NFPA 3000, Standard for an Active Shooter/Hostile Event Response (ASHER), was published in April 2018. It was issued as a provisional standard (PS), which means that the development of this standard was expedited due to the increased frequency and severity of active shooter events since 1999 and the fact that there was no standard program in existence.

NFPA, in section 3.3.5 of the document, defines an ASHER program as:

“A community-based approach to preparedness, mitigation, response, and recovery from an ASHER incident, including public and private partnerships, emergency management, the medical community, emergency responders, and the public.”

Therefore, although hospitals are addressed in this standard, hospitals are not its focus. Much of the information is geared to law enforcement, EMS, and others.

But, healthcare organizations do have roles in the process. Chapter 9 of the document addresses the hospital as the location of the active shooter event. Compliance with this chapter will be required of hospitals only if the community adopts NFPA 3000 as its model for response to such an event. In this case, considerations will include the following:

  • Determination of the number of occupants
  • The ability of occupants to evacuate, relocated within the building, or stay in place (mobility considerations)
  • Staff response, including recognition of and reaction to the event
  • Occupant notification
  • Procedures to include:
    • Evacuation, relocation, etc.
    • Location and identification of lockable spaces
    • Location of exits to the outside and their identification
    • NFPA 101-compliant process to lock doors from inside and unlock from outside
    • Communications plans
    • Alert and warning plans, with timely notification
    • Personal training
    • Medical actions
  • Plans must be available to the AHJ (authority having jurisdiction)
  • Facility assessment
  • Annual exercises

Chapter 19 addresses the hospital’s preparedness to receive victims. Bear in mind that not all organizations designated as “hospitals” will be expected to receive victims, and these will include specialty hospitals without emergency departments. 

The requirements for hospitals that receive victims are very similar to The Joint Commission and CMS requirements for emergency management overall and for a mass casualty incident in particular. The expectation is that plans will be integrated with those of and tested in conjunction with the AHJ. Patient distribution is determined by the AHJ, but the hospital must also prepare for spontaneous arrivals.

More specific requirements include:

  • At least two means of communication with public safety entities, tested monthly
  • A dedicated hospital staff member to communicate with patient distribution coordinators
  • Victim identification shared with AHJ
  • Rapid screening of the hospital facility for devices and weapons upon notification of an event in or near the hospital

Use of HICS (Hospital Incident Command System) and activation of the command center is required.

Please consult NFPA 3000, Standard for an Active Shooter/Hostile Event Response (ASHER), for complete requirements. This document can be read in its entirety or purchased at

Supplemental information is available in the annexes to both chapters 9 and 19.