New York’s 2027 Hospital Security Assessment Starts With Your Incident Logs

Hospitals in New York State that get their incident logs consistent now will start their first annual security assessment with evidence they can use. From 1 January 2027, every general hospital in the state must assess its workplace safety and security at least once a year, and that assessment has to consider workplace violence incident reports and incident logs.

The law was enacted in December 2025, so the requirement itself isn’t new. What has changed is the calendar. With about seven weeks until the first assessment cycle opens, the quality of a hospital’s incident records will shape how much of the assessment rests on real data and how much rests on reconstruction.

This article covers what the law asks for, how it lines up with Joint Commission expectations, and practical steps security and safety leaders can take before January.

What Public Health Law §2832 requires from hospitals

Under Public Health Law §2832 (opens in a new tab), general hospitals must conduct a workplace safety and security assessment at least once a year starting 1 January 2027. Each assessment feeds a safety and security plan that addresses the workplace violence threats and hazards it identifies.

The statute lists what the assessment should consider. Incident data sits at the top of that list, alongside several other inputs.

• Workplace violence incident reports and incident logs
• Concerns or complaints raised by employees, patients, visitors and recognized collective bargaining representatives
• The hospital’s layout, access points and visitor management
• Protective factors such as access control, engineering controls, alarms and communication systems
• The adequacy of employee training policies and security procedures, including how disruptive or violent patients are handled

The law also sets expectations for what happens to incident data after it’s collected. Hospitals must share redacted summaries of the incident log, along with trends and analysis, with the security or safety committee responsible for workplace violence. They must also make sure that data is part of the assessment process. Employees and their representatives must be actively involved in the assessment and the plan, and they must receive a written summary of the plan.

In practice, this means the incident log does more than record events. It becomes the dataset the assessment draws on, the source of the committee’s trend reports, and part of the record the plan is built from.

How the New York law lines up with Joint Commission NPG 2a and 11

For accredited New York hospitals, one well-kept incident record can support both the state assessment and accreditation readiness. The statute itself points in that direction. It says a hospital’s workplace violence prevention program should be consistent with CMS Conditions of Participation and with the workplace violence standards of its CMS-deemed accrediting organization, where those are comparable to The Joint Commission’s.

Since 1 January 2026, The Joint Commission’s National Performance Goals have raised the bar on evidence. NPG 2a (Preventing Workplace Violence) calls for a documented, multidisciplinary program with trend analysis, corrective action and reporting to the governing body. NPG 11 (Creating a Secure and Safe Physical Environment) covers how security incidents are monitored, reported and investigated.

The two frameworks ask similar questions of the same data.

What the reviewer wants to see	NY Public Health Law §2832	Joint Commission NPG 2a / 11
Incident records	Assessment must consider incident reports and incident logs	Monitoring and reporting of security incidents
Trend analysis	Trends and analysis shared with the safety committee	Trend analysis as part of the program
Action on findings	Safety and security plan to reduce identified risks	Corrective action
Oversight	Security or safety committee, with employee involvement	Governing-body reporting

A hospital that logs incidents the same way across every unit and site can answer both sets of questions from one source. A hospital that keeps incidents in several formats will likely end up assembling the evidence twice.

Where hospital incident logs tend to fall short

Most hospitals already record incidents, so the bigger question is whether those records can be compared, counted and trended. A few gaps come up often and are easier to fix before an assessment than during one.

• Paper and spreadsheet records. Reports filed on paper or kept in local spreadsheets are hard to search, total and redact, which slows down the committee summaries the law asks for.
• Inconsistent categories. When one unit logs a verbal threat as “disruptive behavior” and another logs it as “workplace violence,” trend analysis undercounts or double-counts the problem.
• Missing location detail. Without a consistent site and unit field, it’s difficult to show which areas carry the highest risk, a finding the assessment and plan both depend on.
• Gaps between departments. An incident may start with security and end up with Employee Health, HR or Risk. If each team keeps its own notes, the full record of what happened and what was done about it is scattered.
• No record of follow-up. Showing that a finding led to a change, such as added rounding or a new access control measure, requires a trail that many logs don’t keep.

How to get incident logs assessment-ready before January

A few focused steps now can give the first assessment a cleaner dataset to work from.

1. Inventory every way incidents are recorded today. List each form, spreadsheet, app and paper log in use across units, shifts and sites. The number alone is often the clearest sign of how much consolidation is needed.
2. Agree on one set of incident categories. Define what counts as workplace violence, a credible threat, an assault and a disruptive behavior event, then apply those definitions everywhere.
3. Standardize location fields. Use the same site, building and unit names in every report so risk can be compared across the hospital.
4. Plan how summaries will be redacted. The law requires that committee summaries protect the privacy of the people involved. Decide early which fields will be removed or masked.
5. Set a reporting rhythm with the committee. Agree on how often the safety or security committee receives incident summaries, trends and analysis, so the data is part of the assessment process all year.
6. Check the record of follow-up. Make sure corrective actions are logged against the incidents that prompted them.

For a structured way to test your program, download the Hospital Workplace Violence Prevention Evidence Brief. It walks through the operational records a surveyor, board or legal team is likely to ask about and includes a six-question self-assessment you can use to benchmark your program before the January assessment cycle begins.

Turning assessment findings into a safety and security plan

The assessment is only the first half of the requirement. Based on its findings, each hospital must implement a safety and security plan that sets out methods to reduce the risks identified, and update it as conditions change. The statute gives examples such as employee training, increased staffing and security, engineering controls like barriers, lighting and alarms, and facility modifications.

Many of those measures cross department lines. Security may own patrols and access control, while Facilities owns lighting and barriers, HR owns training and Employee Health follows up on injuries. A plan works best when everyone knows who is responsible for each handoff once an incident occurs.

The Cross-Functional Incident Workbook for Hospitals helps teams map that out. It includes worksheets and RACI grids for seven departments that commonly share responsibility for patient and staff safety, giving you a first draft of a cross-functional incident communication plan you can fold into your workplace violence program.

How TrackTik helps hospitals keep one consistent incident record

Hospital security teams using the TrackTik platform from Trackforce can give officers one incident form that works the same way at every site. With TrackTik incident reporting, administrators set up the incident categories and site locations, so each report is tagged by type and location as it’s filed and flows into incident analytics.

That consistency carries through to reporting. TrackTik business intelligence turns incident data into trends a safety committee or governing body can review, and incident routing can notify the departments that share responsibility for a response, with each notification timestamped for the record.

If you’re preparing for your first assessment under §2832, start with the Evidence Brief to see where your records stand. When you’re ready to see how incident reporting and routing could work across your hospital, request a demo or explore healthcare security operations with Trackforce.

This article is for general information and isn’t legal advice. Hospitals should confirm their obligations under Public Health Law §2832 with counsel.