If the victim is conscious, there's not really a way to hold them hostage. The villain could grapple and pin the victim, but they have to spend their action each turn maintaining the grapple, which means they're unable to ready an action -- they can't say "I ready an action to cut this hostage's throat if anyone attacks me". In this scenario, the hostage does provide +4 AC of cover to the villain if the hostage is between the villain and the player character -- but the player character could just walk to the other side of the grapple before attacking.
You might argue that the villain could have the victim conscious but restrained (tied up with rope?). This could work, but it causes other problems: it becomes less likely that the villain can actually kill them (drop them to -10hp) with a single attack.
If the victim is not conscious, holding them hostage is pretty easy. The villain can carry them like an object and can ready an action each turn to attack them. RAW, carrying a large object does not give the villain cover; however a DM might reasonably rule that the villain is using the hostage like an improvised tower shield, which does provide +4 AC of cover.
There are no rules in Pathfinder for accidentally striking something you weren't aiming at. It would be reasonable to add a house rule for this, though. One rule might be: "If you attack and miss, compare your attack roll to the hostage's AC (which is very low because they're unconscious) to see if you hit the hostage instead."