vaayaa Inclusive Education
Healthcare risk assessment

Community and Public Health Practice Risk Assessment: Data, Outreach, Funding and Safety Controls

A worked example of how a community health program identifies, scores and controls risks to participants, data, partners and service continuity, from outreach safety and consent to funding and public messaging.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Community and Public Health Practice course

Executive summary

This assessment shows how a community public health program can find, rate and control the risks that matter most to the people it serves, the data it holds and the services it delivers. Eight hazards were chosen because they are plausible in outreach, screening, education and referral work. Data exposure scores highest before controls, with consent failures, partner dependence, funding shortfalls and unclear public messages close behind. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but the data risk stays at Medium because the impact on trust is serious. The first actions are role based access to case records, a consent checklist at every contact, a second referral route for each core service and a message review step before public advice is released. Every score illustrates method, not a real organization.

Focus area
Community and public health practice
Setting
Local community health outreach and prevention program working with partner agencies and volunteers
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a community-based public health program that delivers screening, education, vaccination reminders and referral support in neighborhoods, schools and community venues. It covers risks to participants, data, partners, staff, volunteers and continuity of service. It does not cover individual clinical decisions or the work of licensed clinicians. Jurisdiction, funding model, data systems and partner arrangements are not specified and are treated as assumptions for teaching.

Context

The program employs a coordinator, outreach workers, a data officer and a small number of nurses, and relies on volunteers and partner agencies for venues and referrals. Participant details are recorded on a case management system and on paper consent forms, with spreadsheets used for attendance and reporting. Mobile equipment and temperature sensitive supplies are moved between sites. Each risk is scored before controls to show its natural level, then again after existing and added controls.

Objectives, assets and stakeholders

The objective is to reach residents with safe, accurate and respectful public health services, protect participant privacy, keep partners and funders confident, and continue services during disruption. Assets in scope are participant records and consent forms, attendance and outcome data, mobile equipment and supplies, venues, partner relationships and the reputation of the program. Stakeholders include participants and their families, outreach workers, nurses, volunteers, the program coordinator, partner agencies, funders, the lead public health authority and the wider community. Every risk has one owner role, and the program coordinator keeps the register current and reports to the steering group each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H01
4 Likely Likelihood 4, impact 3, score 12, high: H05
3 Possible Likelihood 3, impact 3, score 9, medium: H03 H08 Likelihood 3, impact 4, score 12, high: H02 H06 H07
2 Unlikely Likelihood 2, impact 5, score 10, high: H04
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H05
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 H08 Likelihood 2, impact 3, score 6, medium: H02 H04 H06 H07 Likelihood 2, impact 4, score 8, medium: H01
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Exposure of participant health and contact records 20 Critical 8 Medium Data officer
H02 Partner or supplier failure disrupts referrals and venues 12 High 6 Medium Partnerships lead
H03 Outreach staff and volunteers lack current competence 9 Medium 4 Low Training lead
H04 Safety incident during clinics or mobile outreach 10 High 6 Medium Outreach manager
H05 Funding shortfall or breach of grant conditions 12 High 6 Medium Finance lead
H06 Misleading or unverified public health messages 12 High 6 Medium Communications lead
H07 Consent and data sharing breach in surveys or referrals 12 High 6 Medium Program coordinator
H08 Equipment, cold chain and supply failure 9 Medium 4 Low Operations lead
H01

Exposure of participant health and contact records

Technology and data Before 20 After 8

Case records, consent forms and attendance sheets holding health and contact details are viewed, copied or lost through weak access control, shared devices, misplaced paper or unsecured spreadsheets.

Who or what is affected: Participants, families, staff and referring agencies

Causes

Shared devices, staff turnover, paper forms carried between sites and spreadsheets copied by email.

Consequences

Loss of participant trust, stigma, legal notice and loss of partner referrals.

Existing controls

  • The case management system requires a login and logs record views.
  • Paper consent forms are kept in a locked cabinet at the office.

Control gaps

Spreadsheets used for reporting sit outside case system access controls, and access logs are not reviewed.

Additional controls

  • Prevent: Restrict record access by role and enable multi-factor sign in for all users.
  • Detect: Review access logs each month and flag views outside assigned caseloads.
Likelihood 5 x impact 4 before; 2 x 4 after Owner: Data officer Target: Within 30 days Early warning: Case records opened by users outside their assigned role or site.
H02

Partner or supplier failure disrupts referrals and venues

Supplier Before 12 After 6

A key partner agency, venue owner or supplier cannot deliver agreed referrals, space or materials when needed, leaving participants without the planned support.

Who or what is affected: Participants, outreach workers and partner agencies

Causes

Reliance on a few partners, funding cuts at partner agencies and informal arrangements.

Consequences

Delayed care, missed participants, reputational harm and wasted outreach effort.

Existing controls

  • Partner agreements set out referral steps and named contacts.
  • Venue bookings are confirmed in writing before each session.

Control gaps

Partner performance is checked only at annual review, and fallback routes are never tested.

Additional controls

  • Prevent: Hold at least two referral routes and two venues for every core service.
  • Respond: Activate a written fallback partner when a main partner cannot act within one working day.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Partnerships lead Target: Within 60 days Early warning: A partner that misses two agreed referral response times in one month.
H03

Outreach staff and volunteers lack current competence

People Before 9 After 4

Workers and volunteers deliver screening, education or referral conversations without current training, supervision or knowledge of safeguarding and privacy rules.

Who or what is affected: Participants, volunteers and outreach workers

Causes

High volunteer turnover, uneven induction and reliance on individual judgment.

Consequences

Poor advice, unsafe handling of participants and weakened trust in the program.

Existing controls

  • Induction covers core safeguarding and privacy topics.
  • Nurses supervise screening activities on site.

Control gaps

Refresher training is not tracked against role requirements.

Additional controls

  • Prevent: Keep a competence record with refresher dates for each worker and volunteer.
  • Detect: Observe a sample of sessions each quarter and record the feedback given.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Training lead Target: Within 60 days Early warning: A volunteer or worker assigned to a session without a current competence entry.
H04

Safety incident during clinics or mobile outreach

Safety Before 10 After 6

Participants or staff are injured at a clinic, school or mobile site because of crowding, poor access, equipment faults, lone working or adverse weather.

Who or what is affected: Participants, outreach workers, volunteers and venue staff

Causes

Crowded venues, lone working, equipment faults and poor weather.

Consequences

Injury to participants or staff, duty of care claims and suspension of services.

Existing controls

  • Each site has a risk briefing and a named first aider.
  • Equipment is checked before each session using a short list.

Control gaps

Lone working checks are not recorded, and near misses are not reported consistently.

Additional controls

  • Prevent: Use a written site risk check for every venue, including access, crowd and lone working.
  • Respond: Stop the activity, give first aid and record any injury within 24 hours.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Outreach manager Target: Within 30 days Early warning: A near miss or first aid event recorded at any site in a month.
H05

Funding shortfall or breach of grant conditions

Financial Before 12 After 6

Income falls below plan, or funds are spent in ways the grant terms do not allow, so services must be reduced or money must be repaid.

Who or what is affected: Participants, staff, funders and the steering group

Causes

Short funding cycles, dependence on one funder and changes to grant terms.

Consequences

Service reduction, staff redundancy, repayment of funds and loss of credibility.

Existing controls

  • Grant reports are filed on schedule by the finance lead.
  • Monthly income is reviewed against budget.

Control gaps

Grant conditions are summarized but not checked against spending each quarter.

Additional controls

  • Prevent: Map grant conditions to activities and flag any term that restricts how funds are used.
  • Respond: Agree a contingency plan that pauses the lowest priority service if income falls.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Finance lead Target: Within 45 days Early warning: Forecast income below the agreed floor for the next 90 days.
H06

Misleading or unverified public health messages

Reputational Before 12 After 6

Leaflets, posts or talks give advice that is out of date, poorly sourced or unsuitable for the audience, which may influence health decisions.

Who or what is affected: Community members, families and the lead public health authority

Causes

Fast requests for content, reuse of old materials and unclear sources.

Consequences

Harm to health decisions, complaints, regulator attention and loss of trust.

Existing controls

  • Materials are based on national or local guidance where available.
  • A senior nurse signs off leaflets before printing.

Control gaps

Reused older leaflets are not reviewed for currency.

Additional controls

  • Prevent: Use a message review step that checks source, date and audience for every public advice item.
  • Detect: Monitor community feedback and social channels for questions about advice given.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Communications lead Target: Within 30 days Early warning: Public materials released without documented review.
H07

Consent and data sharing breach in surveys or referrals

Legal and compliance Before 12 After 6

Screening answers, survey data or referral details are collected without valid consent or shared with a partner beyond the purpose agreed with the participant.

Who or what is affected: Participants, partner agencies and the program

Causes

Verbal consent not recorded, data shared beyond the referral purpose and unclear partner rules.

Consequences

Breach of privacy rules, complaints, legal action and loss of partner access.

Existing controls

  • Consent forms are signed before screening or survey questions begin.
  • Referral forms list the data shared with each partner.

Control gaps

Consent records are not checked against the data actually shared in referrals.

Additional controls

  • Prevent: Use a consent checklist at every contact and refuse data sharing when consent is missing.
  • Respond: Withdraw and delete survey data when consent is later withdrawn, and record the action.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Program coordinator Target: Within 30 days Early warning: A contact recorded without a signed or verified consent entry.
H08

Equipment, cold chain and supply failure

Operational Before 9 After 4

Mobile equipment, temperature sensitive supplies or stock fail or run out, so sessions are cancelled or supplies are spoiled before use.

Who or what is affected: Participants, outreach workers and suppliers

Causes

Aging equipment, power loss, transport delays and poor stock records.

Consequences

Sessions cancelled, supplies spoiled and participants left without support.

Existing controls

  • Equipment is logged with service dates.
  • Temperature sensitive supplies are stored in a monitored unit with alarms.

Control gaps

Temperature logs are checked only when someone visits the store.

Additional controls

  • Prevent: Schedule maintenance and keep a spare kit list for each mobile site.
  • Recover: Keep a tested restock route and replace lost stock within 48 hours.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Operations lead Target: Within 60 days Early warning: A temperature alarm or overdue service date at any site.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic, with impact judged on harm to people, effect on health outcomes, legal exposure, money, service continuity and trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than inherent. Anything Critical needs immediate action and senior sponsorship, anything High needs a dated plan with a named owner, anything Medium needs routine controls and monitoring, and anything Low is accepted and watched. Outreach workers, volunteers and participant representatives who do the work challenge the ratings, and any rating is reviewed when an indicator reaches its escalation threshold or after a relevant incident.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Case records opened by users outside their assigned role or site.Escalate to the data officer when any out of role access is found, and to the program coordinator if it is not explained within 5 days.
Contacts recorded without a signed or verified consent entry.Escalate to the program coordinator at the end of each week when any gap is found, and to the steering group if three or more remain open.
Adverse events or near misses at clinics, mobile sites or community events.Escalate to the responsible nurse lead at once, and to the steering group within 24 hours for any event that causes harm.
Forecast income below the agreed floor for the next 90 days.Escalate to the finance lead when the forecast drops below the floor, and to the steering group if the gap is not closed within 30 days.
Public health messages released without documented review.Escalate to the communications lead immediately, and withdraw the message if an error is confirmed.

Contingency arrangements

If a serious event occurs, such as a confirmed data breach, a safety incident at a clinic or the loss of mobile equipment, the program coordinator pauses the affected activity, preserves records and informs the steering group. The data officer isolates affected systems and restores records from the latest tested backup. Participants and referring agencies are told promptly what happened and what they should do. Suspected health harm is passed to the responsible nurse lead and the lead public health authority as local rules require. Specialist legal and privacy advice is sought before any notice is issued.

Prioritized action plan

  1. Restrict case record access by role and enable multi-factor sign in, owner data officer, within 30 days.
  2. Use a consent checklist at every contact and store signed forms in a locked, indexed file, owner program coordinator, within 30 days.
  3. Confirm partner data sharing terms and name a backup referral route for each core service, owner partnerships lead, within 60 days.
  4. Build a competence record for outreach workers and volunteers with refresher dates, owner training lead, within 60 days.
  5. Set a funding watch with a 90 day income forecast and a check of grant conditions against spending, owner finance lead, within 45 days.

Conclusion

Safe community health practice depends on steady habits: consent at every contact, role based access to records, checked partner agreements, trained volunteers, tested backups and public messages reviewed before release. The highest scores sit with data exposure, consent and safety at outreach events, and each has actions that reduce residual risk. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real clinical, legal, privacy or public health decision.

Assumptions and limitations

Assumptions

  • The program operates under a local or national public health framework with a named lead agency, although the exact jurisdiction is not specified.
  • Participants include adults and children whose records contain sensitive health and contact information.
  • Partner agencies share referral data under written agreements whose quality varies between partners.

Limitations

  • The scores are examples for learning and do not describe any real program or community.
  • Health, privacy and safeguarding rules differ by jurisdiction and change over time, so specialist review is needed.
  • This is educational content and is not clinical, legal or public health advice, and it does not replace a formal site-specific assessment.

Related frameworks to study

  • Risk management process with identify, assess, treat and monitor steps
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Principles of informed consent and data minimization
  • Plan, do, check, act cycle for continual improvement

Healthcare Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Community and Public Health Practice course Read the best practices for this course

More Healthcare risk assessments

Hourly Active: 39,499 Learners