Violence in hospitals and health care facilities is a serious issue, but proper training and security planning can help to reduce the number and potential for incidents, says health care security expert Thomas A. Smith, CHPA, CPP, of Healthcare Security Consultants Inc., Chapel Hill, N.C.

How can hospital leaders address security issues?

From my perspective, the best thing health care leaders can do to make sure their security programs are working effectively is by ensuring a high level of leadership in the security department. Security managers need to be well-trained, continue their education and, if possible, become certified in health care security.

Thomas A. Smith

The Smith File


  • President and former associate consultant at Healthcare Security Consultants Inc., Chapel Hill, N.C.
  • Former director of hospital police and transportation at University of North Carolina (UNC) Hospitals, Chapel Hill
  • Former director of public safety and assistant director of public safety at Hurley Medical Center, Flint, Mich.
  • Former director of security at Saginaw (Mich.) Osteopathic Hospital


  • Received International Association for Healthcare Security and Safety (IAHSS) Medal of Distinction
  • Two-time recipient of the IAHSS Philip A. Gaffney Faculty Chair Award
  • Received Management Excellence Award from UNC Health Care System


  • President of Southeastern Safety Security Healthcare Council
  • IAHSS Foundation member
  • Member of Facility Guidelines Institute, Health Guidelines Revision Committee
  • IAHSS Guidelines Council member
  • Past chair of IAHSS Healthcare Security Design Guidelines Task Force
  • Past president and board member of IAHSS


  • IAHSS Certified Healthcare Protection Administrator
  • ASIS International Certified Protection Professional
  • Bachelor of science degree in security administration and law enforcement from Northern Michigan University in Marquette

What are the top security policy issues for hospitals these days?

The top issue is workplace violence. Having preventive policies and procedures in place is a first step in dealing with it, and then having reactive plans to mitigate violence. From my experience, people don’t usually act violently out of the blue. There are often warning signs that are missed or don’t get reported or, if they are reported, they are not assessed and acted upon. Health care facilities need to have policies and procedures that require reporting of threatening or unusual behaviors. These reports need to be evaluated and acted upon quickly to mitigate the potential for workplace violence and enhance customer service.

What is your advice for keeping patients safe?

Developing patient safety-related policies is a key security issue. These policies must include plans that:

  • Reduce the potential for elopement.
  • Establish reasonable visitation policies that allow health care facilities to identify who is in the building, especially when fewer staff are on duty and patients are sleeping or are more vulnerable.
  • Clarify when and to whom unusual incidents are reported and how they are investigated. Patients, staff and visitors who experience unusual incidents should be encouraged to report them.
  • Clearly identify a process for investigating quickly escalating incidents internally and externally to law enforcement and/or the proper regulative body where appropriate.
  • Identify how to secure sensitive areas such as the emergency department (ED), behavioral health, infants and pediatrics and others. You need to have clearly identified policies that outline security procedures and then provide appropriate training for new employees and annual refresher training.
  • Clarify use-of-force policies to provide security staff with the tools and guidelines to do their jobs without running afoul of regulatory compliance. There is often a fine line between excessive use of force and reasonable measures to protect patients and staff.
  • Determine the amount and type of training needed for security and staff who work in sensitive areas such as EDs, behavioral health departments and intensive care units.

What’s involved in a security risk assessment?

The International Association for Healthcare Security and Safety has several guidelines for conducting risk assessments.

There is a general security risk-assessment guideline that explains the process. It says, “Security risk assessments will be conducted on a regular and ongoing basis. The objective of the security risk assessment is to identify and prioritize assets of the health care facilities' primary mission and operations, identify threats to and vulnerabilities of those assets and develop reasonable risk-mitigation strategies to protect the assets.”

What are the primary components of an optimal security system?

I always look carefully at those who are leading the security function. The days of hiring the recently retired police leader are over in most cases. I do not see law enforcement professionals making the jump to health care security without receiving specific hospital training and professional development.

If we are discussing alarms, closed-circuit television, card access and response procedures, I believe facilities need to determine whether they are making the best use of the systems they already have in place. I often find that health care facilities have good equipment that they do not fully utilize, or it does not work as intended or does not work at all. Another problem is that departments each have their own systems, which are not integrated.

What is involved in setting up a policy to prevent workplace violence?

It requires getting leadership support and developing an effective health care-specific, workplace-violence policy that links to and is in sync with all related policies in all departments, including human resources, nursing, legal and security, and domestic violence departments. It also requires establishing a threat-assessment team, providing training for staff and the threat-assessment team, and effective reporting procedures for staff, patients and visitors who witness threatening or unusual behaviors.

What are the essential elements of an active-shooter policy?

Many of these incidents involved suicide, but these situations can develop into an active-shooter event, and health care facilities need to be reasonably prepared. I can’t overemphasize the importance of prevention. Active-shooter plans focus on what to do when an active-shooter incident occurs. I recommend steps to prevent the situation from reaching that stage in the first place.

Persons committing violent acts don’t normally just snap and commit a crime. They often will provide signs and indications they are planning or considering a crime. It is essential that hospitals regularly assess the level of security at their facilities, especially access-control plans, identify who belongs in the facility and offer training on reporting suspicious or unusual behavior.

Aware, alert staff members who report unusual situations often can prevent workplace violence if their concerns are evaluated and acted upon when appropriate. That leads to the importance of appointing a threat-assessment team that is trained to evaluate threats.

What role does design play in keeping a hospital secure?

Designing security features into a new health care facility or renovated space from the beginning can improve safety and security, maximize utilization of human resources and lower operational costs. Satisfaction is also enhanced by good security designs. If patients and staff feel safe walking from the parking or transit facilities, their confidence in the organization is bolstered.