Security Risk Assessment Guide for Inpatient Addiction Consult Services

What security risks are specific to inpatient addiction consult services?

An inpatient addiction consult service may see patients across many hospital units, rather than working from a single controlled ward. That makes clear handoffs, reliable ways to summon help, and consistent procedures important—especially when consultations take place after hours or in unfamiliar care areas.

Assess risks based on the setting and the individual situation, not on a substance use disorder diagnosis alone. Relevant hazards may include an acute overdose or withdrawal, a specific threat, unsafe drug-use supplies or sharps, medication diversion, unauthorized access to restricted areas, or a visitor conflict. Pain, distress, and other medical or psychiatric conditions can also shape what support a patient needs. ASAM’s hospital implementation guide emphasizes individualized, nonstigmatizing care and cautions that policies applied differently to patients with substance use disorders can contribute to stigma.

Include privacy and continuity-of-care risks in the assessment. Hospitals must protect patient privacy, safety, and record confidentiality under 42 CFR § 482.13. Where records are covered by Part 2, additional confidentiality rules apply; HHS explains which programs and records those rules cover.

How should hospitals review policies on drug searches and in-hospital drug use?

A clear in-hospital substance use policy should put clinical care and immediate safety first. It should tell staff how to respond to suspected use, assess for urgent medical needs, contact the treating team and addiction consult service, and follow the hospital’s overdose and withdrawal procedures. A calm, private, nonjudgmental conversation can help clarify what is happening and what care the patient needs.

Review any patient belongings search protocol for a defined safety purpose, appropriate authorization, respect for patient rights, and compliance with state law and hospital policy. Avoid routine or diagnosis-based searches. When a search is considered, specify how staff will explain the reason, seek the patient’s cooperation or consent when feasible, use the least intrusive reasonable approach, involve the appropriate clinical and security staff, and document the rationale and outcome. ASAM recommends reviewing whether searches and other restrictions are applied in ways that stigmatize patients with substance use disorders. ASAM’s guide provides further context.

The policy should also explain what staff do if they find substances or supplies: how to reduce immediate danger, who may handle or secure items, how to document the response, and how to protect privacy. Do not assume that a security response, search, confiscation, visitor restriction, or discharge is automatically appropriate in every case. Have legal, clinical, pharmacy, privacy, and security leaders review procedures against applicable law and hospital-wide patient-rights policies.

Which team roles and training should a security plan define?

Assign responsibility for the plan and define who leads each response. A multidisciplinary group may include addiction consult clinicians, bedside nursing, hospital medicine, behavioral health, security, pharmacy, risk management, privacy, facilities, and emergency management. For each role, spell out who assesses clinical needs, calls for assistance, manages access or found items, documents events, communicates with the patient, and coordinates follow-up.

Provide staff de-escalation training and role-specific instruction on recognizing escalating behavior, communicating respectfully, calling for backup, reporting incidents, and knowing when to withdraw to safety. Practice the hospital’s behavioral emergency response procedures with the teams expected to use them. OSHA recommends written workplace violence prevention programs that include staff involvement, hazard assessment, training, incident reporting, and evaluation. OSHA’s hospital workplace violence guidance describes these program elements.

Training should cover the hospital’s own policies and local escalation pathways; a generic course may not explain what to do on a particular unit. A completion certificate documents an individual’s course participation—it does not certify that an organization is HIPAA-compliant. HHS says covered entities must provide workforce training appropriate to employees’ functions, while HHS does not recognize private certifications as a substitute for an organization’s Security Rule obligations. Do not treat annual HIPAA certificate renewal as a universal federal requirement; follow applicable law, accreditation standards, and employer policy.

How can access control and responses to threats or violence protect patients and staff?

Use hospital access control to protect areas that need restricted entry, such as medication storage, staff-only workspaces, and locations with sensitive records. Define how staff verify authorization, respond to lost badges or access concerns, and request security support. Apply visitor or movement restrictions for an identified clinical or safety reason under hospital policy—not as an automatic consequence of a diagnosis.

For threats or violence, define how staff alert one another, request security or law-enforcement assistance when appropriate, protect nearby patients, and document what happened. OSHA identifies factors such as working alone, inadequate security, and insufficient crisis training as potential workplace hazards; its guidance recommends assessing and addressing risks at the facility level. See OSHA’s hospital workplace violence guidance.

Use the least restrictive safe response. Federal hospital patient-rights rules state that restraint or seclusion cannot be used for convenience, discipline, coercion, or retaliation, and may be used only to protect immediate physical safety when less restrictive interventions have been ineffective. 42 CFR § 482.13 sets out these requirements.

What security procedures should teams follow during emergencies?

Connect addiction consult procedures to the hospital’s existing emergency plans, codes, and incident-command system. Staff should know how to summon help, communicate the location and immediate concern, protect people nearby, and hand off responsibility to the responding clinical or security team. The plan should distinguish a medical emergency, such as suspected overdose, from a threat requiring a security response, while allowing both responses to be activated when needed.

Include procedures for behavioral emergencies, threats involving a weapon, fire, evacuation, shelter-in-place, and other hazards identified in the hospital’s risk assessment. Define how the team maintains access to essential patient information and communicates with the treating team during a disruption, while protecting confidentiality. Under 42 CFR § 482.15, hospitals must maintain an all-hazards emergency preparedness program with plans for response, patient needs, communications, and continuity of care.

Make procedures easy to find and rehearse them with the staff who may need to act. After a drill or real emergency, record what worked, identify gaps in communication or access, and assign follow-up actions.

How can hospitals evaluate and improve their security plan?

Use incident reports, near misses, staff feedback, patient concerns, security requests, and drill results to identify patterns. A useful security incident review looks at the circumstances and system factors—not only individual actions—and assigns an owner and due date for each improvement. Track whether corrective actions were completed and whether they reduced the identified hazard.

Review the plan after a serious incident, a meaningful change in staffing or workflow, or the discovery of a new hazard. OSHA recommends ongoing assessment and describes annual worksite analysis as a way to evaluate workplace violence risks. For hospitals accredited under the relevant Joint Commission hospital program, its workplace violence standard includes an annual worksite analysis and role-appropriate training. OSHA guidance and Joint Commission requirements explain these expectations.

Keep review schedules distinct: federal hospital emergency-preparedness plans and related policies must be reviewed and updated at least every two years, while other security or workplace violence review schedules may depend on accreditation, state law, and hospital policy. A practical plan combines scheduled reviews with prompt reassessment after incidents or operational changes. In short, an effective security risk assessment protects patients and staff through individualized clinical responses, clear roles, proportionate access controls, practiced emergency procedures, and ongoing review.

FAQs.

How should a hospital address suspected in-hospital drug use?

First assess whether the patient needs urgent medical care, including evaluation for overdose or withdrawal, and notify the responsible clinical team. Speak with the patient privately and without judgment, follow the hospital’s in-hospital substance use policy, and use security measures only when the facts indicate a specific safety need. Document the clinical assessment and actions taken while protecting patient privacy.

What should a patient belongings search policy include?

It should define the safety grounds for considering a search, who can authorize and conduct it, how staff explain the reason and seek cooperation or consent when feasible, and how they use the least intrusive reasonable approach. Include documentation, safe handling and storage of items, privacy protections, and review under applicable law and hospital policy. Avoid searches based solely on a substance use disorder diagnosis.

How can addiction consult teams respond to threats or violence?

Follow the hospital’s workplace violence prevention and behavioral emergency response procedures: summon help, alert the treating team, protect people at risk, and request security or emergency assistance when appropriate. Use trained de-escalation techniques when safe, and document and report the incident so the hospital can review it and support affected staff and patients.

How often should hospitals review security plans for addiction consult services?

Review the plan on a schedule that meets applicable law, accreditation requirements, and hospital policy, and reassess it after significant incidents, near misses, or operational changes. Federal hospital emergency preparedness plans and related policies must be reviewed and updated at least every two years. For hospitals subject to the relevant Joint Commission hospital workplace violence standard, an annual worksite analysis is also required.