Visitor Screening

Visitor screening is the process of checking who a visitor is, why they're coming and whether they should get access before they enter your workplace. It can be as light as confirming a name against a host's invite or as strict as an ID check against government watchlists. Most organizations fit somewhere in between, and the right level depends on your industry, your regulations and what's inside the building.

What is visitor screening?

Screening is the decision step inside visitor management. Registration collects details, and check-in records arrival. Screening decides whether the person is allowed in, and under what conditions.

A typical flow looks like this:

1. Visitor registration: the host invites the guest, or the guest fills in a form in advance.
2. Screening checks: the system or front desk runs the checks your policy requires.
3. Visitor check in: the guest arrives, confirms their identity, signs any documents and gets a badge.
4. Record keeping: the visit is logged with times, host and screening results.

Why formal visitor screening matters for workplace security

Protecting people

BLS recorded 57,610 nonfatal workplace violence cases serious enough to require days away from work across 2021 and 2022, plus 524 workplace homicides in 2022. Screening won't stop every incident, but it gives the front desk a way to act on known risks, such as a former employee barred from the site. Our guide to office security covers the wider picture.

Protecting information and assets

Visitors can see screens, whiteboards, prototypes and documents. Under ITAR, showing controlled technical data to a foreign person in the US counts as an export, and 22 CFR 120.56 includes visual inspection as a release. For defense and aerospace sites, knowing who's in the building is a compliance issue.

Meeting sector rules

Some regulations spell out visitor controls. The HIPAA Security Rule at 45 CFR 164.310 lists "visitor control" as an addressable safeguard for covered entities. A documented process also gives auditors a timestamped record that checks happened.

The types of checks visitor screening covers

• Identity verification: matching a photo ID to the registration details.
• Invitation and host confirmation: confirming an employee expects the visitor and will be responsible for them.
• Internal watchlists: checking names against people your security team has barred from the site.
• Restricted party screening: checking against lists such as the Treasury's OFAC SDN list, whose listed parties US persons are generally prohibited from dealing with, and the Commerce Department's Entity List.
• Document signing: NDAs, safety waivers or site rules signed before entry.
• Health and safety questions: site-specific questions, used by labs, manufacturing plants and healthcare facilities.
• Escort and area rules: deciding which zones the visitor can enter and whether they need an escort.

How to decide the right level of screening for your organization

Match the checks to real risk. A few questions settle most of it:

• What regulations apply? Healthcare, defense, export-controlled manufacturing and payment card environments carry specific expectations.
• What's on site? Labs, data centers, prototypes and cash raise the stakes compared with a standard office floor.
• Who visits? A site with daily contractors and candidates needs faster, repeatable checks than one with a few client meetings a week.
• What data will you store? Every added check means more personal data to protect and delete on schedule.

Most corporate offices do well with pre-registration, host confirmation, ID checks for first-time visitors and an NDA where needed. Visitor management tools can run these checks at sign-in and alert the host on arrival. Many workplace teams manage visitors in the same platform they use for desk booking; our roundup of hot desk booking software and our guide to hybrid work software cover options.

FAQ

Is visitor screening required by law for all organizations?

No. Most offices face no general legal requirement to screen visitors. Specific rules apply in certain sectors: HIPAA for healthcare, ITAR and EAR for export-controlled sites, federal facility security standards and some payment card rules. OSHA has no specific workplace violence standard, though employers still carry a general duty to provide a safe workplace.

Can visitor screening be done without a receptionist?

Yes. Visitors can pre-register from an invite link, then check in at a tablet kiosk or by scanning a QR code. The system verifies details, collects signatures, prints a badge and notifies the host. Anyone flagged by a watchlist match can be routed to security staff instead of the lobby.

How long should visitor screening records be kept?

Set a retention period in your policy and stick to it. Under GDPR, the ICO's storage limitation guidance says personal data shouldn't be kept longer than you need it. Regulated sites may need longer retention for audits, so check sector rules with your legal team.

Does visitor screening apply to delivery personnel and couriers?

Usually at a lighter level. Many offices send couriers to a mailroom or reception drop point so they never pass the lobby. If a courier needs access beyond that, the same policy applies: identity, purpose and a logged entry. Recurring contractors should be rescreened on a regular schedule.