Active shooter events in healthcare settings, while statistically rare, require specific preparedness measures that account for the unique environment: patients who cannot self-evacuate, clinical areas where evacuation must be weighed against patient safety, and a public-access facility where attackers may arrive through any entrance.

The Joint Commission standard EC.04.01.01 requires hospitals to maintain a security management plan that includes procedures for violent and criminal events. The Department of Homeland Security (DHS) offers specific guidance for healthcare settings through its Active Shooter Preparedness resources. Facility directors play a central role in both infrastructure readiness and emergency planning.

The Healthcare Active Shooter Challenge

Healthcare facilities present unique challenges not present in office or retail active shooter scenarios:

Cannot simply evacuate: Patients on ventilators, undergoing surgery, or receiving critical IV medications cannot be moved quickly or safely. Staff must shelter in place and protect patients in clinical areas rather than evacuating to perimeter assembly points.

Multiple public access points: Hospitals are designed for accessibility — multiple entrances, large lobbies, and open corridors. Controlling access during an incident is far more complex than in a single-entrance office building.

Weapons entering with patients: Trauma patients, patients in crisis, or visitors may be armed upon arrival. Security screening at ED entrances is one mitigation; clinical staff training to recognize weapon risk is another.

Staff dispersed across large campus: Coordinating response across multiple buildings, underground connections, and high-rise towers requires robust mass notification and clear command structures.

Facility Design Mitigation Measures

Access Control Infrastructure

Lockdown capability: All external entrance doors and critical internal zone doors should be capable of remote lockdown from the security command center or designated lockdown stations. Modern access control systems allow mass lockdown commands that secure all controlled doors simultaneously. This capability is tested during active shooter drills.

Hardened reception areas: Lobby reception desks with ballistic-rated panels, access-controlled staff entries, and bullet-resistant glass at high-exposure reception areas provide a first layer of protection. The cost of ballistic-rated construction is significant; decisions about hardening should be risk-based and documented in the security risk assessment.

Stairwell and corridor control: Stairwells are natural escape routes for both potential victims and attackers. Access-controlled stairwell doors that allow exit but require credential for re-entry limit attacker movement between floors.

Refuge areas: Designated lockable rooms within each clinical unit that staff and patients can secure during a lockdown. These rooms should be identifiable in emergency plans and their locations known to all unit staff.

Video Surveillance Coverage

Comprehensive video coverage of all entrances, lobby areas, corridors, and parking structures allows security command to track an active threat in real time. Key capabilities:

  • High-definition cameras with night vision for all exterior areas
  • Analytics-enabled cameras that detect running, loitering, or weapon-like objects (AI-based behavioral analytics)
  • Video available simultaneously to on-site security operations center and law enforcement dispatch
  • Rapid camera review capability to reconstruct attacker movement during and after an incident

Communication Infrastructure

Mass notification systems must reach all areas of the facility simultaneously:

  • PA/overhead paging with clearly audible coverage including stairwells and parking structures
  • SMS and mobile app alerts for staff registered in the system
  • Visual alert displays in clinical areas where audio paging is reduced (NICU, behavioral health)
  • Direct radio communications between security command and unit charge nurses or security zone coordinators

Response Training Frameworks

ALICE vs. Traditional Lockdown-Only

Traditional “lockdown only” training — telling staff to lock doors and wait — has been supplemented or replaced in many hospital programs by more active response models:

ALICE (Alert, Lockdown, Inform, Counter, Evacuate): A response framework that emphasizes situational decision-making. ALICE does not prescribe a single response; instead, it trains staff to make real-time decisions based on their location, patient proximity, and the threat’s position.

  • Alert: Receive and recognize the threat notification
  • Lockdown: When sheltering in place is the safest option
  • Inform: Continuously share real-time information about attacker location
  • Counter: Last-resort physical response to prevent an attacker from causing harm (controversial in healthcare settings; typically limited to non-clinical staff far from patients)
  • Evacuate: When evacuation route is clear and safe

ALICE training for healthcare must be customized to account for patients who cannot evacuate. Clinical staff training emphasizes lockdown and patient protection; administrative and non-clinical staff training may include evacuation options.

Run-Hide-Fight

The DHS “Run-Hide-Fight” framework is simpler and widely recognized. For healthcare:

  • Run: If a safe evacuation route exists and you have no patient care responsibility, evacuate immediately
  • Hide: Secure your location — lock doors, turn off lights, silence devices, move away from doors
  • Fight: As a last resort, with no other option, use whatever is available to disrupt and distract the attacker

Drills and Exercises

Joint Commission EC.04.01.01 requires hospitals to conduct drills for security incidents. Active shooter preparedness requires:

  • Tabletop exercises: Scenario-based discussions with hospital leadership, security, nursing, and local law enforcement — conducted at least annually
  • Full-scale drills: Simulated events that test mass notification, lockdown speed, and staff response — conducted with law enforcement participation where possible
  • Post-drill evaluation: After-action reports documenting identified gaps and corrective actions

Law enforcement integration is essential. Local police, sheriff, and first responder agencies should be partners in hospital active shooter planning, with pre-established communication protocols for their arrival on scene.

Documentation and Regulatory Compliance

Active shooter preparedness documentation should include:

  • Security management plan addressing violent events (Joint Commission EC.04.01.01)
  • Documented active shooter response procedures for each area of the facility
  • Drill records including date, scenario, participants, and corrective actions
  • Security risk assessment that considers active shooter risk level

CMS surveyors may request evidence of active shooter preparedness as part of the Emergency Preparedness Rule (42 CFR 482.15) assessment, which requires hospitals to have policies and procedures for emergency and disaster situations.

Frequently Asked Questions

Is active shooter training required by Joint Commission? EC.04.01.01 requires staff training and drills for security incidents, which must include violent events. Active shooter scenarios represent one of the most severe security incidents a hospital can face, and training documentation for active shooter response should be part of the security management program.

Should hospitals use armed security officers? The decision to arm security officers is complex, involving legal authorization, training requirements, liability considerations, and organizational culture. Most healthcare security experts recommend unarmed security with rapid law enforcement response as the baseline, with armed security only in environments where the risk assessment and organizational policy support it. The IAHSS has published position statements on armed security in healthcare.

How quickly should hospitals be able to achieve a full lockdown? Industry practice suggests a target of 90 seconds or less to achieve full lockdown of all external access points. Testing during drills establishes a baseline, and operational improvements (automated lockdown commands, staff training) reduce lockdown time.

What is the facility director’s specific role during an active shooter event? During an active event, facility directors typically support security command and law enforcement coordination, manage utility systems (ensuring appropriate lighting, unlocking specific access points for first responder entry), and coordinate facility resources for triage areas if needed. Pre-event planning — not during-event improvisation — is the facility director’s primary contribution to active shooter preparedness.