Hazard Vulnerability Assessment
HVA for Healthcare Facilities
Systematic risk evaluation for all-hazards emergency planning
What Is a Hazard Vulnerability Assessment?
A Hazard Vulnerability Assessment (HVA) is a systematic process used to evaluate the potential hazards that could affect a healthcare facility, the likelihood of those hazards occurring, and the facility's current ability to respond to and recover from them. The HVA is the foundation of any all-hazards emergency management program CMS Emergency Preparedness Rule.
Unlike a simple risk list, the HVA assigns numerical scores to each hazard across multiple dimensions — probability, human impact, property damage, business continuity, and the organization's preparedness and response capabilities. This quantitative approach allows leadership to prioritize planning efforts and allocate resources to the highest-risk scenarios rather than trying to prepare equally for everything.
An HVA should never be conducted in a vacuum. It requires a multidisciplinary team that includes facility management, nursing leadership, security, IT, clinical engineering, administration, and local emergency management partners. Each perspective brings unique insight into both the likelihood of specific hazards and the organization's preparedness gaps.
Who Requires an HVA?
Multiple regulatory bodies and accreditation organizations require healthcare facilities to perform an HVA as part of their emergency preparedness program. The requirement is not optional for any facility that participates in Medicare or Medicaid.
Annual Update Required: All regulatory bodies expect the HVA to be reviewed and updated at least annually. Additionally, it should be revisited whenever a significant event occurs (e.g., a new pandemic, a nearby industrial incident, or major facility construction) or when the community risk profile changes.
The Kaiser Model (Most Widely Used)
The Kaiser Permanente Hazard Vulnerability Analysis Tool, developed by Kaiser Permanente and later refined by John Stover, is the most widely recognized and adopted HVA methodology in healthcare. It provides a structured scoring matrix that produces a relative risk percentage for each hazard Kaiser/Stover HVA Model.
The Formula
And MITIGATION = Preparedness + Internal Response + External Response
Seven Scoring Columns
Each column is scored on a 0-3 scale. Note that the three mitigation columns use reversed scoring — a higher score means less capability, which increases risk.
Risk Percentage Bands
Five Hazard Categories
A comprehensive HVA evaluates hazards across five categories. Each category should include events specific to your geographic location, facility type, and patient population. Below are common events for each category, with emphasis on hazards relevant to Georgia healthcare facilities CMS Emergency Preparedness Rule.
Natural
Technological
Human
Hazardous Materials
Information Technology
Georgia-Specific Context
Healthcare facilities in Georgia should tailor their HVA to reflect the state's specific hazard profile. Georgia is particularly vulnerable to tornadoes, severe thunderstorms, ice storms, flooding, and extreme heat. The state averages 20-30 tornadoes annually, primarily during spring and fall, and the metro Atlanta area (including Gwinnett County) experiences significant severe thunderstorm activity GEMA/HS.
Georgia facilities should also consider ice storms (the January 2014 "Snowmageddon" paralyzed metro Atlanta), drought conditions affecting water supply, and extreme summer heat with heat index values regularly exceeding 105 degrees F. Facilities near major highways (I-85, I-285, I-20) should score hazardous materials transportation incidents higher due to proximity to freight corridors.
Conducting the HVA: Step by Step
Available HVA Tools & Resources
Several established tools and resource collections are available to help healthcare facilities conduct their HVA. The Kaiser tool remains the most widely recognized, but other options may better suit specific facility types or state requirements.
Interactive HVA Scoring Tool
Use this tool to practice scoring hazards using the Kaiser model. The tool is pre-populated with Natural Hazards relevant to Georgia. Adjust the scores and watch the risk percentage calculate automatically. You can add custom hazards and print the results.
Note: This tool demonstrates one hazard category. A complete HVA should cover all five categories (Natural, Technological, Human, HazMat, IT) with 30-50+ hazard events total.
Common Survey Findings
CMS and TJC surveyors frequently cite the following deficiencies related to HVAs during healthcare facility surveys:
References
1. CMS Emergency Preparedness Rule: 42 CFR 482.15 — Conditions of Participation for Hospitals.
2. The Joint Commission: Emergency Management (EM) Standards, EM.01.01.01.
3. NFPA 99: Health Care Facilities Code, Chapter 12 — Emergency Management.
4. NFPA 101: Life Safety Code, Chapter 12 — New Healthcare Occupancies.
5. Kaiser Permanente: Hazard and Vulnerability Analysis Tool (Kaiser/Stover Model).
6. ASPR TRACIE: Hazard Vulnerability / Risk Assessment Resources.
7. Georgia Emergency Management and Homeland Security Agency (GEMA/HS): gema.georgia.gov.
Was this article helpful?
Rate this article to help us improve
Discussion (2)
Great breakdown of the technical details. The NFPA 25 maintenance table is exactly what I needed for my ITM schedule.
Really clear explanation. Would love to see a companion video walkthrough of the inspection process.