Active Shooter / Hostile Event Response
NFPA 3000 — Standard for Active Shooter / Hostile Event Response (ASHER)

1. Pre-Event Preparation (Chapters 5–8)

• Risk assessment — identify threat vectors specific to the facility (public access, symbolic targets, ex-employees, contentious events)
• Facility design — lockdown capability on every occupied room, clear sight lines for security, ballistic-resistant materials in command areas, access control
• Staff training — Run/Hide/Fight (or adapted protocols for healthcare/K-12), situational awareness, recognizing pre-attack indicators
• Coordination with responders — pre-incident walkthroughs with local law enforcement, shared floor plans, keyed access, radio interoperability
• Communication systems — mass notification, public address override, automated outbound calling, integrated with fire alarm where permitted

2. Emergency Response (Chapters 9–10)

• Initial notification — 911, internal mass-notify, law enforcement dispatch
• Occupant action — Run / Hide / Fight or adapted facility-specific protocol
• Unified command structure — ICS-compliant Incident Command, law enforcement in operational control, fire/EMS in tactical support
• Warm zone medical response — trained medical responders entering partially-cleared areas under LE protection, delivering tourniquets and hemorrhage control to victims before full scene security
• Evacuation of unaffected occupants — once safe, staged evacuation through cleared egress paths under LE escort

3. Recovery (Chapter 12)

• Scene stabilization — transition from active response to investigation; preservation of evidence; continued medical care
• Business continuity — temporary relocation, critical function restoration, client/family communication
• Psychological first aid — immediate crisis counseling for witnesses and victims; Employee Assistance Programs; community mental health referrals
• Long-term recovery — trauma-informed leadership, anniversary planning, staff retention strategies, facility modifications post-incident

4. Family Assistance & Reunification (Chapter 13)

• Dedicated reunification site — separate from the incident scene and the hospital treating victims; typically a nearby school, church, or community center pre-identified in the plan
• Staffing — social workers, chaplains, translators, law enforcement liaisons, medical examiner representatives
• Notification protocols — structured, compassionate, honest, and only by trained personnel — never by media or social media
• Accommodation for specific populations — children requiring parent reunification, non-English-speaking families, persons with disabilities

5. Training & Exercises (Chapter 11)

• Awareness-level training for all staff at minimum annually
• Tabletop exercises for leadership and response teams every 6 months
• Functional exercises (partial activation of the response plan) annually
• Full-scale exercises (coordinated with local LE, fire, EMS) at least every 3 years
• After-Action Report (AAR) within 30 days of every exercise or actual event, with corrective-action tracking

Healthcare: the Run/Hide/Fight Order is Wrong, and We Should Say So

Every hospital break room has a Run/Hide/Fight poster. It was distributed nationally after the DHS video landed, and administrators feel obligated to display it. For a nurse standing next to a ventilated ICU patient, the Run-first instruction is dangerously misleading. That nurse cannot run. Running, by professional standards, would be abandonment of patient care. The poster on the wall and the clinical reality of the floor are in direct conflict.

NFPA 3000 Ch. 9 acknowledges this plainly, but most healthcare training programs still use the DHS language unchanged because the lawyers like how it looks in a compliance binder. That’s a mistake. If your clinical staff internalize a mental model that doesn’t match the decision they’ll actually make at the moment of crisis, you have trained them to hesitate. Hesitation is the most dangerous state a human can be in during an active assailant event.

What the hospital mental model actually is: Secure → Preserve → Fight

This is what experienced healthcare emergency managers teach once the poster comes off the wall:

• Secure — close the unit. Close the door. Use the magnetic locks, deploy the soft barricade (med cart, crash cart, mop buckets), kill the hallway lights, silence the overhead page. If you have a suite door or double-door unit entry, that’s your primary defensive line. Code Silver is the overhead call that triggers this — distinct from Code Red (fire), Code Blue (clinical), Code Gray (combative patient), because the response pattern is inverted.
• Preserve — continue patient care inside the secured space. The OR team does not walk out of an open chest. The L&D team does not leave a mother mid-delivery. The dialysis tech does not unhook a patient against protocol. Clinical staff on a defended unit preserve care within the secured perimeter until law enforcement clears the building. This is not heroism — it is what patient safety requires, and it is also what the post-event medical board will expect you to have done.
• Fight — last resort, same as everywhere else. The difference is the rest of the chain: you have already secured, you are already preserving. Fight only exists if the attacker defeats the secure step. At that point, the fight should be decisive — you are defending patients who cannot defend themselves.

Note what is missing: Run. In a clinical area, Run is not the first option. It is not the second option. In most units, it is not an option at all. The inpatient nurse, the OR tech, the NICU RN — they stay. That fact should be embedded in training, in drill scenarios, in the laminated card staff keep on the back of the badge. When you pretend otherwise, you create the conditions for post-event second-guessing, lawsuits, and moral injury.

Where Run still applies: the hospital lobby and the administrative wing

Healthcare is not one building — it is a dozen different environments under the same roof. A visitor in the atrium, a billing clerk in the HIM office, a dietitian at the cafeteria line: these people have the same Run/Hide/Fight decision tree as any other adult. The problem is when we teach the clinical care team the same protocol as the front-desk registrar. They are not the same job, and the correct action is not the same.

The fix is zone-specific training. Walk the building with the safety officer and the clinical leadership. For every occupied space, ask three questions: (1) can an adult here evacuate to a cleared exterior assembly point? (2) are there patients here who cannot be moved? (3) is there a lockable egress-compliant door between this space and a hostile entry? The answers divide the campus into Run zones and Secure-Preserve zones. Post the appropriate version on each unit’s Code Silver card, not one poster for the whole hospital.

The ethical question nobody wants to teach but everyone should

Clinical staff will, at some point during Code Silver training, ask the real question: if my patient can walk and I have a clear exit, do I leave without them? The honest answer is not in any training deck I’ve ever seen. It is something like this: your professional duty is to your patient, but your professional duty does not require you to die. If you can take the ambulatory patient with you under a safe-egress protocol, you do. If you cannot, you secure-in-place with them. If the choice is leave the patient to certain death or die with them in a shared room, the profession’s consensus — reinforced by years of mass-casualty after-action reviews — is that you preserve your own life to preserve future care for others.

This is a brutal topic and it belongs in your training because if you don’t teach it, your staff will improvise the answer in real time. Improvisation at the worst moment of a career is how good people end up with lifelong moral injury. A 90-minute facilitated discussion, once a year, with a chaplain or ethicist present, prevents more long-term damage than any of the tactical modules.

Defend-in-place engineering — what actually works on an inpatient unit

Any Code Silver program that doesn’t have the physical plant team at the table is theatre. The secure step of Secure-Preserve-Fight assumes the unit can actually be secured. That is a design question, not a training question. Minimum engineering requirements on any unit that holds non-ambulatory patients:

• Listed electrified locks on unit entry doors — released by fire alarm per NFPA 101 §7.2.1.6 and staff badge override, so a Code Silver does not create a fire-code violation during a simultaneous fire event. Never chains, never zip ties, never wooden wedges. Fire marshals will cite improvised locking in an after-action review and they should.
• Ballistic-resistant panels on nurse stations and unit doors in facilities with elevated threat profiles. NFPA 3000 Ch. 7 describes this as a design consideration; it is cheaper at construction than at renovation.
• Audible + visual mass notification distinct from fire alarm — if Code Silver and Fire Alarm use the same horn, your staff will evacuate into a hostile corridor. NFPA 72 Ch. 24 allows a separate messaging tier.
• Egress from secured units — a unit locked from the inside to keep an attacker out must still allow occupants to leave, either through a second exit (many inpatient units have this) or through listed delayed-egress hardware. Running toward a locked dead-end is worse than the original threat.
• A pre-identified ex-filtration route — if law enforcement tells you to move a unit after the threat is partially cleared, where do you go? That route should be walked twice a year with charge nurses and security leadership, not sketched on a napkin during the event.

Drill frequency: the honest numbers

NFPA 3000 §11.4 sets a floor: annual tabletop, full-scale every three years. That floor is not enough for a healthcare campus of any size, and also too much for the way most hospitals currently run drills.

• Quarterly unit-level tabletops (15 minutes) — charge nurse facilitates, one scenario card per quarter, no administrators present. This is where muscle memory for the secure step actually forms. Free, fast, no scheduling nightmare.
• Annual leadership tabletop (2 hours) — incident command, law enforcement liaison, security, communications, clinical chiefs. Run a scenario with pre-written injects. Focus on decisions, not scripts.
• Full-scale every 2–3 years — coordinated with local LE/fire/EMS. Announce it widely; unannounced full-scale drills have produced documented staff trauma and real 911 calls from confused visitors. NFPA 3000 §11 explicitly discourages unannounced exercises.
• After-Action Report within 30 days — corrective actions tracked like CMS Plan of Correction items, owner assigned, due date committed. If your AAR is still open 6 months later, the next drill is useless.

And a note on recovery: do not schedule the drill on a Monday. Run it Tuesday or Wednesday, so the facilitated debrief lands before the weekend. Staff who drilled an active-shooter scenario on a Friday have nobody to decompress with for 48 hours. The morale cost is real and it is avoidable.

K-12 Schools: ALICE / Modified Lockdown

ALICE (Alert, Lockdown, Inform, Counter, Evacuate) gives teachers and students more decision authority than strict lockdown. Informed by post-Parkland and post-Uvalde analyses, many districts now train students as young as 3rd grade to evacuate if a safe path is available rather than remaining in a classroom without door locks. Controversial but evidence-based: victim survival rates improve with proactive movement in some documented scenarios.

Very Young Children & Adults with Cognitive Disabilities

Pre-K, kindergarten, and populations with cognitive or developmental disabilities cannot follow Run/Hide/Fight independently. Plans must designate staff responsibility: teachers lock doors, turn off lights, and move children to the furthest corner; adult companions in memory-care units take a defensive position. Drilling reduces distress: announced, developmentally-appropriate drills teach children to follow the teacher\'s voice without full comprehension of the threat.

The Egress Locking Trap

Never install a lock that prevents egress during a fire in response to active shooter concerns. NFPA 101 is clear: egress must remain available during a fire emergency. Listed magnetic locks, delayed-egress hardware, and access-controlled egress are the ONLY acceptable solutions. Fire marshals will — and should — cite any chained, barricaded, or non-listed locking device that defeats egress.

1. NFPA 3000: Standard for an Active Shooter / Hostile Event Response (ASHER) Program, 2021 Edition — nfpa.org/product/nfpa-3000-standard.

2. U.S. Department of Homeland Security — Active Shooter: How to Respond.

3. FBI — Run. Hide. Fight. training materials.

4. OSHA General Duty Clause, 29 USC §654(a)(1) — workplace violence prevention.

5. The Joint Commission EM.02.02.01 and CMS 42 CFR §482.15 — Emergency Preparedness for hospitals.

6. Interagency Security Committee (ISC): Planning and Response to an Active Shooter Incident at a Federal Facility.

7. ALICE Training Institute — Alert, Lockdown, Inform, Counter, Evacuate protocol variations.