Hazard Vulnerability Analysis Template (HVA)

By Megan Dahlin, CARF Joint Commission Accreditation & Licensing Expert

A hazard vulnerability analysis template (HVA) is not a generic emergency-planning worksheet. For a behavioral health organization, it is a leadership record of the events most likely to disrupt care, place people at risk, interrupt operations, or draw regulatory scrutiny. When an organization cannot show a current, organization-specific HVA, its emergency planning often appears disconnected from the risks it actually faces.

This form framework is based on Joint Commission Emergency Management standard EM.02.01.01, Element of Performance 1, which requires the organization to conduct a hazard vulnerability analysis to identify potential emergencies affecting demand for services or the organization’s ability to provide services. The HVA should reflect the actual program, setting, location, population served, staffing model, and operational dependencies.

Use the framework below to determine whether your organization has the right HVA components documented. It identifies required fields and leadership review points. It does not provide completed risk ratings, emergency procedures, or policy language.

Why an HVA Matters Before an Emergency Occurs

A weak HVA usually fails in one of two ways. It is either copied from another provider and contains risks that do not fit the organization, or it is so broad that it cannot support meaningful emergency planning decisions. Neither approach gives leadership a reliable basis for prioritizing resources, testing plans, or explaining preparedness decisions during a survey, audit, or investigation.

Behavioral health and substance use treatment settings have risk patterns that differ from office-based or general healthcare operations. A power outage may affect controlled access, electronic documentation, communications, medication storage, refrigeration, food service, and the ability to maintain a safe care environment. A staffing disruption can affect supervision levels, intake capacity, transportation, discharge coordination, and continuity of services. A localized public safety event may create both a facility-security concern and a sudden increase in demand.

The goal is not to predict every possible event. The goal is to establish a defensible, leadership-approved assessment of the hazards that matter most to your organization.

Hazard Vulnerability Analysis Template (HVA) Framework

The following sections belong in an HVA form or supporting workbook. Each section should have a clear owner, review date, and version control information. If the document cannot show who reviewed it and when, it will be difficult to establish that it reflects current operations.

1. Document Control and Organization Profile

Use this section to identify the assessment and the operational context being evaluated.

Required fields:

• Organization legal name
• Program or service line covered
• Physical location or locations covered
• Assessment period
• Date completed
• Date approved
• Next scheduled review date
• HVA owner or responsible department
• Executive approver
• Version number
• Significant operational changes since the prior HVA

The scope matters. A multi-site operator may use one enterprise-level structure, but each location may face different utility reliability, weather exposure, transportation barriers, security conditions, and community response capabilities. A corporate HVA that does not account for location-level realities may not be sufficient for site-specific decision-making.

2. Hazard Inventory

The inventory is the list of hazards evaluated. Do not limit the list to weather events. The HVA should reflect natural, technological, human-caused, infrastructure, and operational threats relevant to the organization.

Required fields for each hazard:

• Hazard name
• Hazard category
• Internal, external, or combined source
• Location or program affected
• Basis for inclusion
• Relevant historical occurrence, if applicable
• Current risk status
• Notes or assumptions

Common categories may include severe weather, fire, utility failure, cyber disruption, infectious disease surge, workplace violence, missing person events, transportation interruption, supply disruption, water interruption, building damage, community emergency, and staffing shortage. The right inventory depends on the organization. Listing a risk simply because it appears on a borrowed template can create noise rather than clarity.

3. Risk Rating Fields

The HVA needs a consistent rating structure so leadership can compare hazards and identify priorities. A scoring model is only useful when the terms are defined and used consistently across the assessment.

Required rating fields:

• Likelihood of occurrence
• Potential impact on life safety
• Potential impact on client care and supervision
• Potential impact on operations
• Potential impact on workforce availability
• Potential impact on facilities and utilities
• Potential impact on communications and technology
• Potential impact on reputation or regulatory standing
• Existing preparedness level
• Overall priority rating

The organization should retain the rating scale definitions used during review. For example, a high impact score should mean the same thing whether leadership is considering a prolonged power interruption or a facility access issue. Without defined scales, risk rankings become subjective and difficult to defend.

4. Existing Capabilities and Dependencies

This section records what the organization currently relies on during a disruption. It is not a place to describe emergency procedures in full. Instead, it should identify the capabilities, vendors, systems, and dependencies leadership considered when rating a hazard.

Required fields:

• Existing internal capability
• External dependency
• Critical vendor or service dependency
• Alternate resource availability
• Known limitation or vulnerability
• Documentation source
• Responsible leader

For behavioral health providers, dependencies often extend beyond the building itself. Consider communications platforms, electronic health record access, transportation arrangements, pharmacy services, food services, contracted security, laboratory relationships where applicable, utilities, and staffing agencies. If a critical dependency is not visible in the HVA, leadership may underestimate how quickly an incident could affect service continuity.

5. Priority Hazard Review

A complete HVA distinguishes between the full hazard inventory and the hazards that require elevated leadership attention. This is the section that connects the assessment to executive oversight.

Required fields:

• Priority hazard designation
• Final risk rating
• Reason for priority status
• Executive review date
• Governing body review date, if applicable
• Related emergency management document reference
• Training or exercise relevance
• Unresolved decision or resource consideration

A priority hazard does not automatically mean the organization has failed to prepare. It means the hazard has a level of likelihood, impact, or operational consequence that warrants documented attention. The distinction matters when leaders are allocating limited resources across multiple sites or programs.

Leadership Review Questions

Before approving the HVA, executive and compliance leaders should be able to answer the following questions clearly:

1. Does the assessment address the actual physical sites, services, and operating hours of the organization?
2. Are the highest-ranked hazards supported by a documented rationale rather than assumptions?
3. Does the HVA identify dependencies that could interrupt care, safety, communications, or staffing?
4. Can leadership explain why certain risks were ranked lower than others?
5. Is there evidence that the assessment was reviewed after a significant operational, environmental, or community change?
6. Do emergency management documents, drills, and leadership discussions align with the priority hazards identified?

If the answer to any of these questions is unclear, the organization may have an HVA document without a reliable HVA process.

Common Documentation Gaps

The most frequent gap is an HVA that has no visible connection to the organization’s emergency planning materials. The assessment identifies priority risks, but the related plans, exercises, training records, and leadership reviews do not reflect those priorities. Surveyors and regulators often look for this consistency.

Another common issue is stale information. A facility may have relocated, added beds, changed service hours, expanded transportation, changed its electronic systems, or revised its staffing model while continuing to use an older HVA. The document may still look complete, but its assumptions no longer match operations.

Finally, some organizations use a single score without recording the factors behind it. A final number is less useful than a record showing whether a hazard was elevated because of life-safety impact, limited staffing coverage, community conditions, or dependence on a single vendor.

When a Review Is Worth Escalating

An HVA deserves immediate leadership attention when operations have changed materially, a serious incident has exposed an unrecognized vulnerability, a site has received regulatory findings related to emergency readiness, or the organization cannot connect its risk assessment to current emergency management records.

Continued Compliance helps behavioral health operators evaluate documentation gaps, readiness exposure, and regulatory risk before those gaps become a larger operational problem. If your HVA review shows uncertainty, contact our team for a focused assessment of your current readiness position.

The strongest HVA is not the longest spreadsheet. It is the one leadership can explain, support with records, and use when conditions change.

This content is provided for general informational purposes only and should not be construed as medical, clinical, legal, financial, tax, accounting, insurance, licensing, accreditation, regulatory, billing, employment, or compliance advice. Requirements change often. Consult qualified professionals or contact Continued Compliance, Inc. for guidance specific to your situation. This article was created by the compliance expert cited above and reviewed by AI. A compliance expert approved and edited it for accuracy before publication.