OPINION

Opinion by

Justice BRIDGES.

Alisa Stewart and her children sued ap-pellees, claiming appellees’ negligence in failing to provide adequate security for the parking lot adjacent to appellees’ hospital complex in McKinney, Texas, allowed Raymond Wingfield to shoot Stewart. On appeal, appellants contend the trial court improperly granted summary judgment in favor of appellees. We affirm the trial court’s judgment.

Factual and Procedural Background

Stewart worked with Amy Wingfield, Wingfield’s wife, in a medical office building adjacent to the hospital. On May 16, 2002, Wingfield used a rifle to shoot his wife in the head as she was exiting her car in the parking lot next to the office building after returning from lunch. When Stewart ran around the car to assist Ms. Wingfield, Wingfield shot Stewart in the back, seriously injuring her.

Appellants sued appellees, claiming the lack of adequate security in the parking lot allowed Wingfield to commit the shooting. Appellees moved for summary judgment on grounds they owed no duty to appellants because Wingfield’s conduct was unforeseeable and Wingfield’s actions were a new and intervening cause that extinguished any possible liability appellees had for appellants’ injuries. In support of the motion for summary judgment, appellees relied on Wingfield’s and Stewart’s deposition testimony and the affidavit of Matt Meineke, the Safety/Security Officer at the hospital.

Wingfield testified he had been at the hospital many times as a firefighter/paramedic and to visit his wife in the adjacent office building, but had no physical altercations with his wife on the premises. Stewart testified she was not aware of any violent tendencies Wingñeld had towards her or his wife. She did not know Wing-field was planning to shoot his wife and did not contend appellees either had knowledge or should have had knowledge of Wingfield’s intentions.

Meineke stated he had held his position since January 2000 and was familiar with security incidents and events on the hospital property and in its immediate vicinity. Based on his job responsibilities, he would be aware of any criminal activity in the hospital parking lot if the conduct was reported to the hospital. Prior to Wing-field shooting his wife and Stewart in the parking lot, no similar criminal activity occurred in the parking lot or on the hospital’s property. According to Meineke, pri- or to the shooting “there had not been any acts of violence such as assaults, shootings, stabbings, and threats of violence, including domestic disturbances, family violence, robberies, and other conduct involving *662 bodily injury in the Hospital parking lot or on Hospital property.”

In their response to the motion for summary judgment, appellants argued appel-lees undertook an affirmative duty to provide security by implementing a Security Management Program and a Security Management Plan and breached that duty by failing to follow those policies and procedures. Appellants also claimed appel-lees had a duty as a premises owner to protect and provide adequate security to users of the parking lot. Appellants contended appellees’ negligence was a proximate cause of appellants’ injuries and Wingfield’s actions were not a new and intervening cause.

In support of their arguments, appellants offered the affidavit of Dr. John Lombardi, a security consultant specializing in criminology and premises security. Lombardi opined appellants had a responsibility to protect and provide adequate security to the users of the parking lot. Further, by adopting a Security Management Program, appellants created the affirmative responsibility to follow their own policies, including that a security officer:

may be dispatched to find a lost vehicle, secure an open vehicle, jump batteries, open locked vehicles, open office doors, secure valuables from a patient, conduct personnel escorts to and from remote parking, conduct after hours escorts to the parking area or public transportation, and to escort guests. An officer can also be dispatched to cut a lock (where the owner is verified), locate missing patients, crowd control, and to otherwise ensure the safety of employees and visitors.

The Security Management Program also created a duty for security officers “to challenge suspicious persons.” In Lombardi’s opinion, appellees failed to follow their policies and procedures by not challenging Wingfield in the parking lot prior to the shooting.

Lombardi also opined the Security Management Plan implemented by appellees “should have placed more emphasis and given greater consideration to security in relation to [the hospital’s] exterior grounds.” The focus on the interior of the facility displaced people to the exterior of the building making “an increase in the number of criminal and related incidents to those persons who are displaced reasonably foreseeable, irrespective of previous criminal and related incidents.”

Lombardi finally opined hospitals are unique facilities because of the large amount of activity and the types and variety of people who visit the facility. Given the nature of hospitals and the conditions and circumstances of the people present at the facility, particularly emergency rooms, “it was reasonably foreseeable that criminal and related activities [might] occur on the exterior grounds” of the hospital. Because appellees “failed to appreciate the unique nature of the use and functioning of their premises as a hospital,” they failed to “provide adequate and proper security” for the external grounds.

Appellants also relied on Wingfield’s deposition testimony that he probably would not have chosen the hospital parking lot to carry out the attack if there had been a greater security presence. Stewart testified she rarely associated with Ms. Wingfield outside work. Accordingly, appellants argued, if appellees had provided adequate security, Wingfield would have shot his wife elsewhere when Stewart was not present. Appellants offered no evidence of any other criminal conduct at or near the hospital.

The trial court granted appellees’ motion without specifying the basis for the ruling.

*663 Standard of Review

A traditional motion for summary judgment is properly granted only when the movant establishes there are no genuine issues of material fact and the movant is entitled to judgment as a matter of law. Tex.R. Civ. P. 166a(c); Provident Life & Accident Ins. Co. v. Knott, 128 S.W.3d 211, 215 (Tex.2003). In reviewing the evidence, we “examine the entire record in the light most favorable to the nonmovant, indulging every reasonable inference and resolving any doubts against the motion.” City of Keller v. Wilson, 168 S.W.3d 802, 824 (Tex.2005). A defendant who conclusively negates an essential element of the plaintiffs cause of action is entitled to summary judgment on that claim. Tex.R. Civ. P. 166a(c); Sw. Elec. Power Co. v. Grant, 73 S.W.3d 211, 215 (Tex.2002). When, as here, the trial court does not specify the basis for its ruling, we must affirm the trial court’s judgment if any ground alleged in the motion has merit. W. Invs., Inc. v. Urena, 162 S.W.3d 547, 550 (Tex.2005).

Negligence

Appellants allege appellees were negligent in failing to provide adequate security in the hospital parking lot. The essential elements of a negligence claim are the existence of a legal duty, a breach of that duty, and damages proximately caused by the breach. D. Houston, Inc. v. Love, 92 S.W.3d 450, 454 (Tex.2002). In their first issue, appellants contend the trial court erred in determining appellees did not have a duty to protect Stewart from Wingfield’s criminal conduct.

Duty

Generally, a person has no legal duty to protect another from the criminal acts of a third person. Timberwalk Apartments, Partners, Inc. v. Cain, 972 S.W.2d 749, 756 (Tex.1998). However, a premises owner “who retains control over the security and safety of the premises” has a duty to use ordinary care to protect invitees from criminal acts of third parties if the premises owner knows or has reason to know of an unreasonable and foreseeable risk of harm to the invitee. Id. 1 Whether the risk was foreseeable is not determined in hindsight but rather in light of what the premises owner knew or should have known before the criminal act occurred. Id. at 757.

Only the general danger, not the sequence of events that produced the harm, must be foreseeable. Id. at 756. When the general danger is the risk of injury from criminal activity of third parties, there must be evidence of specific previous crimes on or near the premises in order to establish foreseeability. Id. In determining whether the criminal conduct was foreseeable, we must consider whether any criminal conduct previously occurred on or near the property, how recently the criminal conduct occurred, how often it occurred, how similar the conduct was to the conduct on the property, and what publicity was given to the occurrences to indicate the premises owner knew or should have known about them. Id. at 757.

Application

Appellees offered Meineke’s affidavit establishing there had been no similar crimes on or near the hospital parking lot in the two-and-a-half years prior to the shooting. Appellants offered no controverting evidence of any criminal activity on or near the premises. Instead, relying on Isaacs v. Huntington Memorial Hospital, *664 38 Cal.3d 112, 211 Cal.Rptr. 356, 695 P.2d 653 (1985), appellants argue an exception should be made to Timberwalk for settings, such as a hospital, where it is reasonably foreseeable that criminal activity is likely to occur due to the presence of victims and perpetrators of violent crime and people with emotional and mental disturbances who often create a volatile and chaotic environment.

Isaacs involved the shooting of a doctor in a hospital parking lot by an unidentified third party. The trial court dismissed the claims against the hospital following the plaintiffs case in chief based, in part, on the plaintiffs failure to introduce evidence of prior similar crimes on the premises. The California Supreme Court reversed the trial court’s decision, holding the foreseeability of criminal conduct by a third person is determined not by a “rigid application of a mechanical ‘prior similars’ rule,” but based on all the circumstances. Id. at 659. However, the Isaacs Court did not conclude criminal conduct in a hospital parking lot is always foreseeable. Rather, it considered the nature, condition, and location of the property as well as evidence of prior crimes in the hospital emergency room and in the immediate vicinity of the property. Id. at 661-62.

The California Supreme Court revisited Isaacs in Ann M. v. Pacific Plaza Shopping Center, 6 Cal.4th 666, 25 Cal.Rptr.2d 137, 863 P.2d 207, 215 (1993), and concluded it had been unnecessary in Isaacs to “consider the viability of the ‘prior similar incidents’ rule” because the record in Isaacs “contained evidence of prior, violent, third party attacks on persons on the hospital’s premises in close proximity to where the attack at issue” occurred. In evaluating the Ann M. plaintiffs contention she was raped due to the landlord’s failure to provide adequate security in the common areas of the shopping center, the California Supreme Court determined a “high degree of foreseeability is required in order to find that the scope of a landlord’s duty of care includes the hiring of security guards” and that level of foreseeability “rarely, if ever, can be proven in the absence of prior similar incidents of violent crime on the landowner’s premises.” Id. The court made no distinction in Ann. M. between a shopping center and a hospital for purposes of the foreseeability analysis. The Texas Supreme Court has also made no distinction between different types of property in applying the Timberwalk factors. See Mellon Mortgage Co. v. Holder, 5 S.W.3d 654, 658 (Tex.1999) (plurality opinion) (“Whether it be a farmer’s field, an industrial park, or a twenty-four-hour laundromat, placing a duty on landowners to prevent criminal acts on their property simply because criminals could gain access to their land would make landowners the insurers of crime victims, regardless of the lack of connection between the landowner and either the victim or the perpetrator.”). Accordingly, we decline to rely on Isaacs to create an exception for hospitals to Timberwalk’s foreseeability factors.

Applying the Timberwalk factors, appellees presented evidence there had been no prior similar criminal activity at or near the hospital, establishing Wingfield’s conduct was not foreseeable. Appellants offered no controverting evidence. Therefore, the trial court did not err in finding appellees did not owe a duty to appellants.

Assumption of Duty

Appellants next argue that, regardless of Timberwalk, appellees affirmatively assumed a duty to protect Stewart and to provide security by implementing the Security Management Plan. Again, appellants’ claim is essentially appellees failed to provide adequate security in the parking lot. A claim a premises owner failed *665 to provide adequate security against criminal conduct is generally a premises liability claim subject to analysis under Timberwalk. Timberwalk, 972 S.W.2d at 753; Gibbs v. Shuttleking, Inc., 162 S.W.3d 603, 609 (Tex.App.-El Paso 2005, pet. denied).

We do not conclude a premises owner could never choose to assume a duty beyond that imposed by the common law. However, the Security Management Plan implemented by appellees to provide a basic level of security on the premises is insufficient as a matter of law to impose a duty on appellees to protect invitees from the unforeseeable criminal conduct of a third person. See Allen v. Connolly, 158 S.W.3d 61, 67 (Tex.App.-Houston [14th Dist.] 2005, no pet.) (“The mere act of taking preventative measures to protect against the possibility of future crime is not the same as foreseeing that criminal activity”). To conclude otherwise would essentially make every premises owner who chooses to provide basic security for the premises, regardless of whether criminal conduct by a third party is foreseeable, an insurer of the safety of invitees, an outcome in direct contradiction to Texas law. Timberwalk, 972 S.W.2d at 756 (“If a landowner had a duty to protect people on his property from criminal conduct whenever crime might occur, the duty would be universal. This is not the law.” (emphasis in original)); Lefmark Mgmt. Co. v. Old, 946 S.W.2d 52, 59 (Tex.1997) (“Courts across the country agree that an owner or possessor of property is not an insurer of the safety of those on the premises.”).

Because there is no material issue of fact that Wingfield’s shooting of Stewart was not foreseeable to appellees, the trial court properly concluded appellees did not owe appellants a duty. We overrule appellants’ first issue.

Mixed Question of Law and Fact

Appellants argue in their second issue that the trial court improperly granted summary judgment because there is a mixed question of law and fact regarding whether appellees owed a duty to protect Stewart. Whether a duty exists is a question of law unless the relevant facts are disputed. Humble Sand & Gravel, Inc. v. Gomez, 146 S.W.3d 170, 181-82 (Tex.2004); Skiles v. Jack In The Box, Inc., 170 S.W.3d 173, 179 (Tex.App.-Dallas 2005, pet, filed). Here, appellees produced evidence establishing there had been no similar criminal conduct on the premises and appellants did not controvert that evidence. Accordingly, we conclude the existence of a duty was a legal question for the trial court. We overrule appellant’s second issue.-

Because the trial court properly granted summary judgment on the ground appel-lees did not owe appellants a duty, we do not consider whether Wingfield’s conduct was a new and intervening cause. We affirm the trial court’s judgment.

. Appellees do not dispute Stewart was an invitee.