Why Is Physical Security on Our Board Agenda Now?
Physical security has always been a board-level responsibility. Patient safety, staff welfare, and the protection of organizational assets are governance concerns by definition; they carry fiduciary weight, regulatory consequence, and reputational exposure. Yet for many healthcare systems, physical security has not received the strategic attention that its importance warrants. It has been managed operationally and funded reactively, governed inconsistently if governed at all.
That gap between principle and practice is no longer sustainable. Expanding regulation, escalating workplace violence, and hard lessons from cybersecurity governance are converging to place physical security firmly on the boardroom agenda. The question for healthcare leaders is not whether it belongs there, but how quickly the distance between current state and actual need can be closed.
Organizations that invest strategically in physical security , not as a cost to be minimized but as a capability to be governed — see measurable returns. A well-integrated security program reduces disruption to clinical operations, lowers workers’ compensation exposure, supports staff retention, and contributes to the stable operating environment that every other strategic initiative depends on. The case for board attention therefore is not only about mitigating risk. It is about enabling the organization to function at its best.
The regulatory landscape
Healthcare security operates within an increasingly defined regulatory environment. The Joint Commission’s environment of care standards require hospitals to maintain programs that address safety and security risks. Its sentinel event framework goes further: Every instance of assault, sexual abuse, or homicide on hospital premises is classified as a reviewable event, triggering mandatory root-cause investigation and corrective action subject to Joint Commission review. In 2024, 65 workplace violence-related sentinel events were reported, a figure widely believed to be a significant under-reporting given that submission is voluntary.
The Centers for Medicare and Medicaid Services tie security-related requirements to Conditions of Participation, the standards that determine eligibility for federal reimbursement. Non-compliance puts Medicare and Medicaid revenue at risk, a consequence boards understand immediately. OSHA’s General Duty Clause adds a further layer of employer obligation, requiring workplaces free from recognized hazards likely to cause serious harm.
At the state level, legislative action has accelerated markedly. California’s SB 553, effective 2024, established the first general industry workplace violence prevention standard. Nine additional states — New York, Connecticut, Minnesota, Illinois, Oregon, Washington, Maine, Maryland, and New Jersey — have enacted or strengthened healthcare-specific protections. At the federal level, the bipartisan Save Healthcare Workers Act (H.R. 3178/S. 1600), introduced in May 2025 with AHA support, would make assaulting an on-duty hospital worker a federal crime punishable by up to ten years’ imprisonment. The trajectory is clear: the regulatory floor is rising, and organizations that treat compliance as their ceiling will find themselves exposed.
What the data tells us
The scale of this challenge is quantified with a precision that demands board-level attention. In June 2025, the AHA published The Burden of Violence to U.S. Hospitals, prepared by the University of Washington’s Harborview Injury Prevention and Research Center. The headline finding: the total financial cost of violence to U.S. hospitals in 2023 was an estimated $18.27 billion.
$18.27 Billion.
For every $1 spent on prevention, $4 is spent responding.
Total financial cost of violence to U.S. hospitals in 2023. Of $3.62B in prevention spending and $14.65B in post-event costs, the 4:1 ratio reflects a system structured to react, not prevent. — AHA, The Burden of Violence to U.S. Hospitals (2025)
That imbalance is not a reflection of how much organizations care about their people. It is a reflection of how security investment has historically been structured: reactively, in response to incidents, rather than strategically, in pursuit of prevention. What’s more, the report’s authors noted that their estimates were “largely conservative,” suggesting the actual burden is higher still.
Bureau of Labor Statistics data reinforces the picture. Healthcare workers are five times more likely to suffer workplace violence injuries than workers in other industries, with nurses, nursing assistants, and emergency department staff bearing disproportionate risk. The AHA report estimated $541 million in staffing-related costs from the non-physical effects of violence alone, the absenteeism, lost productivity, and increased turnover that follow exposure to violent incidents. In an industry already navigating a workforce crisis, these are not secondary concerns.
The inverse is equally important. Organizations that shift from reactive spending to governed, prevention-oriented investment redirect resources from the costliest part of the cycle toward the most effective. The business case is not about spending more on security. It is about spending differently and measuring the return in reduced incident rates, lower compensation claims, improved retention, and uninterrupted clinical operations.
“Every board regularly discusses cyber security issues now. Almost none make an equivalent investment of time in physical security.”
Ken Senser, CSA Chief Strategy Officer • Former Walmart Chief Security Officer
The governance gap that boards already know how to close
That observation identifies both the problem and its solution. Over the past decade, boards have built sophisticated governance structures for cybersecurity: dedicated committees, regular risk reporting, defined accountability, and strategic investment frameworks. They did this because regulatory pressure, high-profile incidents, and litigation risk made cyber a board-level concern. Physical security now faces the same set of drivers — but most healthcare boards have not yet extended their governance frameworks to match.
The good news is that the model already exists. The governance architecture boards have constructed for cybersecurity translates directly to physical security. The capability gap is not about inventing something new. It is about applying proven governance disciplines to a domain that has been waiting for them.
Where security sits shapes what security does
Brad Brekke, CSA’s Chief Business Officer and former Vice President of Assets Protection and Corporate Security at Target Corporation, frames the board’s exposure directly: “If boards understood their exposure on physical security the way they understand it on cyber, this conversation would be very different.”
Part of the reason that conversation has been slow to develop is structural. In many healthcare systems, physical security reports through facilities management, plant operations, nursing, environmental services, or other functions whose primary mission is not security. When security is subordinated to a department with different priorities, it is inevitably shaped by those priorities. It becomes an operational line item rather than a strategic capability resourced to respond to incidents rather than to prevent them and rarely represented in the conversations where risk decisions are made.
“Most healthcare systems don’t have a security strategy. They have a collection of reactions.”
Jeremy Baumann, CSA Chief Executive Officer
A collection of reactions, however well-intentioned, cannot deliver the consistency or accountability that governance requires. Reactions are backward-looking by definition. Strategy is forward-looking; it anticipates risk, allocates resources against priorities, and creates the framework within which operational decisions can be made, measured, and improved. The question of where security sits, who it reports to, and what it is empowered to do is ultimately a question about how the organization governs risk.
The question for your board
The regulatory environment is tightening. The data is unambiguous and the governance model that boards need already exists in an adjacent domain. The gap between where physical security sits today and where it belongs is closable . The organizations that close it first will be better positioned to protect their people, satisfy their regulators, and demonstrate the governance that stakeholders rightly expect.
The question is straightforward: does your board receive regular reporting on physical security risk with the same rigor it applies to financial performance, clinical quality, and cybersecurity? If not, that gap is the most important conversation your leadership team isn’t having yet.
--
Explore the full picture in CSA’s Healthcare Security Governance Imperative: Twelve Questions for Boards and Executive Leaders to Build Safer, More Accountable Health Systems. Drawing on firsthand experience across major health systems, the report examines how governance, leadership, investment, and measurement shape security performance. Use it to guide conversations with your leadership team, identify gaps in your current approach, and set priorities for protecting patients, staff, and the communities you serve.
References
- American Hospital Association. (2025). The Burden of Violence to U.S. Hospitals: A Comprehensive Assessment of Financial Costs and Other Impacts of Workplace and Community Violence. Prepared by Harborview Injury Prevention & Research Center, University of Washington School of Medicine.
- Bureau of Labor Statistics. (2020). Workplace Violence in Healthcare, 2018. U.S. Department of Labor.
- The Joint Commission. (2025). Sentinel Event Data: 2024 Annual Review.
- The Joint Commission. (2025). Sentinel Event Policy (SE). Classifies assault, sexual abuse/assault, and homicide of patients, staff, practitioners, trainees, visitors, or vendors on hospital premises as reviewable sentinel events.
- The Joint Commission. Environment of Care Standards (EC.02.01.01).
- Centers for Medicare & Medicaid Services. Conditions of Participation for Hospitals (42 CFR §482).
- Occupational Safety and Health Act of 1970, Section 5(a)(1) (General Duty Clause).
- California Senate Bill 553 (SB 553). Effective July 1, 2024.
- Save Healthcare Workers Act. H.R. 3178/S. 1600, 119th Congress. Introduced May 5, 2025.
- Additional state healthcare workplace violence legislation: New York (Labor Law §27-b), Connecticut (PA 21-174), Minnesota (Minn. Stat. §144.566), Illinois (Health Care Violence Prevention Act, 210 ILCS 160), Oregon (ORS 654.414), Washington (WAC 296-800-140), Maine (26 MRSA §806), Maryland (Md. Code, Health-General §19-353), New Jersey (N.J.S.A. 26:2H-5.19).
Speak to a Security Expert
Enter your information below to speak to a security expert on our team.
