AS 4485 Ready Healthcare Security Risk Assessment for Facility Managers

Manager inspecting hospital access control

A proper healthcare security risk assessment examines four domains together: people, property, information, and clinical operations. It never treats them as separate audits. Start by defining the scope of the assessment, convening clinical, operational, and security stakeholders, and choosing a baseline standard such as AS 4485 or the National eHealth Security and Access Framework (NESAF). The output has to be a documented risk register and a prioritised action plan, not a verbal walkthrough or a slide deck that gets shelved after the executive meeting.

TL;DR:
A comprehensive healthcare security risk assessment must cover physical security, people and operational risks, administrative controls, and information security without treating them separately.
The assessment should include asset lists for patients, staff, medicines, data, and devices, focusing on persistent risks like occupational violence and lone-worker exposure.
Use a risk matrix that combines likelihood and consequence ratings, prioritizing risks like assaults in parking lots or EDs over less probable but severe scenarios.
Referencing standards such as AS 4485, NESAF, and CIRMP is crucial to ensure credibility and alignment with regulations, especially for high-risk or critical infrastructure sites.
Conduct formal reviews at least annually and after major changes, documenting incidents, escalation actions, and testing controls, while involving specialist providers for complex sites and compliance support.

Abcosecurity

Strengthen Your Healthcare Security Plan

ABCO Security combines tailored strategies, licensed professionals, advanced technology, and 24/7 monitoring for healthcare security challenges.

Explore ABCO Security

Key components every healthcare security risk assessment must include
How do you conduct a healthcare security risk assessment?
Which standards and policies should the assessment reference?
Which areas need attention first, and what hazards dominate there?
What controls and mitigation measures actually work in health settings?
How often should you audit and document your findings?
What should you expect from a specialist security provider?
How does the assessment protect patient privacy and data?
How do you plan for ransomware and insider threats?
What does implementing these controls actually cost?
What experienced practitioners get wrong about security planning
How Abcosecurity supports your next assessment
Sources
FAQ

Key components every healthcare security risk assessment must include

Most assessments fail not because they miss a hazard, but because they miss a category. A hospital or clinic has four interlocking risk domains, and skipping one leaves gaps auditors will find.

Physical security: zoning between public, clinical, and restricted areas; access control at entry points; car park lighting and CCTV coverage; door and window integrity in medication stores and mental health units.
People and operational risks: occupational violence and aggression, lone worker exposure on night shifts, contractor and visitor access into clinical zones.
Administrative controls: written security policies, incident reporting procedures, staff training records, and the documentation trail an auditor will actually ask to see.
Information security: device inventories, e-prescribing system access, cloud storage configurations, and third-party vendor access to patient records.

Each domain needs its own asset list. That means naming what you’re protecting: patients and staff (the people who can be harmed), controlled medicines and cash (the things that get stolen), medical records and imaging (the data that gets breached), and networked devices from infusion pumps to nurse call systems (the infrastructure that gets exploited). Occupational violence and aggression toward healthcare staff is one of the most persistent operational risks in the sector, and it belongs at the top of the asset list, not buried under property loss figures. A hospital vulnerability assessment that lists CCTV blind spots but skips lone-worker exposure in a satellite clinic isn’t incomplete. It’s the wrong assessment for the building you actually run.

How do you conduct a healthcare security risk assessment?

Running the assessment is a sequence, not a checklist you tick in one sitting. Each step feeds the next, and skipping one usually shows up later as a control nobody can justify to an auditor.

Define scope, stakeholders, and your standard baseline. Decide which sites, shifts, and functions are in scope, bring in clinical leads alongside security and facilities staff, and pick AS 4485 or NESAF as your reference standard before you start walking the floor.
Map assets and data flows. List physical assets, then trace how information moves, including e-prescribing platforms and any cloud workloads hosting patient records or rostering data.
Identify threats and vulnerabilities across every domain. Walk each zone physically, review incident logs, and check technical controls; a threat assessment for healthcare that only covers the building misses half the exposure.
Analyse likelihood and consequence, then rank. Score each risk on a simple matrix (see the ratings below) and rank by combined severity, not by whichever hazard is loudest in the room.
Propose controls, assign owners, and set deadlines. Every control needs a named owner, a budget line, and a date. Controls without an owner disappear within six months.
Test, document, and schedule reviews. Verify duress alarms actually alert the right people, keep dated evidence of every test, and set a trigger for re-assessment after any major change, not just a fixed calendar date.

Risk rating works best as a simple matrix crossing likelihood (rare, unlikely, possible, likely, almost certain) against consequence (minor, moderate, major, severe). A car park with three reported assaults in twelve months and no lighting upgrade sits at “likely / major”, which should outrank a theoretically severe but improbable scenario like a full building lockdown failure. Quantitative scoring helps when you’re justifying capital spend to a board; qualitative description helps when you’re briefing clinical staff who don’t think in matrices. Use both. Our security risk assessment checklist for Australian facilities sets out a working template for exactly this six-step sequence.

Which standards and policies should the assessment reference?

Auditors and executives expect specific citations, not general statements about “best practice.” Reference the wrong standard, or none at all, and your risk register loses credibility the moment someone senior asks where a control requirement came from.

AS 4485 sets out security requirements for healthcare facilities, covering asset identification, threat assessment, and expected assessment frequency. It’s the closest thing Australia has to a single reference standard for facility-level security risk analysis in healthcare, and most procurement specifications for hospital security systems point back to it.
NSW Health’s Protecting People and Property manual sets policy expectations for structured risk management, mandates SIAT (Security Improvement Assessment Tool) audits, and lists priority workplaces including emergency departments, mental health units, pharmacy, and car parks. If you operate in NSW, SIAT compliance isn’t optional context. It’s the audit trail your local health district will ask for.
The Security of Critical Infrastructure CIRMP rules require designated hospitals to maintain documented risk management processes across physical, personnel, cyber, and supply chain hazards. Check whether your facility is a declared critical infrastructure asset. If it is, this obligation sits alongside, not instead of, your standard security risk assessment.
NESAF and AS ISO 27799 provide the reference architecture for health information security, mapping eleven key control areas covering classification, third-party access, and governance. This is where e-prescribing security and cloud configuration reviews get their formal backing.

Map each control in your action plan back to one of these four references. It turns a generic recommendation into a defensible line item.

Which areas need attention first, and what hazards dominate there?

Not every zone in a hospital carries equal risk, and treating them equally wastes budget on low-priority upgrades while leaving genuine exposure unaddressed. Five areas consistently top the priority list in NSW Health guidance and in practice across Australian facilities: emergency departments, mental health units, pharmacy, car parks, and aged care wards.

Occupational violence and aggression is the dominant hazard across nearly all of them, not theft or unauthorised access. Staff in EDs and mental health units face the highest exposure to aggressive incidents, which is why interim controls there need to move fast, ahead of any capital works timeline.

Immediate (days): fixed and mobile duress alarms, staffing adjustments on high-risk shifts, and triage protocols flagging patients with a history of aggression.
Short term (weeks): sightline improvements, temporary barrier placement, revised visitor screening at ED entry points.
Capital works (months): zoning redesign, CCTV infrastructure upgrades, structural changes to car park lighting and access.

Pro Tip: Don’t wait for the capital works budget cycle to fix an ED duress gap. A mobile patrol add-on or a temporary CCTV placement can close the immediate risk while the permanent fix works through procurement. For a deeper look at ED-specific controls, see our guide to emergency department security for clinicians and administrators.

What controls and mitigation measures actually work in health settings?

The best controls in a hospital setting are the ones clinicians don’t fight against. A duress alarm nobody wears because it’s clipped to a lanyard that snags on equipment isn’t a control, it’s a compliance box someone ticked once.

Crime Prevention Through Environmental Design (CPTED) principles work well in healthcare because they let public-facing areas like main entrances and cafés stay open and welcoming, while using layout, sightlines, and natural surveillance to tighten security around deeper clinical zones without turning the whole building into a checkpoint.

Electronic controls: access control at zone boundaries (not just the front door), CCTV placed to cover approach paths and blind corners rather than just entrances, duress alarms with logged response times, and audit trails on every access event.
Administrative measures: written policies with named owners, role-based access so a contractor’s card doesn’t open the medication store, structured contractor onboarding, and incident reporting that actually reaches a decision-maker within days.
Technical and cyber controls: identity and access management (IAM), multi-factor authentication (MFA) on clinical systems, encryption for data at rest and in transit, regular patch management, and periodic cloud configuration reviews for any third-party vendor touching patient data.

Our guide to hospital access control systems covers procurement specifics for the second category, and the broader hospital security systems guide walks through how these layers integrate on a single site.

How often should you audit and document your findings?

A risk register that sits static for eighteen months is worse than no register at all, because it gives a false sense of coverage. Run a full security risk assessment at least annually, and again immediately after any major change: a cloud migration, a new wing opening, a merger with another health service. Where SIAT audits apply, local health districts run these biannually, with documented Security Improvement Plans escalated to executive and audit committees when non-compliance turns up.

Log every incident and near miss, including ones that didn’t require a response, and track escalation paths so a pattern (three car park incidents in a month) triggers review before it becomes a fourth.
Set KPIs that feed back into the register: average duress alarm response time, percentage of contractors onboarded with current induction, number of overdue action items.
Keep dated evidence, test logs, training records, incident reports, ready for executive reporting and external audit, because continuous monitoring between formal reviews is what auditors actually check for, not just the annual report cover page.

What should you expect from a specialist security provider?

Complex sites, multi-building campuses, mixed-use aged care and acute wards, or anything touching CIRMP obligations, usually benefit from bringing in a provider rather than running the assessment entirely in-house.

A capable provider delivers a documented risk register mapped to AS 4485 or NESAF, practical support preparing for SIAT audits, specification advice on CCTV and duress alarm placement, and ongoing monitoring or patrol coverage once controls are live, not just a report and an invoice.

Look for adherence to recognised quality frameworks: ISO 9001 for quality management and ISO 30000 are the kind of certifications worth checking before you sign a contract.
Ask how long the provider has operated in the sector; upwards of 15 years suggests they’ve seen enough site types to spot problems a first-time assessor might miss.
Confirm they offer 24/7 monitoring capability, because a duress alarm that only gets a response during business hours isn’t a control on a night shift.
Engage a specialist early when site complexity, critical infrastructure status, or multi-site rollouts make in-house assessment resourcing unrealistic.

How does the assessment protect patient privacy and data?

Patient privacy isn’t a separate compliance exercise bolted onto the physical security assessment. It has to sit inside the same risk register, because a physical breach and a data breach are often the same incident wearing different clothes: an unattended workstation in an unlocked office is both a physical security gap and a privacy failure.

Every information asset in scope, patient records, imaging, e-prescribing data, needs a classification level and a named access control policy. Electronic prescribing systems carry specific requirements around user authentication, provisioning, and account deactivation when staff leave or change roles, and these controls belong in your assessment’s information security section, not in a separate IT-only document nobody in facilities management ever sees.

Third-party access is where most gaps hide. Cloud vendors, pathology labs, transcription services, anyone with a login into a system touching patient data needs a documented access agreement and a periodic review of what they can actually see. NESAF’s eleven control areas give you a structured way to check this systematically rather than relying on whoever set up the vendor account five years ago remembering the details.

Practically, this means your risk register needs a column for data sensitivity alongside physical risk rating. A medication room and a records server room might carry the same consequence rating for very different reasons, one is about controlled substances, the other about a Privacy Act breach, and both deserve the same rigour in documentation and review cadence.

How do you plan for ransomware and insider threats?

Ransomware against health services isn’t a hypothetical anymore. Hospitals have become a preferred target because clinical systems can’t tolerate downtime, which makes operators more likely to pay, and because patient data commands a premium on illicit markets. Your risk register needs ransomware treated as a distinct threat category, not folded into generic “cyber risk,” with its own likelihood and consequence rating tied to how quickly clinical systems could be restored from backup.

Insider threats deserve equal weight, even though they’re harder to discuss openly with staff. Most insider incidents in healthcare aren’t malicious; they’re a staff member accessing a record out of curiosity, or a contractor retaining system access after their engagement ends. Role-based access control and regular access reviews catch both the curious and the negligent before they become a reportable breach.

Practical measures that address both threats at once: multi-factor authentication on every system touching patient data, regular patch management on clinical and administrative systems alike, tested backup and restore procedures for e-prescribing and records platforms, and a documented process for revoking access the day someone’s employment or contract ends, not the week after. Cloud configuration reviews matter here too. Misconfigured storage buckets and overly permissive vendor access are the two most common gaps.

Treat both threats as event triggers for reassessment. A ransomware incident anywhere in the health sector, even at another provider, is a reasonable prompt to re-check your own backup and access controls rather than waiting for the annual review date.

What does implementing these controls actually cost?

Budgeting for security controls fails most often because facilities try to fund everything from one capital works cycle. Split your action plan into the same three tiers used for triage: immediate low-cost fixes, short-term operational spend, and capital works requiring a business case.

Immediate fixes, duress alarm batteries, a policy rewrite, additional signage, cost little and should never wait for a budget cycle. Short-term items like additional patrol coverage or temporary CCTV placement usually come from an operational security budget rather than capital works, and a provider offering flexible service tiers makes this easier to fund incrementally rather than in one lump sum.

Capital works, zoning redesign, structural access control upgrades, a full CCTV network overhaul, need a business case tied directly to your risk register’s highest-rated items. The strongest business cases quote the specific standard clause driving the requirement (an AS 4485 provision, a CIRMP obligation) rather than a general safety argument, because finance committees respond better to a named compliance requirement than a vague risk statement.

One resourcing decision matters more than most facility managers expect: whether to build assessment and monitoring capability in-house or contract it. In-house teams carry ongoing salary and training costs; contracted mobile patrols or monitoring services convert that into a predictable line item, which is often easier to defend in an annual budget review than a headcount increase.

What experienced practitioners get wrong about security planning

Security gets bolted onto a finished building far too often, and it shows. The fix costs more, the sightlines never work as well, and clinicians end up fighting a system designed after the fact instead of one built around how they actually move through a ward.

Bring security into design conversations early and involve clinicians directly, because a nurse who knows the real traffic pattern through an ED will catch a sightline problem an architect’s drawing misses entirely. One design change that consistently pays for itself: specifying duress alarm points and CCTV runs in the tender documents before construction starts, rather than retrofitting them once walls are up. It’s the difference between a $2,000 conduit run and a $20,000 wall-chase job six months after handover.

— Abco

How Abcosecurity supports your next assessment

Running a healthcare security risk assessment properly takes time most facility managers don’t have spare, especially when you’re also chasing SIAT compliance or a CIRMP obligation on top of day-to-day operations. A specialist provider can deliver a security risk assessment mapped to AS 4485 and NESAF, backed by recognized quality standards and extensive sector experience, alongside monitoring and patrol services that turn recommendations into working controls.

Abcosecurity’s services cover the full loop a facility actually needs: documented risk assessments, A1 CCTV & alarm monitoring for 24/7 duress response, mobile patrol services for after-hours coverage of car parks and perimeter zones, and licensed security guarding where a physical presence is the right control for a high-risk ward or entry point. For facilities wanting continuous after-hours assurance without a full guarding contract, the Night Owl Service starts from $5.45 per day and scales into the 12M and 24M monitoring plans as your site’s needs grow.

The practical next step is straightforward: download our security risk assessment checklist and use it to scope your next review, then book a consultation with Abcosecurity to turn the findings into a costed, prioritised action plan.

Sources

FAQ

What are the five steps of a security risk assessment?

The core sequence is identify assets, identify threats and vulnerabilities, analyse likelihood and consequence, prioritise and implement controls, then monitor and review. In healthcare, each step needs to cover physical, people, administrative, and information domains together rather than treating them as separate exercises.

What are some examples of risk assessment in healthcare?

Common examples include an emergency department violence risk review, a pharmacy controlled-drug storage audit, a car park lighting and CCTV coverage check, and an information security review of e-prescribing access controls. NSW Health’s Protecting People and Property manual specifically names ED, mental health, pharmacy, and car parks as priority workplaces for this kind of review.

What is an example of a security risk assessment in a hospital?

A typical example walks through zoning and access control across a hospital’s public, clinical, and restricted areas, scores each zone’s risk of occupational violence, theft, or unauthorised access, then documents controls like duress alarms and CCTV placement against the AS 4485 standard. The output is a risk register with owners and deadlines assigned to each finding, not just a narrative report.

What should every healthcare risk assessment include?

Every assessment needs an asset list (people, property, information, clinical equipment), a threat and vulnerability review across physical, administrative, and technical domains, a likelihood and consequence rating for each risk, prioritised controls with named owners, and a documented review cycle. Abcosecurity’s security risk assessment checklist sets these out in a working template.

How often should a healthcare facility repeat its security risk assessment?

Run a full assessment at least annually, and again immediately after any major change such as a cloud migration, new building wing, or merger. Where SIAT audits apply under NSW Health policy, local health districts run these biannually, with continuous monitoring expected between formal reviews.