Martyn’s Law, formally the Terrorism (Protection of Premises) Act 2025, changes how publicly accessible premises prepare for terrorist incidents. For healthcare, that matters because hospitals are not like ordinary venues.
For the latest position on commencement, tiers, and practical preparation, read Martyn’s Law Is Here: What Does It Mean for NHS Security Teams?. The Act is on the statute book but is not yet in force; commencement is currently expected in spring 2027.
You cannot simply close the doors and move everyone out.
Some patients may be in theatre, critical care, dialysis, maternity, or other areas where movement is difficult or unsafe. Hospitals are also open, busy places with staff, patients, visitors, contractors, and emergency services moving through them all day.
That means preparedness cannot stop at paperwork.
The useful question is not only, “Do we have a plan?”
It is, “Can people put that plan into practice under pressure?”
Why healthcare is different
Hospitals have to balance security with clinical care. Entrances, A&E waiting rooms, corridors, cafes, car parks, wards, and public reception areas all create different risks and different practical problems.
In many workplaces, an evacuation plan can assume that most people can leave quickly. Healthcare cannot always make that assumption.
That is why training matters. Staff need to understand what their role is, how to report concerns, how to follow instructions, and how to keep communication clear when the situation is uncertain.
Standard duty and enhanced duty
Martyn’s Law uses a tiered approach. In broad terms, premises expected to have 200 to 799 individuals present fall under the standard duty, while larger premises and qualifying events may fall under enhanced duty requirements.
For healthcare, that may mean different sites have different obligations. A community hospital, outpatient hub, urgent treatment centre, or larger clinic may not have the same requirements as a major acute hospital.
But the practical principle is the same across both tiers:
People need to know what to do before something happens.
Standard duty is likely to put emphasis on awareness, reporting concerns, communication, and procedures such as lockdown or evacuation. Enhanced duty goes further, including more formal planning, testing, and review.
Either way, the plan only works if people understand it.
Training is where the law becomes real
Policies do not protect people on their own.
People protect people.
Training is what turns a written procedure into action. Healthcare security officers, receptionists, porters, nurses, estates teams, cleaners, and volunteers may all notice something before a manager or security supervisor does.
That concern might be an unattended bag, someone testing doors, a visitor in a restricted area, unusual behaviour, or a vehicle parked somewhere it should not be.
Most concerns will turn out to be innocent.
Good training gives staff the confidence to notice, report, and respond calmly without creating panic. The aim is preparedness, not paranoia.
Security teams need scenario practice
Healthcare security teams need more than a short awareness briefing. They need to understand local procedures and practise realistic decisions.
That includes lockdown arrangements, suspicious item protocols, radio communication, escalation routes, police liaison, protecting scenes, supporting clinical areas, and managing frightened or distressed members of the public.
Scenario-based exercises are especially useful because they test whether plans make sense on a real site.
A suspicious package near A&E. Ambulances still arriving. Relatives becoming distressed. Conflicting information coming over the radio.
What happens next?
That kind of scenario reveals gaps that a policy document may hide.
Everyone else needs simple messages
Martyn’s Law should not sit only with the security department.
Most staff do not need to become counter-terrorism specialists. They do need simple, memorable actions.
Notice. Report. Follow instructions. Help keep people calm.
Simple messages are easier to remember at 3am on a busy shift than a complicated procedure hidden in a folder.
This is also where communication skills matter. In a tense situation, staff may need to give clear instructions, explain what is happening, or keep people calm. The same principles behind practical de-escalation language still apply: stay clear, stay calm, and avoid making the situation harder than it already is.
Testing should find weaknesses early
A plan that has never been exercised is still partly theoretical.
Testing does not always need to mean a large live exercise. It can include tabletop scenarios, lockdown walk-throughs, communication checks, emergency contact reviews, or short department briefings.
The purpose is not to catch people out.
It is to find weak points before a real incident does.
Reports and debriefs matter here too. If a test reveals a problem, that learning needs to be recorded clearly enough that someone can act on it. The same basic habits from good incident report writing apply: facts, actions, outcomes, and follow-up.
Avoid the tick-box trap
The biggest risk is treating Martyn’s Law as another compliance folder.
Healthcare security already deals with violence and aggression, missing patients, unauthorised access, safeguarding concerns, domestic incidents, staff safety, and emergency planning.
Martyn’s Law should connect with that existing work, not sit separately from it.
A site that has a policy but no practical training may still struggle when people are under pressure. A site that trains, tests, learns, and improves is in a much better position.
Where healthcare sites can start
A practical starting point is to ask:
- Which sites fall under standard or enhanced duty?
- Which public areas and vulnerable locations need attention?
- Are lockdown and communication procedures clear?
- Who owns Martyn’s Law preparation locally?
- Have security teams practised realistic scenarios?
- Do non-security staff know how to notice and report concerns?
- Are exercises reviewed and improved afterwards?
The framework matters. But the framework is not the finish line.
Training is what makes it usable.
When something serious happens, staff will not reach for legislation first. They will rely on their training, their communication, and the people around them.
In healthcare, where patients cannot simply walk away from danger, that preparation matters.
For official information, see the GOV.UK collection on the Terrorism (Protection of Premises) Act 2025.
