Healthcare Security Readiness Self-Assessment
Could you prove — to a board, or to a Joint Commission surveyor or a DEA inquiry — that your security protections function, with the facility you have today? This is a focused 20-question read across five zones. It surfaces where you can’t yet prove it, not a compliance score. Yes = the capability is in place, integrated, and documented; Partial = it exists but coverage or documentation is inconsistent; No = not in place; N/A = not applicable (e.g. no maternity unit). Count only Yes; each Partial names the gap. The band thresholds are our design decision, not a regulation’s.
This self-assessment runs entirely in your browser. Nothing you enter is sent to us or stored. No email required.
Access control & attribution
Is access to the areas you have identified as security sensitive individually attributable — no shared badges, no shared codes?
Access control exists but shared credentials are common in practice.
Do high-traffic clinical doors support hands-free credentialed entry, so a nurse with full hands doesn’t need the door propped?
Some doors, or the workaround is still routine.
Does your access-control audit trail survive a rekey, a maintenance event, or a system migration?
A trail exists but breaks on those events.
Is credential access revoked promptly on a role change, transfer, or departure?
It happens, but with lag or gaps.
Controlled-substance access & the audit trail
Can you produce a retrievable record of who accessed controlled-substance storage, and when?
Storage is secured but access attribution is thin.
Are your diversion-relevant access logs actually reviewed for unusual patterns — not just retained?
Logs are kept but rarely reviewed.
Is key control on any mechanical override of controlled spaces disciplined and documented?
Keys exist but control is loose.
Could you produce the controlled-substance access record on request, organized the way a DEA inquiry examines it?
Records exist but are slow or scattered.
Infant/pediatric protection & patient identification
For maternity or pediatric units, is there retrievable evidence of any abduction-security alert and the response to it — not just that a tagging system exists?
A system exists but alert-and-response evidence isn’t retrievable.
Are exit, elevator, and egress controls on protected units integrated with the alerting — and do they preserve the record when they act?
Integration is partial or the record isn’t preserved.
Do you use distinct methods of identification for newborn patients, documented as procedure?
Done in practice but not documented as procedure.
Are your abduction-response procedures written, current, and documented — independent of any specific device?
Procedures exist but are dated or thin.
Behavioral-health & ligature environments
For designated psychiatric units, has an environmental risk assessment been conducted and acted on, with the action documented?
Assessment done but action or documentation incomplete.
For nonpsychiatric units, are procedures in place — monitoring, object assessment — for a patient at risk of self-harm, without assuming the unit itself is ligature resistant?
Procedures exist but are inconsistent by unit or shift.
Is the monitoring and documentation a surveyor actually looks for retrievable for a specific patient and date?
Records exist but retrieval is unreliable.
Do your security systems support, rather than obstruct, the clinical monitoring these environments depend on?
Some friction between the systems and clinical workflow.
Workplace violence, visitors & the security of the systems
Do you have a workplace-violence-prevention program with incident reporting that reaches the governing body, and an annual worksite analysis with documented action?
A program exists but reporting or the worksite analysis is incomplete.
Is visitor and contractor management fast enough that waving someone through is not the reasonable choice — with a real check-in record?
A process exists but is routinely bypassed under pressure.
Is video retained long enough, and retrievable reliably enough, to answer a question asked months after the event?
Retained, but the window is shorter than the questions that arrive — or retrieval is unreliable.
Are the security systems themselves backed up, redundant, and access-controlled — so a failure doesn’t erase your proof?
Partial redundancy, or no documented testing of it.
You can likely prove it — verify, don’t assume
Your capabilities look integrated and documented. The value now is a cold second look before a surveyor’s — confirming the Partials you flagged are truly closed and that the records are retrievable, not just believed to exist. Take your Partial notes to your next Environment of Care committee.
Gaps to close before a survey
The systems are there, but specific attribution and documentation gaps — the kind a survey examines and a board asks about — would surface under pressure. The Partial notes point to exactly where to focus first.
You own systems you can’t yet prove work
There are real gaps between what your facility owns and what you could prove functioned on the record. These are the workarounds a survey tests and an audit targets. Start here, with security, pharmacy, facilities, and your accreditation coordinator together.
There are real gaps between what your facility owns and what you could prove functioned on the record. These are the workarounds a survey tests and an audit targets. Start here, with security, pharmacy, facilities, and your accreditation coordinator together.
This self-assessment surfaces where a program can’t yet prove it functions and points to gaps. It is not a survey and does not predict or promise a Joint Commission, CMS, or DEA outcome — the accreditation and compliance determinations are the organization’s and its regulators’. The systems referenced are our recommendation for meeting the accountability these regulations create, not a mandate. The band thresholds are a declared design decision, not drawn from any regulation. Current as of Accreditation 360 (eff. Jan 1 2026); snapshot July 10, 2026.
This surfaces where a program can’t yet prove it functions; it is not a compliance score and not a survey. Count only Yes. Each Partial is a named gap — the note identifies the specific condition that prevents a full Yes. N/A does not penalize. Responses stay in your browser and are not transmitted.
When is your facility exposed to a survey finding?
Before the full self-assessment, a faster gut-check. These are conditions that tend to precede a finding — each is an attribution or documentation gap, not a missing device. If any is true today, it is worth a closer look.
A teaching self-check, not a scored result and not a compliance determination. If any of these is true today, it is worth a closer look before a survey.