If you are a hospital administrator, you have probably been asked how often a hospital should conduct a security assessment, and you have probably answered with the date of the last one. That date is usually tied to a survey window, a new building opening, or an incident that made the board uncomfortable. Between those moments, the assessment sits in a binder, the campus keeps changing, and everyone assumes the findings still describe the building they walk into every morning.
I have spent my career in law enforcement, fire service, private security, and federal government, and I have read a great many hospital security assessments. Most of them were competent on the day they were written. The problem is never the quality of the document. The problem is that a hospital is one of the most dynamic environments in any industry, and a document written eighteen months ago is describing a campus that no longer exists. New clinics open, entrances are added for construction, the behavioral health census doubles, a pharmacy moves, and the guard contract turns over. The assessment does not know any of that.
Why the Survey Cycle Is the Wrong Clock
Most hospitals time their security assessments to the accreditation and regulatory calendar. That is understandable, because surveyors will ask to see one, and a fresh document answers the question cleanly. But a survey cycle is measured in years, and the threats that matter in a hospital are measured in shifts. A single agitated visitor, a patient in crisis who was never flagged, a diverted medication, or a stranger on the maternity unit does not wait for the next survey. If the assessment is only refreshed when the surveyor is coming, the hospital is managing its documentation rather than its risk.
The other problem with the survey clock is that it produces one enormous assessment of everything at once. That kind of document is expensive, disruptive, and stale by the time it is finalized. Nobody reads a two-hundred-page report closely, and the findings that matter most get the same weight as the ones about signage. A better approach breaks the assessment into pieces, puts each piece on its own schedule, and lets the highest-risk areas get looked at far more often than the rest.
How Often Should a Hospital Conduct a Security Assessment by Area
The emergency department is the highest-risk point on the campus and it deserves the most frequent attention. I would want someone with security judgment walking the ED every quarter, looking at how patients and visitors move through triage, where staff can and cannot retreat, whether the panic alarms work, whether officers are actually positioned where the post orders say they are, and how the department is handling patients in behavioral crisis while they wait for placement. This does not have to be a formal report each time. It has to be a real look by someone who knows what they are looking at.
Behavioral health units, the maternity unit, and the pharmacy should be assessed at least twice a year, and the assessment should include a test rather than a review of the written protocol. The infant abduction plan should be drilled without warning and timed. Pharmacy access lists should be pulled and compared to who actually badged in after hours. Behavioral health should be examined for ligature risks, contraband paths, and how escorts are handled when a patient leaves the unit for imaging or a procedure. Parking structures and the campus perimeter belong on an annual cycle, with a walk after dark, because the daytime picture tells you almost nothing about them.
The full campus assessment, the one that covers every entrance, every system, and every contract, should happen once a year and should be the summary of everything the quarterly and semiannual work found. When it is built that way, it stops being a project and becomes a report on a program that is already running.
The Events That Should Trigger an Assessment Regardless of the Calendar
A schedule is the floor, and certain events should reset it. Any serious workplace violence incident against a nurse or staff member should trigger a focused reassessment of the unit where it happened, and that reassessment should look for the structural conditions that let it occur, since the same conditions usually exist on other units. Any change to the physical campus, including construction, a new entrance, a new clinic, or a lease of off-site space, should trigger a review before the change opens rather than after. Any change to the guard contract, including a new vendor, a new account manager, or a reduction in hours, should trigger a review of post orders against actual coverage.
Changes in the patient population count as well. A rise in behavioral health boarding in the ED, a new service line that brings in a different visitor profile, or a shift in the surrounding neighborhood all change the risk picture. Hospitals tend to notice these changes clinically long before anyone asks what they mean for security. The administrator who connects those two conversations is doing more for campus safety than any binder ever will.
An Assessment Is Not a Test
I want to draw a distinction that most hospitals miss. An assessment describes what controls exist. A test finds out whether they work. A consultant can note that the maternity unit has a locked door, a camera, and an alarm on every infant, and the assessment can score it well. None of that tells you whether a determined person could walk off the unit with a child during a shift change. Only an unannounced drill tells you that. The doctrine I built my book Until Tested: Security Is Only Assumed around is that a control you have not tried to defeat is a control you are assuming, and hospitals are full of assumed controls that look excellent on paper.
So the real answer to how often a hospital should assess its security includes a second question, which is how often it tests what the assessment found. Every quarterly walk of the ED should include at least one thing that was tried rather than observed. Every semiannual review of the high-risk units should include a drill. The annual campus assessment should report on how many of those tests were run, how many controls failed, and what was fixed. That is a very different document from the one most boards currently receive.
Who Runs the Schedule
A schedule like this only works if one person owns it. In most mid-sized hospitals nobody does, because security is divided among facilities, nursing, HR, pharmacy, and IT, and each of them assumes someone else is watching the calendar. The person who owns the schedule needs enough standing to walk into the ED and ask hard questions, enough knowledge to know what a failed control looks like, and a direct line to the COO or CEO so that findings turn into decisions. That is an executive security role, and it does not have to be full-time to be real.
If you want to start this quarter, do three things. Pull the last assessment and mark every finding that was never closed, because those are your first priorities. Put the ED, behavioral health, maternity, pharmacy, and parking on a written assessment calendar with a named owner for each date. Then pick one control the last assessment praised and have someone try to defeat it. What you learn from that single test will tell you more about your campus than the rest of the binder.
Go Deeper
Most hospitals that want an assessment schedule like this run into the same obstacle, which is that no one on staff has the time or the background to own it. I explain how a part-time executive fills that role in What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director lays out how that leader builds the calendar, runs the tests, and gives the board a report it can act on.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply