The shootings and related incidents at US hospitals in the last two months have sent shockwaves through the medical community. After entering the Saint Francis Hospital in Tulsa, Oklahoma on June 1, 2022, Michael Louis, a former patient, opened fire on both patients and staff, killing five and injuring several others. On the same day a security guard was killed in a shooting at a hospital in Ohio. Just over a month later, a hospital in Missouri was evacuated following reports of an armed man entering the building and making threats.

Such outrages serve as stark reminders of the vulnerability of these facilities, prompting risk managers nationwide to consider how best to defend their patients, staff and premises. Hospitals, and particularly urgent care centres, are designed to be welcoming and easy to access, so are soft targets for anyone so inclined. While facilities in city centres often have security guards and sometimes a police presence, once inside, virtually all areas are freely accessible, with all but the most seriously ill and vulnerable just behind curtains and unlocked doors.

On average, a security breach will cost a medical facility circa. $800,000, factoring in physical damage, procedure review, evacuation, retraining, the response by multiple agencies and addressing potential reputational and staff retention issues. However, that figure is based on a typical breach where an intruder is looking to steal pharmaceutical drugs, meaning the cost involving an active assailant is potentially several multiples of that.

Insurance clearly has a role to play in mitigating these costs and many medical facilities rely on the government scheme TRIA, yet this does not provide active assailant cover. TRIA offers a very narrow type of protection, which doesn’t even include domestic terrorism and is essentially just a treaty-based reinsurance product to reinsure insurance companies. It will also not provide cover for workplace violence, despite estimates suggesting around 50% of all non-fatal injuries occur in healthcare and social service organisations. The high incidence of this type of violence in healthcare is why it is America’s most dangerous profession to work in.

Recent events have therefore further highlighted a significant protection gap and the need for insurance cover capable of providing protection against these threats. Attacks by active assailants often occur in shopping malls or schools where most people are able bodied, yet in a medical setting the vast majority are incapacitated and unable to escape. Some medical facilities are therefore turning to specialist crisis management cover to close the gaps inherent with TRIA and non-specialist insurance policies.

Comprehensive crisis management insurance can cover damage to the hospital building, loss of revenue following an incident, liability due to bodily injury or any third-party liability a hospital might be subject to. It additionally includes defence and settlement costs from any litigation that may occur and the cost of any necessary public relations work. Some insurance providers also offer a third-party crisis management team (which could be termed second responders) to liaise with first responders. Second responders can offer a huge range of support from staff retraining and psychiatric care to finding alternative premises should a facility be badly damaged. Second responders work with the insured and any victims to get through the process of recovery but they also work to minimise the effects of active shooter events before they occur. This can include employee screening, pre-event surveys and risk management advice on areas where security could be improved to reduce the risk.

The rate at which public mass shootings occur in the US has tripled since 2011, with more than 300 taking place so far this year. Sadly, recent events have shown that medical centres are not immune from this trend, serving as unsettling reminders of their innate vulnerabilities. In reflecting on this, risk managers and insurance buyers are questioning their continued reliance on basic cover, with many concluding specialist crisis management insurance is needed to safeguard their facilities against this increasing threat.