Workplace Violence Prevention: OSHA Requirements & Employer Guide 2026

Introduction: Workplace Violence as an Occupational Hazard

Workplace violence is a growing occupational safety concern that affects virtually every industry. According to the Bureau of Labor Statistics, workplace homicides averaged 392 per year between 2019-2023, making intentional injuries by another person one of the leading causes of workplace death. Beyond fatalities, an estimated 2 million workers experience workplace violence annually, ranging from verbal threats to physical assaults.

For employers, workplace violence represents a convergence of legal liability, worker safety, productivity loss, and reputational risk. While OSHA does not yet have a dedicated workplace violence standard for most industries, the agency actively enforces prevention through the General Duty Clause — and new state laws are establishing increasingly specific requirements.

This guide provides a comprehensive framework for workplace violence prevention that satisfies current OSHA expectations, state law requirements, and industry best practices for 2026.

OSHA's Regulatory Framework

The General Duty Clause

Without a specific standard, OSHA relies on Section 5(a)(1) of the OSH Act — the General Duty Clause:

"Each employer shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm."

For a General Duty Clause citation related to workplace violence, OSHA must establish:

1. A hazard existed — A condition or practice that exposed employees to violence
2. The hazard was recognized — By the employer, the industry, or common sense (prior incidents, industry data, or expert knowledge)
3. The hazard was causing or likely to cause death or serious harm — Based on the severity of potential outcomes
4. A feasible abatement existed — Reasonable measures were available to reduce the hazard

OSHA Guidance Documents

OSHA has published several guidance documents that, while not legally binding standards, establish expectations for employer programs:

• OSHA 3148 — Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (2016)
• OSHA 3153 — Recommendations for Workplace Violence Prevention Programs in Late-Night Retail Establishments
• OSHA 3827 — Guidelines for Preventing Workplace Violence for Healthcare Workers (2024 update)

State Laws

Several states have enacted specific workplace violence prevention laws that exceed federal OSHA requirements:

California SB 553 (effective July 1, 2024):

• Requires written workplace violence prevention plans for nearly all employers
• Annual training for all employees
• Violent incident logs maintained for 5 years
• Record retention of training records for minimum 1 year

New York Retail Worker Safety Act (effective 2025):

• Written violence prevention policy
• Training programs
• Panic button requirements for certain retail establishments

Other states with heightened requirements include Oregon, Washington, Illinois, and Connecticut — primarily focused on healthcare settings.

Types of Workplace Violence

OSHA and NIOSH classify workplace violence into four categories:

Type 1: Criminal Intent

The perpetrator has no relationship to the business or employees. Violence occurs during the commission of a crime:

• Armed robbery
• Trespassing
• Carjacking
• Assault during theft

Highest risk: Retail, convenience stores, gas stations, taxi drivers, delivery services

Type 2: Customer/Client

The perpetrator is a customer, client, patient, or person receiving services from the business:

• Patient assaulting a healthcare worker
• Student attacking a teacher
• Citizen assaulting a government employee
• Customer confrontation in retail

Highest risk: Healthcare, education, social services, government, hospitality

Type 3: Worker-on-Worker

Violence between current or former employees:

• Bullying and harassment
• Physical altercations between coworkers
• Supervisor/subordinate conflicts
• Threats or intimidation

Risk factors: Poor management, workplace culture, job stress, downsizing

Type 4: Personal Relationship

The perpetrator has a personal relationship with the targeted employee but no relationship to the workplace:

• Domestic violence spillover
• Stalking
• Disputes following a personal relationship into the workplace

All industries are at risk — this type is the hardest to predict and prevent

Building a Workplace Violence Prevention Program

A comprehensive program follows OSHA's recommended framework of five core elements.

Element 1: Management Commitment & Employee Involvement

Management commitment includes:

• Written policy statement declaring zero tolerance for workplace violence
• Designated program coordinator or committee
• Budget allocation for prevention measures (security, training, environmental modifications)
• Accountability at all management levels
• Response protocols for reported threats or incidents

Employee involvement includes:

• Participation in hazard identification and program development
• Reporting mechanisms without fear of retaliation
• Feedback channels on program effectiveness
• Representation on safety committees

Element 2: Worksite Analysis and Risk Assessment

A thorough risk assessment identifies factors that contribute to violence potential:

Records analysis:

• Review past incident reports, workers' compensation claims, police reports
• Analyze patterns — time of day, location, type of incident, contributing factors
• Review OSHA 300 logs for violence-related recordable injuries

Environmental assessment:

• Evaluate building layout — access points, isolated areas, escape routes
• Assess lighting — parking lots, hallways, stairwells
• Review security measures — cameras, alarms, locks, access control
• Identify high-risk areas — cash handling, medication storage, isolated workstations

Job-specific analysis:

• Which positions involve contact with the public?
• Which positions involve cash handling or valuable goods?
• Which positions require working alone or in isolated areas?
• Which positions involve denying services or delivering bad news?
• Which positions involve working late nights or early mornings?

Industry data:

• Review BLS data for industry-specific violence rates
• Consult industry associations for sector-specific guidance
• Benchmark against peer organizations

Element 3: Hazard Prevention and Control

Based on the risk assessment, implement controls following the hierarchy:

Engineering Controls:

• Access control — Badge readers, buzzed entry, visitor management
• Physical barriers — Bullet-resistant enclosures, reception windows, raised counters
• Surveillance — Security cameras in high-risk areas
• Alarm systems — Panic buttons, silent alarms, duress codes
• Lighting — Adequate illumination in all areas, especially parking
• Safe rooms — Lockable interior rooms for shelter
• Furniture design — Bolted-down furniture, removal of potential weapons

Administrative Controls:

• Staffing — Adequate staffing levels during high-risk periods
• Cash handling — Minimal cash on hand, time-delay safes, armored pickup
• Work scheduling — Buddy system for isolated tasks, limit late-night solo work
• Visitor management — Sign-in procedures, escorts, restricted access
• De-escalation protocols — Trained procedures for handling confrontations
• Emergency procedures — Evacuation routes, lockdown procedures, communication plans

Personal Safety Measures:

• Personal alarms — Wearable panic buttons for high-risk positions
• Communication devices — Two-way radios, cell phones for isolated workers
• Self-defense training — Appropriate for healthcare, corrections (with caution)

Element 4: Training

Effective training is the cornerstone of prevention. All employees should receive training on:

General awareness training (all employees):

• Workplace violence policy and zero-tolerance commitment
• Types of workplace violence and warning signs
• Reporting procedures (how, when, to whom)
• Emergency response procedures (evacuation, lockdown, shelter)
• Retaliation protections for reporters

Role-specific training:

• Managers/supervisors: Threat assessment, investigation procedures, documentation, employee assistance resources, legal obligations
• Front-line staff: De-escalation techniques, conflict resolution, customer interaction safety
• Security personnel: Response protocols, restraint techniques (where appropriate), coordination with law enforcement
• Healthcare workers: Patient behavior management, team-based response, restraint alternatives

Active shooter response: Following the DHS "Run, Hide, Fight" framework:

1. RUN — If safe evacuation is possible, evacuate immediately
2. HIDE — If evacuation is not possible, find a secure location, lock/barricade doors, silence phones
3. FIGHT — As an absolute last resort, take action against the active shooter

Training frequency:

• Initial training for all new employees
• Annual refresher training (required by California SB 553 and recommended generally)
• Supplemental training after incidents or when new hazards are identified

Element 5: Incident Response and Investigation

Immediate response:

1. Ensure safety of all employees — evacuate, provide medical attention
2. Secure the scene and call law enforcement as appropriate
3. Notify management and activate emergency response plan
4. Document the incident while details are fresh

Investigation:

• Conduct a thorough root cause analysis — what happened, why, contributing factors
• Interview witnesses and involved parties
• Review security footage and access records
• Identify program failures — what controls failed or were missing?
• Develop corrective actions to prevent recurrence

Post-incident support:

• Provide Employee Assistance Program (EAP) referrals
• Offer critical incident stress debriefing for affected employees
• Allow time off for employees involved in traumatic incidents
• Follow up on workers' compensation claims
• Communicate with all employees about actions taken (without compromising investigations)

Recordkeeping Requirements

OSHA Recordkeeping (29 CFR 1904)

Workplace violence injuries are recordable on the OSHA 300 Log when they result in:

• Death
• Days away from work
• Restricted work or job transfer
• Medical treatment beyond first aid
• Loss of consciousness
• A significant injury or illness diagnosed by a PLHCP

California SB 553 Requirements

California employers must maintain:

• Violent incident log — Recording date, time, location, type, circumstances, and response for every incident. Retained for 5 years
• Training records — Dates, content, trainer qualifications. Retained for 1 year minimum
• Written WVPP — Available for employee and Cal/OSHA review at all times

Recommended Documentation

Beyond legal requirements, maintain:

• Threat assessment records
• Restraining orders and protective orders involving employees
• Security audit reports
• Training attendance and evaluation records
• Investigation reports with corrective actions
• Program evaluation reports

Industry-Specific Considerations

Healthcare

Healthcare workers face the highest risk of workplace violence — 5× the rate of other industries:

• Patient aggression — Emergency departments, psychiatric units, dementia care
• Visitor confrontations — ICU waiting areas, end-of-life situations
• Drug-seeking behavior — Emergency departments, pharmacies
• OSHA's specific guidelines (OSHA 3148/3827) provide detailed recommendations
• Many states require specific healthcare violence prevention programs

Construction

Construction faces unique violence risk factors:

• Multi-employer worksites with unfamiliar workers
• Disputes over work quality, territory, or access
• Isolated work locations with limited communication
• Tools and equipment that can become weapons
• Substance abuse issues on some sites
• Traffic confrontations during road work
• Trespassers on active construction sites

Retail

Late-night and small retail operations face elevated robbery risk:

• Cash handling procedures are critical
• Adequate lighting and visibility
• Security cameras — visible deterrent
• Staffing — Never schedule single-worker shifts in high-risk areas
• Training on robbery response (comply, observe, report)

Legal Liability Beyond OSHA

Employers face legal exposure from multiple sources:

1. OSHA General Duty Clause — Citations and penalties
2. Workers' compensation — Mandatory coverage for violence-related injuries
3. Negligence lawsuits — "Negligent hiring," "negligent security," "negligent supervision"
4. EEOC — If violence is related to harassment or discrimination
5. State laws — Specific workplace violence statutes (California, New York, etc.)
6. Premises liability — Inadequate security for visitors and customers

The legal standard is foreseeability — could the employer have reasonably anticipated the risk? Previous incidents, industry data, and failed controls all establish foreseeability.

Program Evaluation

Annual Review

Evaluate program effectiveness annually by reviewing:

• Incident data — Trends in frequency, severity, and type
• Near-miss reports — Leading indicators of program gaps
• Employee surveys — Perception of safety, willingness to report
• Training effectiveness — Knowledge retention, behavior change
• Control measures — Are engineering controls functioning? Are policies being followed?
• Response times — How quickly are threats assessed and addressed?

Continuous Improvement

• Update the risk assessment when workplace conditions change
• Revise training content based on new threats and lessons learned
• Benchmark against industry best practices
• Incorporate employee feedback into program updates
• Track leading indicators (near-misses, threats reported) not just lagging indicators (injuries)

Conclusion

Workplace violence prevention is no longer optional — it's a legal requirement (through the General Duty Clause and increasing state legislation), a moral obligation, and a business necessity. The cost of a comprehensive prevention program pales in comparison to the human suffering, legal liability, and business disruption caused by a workplace violence incident.

Start with a honest risk assessment, build a written program with management commitment, train all employees on recognition and response, and establish robust reporting and investigation procedures. Use digital tools to track training completion, manage incident documentation, and maintain the records that demonstrate your commitment to a safe workplace.