Hospital security officer duties, and how to show the work was done

01

What a hospital security officer does, and the rules behind the job

A hospital security officer protects patients, visitors, staff and property, and keeps the care environment safe, in a building open 24 hours a day. Some hospitals run their own (proprietary) security department, others contract it out, and some large systems also have a campus police department with sworn officers. No single federal law lists what a hospital security officer must do; the duties come from several layers of rules.

For a hospital that takes Medicare or Medicaid, the Centers for Medicare & Medicaid Services (CMS) Conditions of Participation set the patient's side of it. 42 CFR 482.13, Condition of participation: Patient's rights, says at (c)(2) that "the patient has the right to receive care in a safe setting" and at (c)(3) that "the patient has the right to be free from all forms of abuse or harassment." Paragraph (e) adds that restraint or seclusion "may only be imposed to ensure the immediate physical safety of the patient, a staff member, or others and must be discontinued at the earliest possible time," and paragraph (f) requires that it be carried out by trained staff. That matters to security, because officers are often called to help when a patient becomes violent.

On the worker's side, federal OSHA has no specific workplace violence standard. Its workplace violence topic page says so, defines workplace violence as "any act or threat of physical violence, harassment, intimidation, or other threatening behavior that occurs at the work site," and lists healthcare workers among those at increased risk. Employers can still be cited under the General Duty Clause of the OSH Act, Section 5(a)(1), which requires a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA's Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (OSHA 3148, 2016) is the federal guidance hospitals build on.

Accreditation is the third layer. The Joint Commission's workplace violence prevention requirements, implemented in 2022, ask for a program led by a designated individual, an annual worksite analysis, incident reporting and investigation, and training. Its workplace violence prevention resource center maps each requirement to the standard number used in each accreditation program; for hospitals, several now sit under NPG.02.04.01, so check the numbering in your own current manual. The International Association for Healthcare Security and Safety (IAHSS) also publishes Healthcare Security Industry Guidelines, an industry benchmark; work from a current copy.

02

The core duties of a hospital security officer

A written job description and the post orders for each post set the detail. Across most hospitals, the duties fall into the same groups:

• Patrols of the buildings and grounds: nursing units, the emergency department, stairwells, mechanical areas, loading docks, parking garages and lots, and any door that should be locked after hours.
• Access control and visitor management: staffing entrances, issuing visitor badges, controlling after-hours entry, and locking down restricted areas such as pharmacies, maternity and pediatric units, and behavioral health units.
• Emergency department presence: a fixed post or regular rounds in the ED and its waiting room, where aggression is most likely.
• Responding to calls and alarms: panic buttons, duress alarms, door alarms, and the hospital's overhead codes for a combative person, a missing patient, an infant or child abduction, or a security threat.
• Assisting clinical staff with aggressive patients, within the hospital's policy and the restraint rules in 42 CFR 482.13; clinical staff lead, and security supports.
• Escorts: walking staff to their cars at night, which OSHA 3148 lists among the controls for hospitals, and escorting visitors to restricted areas.
• Patient property and lost and found: logging and securing valuables and found items.
• Checking security equipment: cameras, alarms, door hardware and, where used, weapons screening equipment. OSHA 3148 says metal detectors "should be regularly maintained and assessed for effectiveness," and that alarm systems "should be regularly maintained."
• Emergency response: supporting fire alarms, evacuations, utility failures and mass casualty events under the emergency operations plan, including a fire watch where a fire system is impaired.
• Reporting: incident reports, the daily activity report, and liaison with local law enforcement.

03

Where the risk is, and how posts and patrols are set

Posts and patrol routes should follow the risk. OSHA 3148 builds a violence prevention program from five parts: management commitment and employee participation, worksite analysis, hazard prevention and control, safety and health training, and recordkeeping and program evaluation. The worksite analysis is where security's routine is set. OSHA recommends reviewing medical, safety, workers' compensation and insurance records, the OSHA 300 log, "incident/near-miss logs, a facility's general event or daily log and police reports" to find patterns of assaults by location, job and time.

The Joint Commission asks for the same thing once a year. Its worksite analysis page quotes the hospital requirement: "The hospital conducts an annual worksite analysis related to its workplace violence prevention program," including a proactive analysis of the worksite and an investigation of the hospital's workplace violence incidents, and it expects action on what the analysis finds.

The places that usually need most attention:

• the emergency department and its waiting room, especially overnight;
• behavioral health units and any room used to hold a patient on a psychiatric hold;
• maternity, nursery and pediatric units, where infant security is the concern;
• entrances that are open after hours, and doors that are propped open;
• parking garages and lots, and the walk between them and the staff entrance;
• pharmacies, cashier points and anywhere drugs or money are held;
• remote or quiet areas at night: stairwells, basements, loading docks.

California sets this out in law. Cal/OSHA's Workplace Violence Prevention in Health Care standard, 8 CCR 3342, requires an annual review of the prevention plan that evaluates, among other things, the "sufficiency of security systems, including alarms, emergency response, and security personnel availability," and the security risks of "specific units, areas of the facility with uncontrolled access, late-night or early morning shifts," and "employee parking areas." Among its corrective measures is "maintaining sufficient staffing, including security personnel, who can maintain order in the facility and respond to workplace violence incidents in a timely manner." Separately, California Health and Safety Code section 1257.7 requires general acute care, acute psychiatric and special hospitals to conduct a security and safety assessment at least annually and to keep a security plan that may address the physical layout, staffing and "security personnel availability." Outside California, the same questions are good practice even where no state law asks them.

Once the risk is known, write it into the post orders: which areas each patrol covers, how often, what to check at each point, and what to do about what is found.

04

Training, and the limits of the role

Hospital security officers need more than a general guard course: the skills that matter most are communication and de-escalation. OSHA 3148 says that "security personnel need specific training from the hospital or clinic, including the psychological components of handling aggressive and abusive clients, and ways to handle aggression and defuse hostile situations." The Joint Commission's education and training page expects workplace violence training at hire, annually, and whenever the program changes, including de-escalation and the role of security.

California goes furthest. Under 8 CCR 3342(f)(3), employees "assigned to respond to alarms or other notifications of violent incidents" or whose work involves confronting or controlling aggressive or violent people must be trained before initial assignment "and at least annually thereafter," on topics including general and personal safety measures, aggression and violence predicting factors, and the assault cycle. Health and Safety Code 1257.7(c) requires that people "regularly assigned to provide security in a hospital setting shall be trained regarding the role of security in hospital operations, including the identification of aggressive and violent predicting factors and management of violent disturbances."

Where security staff help apply restraints or hold a patient in seclusion, 42 CFR 482.13(f) applies to them as well: staff must be trained and able to demonstrate competency before doing so, including in "the use of nonphysical intervention skills." Some hospitals decide that security only stands by; either way, the policy should say which.

Licensing is set by each state, and the rules for contract, in-house and armed officers differ from state to state. Check the state licensing board before assigning anyone to a post.

The limits of the role are as important as the duties. A security officer is not a clinician and does not decide on restraint, sedation or a psychiatric hold. Unless sworn, they are not police, and any power to detain someone comes from state law and hospital policy, which is usually narrow. Any force used, and the reason for it, should be written up promptly in a use of force report, and the hospital's policy should say who reviews it.

05

The records, and how the program is checked

Without records, the annual worksite analysis has nothing to analyze. The main records are these:

• Incident reports for every assault, threat, theft, trespass, missing patient and use of force, written the same shift. See the guide to security incident reports. The Joint Commission's data collection page quotes the hospital requirement to report and investigate "safety and security incidents involving patients, staff, or others within its facilities, including those related to workplace violence."
• The daily activity report for each shift, and the pass-down log between shifts.
• Patrol and check records: which areas were patrolled, which doors, alarms and cameras were checked, and what was found.
• The OSHA 300 log, kept by the hospital, not by security. OSHA 3148 notes that "injuries caused by assaults must be entered on the log if they meet the recording criteria." See the OSHA 300 log guide.
• Training records for each officer, with dates.
• Equipment test records for duress alarms, panic buttons, door alarms and cameras.

Supervisors read the reports every shift, walk the posts and patrol routes themselves at different times, and compare what the patrol records say with what they find: a door recorded as secure at 2 a.m. and found propped open at 2:15 a.m. is a conversation worth having.

Once a year, the prevention plan and the security plan are reviewed against the incident data and the worksite analysis, and the posts, patrols and training change where the data says they should. For a contracted service, the same records feed the contract review; see security KPIs.

06

Where the record fails, and where SiteClara fits

Incidents are usually written up, because someone was hurt or something happened. The record thins out in the routine work that is meant to stop incidents: the stairwell patrol overnight, the check of the maternity unit's door alarm, the parking garage walk at shift change. That work is often one line on the daily activity report, written at the end of the shift: "all secure" for the whole night. Nobody can tell when each check was done, a missed round is rarely recorded as missed, and a broken door closer noted on the report may never reach engineering.

SiteClara records those checks at the location. A printed QR code poster, with an optional NFC tag behind it, goes at each checkpoint on the patrol: a stairwell door, an ED entrance, a nursery door, a parking garage level. The officer scans the code or taps the tag on their own phone, with no app to install, sees the checks due there, and marks each one done or says what stopped them, for example a unit that asked security to stay out during a procedure. The time and the named officer are recorded as it happens, with a photo when one is asked for. A problem found on the round, such as a door that does not latch or a camera that is dark, goes onto the team's list of jobs until someone closes it.

The security supervisor sees what is due, done and missed, and records the reason when a check was missed. Each day they review the totals and photos, add a note and approve a report that goes the next morning to nominated managers, such as the director of security or, for a contracted service, the hospital's contract manager. It shows what was reported, completed and still open, and how the scheduled checks went, with the reasons for any that were not done.

07

Questions people ask

What are five responsibilities of a security officer?

The Bureau of Labor Statistics Occupational Outlook Handbook profile of security guards lists what they typically do, including patrolling property, monitoring alarms and video-surveillance systems, responding to emergencies, controlling building access by employees and visitors, and writing reports on what they observed while on duty. In a hospital, the same five sit alongside emergency department cover, escorts and support for clinical staff with aggressive patients.

What qualifications do you need to be a hospital security guard?

The Occupational Outlook Handbook profile of security guards says that "most states require that security guards be licensed by the state in which they work," that guards who carry weapons usually need a separate license, and that armed guards face background, criminal record and fingerprint checks. It adds that many states recommend about 8 hours of pre-assignment training, 8 to 16 hours of on-the-job training and 8 hours of annual training. Hospitals usually ask for more: in California, Health and Safety Code section 1257.7 requires anyone regularly assigned to hospital security to be trained in the role of security in hospital operations and the management of violent disturbances.

Is hospital security dangerous?

It carries more risk than most security posts. OSHA's Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers reports that between 2011 and 2013, 70 to 74% of workplace assaults occurred in healthcare and social service settings, and that for healthcare workers assaults made up 10 to 11% of workplace injuries involving days away from work, compared with 3% for all private sector employees. That is why posts, patrols and training follow the worksite analysis.

08

Where to read more, and a list to take away

Start with OSHA's Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers, with its worksite analysis checklists, and OSHA's workplace violence in healthcare page. The Joint Commission's workplace violence prevention program page lists the program requirements. In California, read 8 CCR 3342 and Health and Safety Code 1257.7 in full; elsewhere, check your State Plan and your state's hospital and security licensing rules.

Before your next survey, or your next contract review, check that:

• each post has written post orders, and the patrol routes cover the areas the worksite analysis says are highest risk;
• officers are trained in de-escalation and hospital security before their first shift and at least annually, and the training records show it;
• the policy says what security does, and does not do, when clinical staff restrain or seclude a patient;
• duress alarms, panic buttons, door alarms and cameras are tested on a schedule, and faults are reported and fixed;
• every incident is reported the same shift, investigated, and fed into the annual review;
• routine patrols and checks leave a record of when they were done and by whom, and missed ones are recorded as missed;
• problems found on patrol reach the people who can fix them, and stay open until they are fixed.