Martyn's Law for hospitals and healthcare
Last reviewed:
If you manage a hospital or healthcare premises, Martyn's Law will very likely apply to you at any real scale, while smaller practices are often a different story. This guide sets out what the law expects of a site like yours, who's responsible for meeting it, and how that sits alongside your existing emergency planning.
Standard and enhanced tier for a healthcare site
Before working out where your site fits, it helps to understand how the law categorises premises and what those categories demand. Martyn's Law places public premises into two main tiers based strictly on maximum expected headcount, including inpatients, staff, outpatients and visitors together.
Standard tier (200–799 people)
- What it means: focuses on simple, low-cost preparedness.
- Key requirement: you must notify the regulator and maintain basic procedures for four emergency responses (evacuation, invacuation, lockdown and communication).
- Implications: no mandatory paid training, expensive security upgrades, or heavy documentation are required.
Enhanced tier (800+ people)
- What it means: asks more of high-capacity premises, because of the larger potential impact of an incident.
- Key requirement: includes all standard tier duties, plus formal requirements like a documented vulnerability assessment, a designated senior responsible individual, and measures designed to reduce the premises' vulnerability.
Larger acute trusts frequently reach this tier once wards, outpatient clinics and visiting hours are counted together. Smaller practices, a GP surgery, a local clinic, are a different story, and often stay comfortably under 200.
How to tell if your hospital or healthcare premises needs a plan for Martyn's Law
Healthcare premises fall under the Act's health care category.
Your tier depends on the headcount you can reasonably expect at once, including predictable spikes like overlapping visiting hours, defined in the guidance as occurring "from time to time." That number must include inpatients, staff on shift, outpatients attending appointments, and visitors, counted honestly rather than just staff on the clock.
Below are some examples to help illustrate this:
- Site A (out of scope). A small GP surgery with a handful of consulting rooms and a waiting area, patients, staff and visitors together, sits well under 200 even at its busiest.
- Site B (standard or enhanced tier, general hospital). A general hospital with wards, staff, outpatient clinics and visiting hours overlapping reaches several hundred people quickly, commonly standard tier and often enhanced tier for larger acute sites.
- Site C (group of buildings). A hospital trust operating fourteen buildings across one site is treated as a single group of buildings under common control, one premises, one responsible person, rather than assessed building by building (para 4.9).
To double check whether your site comes under the scope of Martyn's Law, use our free checker.
Who is the "responsible person"?
Someone has to be legally on the hook for getting this done. The law calls that person the responsible person, and it sits with the NHS trust or board, or the private operator, in control of the premises, following the same control test used everywhere else, not a fixed rule about trusts versus individual sites.
Genuinely separately controlled sites within a larger trust may be assessed individually instead. Health is a devolved matter, but Martyn's Law itself applies uniformly across all four UK nations. See Martyn's Law across the UK's four nations.
See who the responsible person is for the full control test.
What you must do (standard tier)
If you're in the standard tier, compliance requires two primary actions:
- Register your site with the Security Industry Authority
(SIA), the law's regulator.
- This is a simple registration, not an application process.
- There's no fee and no approval process to wait for. The SIA portal isn't open yet, so no action is required until it launches.
- Prepare four core emergency procedures. You must
establish basic, practical procedures for four scenarios:
- Evacuation. Getting people out of the building safely.
- Invacuation. Moving people to safe spaces inside the building.
- Lockdown. Securing doors to keep an external threat out.
- Communication. Quickly telling patients, staff and visitors what to do.
Hospital challenge: you can't simply evacuate an ICU or a ward full of patients who can't be moved quickly, so in practice invacuation and lockdown tend to dominate over evacuation, securing and protecting people in place rather than getting everyone out. This duty sits alongside, but isn't the same as, existing NHS emergency preparedness, resilience and response (EPRR) planning. A terrorism-specific procedure needs to exist within that broader framework, not be assumed to already be covered by it.
What you do not have to do (standard tier)
A lot of the worry around Martyn's Law comes from assuming it means extra CCTV, an expensive consultant, or mandatory training courses on top of existing clinical procedure. None of that is required at the standard tier.
- You do not need a written plan by law, though the guidance recommends one, since it's hard to demonstrate compliance without it (para 7.32). See what para 7.32 actually says.
- You do not need to install additional CCTV specifically because of this Act. See what Martyn's Law actually requires on security kit.
- You do not need paid or accredited training; using a third-party product or service is never mandatory (para 6.7).
- You do not need a fixed review schedule; periodic review is good practice, not a legal requirement.
- You do not need a risk assessment document or a designated senior individual at the standard tier. Those apply only at the enhanced tier.
How to get Martyn's Law ready in minutes
If you're in scope for the standard tier, every duty above can be worked out and written down by hand, for free. It's perfectly possible, and we'd rather tell you that straight than fear-monger you into hiring a consultant or buying a tool you don't need.
The part that takes time is applying the guidance to your actual site and existing emergency arrangements without duplicating or contradicting established clinical procedure.
That's what Martyn's Law Plan was built to solve. It's a short questionnaire that turns your answers into a plan written around your actual site, rather than a generic document that clashes with what your teams already do. Above all, it gives you peace of mind that you're prepared for when an inspection comes.
For now, start with the free tier checker, no email required, to confirm where you stand.
Similar venues: offices and schools, nurseries and education settings.
Common questions
Is a small GP surgery in scope?
Usually not. A typical GP surgery or small clinic, a handful of consulting rooms, a waiting area, sits well under the 200-person threshold even at its busiest, patients, staff and visitors together. Scope becomes a live question at the scale of a hospital or a larger healthcare campus, not a neighbourhood practice.
Is Martyn's Law assessed at trust level or hospital-site level?
It follows control, the same test as everywhere else, not a fixed rule about trusts versus sites. The guidance's own example is a hospital trust operating fourteen buildings across a site, assessed together as one group of buildings under common control, one premises, one responsible person. Where sites or buildings are genuinely separately controlled, they may be assessed individually instead.
Do our existing NHS emergency preparedness plans already satisfy this?
Not automatically. Martyn's Law is a separate legal duty, and existing emergency preparedness, resilience and response (EPRR) planning is a good foundation to build from, but the Act specifically requires procedures addressing a terrorist attack, not general emergency planning. Worth checking your existing plans explicitly cover that scenario, rather than assuming broader emergency arrangements automatically extend to it.
About this guide. Written by the Martyn's Law Plan team, based on the statutory guidance published under the Terrorism (Protection of Premises) Act 2025. Last reviewed: . Read the official guidance on GOV.UK.
Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.