More than 34 million people were admitted to a U.S. hospital last year: roughly one person every second. All of these patients, and their families, rely on healthcare facilities to operate 24/7 to deliver essential care. Yet, a growing range of threats can disrupt operations, compromise safety and lead to significant financial losses. The time to plan is long before a plan is needed.
To craft effective risk mitigation strategies, healthcare leaders need to better understand the evolving threat landscape. Threats typically fall into several key areas that can lead to operational downtime, economic losses and reputational damage – not to mention the potential for loss of life. Threats cause disruption to physical security and digital and cybersecurity, and even operational and maintenance continuity.
Threats to physical security
Facilities must be prepared to contend with challenges ranging from natural disasters to vandalism and gun violence. These issues are difficult in any facility, yet involve distinctive considerations in a health care setting where occupants, from patients to families to staff, are vulnerable and, for patients, potentially immobile.
For example, Tampa General Hospital, a 1,000-bed facility located at sea level near the ocean, is the region’s only Level 1 trauma center. Its location makes it particularly vulnerable to storms, raising additional physical security considerations to ensure continuous operations throughout a hurricane. During Hurricane Milton in 2024, the hospital was in a mandatory evacuation zone. To protect the facility, it deployed a reusable mobile flood barrier system anchored to the ground. Despite a storm surge of over four feet, Tampa General did not flood and remained fully operational, continuing to provide patient care throughout the storm.
Results like those start with insights that can help inform planning that is essential to mitigate impacts and speed recovery. This should start by assessing baseline conditions and identifying vulnerabilities and projected impacts. Vulnerability assessments combine top-down scientific data with a bottom-up review of individual assets and readiness for current and future hazards. GIS mapping helps visualize that data, and a hotspot analysis can overlay climate stressors with critical functions to ensure that finite resources are directed at mitigating risks of highest importance. Due to the cascading nature of climate-related risks, planning and decision-making must take a systems approach.
Digital and cybersecurity
Beyond the immediately visible, healthcare facilities face a growing array of less tangible but equally devastating threats, particularly in the realm of cybersecurity. Ransomware attacks are becoming more frequent and advanced, with AI-enhanced tactics introducing new and unfamiliar risks, particularly for unsecured connected building systems. Healthcare facilities are prime targets for cyberattacks due to the sensitivity of patient data and the need for operational continuity.
There are real benefits to building more reliable clinical networks. Chester County Hospital in West Chester, Pennsylvania, is a good example. There, a new 290,000 square foot hospital building incorporated resilient fiber optic infrastructure to replace outdated systems and enable a seamless migration to Penn Medicine standards, including VoIP, access control and video surveillance. A new MDF/Demarc and 11 IDF rooms ensure robust, redundant connectivity for clinical and operational networks. A surgical command center enables real-time monitoring, collaboration and training. This project significantly enhances risk mitigation by ensuring infrastructure reliability, communication redundancy and clinical continuity during future expansion or disruption.
Operational and maintenance challenges
All of these threats can be even more challenging when facility infrastructure and technology aren’t fully up to date. Many U.S. healthcare facilities have aging infrastructure and would be well served by investments in enhanced maintenance and modernization to meet today’s standards. Proactive maintenance and renovations not only promote safety and efficiency, but can also help retain a skilled workforce and provide a competitive advantage in attracting clinical staff. In a 2024 ASHE survey of hospital leaders, 80% cited aging facilities and infrastructure as their top concern.
Effectively addressing these and other types of threats requires a multidisciplinary approach to developing and regularly updating crisis and threat management plans. Since hospitals are typically central to a community’s response to broad threats, from violence to extreme weather, facilities managers also should consider using a community risk model.
For example, Pinellas County, Florida, built a custom probabilistic risk model to reflect projected impacts to county assets and infrastructure from sea level rise, tidal and storm surge concerns. This effort included identifying critical elevations for infrastructure, a cost/risk assessment and a design model adaptive to future conditions.
Healthcare facilities face a complex threat landscape, from day-to-day operational challenges to sophisticated cyber crime and climate-driven disasters. By prioritizing comprehensive, multi-disciplinary strategies, such as proactive maintenance, day-zero cybersecurity readiness and pre- and post-disaster planning, healthcare facilities can significantly enhance their resilience. Strategies should be robust, flexible and able to respond to a wide range of futures while ensuring the continuous delivery of critical, lifesaving healthcare services.
Chris Talbert, PE, LEED AP
Chris Talbert, PE, LEED AP, is senior vice president and regional director of High-Performance Design at WSP in the U.S., one of the world’s leading professional services firms. Prior to joining WSP, he spearheaded enterprise-wide sustainability initiatives at HCA Healthcare, driving significant carbon reductions and capital reinvestments across a national hospital network. Talbert’s career highlights include shaping innovative energy plant concepts and contributing to landmark projects such as Nashville’s first LEED-certified facility.
