How to scope security for ambulatory clinics and off-campus care sites

As health systems expand care beyond the hospital campus, security programs must extend with them. Ambulatory and off-campus sites may operate with smaller teams, public access, limited support, and different patient populations. Applying the same model everywhere can leave higher-risk sites underprotected while misdirecting resources.

An effective scope creates systemwide consistency without treating every clinic as identical. It connects site conditions, operating requirements, people, technology, procedures, and oversight in a model that can be evaluated before a contract is signed.

Ambulatory security scoping: Quick answers

• What determines a site's security needs? Consider the care provided, operating hours, access points, staffing patterns, incident history, surrounding environment, and distance from support.
• Does every site need an on-site security professional? Not necessarily. The appropriate model may combine on-site personnel, mobile patrols, remote monitoring, access control, duress systems, and staff training.
• What should a security scope include? Define site risk tiers, required outcomes, coverage, responsibilities, escalation procedures, technology, reporting, governance, and performance measures.
• What should buyers evaluate in a provider? Look for healthcare training, local responsiveness, multi-site management, workforce continuity, technology integration, and program improvement.

Start with a complete site inventory

A defensible scope begins with information about each location, not assumptions based on size or patient volume. The Joint Commission requires ambulatory organizations to manage safety and security risks and conduct an annual workplace violence worksite analysis. Its guidance emphasizes facility circumstances, policies, training, environmental design, incident history, and corrective action.

For each site, document:

• Clinical profile: Services, patient population, controlled medications, behavioral health considerations, and security-sensitive activities.
• Operating profile: Hours, lone-working periods, opening and closing routines, visitor flow, and peak demand.
• Physical profile: Entrances, parking, shared areas, sightlines, cameras, access control, alarms, and duress devices.
• Risk profile: Incidents, near misses, staff concerns, local conditions, law enforcement coordination, and distance from health system support.

Use these inputs to assign a risk tier and required controls. Reassess it when services, hours, staffing, construction, or surrounding conditions change.

Define outcomes before specifying coverage

A scope should state what security must accomplish before prescribing posts and hours. Outcomes may include managing access, responding to duress or aggression, supporting opening and closing, protecting sensitive areas, coordinating emergency response, and documenting incidents.

Translate each outcome into responsibilities. Specify who receives alarms, escalation paths, response priorities, after-hours procedures, and handoffs to law enforcement or emergency services. Post orders should reflect the site's clinical environment rather than repeat a hospital template.

Match security layers to each risk tier

A tiered model helps buyers apply consistent decision rules across a distributed network:

• On-site personnel: May be appropriate where patient acuity, incident patterns, public traffic, or response needs require an immediate physical presence.
• Mobile patrols: Can support clustered locations, opening and closing checks, parking areas, and event-driven visits.
• Security technology: Can strengthen access management, situational awareness, duress response, and incident review when monitoring and response ownership are defined.
• Staff readiness: Should include role-appropriate awareness, de-escalation, emergency communication, reporting, and site-specific procedures.

Example: Security tiering matrix for ambulatory clinics

Evaluate the provider's operating model

The provider should demonstrate how the scope will function across multiple sites, not simply supply hourly rates. Ask:

• How will healthcare-specific training and site orientation be delivered and verified?
• Who supervises the program locally, and how are urgent issues escalated?
• How are staffing continuity, relief coverage, and schedule changes managed?
• Can reporting identify trends across locations while preserving site-level detail?
• How will personnel integrate with existing cameras, access control, duress systems, and health system procedures?
• What process converts incidents, staff feedback, and operational changes into scope adjustments?

These questions reveal whether a provider can manage an evolving program rather than disconnected assignments.

Establish governance and change control

The final scope should define decision-makers, review cadence, reporting standards, and performance measures. Indicators may include incidents, response activity, open positions, training completion, equipment issues, corrective actions, and recurring concerns.

Security, facilities, clinical operations, human resources, risk management, and the provider should review results together. When a clinic adds a service line, extends hours, renovates space, or experiences a new pattern of incidents, the scope should trigger reassessment rather than wait for contract renewal.

Final thoughts

Scoping ambulatory security requires consistency in governance and flexibility at the site level. A risk-tiered approach gives health systems a clearer basis for allocating resources, comparing providers, and holding the selected partner accountable.

Speak with an healthcare security expert