Ligature Risk Assessment: CMS Expectations and How to Run One

A ligature risk is any feature of the physical environment that a patient could use to attach a cord, rope, bedsheet or other material for the purpose of self-strangulation. A ligature risk assessment is the structured process a hospital uses to find those features, decide which ones matter given the patients actually cared for in that space, and document what it did about them.

The single most common mistake in this area is treating it as a construction problem. CMS’s current guidance says the opposite — explicitly, and with an example. This guide sets out what the federal requirement actually is, what CMS expects a hospital to be able to demonstrate, and how to run an assessment that survives a survey.

The regulatory basis: care in a safe setting

There is no CMS regulation about ligature points. The obligation runs through the Patient’s Rights Condition of Participation at 42 CFR 482.13(c)(2): “The patient has the right to receive care in a safe setting.”

QSO-23-19 explains how CMS reads that sentence:

“The intention of this requirement is to specify that each patient receives care in an environment that a reasonable person similarly situated as the patient would consider to be safe. Additionally, this standard is intended to provide protection for the patient’s emotional health and safety as well as his/her physical safety. Respect, dignity, and comfort would also be components of an emotionally safe environment.”

Two things follow. First, the standard is a reasonable person similarly situated as the patient test — it is patient-relative, not absolute. Second, CMS is explicit that ligature-related deficiencies are not confined to one tag: “Patient safety issues related to ligature risks identified should be cited at the appropriate CoPs (for example, Patient Rights, Physical Environment, Nursing Services, QAPI, etc.) depending on the specific types of non-compliance identified.” A ligature finding can land as a nursing deficiency or a QAPI deficiency rather than an environment one.

The central determination: patient-matched environment, not universal hardening

This is the paragraph that should drive your programme, quoted from the memorandum’s background section:

“The focus of ligature risk management should be to place patients in an environment, with appropriate monitoring, reflective of their specific medical and psychiatric needs. Based on their clinical evaluation, some patients may require both a more restrictive environment and an increased level of monitoring than other patients. Therefore, it is not expected that hospitals have the same ligature risk configuration throughout their facility, but rather focus on the specific needs and risks of individual patients, based on their clinical or psychiatric assessment.”

CMS then gives a worked example of the corrective-action error it wants to stop:

“For example, the attempted use of a door as a ligature point does not mean all patient doors in the hospital need to be replaced. Instead, surveyors should investigate further to determine whether the failure could have been the result of something more basic to safe patient care, such as insufficient monitoring and/or patient assessment and evaluation. All contributing factors should be considered before corrective action is initiated.”

This reframes the whole exercise. The determination is not “is this a ligature point?” — almost every feature of a hospital room is, given enough intent and time. The determination is “is the environment in which this patient is being cared for, combined with the level of monitoring being applied, appropriate to the risk this patient presents?” Environment and monitoring are substitutes for one another within limits, and the assessment has to consider both together.

The three elements CMS expects

QSO-23-19 states: “Hospitals should consider three main elements in ensuring patient safety related to ligature risks.” They are, in the memorandum’s order:

1. Patient assessment

CMS’s position on screening tools is direct and frequently misquoted: “CMS does not endorse nor require the use of any particular tool.” The memorandum continues that the screening or assessment tool used “should be appropriate to the patient population served, care setting, and staff competency,” and that hospitals should implement a strategy appropriate to the population — giving the example that a strategy suitable for a post-partum unit “would most likely not be the same” as one used in the emergency department.

Where CMS does set expectations about who gets screened:

• “All patients in psychiatric hospitals and psychiatric units should be screened for suicidal ideation in order to ensure patient safety.”
• “In acute care hospitals, patients being evaluated and treated for behavioral health conditions as their primary reason for care should be screened for suicidal ideation.”
• “Hospital policy should address any other circumstances where suicidal screening is required.”

That third bullet is where hospitals have real discretion and real exposure. CMS delegates the boundary of universal versus targeted screening to hospital policy — and then measures you against the policy you wrote. A policy that is vague about which other presentations trigger screening gives a surveyor nothing to find you compliant against.

The memorandum points hospitals to the 2018 report Recommended standard care for people with suicide risk: Making health care suicide safe, issued by the National Action Alliance for Suicide Prevention’s Transforming Health Systems Initiative Work Group, as a resource “highly useful in developing the best practices for effective patient screening and assessment.” It is a recommended resource, not a mandate.

2. Staffing and monitoring

CMS expects education and training for staff on identifying patients at risk of harm to self or others, identifying environmental patient safety risk factors, and mitigation strategies. Two specifics are worth pulling out because they are checkable:

• Who counts as staff. The memorandum defines it broadly: “direct employees, volunteers, contractors, per diem staff, and any other individuals providing clinical care under arrangement.” Agency and per diem staff are frequently the gap in a training roster.
• Training timing. “CMS expects hospitals to provide education and training to all new staff initially upon orientation and whenever policies and procedures change. Additionally, CMS recommends ongoing training at least every two years after initial training.”

The distinction between expects and recommends in that passage is CMS’s own wording. Initial training at orientation and retraining on policy change are expectations; the two-year ongoing cycle is a recommendation. Hospitals may find their accreditor sets a firmer interval.

Hospitals also have flexibility here: CMS states they “have the flexibility to tailor the training to the services staff provide and the patient populations they serve.” Uniform enterprise-wide behavioural-health training for every employee is not required, and is often a poor use of the training budget compared with deeper training for the units that actually hold at-risk patients.

3. Environmental risk

The memorandum’s framing mirrors the patient-assessment element:

“Just as all hospitals should implement a patient risk assessment strategy to ensure patient safety, all hospitals should implement an environmental risk assessment strategy to provide patient care in a safe setting. Environmental risk assessment strategies may not be the same in all hospitals or hospital units. The hospital should implement environmental risk assessment strategies appropriate to the specific care environment and patient population. Risk assessments should be appropriate to each unit and should consider the possibility that the unit may sometimes care for patients at risk for the threat of harm to self or others.”

That final clause is the one most often missed. A medical-surgical unit is not exempt from environmental risk assessment because it is not a psychiatric unit — it is expected to have assessed itself against the scenario where it is boarding or holding an at-risk patient, which in practice happens on almost every med-surg floor and in every emergency department.

What counts as a risk: CMS’s own list is not limited to ligatures

The memorandum’s discussion section is broader than the title suggests. It states that although all risks cannot be eliminated, hospitals should be able to demonstrate how they identify patients at risk of self-harm or harm to others and the steps taken to minimise those risks “in accordance with nationally recognized standards and guidelines,” and lists potential risks that “include, but are not limited to”:

• ligatures
• sharps
• harmful substances
• access to medications
• breakable windows
• accessible light fixtures
• plastic bags (for suffocation)
• oxygen tubing
• bell cords

An assessment instrument that inventories anchor points and stops there is narrower than CMS’s own stated scope. Note in particular that four items on that list — harmful substances, access to medications, plastic bags and oxygen tubing — are supply and workflow issues, not building features, and are fixed by process rather than capital.

Running the assessment

CMS does not prescribe a method, so what follows is a defensible structure built from the memorandum’s three elements rather than a mandated procedure. Adapt it; do not present it to a surveyor as a federal requirement.

Step 1 — Define the scope by care environment, not by department

List every physical space where a patient could be held, including spaces that are not behavioural-health units: emergency department treatment rooms and hallway beds, med-surg rooms used for boarding, observation units, ICU, imaging suites and corridors, waiting areas, and any bathroom or shower accessible from those spaces. Bathrooms are consistently the highest-yield space and are consistently under-assessed.

Step 2 — Characterise the patient population each space actually holds

For each space, record: does this space routinely hold patients at risk of self-harm; does it occasionally hold them; and if occasionally, under what circumstances and with what monitoring? This is the step that satisfies CMS’s “may sometimes care for patients at risk” clause, and it is the step that determines whether a given anchor point is a finding or an accepted risk.

Step 3 — Inventory hazards against the full list

Walk the space and inventory against all nine of CMS’s listed risk categories, not just anchor points. Do it at the patient’s eye level and from the patient’s position — sitting on the bed, sitting on the floor, in the bathroom with the door closed. Include what is brought into the space: equipment, supply carts, linen, tubing, cords.

Step 4 — For each hazard, decide mitigation across all three elements

This is where the memorandum’s logic gets applied. For each identified hazard, the options are not only “remediate the environment.” They are:

• Eliminate — replace or remove the feature (ligature-resistant hardware, tamper-resistant fixtures).
• Restrict — control access to the space or the item (locked storage, removal of equipment when the space holds an at-risk patient).
• Monitor — increase observation level, up to continuous one-to-one observation, for patients whose assessment warrants it in that space.
• Relocate — move the patient to a space whose configuration matches their assessed risk.

CMS’s stated position that hospitals need not have the same configuration throughout the facility is what makes the last two legitimate long-term answers rather than temporary workarounds — provided the assessment and monitoring genuinely support them.

Step 5 — Document the accepted risks explicitly

Every hazard you do not eliminate becomes an accepted risk with a stated compensating control. Write down the hazard, the population held in that space, the control, who is responsible, and the review date. An undocumented accepted risk is indistinguishable from a missed one.

Step 6 — Route findings into QAPI and re-assess on change

Because CMS names QAPI as a possible citation location, the assessment output should be visible in the quality programme rather than sitting only with facilities. Re-assess on any of: renovation or equipment change; a self-harm event or near-miss; a change in the patient population a unit holds; a change in staffing model that alters monitoring capability.

Corrective action after an event

The memorandum is unusually specific about how corrective action should be reasoned, and it is the passage most useful to a hospital drafting a plan of correction. CMS directs surveyors, after an attempted use of a feature as a ligature point, to “investigate further to determine whether the failure could have been the result of something more basic to safe patient care, such as insufficient monitoring and/or patient assessment and evaluation,” and states that “all contributing factors should be considered before corrective action is initiated.”

In practice this means a plan of correction that consists solely of a capital remediation is incomplete on its own terms — it has skipped the assessment and monitoring analysis CMS expects. A defensible plan of correction addresses all three elements: what the patient assessment found or missed, what the monitoring level was and whether it was executed, and what the environment contributed. This is the same causal discipline applied in a sentinel event review, and where staff behaviour is in question, the just culture algorithm is the tool for separating system failure from individual accountability.

Ligature risk and restraint are different tools for related problems

Increasing monitoring and restricting the environment for an at-risk patient is not the same as restraining them, and the two are governed separately. Restraint and seclusion carry their own detailed federal requirements at 42 CFR 482.13(e)–(g) — order time limits by patient age, a 1-hour face-to-face evaluation for violent or self-destructive behaviour, specific training content, and death reporting to CMS.

The connection matters because a hospital with a poorly matched environment and inadequate monitoring will tend to reach for restraint as the compensating control, which is precisely the sequence 482.13(e)(2) prohibits — restraint may only be used when less restrictive interventions have been determined to be ineffective. An environmental control or a higher observation level is a less restrictive intervention.

What this page does not cover

Accrediting organisations maintain their own ligature-risk standards, environment of care requirements and suicide-prevention requirements, and these are the source of much of the detailed guidance circulating in the field — including specific expectations about ligature-resistant construction in psychiatric units and about which environments must be entirely ligature-resistant. Those standards are separate from the CMS requirement described here, are revised on their own schedule, and are not reproduced on this page. Check your accreditor’s current manual directly; do not assume a secondary summary is current.

Frequently asked questions

What regulation requires a ligature risk assessment?

No CMS regulation names ligature risk. The obligation derives from 42 CFR 482.13(c)(2), the patient’s right to receive care in a safe setting, as interpreted in CMS memorandum QSO-23-19-Hospitals (17 July 2023). Deficiencies may be cited at Patient Rights, Physical Environment, Nursing Services, QAPI or other Conditions of Participation depending on the non-compliance found.

Does every hospital room have to be ligature-resistant?

No. CMS states directly that “it is not expected that hospitals have the same ligature risk configuration throughout their facility,” and that the focus should be on placing patients in an environment, with appropriate monitoring, reflective of their specific medical and psychiatric needs.

Does CMS require a specific suicide risk screening tool?

No. QSO-23-19 states that “CMS does not endorse nor require the use of any particular tool,” and that the tool should be appropriate to the patient population served, care setting, and staff competency.

Who must be screened for suicidal ideation?

Per QSO-23-19: all patients in psychiatric hospitals and psychiatric units; in acute care hospitals, patients being evaluated and treated for behavioral health conditions as their primary reason for care. Hospital policy must address any other circumstances where screening is required.

How often must staff be retrained?

CMS expects initial training at orientation and retraining whenever policies and procedures change, and separately recommends ongoing training at least every two years after initial training. Accreditors and states may require a shorter interval.

Do non-psychiatric units need an environmental risk assessment?

Yes. CMS states that risk assessments should be appropriate to each unit and “should consider the possibility that the unit may sometimes care for patients at risk for the threat of harm to self or others” — which covers emergency departments, observation units and medical-surgical units that board at-risk patients.

Is a ligature risk assessment only about anchor points?

No. CMS’s own list of potential risks includes ligatures, sharps, harmful substances, access to medications, breakable windows, accessible light fixtures, plastic bags, oxygen tubing and bell cords, and is expressly non-exhaustive. Several of those are supply and workflow controls rather than building features.

Is the 2017 CMS ligature memo still the current guidance?

The current CMS memorandum on this subject is QSO-23-19-Hospitals, dated 17 July 2023 and effective immediately. Guidance and vendor material still citing the December 2017 clarification as current should be treated with caution.

Related reading

• Restraint and Seclusion Under the CMS Conditions of Participation
• Sentinel Event: What It Means, and What Happens Next
• Just Culture Algorithm: How Hospitals Classify Behavior After an Adverse Event
• National Patient Safety Goals and the 2026 National Performance Goals change
• EMTALA: Screening, Stabilization, and Transfer Rules
• Patient Safety & Infection Prevention