Drawing the Boundaries: Martyn's Law Across a Complex NHS Estate

A common assumption in NHS estates teams is that public-facing buildings will sit in Martyn's Law's enhanced tier. Some will. Many will not. And a surprising number will sit in both tiers at once, depending on where you draw the line.

The Act does not tier organisations. It tiers premises. For a Trust running an acute hospital, a handful of community sites, clinics in shared buildings and space inside a retail park, that means one organisation can hold enhanced, standard and out-of-scope premises simultaneously.

The real compliance task is not deciding whether the NHS is enhanced tier. It is mapping a diverse estate, drawing defensible boundaries around each premises, and knowing who is responsible for what inside them.

How the tier is decided

Health care is one of the uses listed in Schedule 1 of the Act. The Home Office statutory guidance confirms this includes hospitals, primary care clinics, and doctor and dentist surgeries.

Whether a given premises is in scope, and which tier it falls into, then turns on one question: how many people can reasonably be expected to be present at the same time, from time to time, in connection with a Schedule 1 use.

Three points trip people up.

• Staff count. The figure includes staff, not just patients and visitors. A hospital with modest public footfall can still pass 800 once clinical, estates and support staff on shift are included.
• Peak, not average. NHS England's guidance is explicit that the assessment is the highest number reasonably expected at any one time, not average daily attendance. Shift handovers, visiting hours and outpatient clinic peaks all matter.
• Public status alone decides nothing. A building being publicly accessible does not put it in the enhanced tier. A busy GP surgery with 150 people at peak is out of scope. A health centre with 400 is standard tier.

There is also no cap for health care. The Act places early years, school and further education settings in the standard tier whatever their size. Hospitals get no equivalent treatment, so an acute site above 800 is enhanced tier.

Where the boundaries get hard

The Act defines premises as a building, part of a building, or a building and other land. That flexibility is where NHS estates become complicated. There are four situations every Trust will recognise.

Parts of a building

A hospital may contain a public café, a retail pharmacy or a shop run by a third party. NHS England's technical bulletin notes that each of these could be assessed independently, and may fall into a different tier from the hospital around it. At the same time, they remain part of the larger premises. Both sets of duties can apply at once.

Hospital campuses

Many acute sites are groups of buildings: main block, outpatients, mental health unit, education centre, staff residences, multi-storey car park. The Act allows a group of buildings to be treated as a single premises, but gives no definitive test. NHS England points to geographical proximity and whether the buildings are under the same responsible person's control.

This choice matters. Treat the campus as one premises and the whole site is likely enhanced tier. Treat buildings separately and a satellite outpatient block might be standard tier, or out of scope. Neither answer is automatically right. What matters is that the decision is reasoned, recorded and consistent with how the site actually operates.

Premises within premises

Health on the high street means NHS services increasingly sit inside other qualifying premises. A community diagnostic centre in a shopping centre is the obvious example. NHS England cites the Metro Centre in Gateshead, which houses NHS diagnostic, pharmacy and optometry services. The unit may be its own qualifying premises, while the shopping centre is a larger one with its own responsible person and tier.

Leased and shared space

On most estates, some buildings are leased out and others are leased in. Some are shared with other providers, local authorities or universities. The question is never just who owns the building. It is who controls it in connection with the Schedule 1 use.

Who is responsible

The Act places duties on the responsible person: whoever controls the premises in connection with its Schedule 1 use. For most premises that means the operator, not the landlord. Hospitals are handled differently.

Where several organisations share a qualifying premises, the Act requires them to co-ordinate so far as reasonably practicable. For enhanced tier premises it goes further. Anyone who controls part of the premises, even if they are not the responsible person, must co-operate with the responsible person.

In practice that means the café operator, the retail pharmacy, the leased-in university teaching block and the private patient unit all become part of the Trust's compliance picture. Leases, licences and service agreements written before 2025 will rarely say anything about this.

What the enhanced tier asks of a hospital

Standard tier premises need public protection procedures: evacuation, invacuation, lockdown and communication. Many Trusts are already close here, because the NHS EPRR Core Standards cover the same ground.

The enhanced tier adds public protection measures, implemented so far as reasonably practicable, across four areas:

1. Monitoring the premises and immediate vicinity, from staff awareness to CCTV and control rooms.
2. Controlling movement into, out of and within the premises, through access control, locks, barriers and search policies.
3. Physical safety and security, including stand-off, glazing and hostile vehicle mitigation.
4. Security of information, such as floor plans and security protocols.

Hospitals raise particular tensions here. They are open around the clock. Emergency departments cannot be locked down in the way a stadium can. Ambulance routes, patient transport and delivery bays complicate vehicle mitigation. Lockdown that protects a public atrium may trap a clinical area that must stay reachable. The "reasonably practicable" test exists for exactly these trade-offs, but the reasoning has to be written down.

That is the other enhanced tier requirement. The responsible person must document its procedures and measures, explain how they reduce risk, and give that document to the Security Industry Authority (SIA). Where the responsible person is an organisation, it must also appoint a Designated Senior Individual. NHS England recommends this is the Trust's Accountable Emergency Officer, who already holds board-level responsibility for emergency preparedness.

A practical method for mapping the estate

This approach turns a vague question into a register the board can sign off.

1. List every site and building. Owned, leased in, leased out, shared and licensed. Include satellite clinics and space inside other organisations' premises.
2. Identify the Schedule 1 use of each. Health care will dominate, but note cafés, retail, conference and education space, and anything mainly used for something else, such as an office-only building.
3. Establish peak occupancy. Use real data where you have it: access control logs, rota and shift patterns, outpatient bookings, visiting policies, footfall counters. Count staff. Record the method, not just the number.
4. Draw the premises boundaries. Decide which buildings are grouped and which stand alone, and which internal areas are separate premises. Write down why, with reference to proximity and control.
5. Settle principal use where it matters. For any single premises with more than one Schedule 1 use, apply the Principal Use of Premises Regulations 2026 and record the outcome.
6. Assign a tier to each premises. Out of scope, standard or enhanced.
7. Name the responsible person for each. Flag every premises where another organisation controls part of it, and every Trust unit sitting inside someone else's premises.
8. Check the agreements. Review leases, licences and service agreements for co-operation, information sharing and access to security systems.
9. Gap-assess against the duties. Procedures for standard tier. Procedures, measures and documentation for enhanced tier.

The output is a Martyn's Law premises register. It becomes the backbone of Premises Assurance Model returns, the enhanced tier documents sent to the SIA, and the capital plan for any security work that follows.

Timeline and assurance

The Act received Royal Assent on 3 April 2025, and the Government committed to an implementation period of at least 24 months. April 2027 is the earliest point the duties could commence, not a confirmed deadline. The final date will be set by commencement regulations. NHS England's technical bulletin anticipates SIA compliance assessments from April 2027, which is a sensible planning assumption. Our Martyn's Law tracker follows every official update.

NHS England has built Martyn's Law into the Premises Assurance Model. Organisations were asked to categorise sites by tier in the 2025 return, and PAM is being updated in 2026 and 2027 to collect further compliance data. Trusts have also been asked to name their responsible persons.

A Trust that has not yet drawn its premises boundaries has little time to act on the answer before commencement, whenever it is confirmed.

Getting the boundaries right

For most NHS organisations, Martyn's Law will not be a single compliance project. It will be dozens of smaller ones, each shaped by a boundary decision made early. Draw the lines too wide and you commit the whole estate to enhanced tier measures it may not need. Draw them too narrow and you risk under-protecting sites that clearly qualify, with the Trust's name on the enforcement notice.

The organisations that will find commencement manageable are those that treat boundary-drawing as the first piece of security work, not an administrative preliminary.

Fyrfly Systems works with public sector estates on premises mapping, occupancy assessment and the monitoring, access control and CCTV measures the enhanced tier calls for. Our free security compliance checker includes an NHS estates option, and the Martyn's Law guide covers the Act in full.

Frequently asked questions