Healthcare is one of the uses listed in Martyn’s Law. The statutory guidance published in April 2026 confirms that this includes hospitals, primary care clinics and doctor and dentist surgeries. Unlike schools and places of worship, healthcare premises get no special treatment, so a large hospital can fall into the more demanding enhanced tier.
Here is what the Terrorism (Protection of Premises) Act 2025 means for healthcare settings ahead of the duties coming into force, expected in spring 2027.
A healthcare building is in scope if it is publicly accessible and it is reasonable to expect 200 or more people to be present at the same time. The count must include staff, which the guidance defines as everyone working there, including employees, contractors and volunteers.
The responsible person must notify the Security Industry Authority (SIA) and have reasonably practicable procedures for evacuation, invacuation, lockdown and communication, and make sure staff understand them.
Enhanced tier premises must also:
Penalties for enhanced tier premises can reach £18 million or 5% of worldwide revenue, whichever is greater. See our standard vs enhanced tier guide.
Hospitals face challenges that most other premises don’t:
NHS organisations already have emergency preparedness, resilience and response (EPRR) arrangements, including lockdown plans. Martyn’s Law doesn’t replace these. Many trusts will find the work is about checking that existing plans cover terrorism scenarios, that lockdown and invacuation are clearly defined, and that communication reaches every ward and department, then documenting the evidence.
Overhead announcements can be disturbing for patients, are easy to miss in clinical areas, and can’t give detailed instructions. Pagers and bleeps reach only some staff. Emails go unread in an emergency. A good communication procedure gets a clear, consistent instruction to staff in every area at the same time, ideally without alarming patients unnecessarily, and allows updates as the situation changes.
PopAlert delivers pre-written lockdown, invacuation, evacuation and All Clear instructions full screen on every connected computer, at nurses’ stations, reception desks and offices, at the same moment. Role-based access controls who can trigger alerts, administrators can send live updates, and audible tones can be configured per alert type. It runs on your local network and works alongside existing alarm and access control systems.
Learn more about PopAlert for healthcare or book a demo.
This article is general information, not legal advice. Check the latest Home Office and SIA guidance for your premises.