Security Risk Assessment Checklist for Physician-Owned Surgical Hospitals

Use this checklist to review the security risks that affect your surgical hospital’s people, spaces, equipment, records, and clinical operations. Tailor each step to your facility’s layout, services, staffing, technology, and emergency plans; a generic checklist cannot replace a facility-specific assessment.

How to Conduct a Facility-Specific Security Risk Assessment

Start by defining what the assessment covers: the hospital building and grounds, affiliated offices or storage areas, staff and contractors, patient and visitor access, information systems, and equipment used in patient care. Map how patients, employees, vendors, supplies, and information move through the facility—including after-hours and emergency access.

HIPAA’s Security Rule requires covered entities to assess risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI), then manage identified risks to a reasonable and appropriate level. The analysis must cover ePHI the organization creates, receives, maintains, or transmits. See the HHS guidance on conducting a risk analysis and 45 CFR § 164.308.

• Walk the facility during normal operations and, where practical, during evenings or weekends.
• Review incident reports, access logs, maintenance records, security complaints, and prior assessment findings.
• Identify threats such as unauthorized entry, theft, vandalism, workplace violence, fire, utility failure, and cyber incidents that could disrupt clinical services.
• Assess both the likelihood and potential impact of each risk, including possible effects on patient safety, privacy, equipment availability, and surgical operations.
• Record existing safeguards, gaps, responsible owners, and proposed corrective actions.

Include hazards specific to your hospital’s services and layout, such as access to operating rooms, recovery areas, medication storage, sterile processing, medical gas systems, records, and network infrastructure. Revisit the analysis when operations, ownership, staffing, the building, or technology changes, or after a significant incident. HIPAA does not set one universal schedule for repeating the risk analysis; HHS says the process should be ongoing and the frequency should reflect the organization’s circumstances.

Which Staff Roles and Training Does the Security Plan Require?

Assign a security official to coordinate the program and make responsibilities clear. Depending on your facility, involve the administrator, clinical leaders, facilities and security staff, human resources, the privacy officer, IT or cybersecurity personnel, and the person responsible for emergency preparedness. Physician ownership does not remove the need to define who has authority to approve controls, assign resources, and track corrective actions.

The HIPAA Security Rule requires a security awareness and training program for all workforce members, including management. Training should reflect each person’s duties and your hospital’s policies—for example, how to report a suspicious person, protect credentials, challenge or escort visitors, respond to threats, and report a lost badge or key. See 45 CFR § 164.308(a)(5).

• Orient new workforce members to the security procedures that apply to their roles.
• Provide role-specific instruction to staff who manage access systems, keys, surveillance equipment, or security incidents.
• Make sure employees know how to summon help and follow emergency instructions without putting themselves or patients at unnecessary risk.
• Document training completion and provide updates when policies, risks, or systems change.

The HIPAA Security Rule calls for security awareness and training, but it does not establish a universal annual training-certificate renewal schedule. Set a schedule that fits your risks and employer-specific policies, and distinguish completion of a training course from the hospital’s broader responsibility to implement safeguards.

How to Secure Sensitive Areas, Equipment, and Keys

Review each area according to its purpose and the consequences of unauthorized access. Apply physical access control procedures that allow authorized people to do their jobs while limiting entry to sensitive areas. HIPAA’s physical safeguards include facility access controls, workstation security, and device and media controls. See 45 CFR § 164.310 and HHS guidance on physical safeguards.

• Check exterior doors, staff entrances, loading areas, windows, and access points near operating, recovery, pharmacy, records, and IT spaces.
• Use badges, codes, locks, or staffed checkpoints appropriate to the risk, and remove or change access promptly when a person’s role ends or changes.
• Set visitor procedures that cover identity verification, sign-in, badges, escorts, restricted areas, and after-hours access.
• Secure portable equipment and media, and document who is responsible when items are moved, loaned, repaired, or removed from the facility.
• Protect workstations that can access ePHI from unauthorized viewing or use, including in shared clinical and administrative spaces.

Maintain key control and recovery procedures for physical keys, access cards, codes, and emergency overrides. Keep an up-to-date record of key assignments, limit duplication, require prompt return after a role change or separation, and define how missing keys or compromised codes are reported and addressed. Test that emergency access remains available to authorized responders without leaving routine access uncontrolled.

How to Assess Surveillance Coverage and Manage Video Records

Walk the facility to compare camera views with actual security needs. Check entrances, exits, public corridors, parking or loading areas, and other locations identified in your risk analysis. Confirm that cameras, recording equipment, clocks, and access controls work as intended, and document blind spots or equipment failures.

Design camera placement and monitoring procedures to protect privacy as well as security. Avoid unnecessary recording in treatment or other private areas, limit access to live feeds and recordings, and establish how staff can request review after an incident. If footage could identify patients or reveal information about their care, assess whether it contains protected health information and apply appropriate privacy and security safeguards. HHS explains that visual or audio access to patient information can raise HIPAA privacy concerns in its guidance on media access to protected health information.

• Specify who may view, export, disclose, or delete recordings, and keep an access record where appropriate.
• Set surveillance record retention periods based on security needs and applicable state law, contracts, and other requirements.
• Preserve relevant footage when an incident, investigation, or legal hold requires it; document who secured the footage and when.
• Test recording, playback, export, storage capacity, time synchronization, and backup or recovery arrangements.

HIPAA’s six-year documentation rule applies to documentation required by the Security Rule; it does not automatically establish a six-year retention period for every video recording. See 45 CFR § 164.316. Choose a retention schedule for footage based on your facility’s risk assessment and other applicable obligations.

How to Protect Electronic Protected Health Information and Connected Devices

Identify where ePHI is stored, received, maintained, or transmitted, including electronic health records, workstations, mobile devices, imaging systems, backups, and services operated by vendors. Assess risks to electronic protected health information confidentiality, integrity, and availability, and make sure the assessment includes systems located on-site and elsewhere.

Build and maintain a network-connected medical device inventory. Depending on the equipment and how it is used, include identifiers such as location, owner, device type, operating or software version, network connections, vendor support contact, and maintenance status. Include clinical devices and relevant supporting systems, such as monitoring, imaging, anesthesia, and infusion equipment. The FDA’s postmarket cybersecurity guidance notes that networked medical devices can have cybersecurity vulnerabilities and that managing those risks requires ongoing attention.

• Review user accounts and permissions, remote access, authentication, system logs, and the process for disabling access when it is no longer needed.
• Coordinate security updates and vulnerability response with IT, clinical engineering, and device vendors, while considering patient safety and device availability.
• Use appropriate network protections, such as separating device systems where feasible, and document approved connections and exceptions.
• Assess backups, restoration procedures, and downtime workflows so critical care can continue during system outages.
• Include vendors and service providers in the assessment when they can access systems, facilities, or ePHI.

HHS notes that maintaining an up-to-date IT asset inventory can help organizations understand where ePHI resides, although the Security Rule does not itself require a particular inventory format. See the HHS cybersecurity newsletter on asset inventories.

How to Prepare for Workplace Violence and Security Emergencies

Assess threats and vulnerabilities in areas where staff work alone, interact with distressed patients or visitors, handle conflicts, or manage difficult news. Include entrances, waiting areas, recovery spaces, parking, and after-hours operations. Invite staff to report hazards and near misses so the assessment reflects day-to-day conditions.

• Define how employees report threats, violence, suspicious behavior, and urgent security concerns.
• Set clear roles for requesting help, contacting emergency services, protecting patients, and communicating during an incident.
• Plan for access control during emergencies, including when doors should be secured, who can authorize entry, and how responders reach clinical areas.
• Coordinate security procedures with evacuation, shelter-in-place, fire, utility-failure, and information-system downtime plans.
• After an incident or exercise, review what worked, identify gaps, and assign follow-up actions.

OSHA’s hospital resources discuss workplace violence prevention, employee involvement, program evaluation, and post-incident support. Use the OSHA hospital workplace violence guidance to inform a plan tailored to your facility. Check applicable federal, state, and local requirements when developing or updating protocols.

How to Document Findings, Corrective Actions, and Program Reviews

Document the assessment in a format that lets responsible leaders understand the risks and monitor the response. HIPAA requires written or electronic documentation for required Security Rule activities and assessments, but it does not prescribe one specific risk-analysis format. See HHS risk analysis guidance.

• Record the assessment scope, date, participants, information reviewed, locations visited, and methods used.
• For each finding, describe the threat or vulnerability, affected area or system, existing safeguards, potential impact, and priority.
• Assign each corrective action an accountable owner, target date, resources, and a way to verify completion.
• Document accepted risks and the rationale, approval, and review date for the decision.
• Keep policies, assessment records, and other required documentation available to the people responsible for implementing them.

HIPAA requires covered entities and business associates to retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later, and to review and update documentation as needed in response to relevant environmental or operational changes. This requirement applies to required documentation, not automatically to every operational record. Review the program after significant incidents, material changes, and exercises, and track open actions until they are verified as complete.

A practical security program connects a facility-specific assessment to clear responsibilities, workable safeguards, staff readiness, and documented follow-through. Revisit the risks as your hospital’s operations and technology evolve, and use each review to strengthen patient safety and protect sensitive information.

FAQs

How often should a physician-owned surgical hospital review its security risk assessment?

HIPAA does not prescribe a single fixed interval for repeating a comprehensive risk analysis. HHS describes the process as ongoing and recommends updating it as needed, including when environmental or operational changes affect ePHI security. Set a review schedule that reflects your facility’s risks, and reassess promptly after significant changes or incidents.

Which staff members need security training?

The HIPAA Security Rule requires a security awareness and training program for all workforce members, including management. Tailor additional instruction to each person’s responsibilities—for example, access control, incident reporting, emergency response, or device management—and follow your organization’s policies for documenting completion.

What should a hospital include in its electronic information security assessment?

Include the ePHI your hospital creates, receives, maintains, or transmits; the systems and locations involved; relevant workforce and vendor access; potential threats and vulnerabilities; existing safeguards; and risks to confidentiality, integrity, and availability. Also assess connected devices, backups, incident response, and downtime arrangements where relevant to your facility.

How should a facility manage keys and surveillance records?

Maintain a current record of key and access-card assignments, limit duplication and access to recordings, and set procedures for reporting missing keys or unauthorized access. Establish a documented retention schedule for surveillance records based on security needs and applicable requirements, and preserve footage relevant to an incident or legal hold. HIPAA’s six-year documentation rule does not automatically require keeping every video recording for six years.