126 Australian healthcare workers were hospitalised following assaults in 2024–25, according to Australian Institute of Health and Welfare figures reported by the Australian College of Nursing. For hospital managers, that's a reason to examine not just how many officers are rostered, but who takes charge when a threat develops and what changes after staff report it.

Reliable security in hospitals connects clinical decisions, controlled access, trained response and incident learning. More uniforms alone won't fix an unanswered duress alarm, an unclear command structure or a behavioural warning that never reaches the next shift.

What the Numbers Say About Hospital Risk

Australian Institute of Health and Welfare figures reported by the Australian Nursing and Midwifery Federation show assault hospitalisations among healthcare workers rising from 49 in 2015–16 to 126 in 2024–25. The rate increased from 4.3 to 8.1 per 100,000 healthcare workers. In 2024–25, assaults accounted for 15% of healthcare-worker injury hospitalisations, compared with 3.8% across the general population.

Assault hospitalisations among Australian healthcare workers

These figures cover injuries serious enough to require hospital admission. They do not capture verbal threats, attempted assaults, less severe physical violence or incidents that go unreported. Those events still need a clear response and a reporting path, particularly in emergency departments, mental-health units and transfer areas.

Define the job beyond emergency response

Hospital security protects patients, staff and visitors while care continues. Its work includes managing visitor movement and aggression, protecting medicines and assets, and coordinating physical access with clinical information systems.

The operational test is who owns the first five minutes of an incident. Staff need to know who receives the call, who directs the response and who records the outcome. A report should inform the next shift's briefing and deployment decisions; otherwise, the same warning may be missed again.

Practical rule: Treat every incident report as a prompt to check a control, assign an owner and confirm what changes.

Keep administrative responsibilities distinct. Hospitals that need to hire medical coder support should keep that function separate from operational security reporting. Security reports need their own owner, escalation route and follow-up.

A Zone Model for Security in Hospitals

Use this hospital zones, risks, controls and owners baseline for the current review, not as a uniform headcount formula. Validate each control against clinical practice, emergency egress and the actual floor plan before putting it into post orders.

Put fixed posts where decisions happen

An emergency department needs someone who can distinguish a permitted visitor from an unauthorised arrival without delaying urgent care. Position Security Guarding around reception and ambulance-entry interfaces according to assessed demand, with clear sightlines and a reliable connection to the clinical coordinator.

Don't turn ambulance access into a checkpoint that delays treatment. Define who can release a restricted door, where accompanying people wait and how officers redirect visitors when clinicians need space.

A healthcare visitor management process should distinguish patients, carers, interpreters, contractors and ordinary visitors. A single visitor rule applied without clinical exceptions creates friction and encourages staff to bypass it.

Car parks need a different deployment. Mobile Patrols, lighting inspections and usable CCTV coverage can address walking routes, isolated stairwells and perimeter breaches more effectively than an officer permanently seated inside reception.

The trade-off is availability. If a patrol officer also provides the internal response, specify who covers the perimeter when that officer attends an incident.

Protect clinical boundaries without obstructing care

Pharmacy, plant and loading doors need access records that identify the person, purpose and authorisation. Gatehouse Security or a concierge-style receiving point can verify deliveries and contractors before they enter back-of-house routes.

For example, a refrigeration technician should receive access to the relevant plant area, not unrestricted movement through pharmacy corridors. Facilities should confirm the work order and nominate an escort where needed.

Mental-health, maternity and paediatric controls require clinical ownership. Security supports observation, safe movement and visitor restrictions, but clinicians determine patient-specific care and escalation arrangements.

• Staff corridors: Use anti-passback only where workflows and emergency egress support it. Add short patrol beats around known tailgating points.
• ICT and records rooms: Require approved badge access and separate system authentication. Possession of a badge shouldn't authorise every workstation.
• Restricted wards: Test arrangements with carers and clinical teams so legitimate access doesn't rely on propped doors.

A zone without a named owner and a review date is an intention, not a managed control.

The First Five Minutes of an Incident

A behavioural score is an early warning, not a guarantee. In a study of two Melbourne emergency departments, the Brøset Violence Checklist was completed for 42,675 of 108,274 eligible presentations; a threshold of 3 delivered 99.2% specificity but only 15.6% sensitivity for unplanned alerts.

Many incidents therefore occurred without reaching that threshold. One participating department recorded 868 duress alarms and 169 Code Grey events during 2022, reinforcing the need for continuous observation and an available response team.

The checklist belongs inside a response process, not above it.

Assign decisions before the alarm

Use this sequence as an operating template, adapted to the hospital's clinical protocols. Immediate protective actions come first; documentation and handover continue after the area is safe.

1. Recognise and notify. On a rising score or observed threat, the clinical lead contacts security and moves exposed staff or vulnerable patients where clinically safe. Staff shouldn't wait for a completed checklist before activating duress.

2. Control the approach. Security attends the agreed response point and manages entry feeding the affected area. Officers need a specific destination, safe approach and clinical contact, not an instruction to check the campus generally.

3. Apply the hospital's response rules. Follow local de-escalation and Code Grey or Code Black procedures. Assign clinical leadership, communication, bystander management and security roles before considering restraint under authorised procedures.

4. Record objective facts. Capture location, observed behaviour, alarm activation, arrival and actions in the appropriate clinical and security records during the same shift. Distinguish what an officer witnessed from what another person reported.

5. Change the next interaction. Review behavioural alerts, access instructions and the next patrol briefing. Share only information each recipient needs to act safely.

A documented Code Grey response arrangement should identify the response leader, backup communications and the process when the nominated officer is already committed elsewhere.

Review missed warnings and handover failures

A low score must never overrule a worker reporting an immediate threat. Audit false negatives, near misses and unplanned alerts alongside formally activated codes.

Failing to refresh a behavioural record after sexualised or aggressive conduct leaves later workers without useful precautions. Record the conduct and agreed response without assuming that a diagnosis predicts behaviour.

I recommend a structured debrief within 24 hours, where operationally feasible, with clinical and security leads. Treat that as a local management target, not a statutory deadline, and record the resulting actions against the relevant incident and authorised behavioural record.

Measure alarm acknowledgement, dispatch and arrival separately. Response-time percentiles reveal delays that a simple average can conceal, especially when an officer must cross buildings or wait for a locked door to open.

Where Doors and Data Share One Risk

A badge decision can shape both physical access and digital exposure. It may admit someone to a room with records, workstations or equipment connected to clinical systems. The practical question is who checks that access still matches the person's current role.

A 2023 analysis of large Australian healthcare providers identified 929 confirmed cyber-security incidents during the first five years of the Notifiable Data Breaches reporting period, which began in 2018. Human factors were the largest contributor. These were reportable breaches, not every attempted intrusion or unsuccessful attack.

Match visible pathways to practical controls

Facility managers can address access failures without investigating malware. Start with the physical and administrative pathways staff can observe:

• Tailgating into a records room: Use approved anti-passback settings, escort rules and a safe way for staff to challenge unfamiliar entrants. A card reader alone cannot stop someone following an authorised person.
• A borrowed login at an unprotected workstation: Require unique accounts, screen locking and prompt removal of unnecessary permissions. Shared credentials may ease workflow delays, but they weaken accountability.
• A contractor retaining access after completion: Have ICT, facilities and security check joiners, movers and leavers together. Close the work order and remove both physical and digital permissions.

For example, when a contractor finishes work near imaging equipment, check whether they still need a door credential or remote support account. Closing only the physical pass leaves digital authorisation active.

The same coordination should guide monitoring. A forced door and repeated failed logins associated with that area should reach a nominated duty manager, rather than sit in separate inboxes without an owner.

Make continuity part of the response

Set a clear approval path for log access, evidence preservation and coordination with ICT. The people who can authorise access should be known before an incident, and records should be preserved under the hospital's procedures. Include clinical continuity instructions for admissions, read-only systems, downtime procedures and responsibility for patient communications if privacy is affected. A data privacy and security measures guide can support discussion of how physical and information risks connect.

Use the hospital's privacy obligations and existing ISO-style risk process to document decisions. Standards-based language in a procedure does not, by itself, establish certification or compliance.

The following embedded video can support a team discussion, but local procedures must govern action.

Keep access-hygiene training separate from violence-response training. Recruitment discussions about healthcare cybersecurity salary expectations should sit alongside clear definitions of local responsibilities and coverage.

Practise the contact tree with ICT, security and the clinical duty manager. Confirm who answers, who can make decisions and who takes ownership during the first five minutes. After an incident, use the handover to update the next shift's access instructions and briefing.

Licences Privacy and Award Duties

A licence check is only useful if it matches the officer's jurisdiction and assigned duties. Record the check and confirm it again when a replacement officer is rostered. A supplier's general assurance does not establish that each person assigned to the hospital is authorised for the work.

The Fair Work Ombudsman's Security Services Industry Award summary describes work covered by the award, including patrolling, protecting, screening, watching and guarding by physical or electronic means, as well as crowd control, monitoring and loss prevention. Confirm award coverage for the employment arrangement rather than assuming every hospital-employed role falls under the same instrument.

Check jurisdiction and duty together

Security licensing is governed by state and territory law. Check the current licensing requirements with the regulator responsible for the state or territory where the officer will work.

Who issues security licences for hospital deployments

An officer's licence does not automatically transfer between jurisdictions. Check the jurisdiction, authorised activities, expiry and relevant conditions for each officer, including relief personnel.

A security officer work description should turn these checks into clear assigned tasks. Specify whether the role includes reception assistance, CCTV monitoring, access enforcement or emergency response, rather than bundling them into an ambiguous position description.

Keep security records factual and authorised

Incident notes should record what was seen, heard and done, not offer a diagnosis. Describe a person striking a door and threatening a worker; do not assign a clinical label or speculate about intent.

CCTV and access logs require authorised purposes and controlled access under hospital policy. Officers should not browse footage out of curiosity, share patient images through personal messaging accounts or keep local copies after an authorised handover.

Procurement check: A concierge-labelled shift does not remove licensing or award obligations if the assigned duties are security work.

Before deployment, ask providers for current licences, a match between duties and licence classifications, training records and auditable roster information. Require prompt notification of substitutions so the hospital can check the replacement officer's authorisation before the shift begins.

Supplier availability is only one part of procurement. Confirm that the provider can explain clinical boundaries, protect records and supply appropriately authorised replacement staff without weakening the post.

Set Department Risk and Commission the Next Review

Department-level review is more useful than a hospital-wide staffing ratio. The same number of patients can create different security demands in an emergency department, on an isolated transfer route or across a campus with limited after-hours backup.

A 2024 study of five regional and remote Australian emergency departments recorded 314 security alerts across 214,617 presentations, an overall rate of 1.46 per 1,000, with site rates ranging from 0.48 to 2.94 per 1,000. The variation supports assessing each department's activity and conditions, rather than setting deployment by patient volume alone.

Commission a review that produces decisions

Review remoteness, case mix, access block, staffing and layout. A regional site with limited after-hours support needs a defined backup plan that reflects its actual response routes.

A healthcare security risk assessment should bring clinical, facilities, ICT and security leads together with the floor plan. Walk the route from the officer's post to the treatment space, including ambulance entry, locked interconnecting doors and public waiting areas.

Use the zone table to settle operational questions:

• Decision owner: Who directs immediate protective action, and who takes over if that person is absent?
• Duress pathway: Where does the alarm appear, who acknowledges it, and what is the fallback if communications fail?
• Roster authority: Does each officer hold the licence required for the assigned duties?
• Learning evidence: Which recent incident changed an authorised behavioural alert, post instruction or shift briefing?

Training attendance does not prove the response sequence works. Rehearse a scenario on the actual floor plan. Check whether staff can locate the alarm, identify the incident location and reach the designated response point.

Build a dashboard managers can act on

Join incident reports, door events and guard timestamps in a monthly operational dashboard. Limit patient-identifying information and give managers enough detail to make deployment decisions without circulating unnecessary clinical information.

Track alert density, time-of-day patterns, repeat-location demand, escalation severity and response-time percentiles. Separate acknowledgement, dispatch, travel and access delays to identify whether the constraint is communication, positioning or a physical barrier.

Include reporting quality. Low incident counts may reflect missing reports if staff find the form burdensome or receive no feedback. A qualitative study involving Australian emergency department professionals identified weak reporting and follow-up as barriers to prevention in the Edith Cowan University publication. Make reporting accessible, acknowledge submissions and tell staff what changed.

Agree who owns the first five minutes before adding headcount. Use recorded demand and tested response routes to decide where additional officers will help.

Close the review with named actions, responsible managers and review dates. Assign immediate fixes, such as clearing a blocked sightline, updating an outdated contact or repairing an unreliable door release, directly to an owner.

ABCO Security Services Australia lists static security guarding, mobile patrols, concierge and reception coverage, and CCTV and access control among its services. Its offices are in Melbourne, Sydney, Adelaide, Perth and Brisbane. Visit ABCO Security Services Australia to discuss a hospital review focused on zone ownership, duress escalation and incident information passed to the next shift.