Choosing the Right Tool for Your Hazard Vulnerability Assessment (HVA)

After selecting the HVA committee, the next step is choosing the risk assessment tool the group will use.

This decision deserves more attention than it often receives.

The tool is not simply a spreadsheet used to record the committee’s conclusions. It influences the questions the committee asks, the factors it considers, and ultimately how the organization understands and prioritizes risk.

In other words, the tool shapes the conversation.

If the assessment only asks, “How likely is this hazard to occur?” the committee may identify frequently occurring events, but overlook hazards with a lower probability and potentially catastrophic consequences.

It may also fail to identify weaknesses in the hospital’s ability to respond, sustain operations, protect patients and staff, or recover after the event.

A stronger HVA tool helps the committee examine several dimensions of risk:

• The probability that the hazard will occur

• The potential impact on people, property, operations, finances, reputation, and continuity of care

• The organization’s current level of preparedness

• The availability and reliability of internal response capabilities

• Dependence on community partners and outside resources

• The ability to sustain operations during a prolonged event

• The difficulty and time required to recover

That broader view is important because probability alone does not tell the full story.

A water interruption may appear less dramatic than a tornado or active assailant event. But if the hospital cannot maintain sanitation, sterilization, food service, cooling systems, dialysis, laboratory operations, or patient care without water, the operational consequences may become severe very quickly.

A cyberattack may not physically damage the building, but it can affect clinical documentation, medication administration, diagnostic testing, patient registration, communications, billing, access controls, medical devices, and the hospital’s ability to coordinate care.

A regional infectious disease outbreak may develop gradually rather than arrive as a single obvious incident. Its effects may include staffing shortages, supply depletion, isolation-capacity concerns, increased patient volume, employee illness, public anxiety, misinformation, and prolonged operational strain.

The right tool encourages the committee to examine these interconnected consequences.

The Kaiser Permanente HVA Tool

Many hospitals use a version of the Kaiser Permanente Hazard Vulnerability Analysis tool.

ASPR TRACIE identifies it as a widely used healthcare tool that provides a systematic method for analyzing hazards that may increase demand for hospital services or interfere with a facility’s ability to provide those services. The tool is intended to help healthcare organizations prioritize planning, mitigation, response, and recovery activities. The revised version also allows organizations to incorporate information from actual emergency activations into the risk analysis.

The Kaiser tool generally examines risk through several categories, including:

• Probability

• Human impact

• Property impact

• Business impact

• Preparedness

• Internal response capability

• External response capability

These categories help the committee move beyond a narrow discussion of whether an event is likely.

For example, a hospital may determine that a large structural fire is unlikely. However, the potential human impact, interruption of patient care, evacuation difficulty, property damage, and recovery time could still make it a significant organizational risk.

Similarly, severe weather may occur regularly, but the hospital’s existing preparedness measures, hardened infrastructure, backup power, staffing plans, and regional partnerships may reduce its overall vulnerability.

The score helps reflect both sides of the equation:

What could happen, and how prepared are we to manage it?

The Kaiser tool is not the only acceptable option. ASPR TRACIE maintains resources and comparisons involving several HVA and risk assessment tools used by healthcare organizations, public health agencies, and emergency preparedness partners.

Some hospitals use tools developed by:

• State health departments

• Healthcare coalitions

• County or regional emergency management agencies

• Parent health systems

• Corporate emergency management programs

• Accreditation or consulting organizations

• The hospital’s own emergency management team

Any of these may be appropriate.

The question is not whether the tool has a familiar logo at the top. The question is whether it helps the hospital conduct a meaningful, comprehensive, and consistently applied assessment.

Tool Selection Criteria

When selecting, adapting, or developing an HVA tool, the committee should consider several questions.

Is the tool healthcare-specific?

Healthcare organizations have operational vulnerabilities that are not always captured by general business risk assessments.

Hospitals must consider patient acuity, continuity of clinical care, medical gas systems, infection prevention, pharmaceutical supplies, diagnostic services, patient evacuation, medical records, staffing ratios, vulnerable populations, and the consequences of delaying or relocating treatment.

A general risk assessment may identify a power failure as a business interruption.

A healthcare-specific tool should encourage the committee to ask what that failure means for ventilated patients, medication storage, operating rooms, imaging, elevators, nurse-call systems, security equipment, medical records, and emergency department operations.

Does the tool support applicable requirements?

The tool should support the hospital’s regulatory and accreditation obligations.

CMS requires participating healthcare organizations to develop emergency plans based on facility-based and community-based risk assessments using an all-hazards approach.

CMS describes that approach as focusing on the capabilities needed to address a broad range of emergencies, including natural, human-caused, and facility-specific incidents.

The HVA tool should help the organization demonstrate how it identified and evaluated those risks.

The tool itself does not create compliance. Its value comes from the quality of the assessment, the documentation supporting it, and the actions taken because of it.

Does it include facility-based and community-based risk?

Hospitals do not operate in sealed containers.

A hazard affecting the surrounding community can quickly become a hospital emergency, even when the facility itself remains physically undamaged.

A tornado, industrial accident, transportation incident, mass-casualty event, wildfire, chemical release, widespread power outage, or infectious disease outbreak may produce a surge of patients and family members.

At the same time, community damage may reduce the availability of emergency medical services, utilities, transportation, vendors, supplies, staffing, and mutual-aid resources.

The committee should consider both:

What can happen inside or directly to the hospital?

And:

What can happen in the community that will affect demand for services or the hospital’s ability to operate?

CMS emergency preparedness requirements emphasize both facility- and community-based risk and coordination with federal, state, tribal, regional, and local preparedness systems.

Does it consider internal and external hazards?

Some threats begin outside the organization:

• Hurricanes

• Tornadoes

• Flooding

• Wildfires

• Hazardous-material releases

• Civil disturbances

• Transportation accidents

• Community violence

• Supply-chain disruptions

• Infectious disease outbreaks

Others may begin inside the hospital:

• Fire

• Utility failure

• Medical gas interruption

• Information technology outage

• Cyberattack

• Workplace violence

• Infant or pediatric abduction

• Patient elopement

• Active assailant

• Internal flooding

• Equipment failure

• Loss of communications

• Contamination event

The distinction matters because internal and external events may require different warning systems, response structures, protective actions, staffing strategies, and resource decisions.

A good tool allows the committee to examine both.

Does it evaluate more than property damage?

Hospitals sometimes underestimate risk when the discussion focuses too heavily on the building.

The facility may remain standing while the organization loses the ability to safely care for patients.

The tool should help evaluate potential effects on:

• Patients

• Visitors

• Employees

• Physicians

• Contracted personnel

• Clinical operations

• Critical infrastructure

• Information systems

• Medical equipment

• Utilities

• Supply chains

• Financial operations

• Regulatory compliance

• Reputation and public trust

• Continuity of care

Human impact should also include more than death or physical injury.

The committee should consider psychological harm, exposure, displacement, delayed treatment, interrupted care, employee fatigue, family reunification concerns, and the consequences for medically or behaviorally vulnerable patients.

Does it assess preparedness and response capability?

A hazard may be significant, but the hospital’s vulnerability will depend partly on what has already been done to prepare.

The committee should examine:

• Existing plans and procedures

• Staff training

• Exercise performance

• Equipment and supply availability

• Backup systems

• Redundancy

• Department-level capabilities

• Staffing depth

• Vendor support

• Mutual-aid agreements

• Communication systems

• Community response capabilities

• Leadership familiarity with emergency roles

The assessment should distinguish between having a written plan and having a demonstrated capability.

A plan may state that a department will perform a particular function during an emergency. That does not necessarily mean employees have been trained, the required equipment is available, staffing is sufficient, or the process has been tested under realistic conditions.

Preparedness should be supported by evidence, not confidence alone.

Can the tool be updated after exercises and actual events?

An HVA should not be frozen in time.

Exercises, incidents, near misses, after-action reviews, regulatory findings, construction projects, new services, changes in patient populations, community development, and emerging threats should all inform future assessments.

The revised Kaiser tool’s inclusion of actual activations reflects an important principle: experience should change how the organization evaluates risk.

Suppose the hospital previously rated its communication capability as strong. During a real event, leaders discover that the mass-notification system did not reach contracted employees, several departments did not receive timely updates, and managers relied on informal text-message chains.

That experience should influence the next HVA.

The committee should be able to say:

“We believed we were prepared. The event showed us otherwise. The score needs to change.”

The reverse can also be true.

A successful response, completed mitigation project, new generator, improved water reserves, tested downtime process, or strengthened mutual-aid agreement may reduce vulnerability.

The HVA should remain a living assessment of current risk, not an annual reenactment of last year’s meeting.

Is the scoring method understandable?

A sophisticated formula does not necessarily produce a better assessment.

If committee members do not understand how the score is calculated, they may have difficulty applying the tool consistently or explaining the results to leadership.

The scoring process should be clear enough that participants understand:

• What each category means

• What evidence should influence the rating

• How preparedness affects the overall score

• How internal and external capabilities are evaluated

• How the final priority is calculated

• What the score does and does not represent

Consistency matters more than false precision.

The difference between a score of 41 and 43 may not be operationally significant. The important issue is whether the committee applied the same reasoning and criteria across the hazards being evaluated.

Will the results guide decisions?

A useful HVA should help the organization decide what to do next.

The results should influence:

• Emergency Operations Plan priorities

• Department-level procedures

• Continuity planning

• Training topics

• Exercise design

• Mitigation projects

• Capital requests

• Equipment purchases

• Supply levels

• Staffing strategies

• Vendor agreements

• Community partnerships

• Leadership discussions

The HVA is not complete when the hazards have been ranked.

The committee should identify what the results mean for the emergency management program.

For each priority hazard, the organization should consider:

• Are current plans adequate?

• Are responsibilities clearly assigned?

• Have staff been trained?

• Has the response been exercised?

• Are critical resources available?

• Can operations be sustained?

• Are outside partners prepared to support us?

• What mitigation could reduce the risk?

• Who owns the next action?

• How will improvement be measured?

The score should open the door to action.

The Mathematics Is Not the Magic

Scoring is useful. It gives the committee a structured way to compare hazards and establish priorities.

But the committee should not become trapped in arguments over individual numbers while missing the operational story behind them.

The mathematics is not the magic.

The real value is in the discussion required to reach the score.

When committee members disagree, that does not mean the process is failing. The disagreement may be exposing different experiences, assumptions, or levels of awareness.

Security may consider the hospital well prepared for an active assailant because officers have trained extensively.

Nursing may have a different view because clinical departments have not practiced lockdown, barricading, patient movement, or reunification procedures.

Facilities may rate backup power capability highly because generators are regularly inspected and tested.

Clinical leaders may identify areas where critical equipment is not connected to emergency power or where staff do not know which outlets remain functional.

Information Technology may believe downtime procedures are well developed.

Frontline staff may reveal that the paper forms are outdated, supplies are difficult to locate, and few employees have practiced operating without the electronic medical record.

Those differences are precisely what the HVA process should uncover.

A hazard score should cause the team to ask better questions:

• What assumptions are we making?

• What evidence supports this score?

• What have previous emergencies, exercises, and near misses taught us?

• Are we evaluating the written plan or the demonstrated capability?

• What would fail first?

• What services would be affected?

• How long could we sustain operations?

• Which patients would be most vulnerable?

• What resources would we need?

• What support would we require from outside partners?

• Would those partners be available during a regional emergency?

• What would make recovery difficult?

• What have we never tested?

The score is a conversation starter, not a verdict carved into stone.

Avoiding the Copy-and-Paste HVA

One of the easiest mistakes is to carry forward the same hazard list and scores year after year.

The dates change.

A few names are updated.

The committee approves the document.

The risk profile remains suspiciously identical.

But hospitals change constantly.

New construction may alter evacuation routes and utility dependencies. New clinical services may introduce different hazards. Leadership and staffing changes may affect response capabilities. Technology upgrades may create new strengths or vulnerabilities.

Community growth may increase traffic, patient volume, and infrastructure demands.

Severe weather patterns, cybersecurity threats, violence trends, supply-chain conditions, and infectious disease concerns may evolve.

Even when the hazard remains the same, the organization’s vulnerability may have changed.

The annual review should therefore include questions such as:

• What has changed inside the hospital?

• What has changed in the surrounding community?

• What incidents occurred during the past year?

• What exercises were conducted?

• What corrective actions remain incomplete?

• What new dependencies have been created?

• What capabilities have improved?

• Where has institutional knowledge been lost?

• What concerns are frontline employees reporting?

• What keeps department leaders awake at night?

The committee should also compare its findings with community and regional assessments when available.

The goal is not to copy the county’s hazard rankings. A county emergency management agency and a hospital may experience the same hazard very differently.

Instead, community information should help the committee understand the broader environment in which the hospital will operate.

Choosing the Best Tool

There is no single tool that will be perfect for every healthcare organization.

A large academic medical center, rural critical access hospital, behavioral health facility, rehabilitation hospital, pediatric hospital, and long-term care organization may face different hazards, dependencies, patient needs, and community expectations.

The best tool is one that:

• Fits the organization

• Supports applicable requirements

• Examines meaningful healthcare consequences

• Is understood by the committee

• Can be applied consistently

• Allows evidence and experience to influence the score

• Can be updated as risks and capabilities change

• Produces results leadership can understand

• Leads to decisions and measurable action

The committee may decide to modify an existing tool by adding hazards, clarifying definitions, adjusting scoring instructions, or including fields for evidence, responsible departments, mitigation priorities, and corrective actions.

That can improve the assessment, provided the modifications are intentional and the scoring remains understandable.

The tool should serve the organization.

The organization should not contort its risk assessment merely to satisfy the structure of a spreadsheet someone downloaded years ago.

From Assessment to Action

Once the assessment is complete, the committee should be able to explain more than which hazards received the highest scores.

It should be able to tell leadership:

• Why those hazards matter

• What consequences are most concerning

• Where preparedness gaps exist

• Which capabilities need to be strengthened

• What resources may be required

• What should be trained or exercised

• What mitigation actions should be prioritized

• How progress will be monitored

That is the standard by which the tool should ultimately be judged.

Did it help the hospital better understand its risk?

Did it uncover assumptions or vulnerabilities?

Did it produce more focused plans, training, exercises, investments, and leadership decisions?

Did it change what the organization will do next?

The right people create the discussion.

The right tool gives that discussion structure.

But the final score is not the destination.

It is the point where the hospital decides what to improve.

Because if the HVA never changes what the organization plans, tests, purchases, strengthens, or prioritizes, then the tool has become little more than a calculator wearing a wizard hat.

2026 HVA Workbook.xlsx

Download XLSX • 55KB