Hazard vulnerability analysis (HVA) for behavioral health programs

Who requires an HVA

Who	What they ask for	Applies to
The Joint Commission	An all-hazards hazard vulnerability analysis (EM.11.01.01) covering natural, human-caused and technological hazards, hazardous materials and emerging infectious diseases, with the hazards prioritized. The prioritized hazards then feed the communications and staffing plans. The Emergency Management chapter was rewritten for behavioral health care and human services organizations effective July 1, 2025.	Accredited behavioral health programs, outpatient and residential
CMS	An emergency plan "based on and include[ing] a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach," reviewed and updated at least every 2 years (42 CFR 485.920).	Medicare-certified community mental health centers (Medicare partial hospitalization is furnished by hospitals and CMHCs)
CARF	Written emergency procedures, tested with unannounced drills and analyzed in writing, in the health and safety section (1.H). An HVA is the usual way to show which emergencies you planned for.	CARF-accredited programs
Texas HHSC	Written procedures for medical and psychiatric emergencies, with staff trained (26 TAC 564.707). We found no separate HVA rule for outpatient chemical dependency programs; residential programs also have evacuation and drill rules (564.1203).	Licensed Texas chemical dependency treatment facilities

Even where no one requires it, an HVA is a short, honest way to decide where the next dollar of preparation goes. A one-site outpatient program can do a good one in an afternoon.

How to score a hazard

No accreditor we know of prescribes a single format, and ASPR TRACIE (part of HHS) publishes a comparison of several HVA tools, including the widely copied hospital tool from Kaiser Permanente. Hospital tools have dozens of columns. For a behavioral health program, three ratings per hazard are enough, each from 0 to 3:

Rating	The question	0	3
Likelihood	How likely is this at this site in the next year or two?	Not realistic here	Expected, or it has happened recently
Impact	If it happens, how badly does it hurt people and services (injuries, closing, lost records, clients without care)?	No real effect	People hurt or the program closed for days
Preparedness	How ready are we today: a written plan, trained staff, supplies, a backup, a recent drill?	Nothing in place	Planned, equipped and drilled

We combine them as score = likelihood × (impact + 3 − preparedness), so a hazard scores from 0 to 18. Preparedness lowers the score but never erases a likely, severe hazard, and a hazard you can't imagine happening (likelihood 0) scores 0 however bad it would be. It's one simple method, not a required formula; what matters is that you use the same method every year so the scores can be compared.

The worksheet

Rate each hazard 0 (none) to 3 (high). Scores of 10 or more are shown in red. Nothing you enter leaves this page. Use Load the example to see the made-up program below, or Print for a paper copy to sign.

Signed by: ______________________ (leadership)   Date: ____________   Reviewed with county emergency management or community partners: yes / no

A worked example

A made-up program, not a real one: an outpatient IOP in a one-story leased office near the Texas Gulf Coast, with day and evening groups, naloxone on site, no generator, and a landlord who maintains the building systems. Its leadership scored the year like this:

Hazard	Type	L	I	P	Score
Hurricane / tropical storm	Natural	3	3	2	12
Flooding	Natural	2	3	2	8
Tornado / severe thunderstorm	Natural	2	2	2	6
Extreme heat	Natural	3	1	2	6
Winter storm / freeze	Natural	2	2	1	8
Building fire	Technological	1	3	3	3
Power outage	Technological	3	2	1	12
Water outage / boil notice	Technological	2	1	2	4
Phone, internet or EHR outage / cyberattack	Technological	2	3	1	10
Workplace violence / active threat	Human-caused	1	3	1	5
Overdose or medical emergency on site	Human / medical	3	3	3	9
Infectious disease outbreak	Emerging infectious disease	2	2	2	6
Hazardous materials spill nearby	Hazardous materials	1	2	1	4
Bomb threat	Human-caused	1	2	1	4
Sudden loss of staff	Human-caused	2	2	1	8

How to read it:

• Hurricane and power outage tie at 12. Both are likely on the coast; the hurricane wins the tie on impact. The program has a closing plan for storms (preparedness 2) but no generator and no written plan for a multi-day outage (preparedness 1).
• The phone, internet or EHR outage is third (10). A ransomware attack or a cut fiber line stops scheduling, notes and billing at once, and nobody had tried restoring from backup.
• An overdose on site is likely (3) and severe (3) but scores 9, because the program is well prepared: naloxone checked monthly, staff trained, a drill done this year. Preparedness is doing its job. It stays on the drill list so it stays that way.
• A building fire scores only 3 because the program drills quarterly and the building has sprinklers. Fire drills still happen; they're required regardless (see fire drill requirements).

What the example program did with it: added a power-outage annex and a downtime (paper) packet to its plan, scheduled a test restore of its backups, ran a hurricane tabletop in May before the season (the Atlantic hurricane season runs June 1 to November 30), and set its next live exercise as a power failure during an evening group.

Where the ratings come from

Ratings are judgment, but they should be informed judgment. Before the meeting, gather:

• Your county's risk profile. FEMA's National Risk Index rates natural hazards (hurricane, riverine flooding, tornado, heat wave, winter weather and more) by county and census tract.
• Your county or city emergency management office. Its hazard mitigation plan names the local hazards, and the CMS rule's "community-based" language is a reminder to compare notes. In Texas, the Texas Division of Emergency Management lists regional and local contacts.
• Your own history. Incident reports, past closures, utility outages, the times the phones or the EHR went down.
• The building. Ask the landlord about flooding history, the fire alarm and sprinkler service, and what happens to the HVAC in a freeze.
• Your vendors. What your EHR, phone and internet providers promise in an outage, and how you'd reach clients if they fail.

From the HVA to the plan and the drills

An HVA that sits in a binder does nothing. It earns its place three ways:

1. The plan. Each of the top hazards gets a section in the emergency operations plan: who decides, how clients and staff are told, how services continue. The Joint Commission's rewritten chapter ties the communications and staffing plans to the prioritized hazards.
2. The exercises. Pick drill and tabletop scenarios from the top of the list, and rotate them. A program that only ever drills fire hasn't tested its biggest risks.
3. The budget. A low preparedness score on a likely hazard is a spending decision: a battery backup for the network, a second internet line, a stocked go-bag, a training session.

Then re-score next year, after real events and drill critiques have shown you where you were wrong. Comply ties the three together: the HVA, the yearly plan review and the exercises every six months are linked tasks in the compliance calendar.

Mistakes that make an HVA useless

• Copying a hospital's HVA. Mass-casualty surge, decontamination and generator fuel rows don't fit an outpatient office. Use hazards that fit your building and services.
• Scoring everything 3. If every hazard is top priority, none is. Force a ranking.
• Leaving out the human hazards. For a substance use program, an overdose on site, an agitated client or visitor, and a sudden loss of key staff are often more likely than any storm.
• Forgetting the technology. Phone, internet and EHR outages, and cyberattacks, belong on every list now.
• No signature and no date. Surveyors want to see that leadership reviewed it, usually in the quality committee minutes.
• Never updating it. A move, a new service, a new building or a real emergency all mean re-scoring, not waiting for the anniversary.

How Comply handles the HVA

The HVA is a yearly task in Comply and one of the first things it schedules for a new program. The worksheet has the 15 hazards in the table above; hurricane and tornado rows appear when your setup says they're possible, and Comply suggests both from your state. For each hazard you rate likelihood, impact on people and services, and preparedness from 0 to 3, then name the top 3 hazards (required), confirm whether you reviewed it with community partners or the county plan, and attach the leadership signature. It's due a year after the last one, shown 60 days ahead, and it's filed in the survey binder under Emergency Management next to the plan review and the exercises. See it on a made-up program in the Comply tour.

Questions

How often should a hazard vulnerability analysis be updated?

At least every year, and whenever something big changes: a move, a new building or service, or a real emergency that showed your ratings were wrong. CMS asks Medicare-certified community mental health centers to review and update the plan and its risk assessment at least every 2 years; most accredited programs do it yearly.

Does an outpatient behavioral health program need an HVA?

If it's accredited by the Joint Commission, yes: the Emergency Management chapter for behavioral health care and human services applies to outpatient programs. It's also the basis of the risk assessment CMS requires of community mental health centers. For other programs, it's the simplest way to decide what your emergency plan should cover.

Is there a required HVA template?

Not one we know of. Use a method that rates likelihood, impact and preparedness, ranks the hazards, and is used the same way every year. ASPR TRACIE compares several free tools; the worksheet on this page is a short version built for behavioral health.

Who should be in the room?

The program director or owner, whoever runs operations and the building, a clinical lead, and someone who knows your technology. Share the result with the landlord and, if you can, the county emergency management office.

Is the HVA the same as the HIPAA security risk analysis?

No. The HIPAA risk analysis (45 CFR 164.308) is about threats to electronic health information. The HVA is about emergencies that threaten people and services. A cyberattack appears on both, so let them inform each other.

Part of the same set: the emergency operations plan guide, environment of care rounds, the ligature risk assessment, incident reporting and the Texas HHSC inspection checklist. For the full survey picture, see the Joint Commission checklist's Emergency Management section. Opening a program? Cima Consulting's program launch with accreditation includes the environment-of-care and emergency plans.

Sources

• The Joint Commission, R3 Report Issue 49: New and revised Emergency Management standards for behavioral health care and human services (effective July 1, 2025; EM.11.01.01 all-hazards HVA) and EM chapter revised (Joint Commission Online, January 22, 2025).
• 42 CFR 485.920, community mental health centers: emergency preparedness; ASPR TRACIE, CMS emergency preparedness rule: CMHC requirements.
• ASPR TRACIE, Hazard vulnerability / risk assessment topic collection and evaluation of HVA tools.
• FEMA, National Risk Index; Texas Division of Emergency Management; NOAA National Hurricane Center (Atlantic season June 1 to November 30).
• 26 Tex. Admin. Code chapter 564 (564.707 emergencies; 564.1203 residential evacuation).

The example program and its scores are made up. This guide is general information, not legal or emergency-management advice. Comply isn't affiliated with or endorsed by The Joint Commission, CARF, CMS or FEMA.