corrective actions.

OSHA describes training and employee participation as parts of an effective workplace violence prevention program. Training should be specific to the facility’s policies and procedures, with refreshers or additional instruction when assessments, incidents, or changes in work practices reveal a need. See OSHA’s Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers.

How to evaluate and improve security measures

Turn assessment findings into an action plan. Rank each risk by its potential consequences, likelihood, people affected, and the strength of current safeguards. Assign an owner, a target date, and a way to verify completion.

• ☐ Prioritize urgent hazards and gaps that could expose patients, staff, or visitors to immediate harm.
• ☐ Select controls that address the identified risk, considering operational impact and access to care.
• ☐ Track corrective actions, equipment repairs, policy changes, training, and unresolved risks.
• ☐ Review incident and near-miss trends to see whether problems recur or shift to different locations or times.
• ☐ Test whether controls work in practice, including during busy periods and planned or unplanned system outages.
• ☐ Reassess after a serious incident, a significant facility or service change, or evidence that a control is not working as intended.
• ☐ Share relevant findings with leadership, staff, and community partners while protecting sensitive information.

For controlled substances, include access, inventory reconciliation, recordkeeping, and procedures for suspected theft or significant loss. DEA guidance explains that registrants have security responsibilities and that theft or significant loss requires prompt notification to DEA; review current requirements and facility procedures with the responsible compliance and pharmacy leaders. See the DEA’s 2024 Drugs of Abuse Resource Guide.

In summary, a useful hospital security assessment is site-specific, informed by the people who use the facility, and followed by assigned corrective actions. Review both the controls themselves and whether staff can reliably use them to protect patients, visitors, and workers while maintaining access to care.

FAQs.

How often should a safety-net hospital conduct a security risk assessment?

There is no single universal federal interval for every hospital security risk assessment. As a practical approach, review risks regularly and after a significant incident, facility or service change, or identified control failure. OSHA guidance recommends worksite analysis annually or after an incident, while CMS requires covered hospitals to review and update their emergency preparedness plan at least annually. Those are distinct recommendations and requirements, so confirm which rules apply to your facility and state.

Who should participate in a hospital security risk assessment?

Include people who understand both hospital operations and day-to-day risks: security, facilities, emergency management, nursing, clinical services, pharmacy, human resources, occupational safety, compliance, and leadership. Involve frontline workers from different shifts and locations, and seek input from patient or community representatives and relevant emergency-response partners where appropriate.

How should hospitals assess security risks to vulnerable patients?

Identify where a patient’s age, disability, condition, communication needs, or ability to seek help may affect their safety. Review practical safeguards for identification, authorized access, transport, privacy, and escalation response, including infant abduction prevention where relevant. Coordinate measures with clinical teams and check that protections do not unnecessarily delay care or restrict access.

How can a hospital determine whether security measures are effective?

Test them in practice. Review incident and near-miss patterns, inspect equipment, conduct drills, ask staff whether procedures are workable, and verify that alerts lead to an appropriate response. Document gaps, assign corrective actions, and reassess after implementation to confirm the change reduced the identified risk.