Procedures, documented — not drills, not devices
The current hospital citation is NPG.11.01.01 EP 2: written policies and procedures to follow in the event of a security incident, including an infant or pediatric abduction, and “Documentation is required.” What is required is that you identify and implement procedures, and document them. Drills are not required — the Joint Commission’s own standards FAQ treats an exercise as one method of evaluating effectiveness, and says it is up to the organization to determine the appropriate actions. And no specific system is required: there is no RFID tag, alarm, or real-time-location mandate anywhere in the standard.
Two adjacent facts are worth getting right because the field routinely gets them wrong. Newborn identification — using distinct methods of identification for newborn patients — has been in effect since January 1, 2019, not any later date; its 2026 home is under Goal 1, patient identification, not a security goal. And the historic citation people still reach for is EC.02.01.01 EP 9. NPG.11.01.01 EP 2 covers the same subject matter. Element-level succession awaits the Joint Commission’s Disposition Report, which we have not pulled.
“Every vendor tells a maternity unit the tag system is the requirement. The requirement is a documented procedure. The tag is one good way to help you execute and prove it.”
Sources: NPG.11.01.01 EP 2 (NPG Hospital Program document); Joint Commission standards FAQ on abduction drills; NPSG.01.01.01 EP 3 / R3 Report Issue 17 (June 2018) for newborn identification.
What would change this: JC Disposition Report pull (historic-to-current EP mapping); JC mid-2026 announcements.
Reviewed July 2026 by the Eagle Systems healthcare practice. The systems referenced are how a facility meets the accountability the regulation creates, not a mandate; the accreditation and compliance determinations belong to the organization and its regulators. Current as of Accreditation 360 (eff. Jan 1 2026).