Workplace Violence Prevention: OSHA Requirements & Employer Guide

Introduction: Workplace Violence as an Occupational Hazard

Workplace violence is an occupational safety concern in virtually every industry. OSHA, citing the Bureau of Labor Statistics Census of Fatal Occupational Injuries, reports that violent acts caused 740 of the 5,283 fatal workplace injuries in 2023, the third-leading cause of fatal occupational injuries; homicides (458) were 8.7 percent of all work-related deaths. Beyond fatalities, many workers report violence each year, from threats and verbal abuse to physical assaults, and OSHA notes that many more cases go unreported.

For employers, workplace violence represents a convergence of legal liability, worker safety, productivity loss, and reputational risk. OSHA has no dedicated workplace violence standard, so it enforces prevention through the General Duty Clause, and state laws such as California's add specific requirements.

This guide provides a framework for workplace violence prevention that meets current OSHA expectations, state law requirements, and industry best practices for 2026.

There is no federal OSHA workplace violence standard: OSHA enforces violence prevention through the General Duty Clause, Section 5(a)(1) of the OSH Act, injuries from violence at work are recorded under 29 CFR 1904 like any other, and California has required most employers to keep a written prevention plan since July 1, 2024.

OSHA's Regulatory Framework

The General Duty Clause

Without a specific standard, OSHA relies on Section 5(a)(1) of the OSH Act — the General Duty Clause:

"Each employer shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm."

For a General Duty Clause citation related to workplace violence, OSHA must establish (Field Operations Manual, Chapter 4):

1. A hazard existed: A condition or practice that exposed employees to violence
2. The hazard was recognized: By the employer, the industry, or common sense (prior incidents, industry data, or expert knowledge)
3. The hazard was causing or likely to cause death or serious harm: Based on the severity of potential outcomes
4. A feasible abatement existed: Reasonable measures were available to reduce the hazard

OSHA Guidance Documents

OSHA has published several guidance documents that, while not legally binding standards, establish expectations for employer programs:

• OSHA 3148: Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (2016)
• OSHA 3153: Recommendations for Workplace Violence Prevention Programs in Late-Night Retail Establishments
• OSHA 3976: Taxi Drivers: How to Prevent Robbery and Violence

State Laws

Several states have enacted specific workplace violence prevention laws that exceed federal OSHA requirements:

California Labor Code 6401.9 (SB 553), operative July 1, 2024:

• A written workplace violence prevention plan for nearly all employers, available to employees at all times (6401.9(c)(1)); healthcare facilities under Cal/OSHA's healthcare rule (8 CCR 3342), some corrections and law enforcement employers, teleworkers, and small sites closed to the public are exempt (6401.9(b)(2))
• Training when the plan is first established and annually thereafter (6401.9(e)(2))
• A violent incident log, kept at least 5 years (6401.9(f)(3))
• Training records, kept at least 1 year (6401.9(f)(2))

Other states have their own laws, many of them for healthcare or retail settings; check your state's labor department.

Types of Workplace Violence

California's Labor Code 6401.9(a) defines four types of workplace violence:

Type 1: Criminal Intent

The perpetrator has no legitimate business at the worksite, including anyone who enters the workplace or approaches workers intending to commit a crime:

• Armed robbery
• Trespassing
• Carjacking
• Assault during theft

Higher risk (OSHA): workers who exchange money with the public, delivery and taxi or ride-share drivers

Type 2: Customer/Client

The perpetrator is a customer, client, patient, or person receiving services from the business:

• Patient assaulting a healthcare worker
• Student attacking a teacher
• Citizen assaulting a government employee
• Customer confrontation in retail

Higher risk (OSHA): healthcare professionals, social assistants, public service workers, customer service agents

Type 3: Worker-on-Worker

Violence against an employee by a present or former employee, supervisor, or manager:

• Bullying and harassment
• Physical altercations between coworkers
• Supervisor/subordinate conflicts
• Threats or intimidation

Risk factors: Poor management, workplace culture, job stress, downsizing

Type 4: Personal Relationship

The perpetrator does not work there but has, or is known to have had, a personal relationship with an employee:

• Domestic violence spillover
• Stalking
• Disputes following a personal relationship into the workplace

All industries are at risk.

Building a Workplace Violence Prevention Program

OSHA's healthcare guidelines (OSHA 3148) build a program on five blocks: management commitment and worker participation, worksite analysis, hazard prevention and control, training, and recordkeeping and program evaluation. This guide follows them and gives incident response its own step.

Element 1: Management Commitment & Employee Involvement

Management commitment includes:

• Written policy statement declaring zero tolerance for workplace violence
• Designated program coordinator or committee
• Budget allocation for prevention measures (security, training, environmental modifications)
• Accountability at all management levels
• Response protocols for reported threats or incidents

Employee involvement includes:

• Participation in hazard identification and program development
• Reporting mechanisms without fear of retaliation (1904.35(b)(1)(iv))
• Feedback channels on program effectiveness
• Representation on safety committees

Element 2: Worksite Analysis and Risk Assessment

A thorough risk assessment identifies factors that contribute to violence potential:

Records analysis:

• Review past incident reports, workers' compensation claims, police reports
• Analyze patterns — time of day, location, type of incident, contributing factors
• Review OSHA 300 logs for violence-related recordable injuries (29 CFR 1904.29)

Environmental assessment:

• Evaluate building layout — access points, isolated areas, escape routes
• Assess lighting — parking lots, hallways, stairwells
• Review security measures — cameras, alarms, locks, access control
• Identify high-risk areas — cash handling, medication storage, isolated workstations

Job-specific analysis:

• Which positions involve contact with the public?
• Which positions involve cash handling or valuable goods?
• Which positions require working alone or in isolated areas?
• Which positions involve denying services or delivering bad news?
• Which positions involve working late nights or early mornings?

Industry data:

• Review BLS data for industry-specific violence rates
• Consult industry associations for sector-specific guidance
• Benchmark against peer organizations

Element 3: Hazard Prevention and Control

Based on the risk assessment, implement controls following the hierarchy:

Engineering Controls:

• Access control: Badge readers, buzzed entry, visitor management; locks that keep intruders out must still let employees open exit route doors from the inside at all times without keys, tools, or special knowledge (1910.36(d)(1); construction 1926.34(a))
• Physical barriers: Bullet-resistant enclosures, reception windows, raised counters
• Surveillance: Security cameras in high-risk areas
• Alarm systems: Panic buttons, silent alarms, duress codes
• Lighting: Adequate illumination in all areas, especially parking
• Safe rooms: Lockable interior rooms for shelter
• Furniture design: Bolted-down furniture, removal of potential weapons

Administrative Controls:

• Staffing: Adequate staffing levels during high-risk periods
• Cash handling: Minimal cash on hand, time-delay safes, armored pickup
• Work scheduling: Buddy system for isolated tasks, limit late-night solo work
• Visitor management: Sign-in procedures, escorts, restricted access
• De-escalation protocols: Trained procedures for handling confrontations
• Emergency procedures: Evacuation routes, lockdown procedures, communication plans, written into the emergency action plan where one is required (1910.38(c))

Personal Safety Measures:

• Personal alarms: Wearable panic buttons for high-risk positions
• Communication devices: Two-way radios, cell phones for isolated workers
• Self-defense training: Appropriate for healthcare, corrections (with caution)

Element 4: Training

Effective training is the cornerstone of prevention. All employees should receive training on:

General awareness training (all employees):

• Workplace violence policy and zero-tolerance commitment
• Types of workplace violence and warning signs
• Reporting procedures (how, when, to whom)
• Emergency response procedures (evacuation, lockdown, shelter)
• Retaliation protections for reporters (1904.35(b)(1)(iv); 29 CFR Part 1977)

Role-specific training:

• Managers/supervisors: Threat assessment, investigation procedures, documentation, employee assistance resources, legal obligations
• Front-line staff: De-escalation techniques, conflict resolution, customer interaction safety
• Security personnel: Response protocols, restraint techniques (where appropriate), coordination with law enforcement
• Healthcare workers: Patient behavior management, team-based response, restraint alternatives

Active shooter response: Following the DHS "Run, Hide, Fight" framework:

1. RUN: If safe evacuation is possible, evacuate immediately
2. HIDE: If evacuation is not possible, find a secure location, lock/barricade doors, silence phones
3. FIGHT: As an absolute last resort, take action against the active shooter

Training frequency:

• Initial training for all new employees
• Annual refresher training (required by California SB 553 and recommended generally)
• Supplemental training after incidents or when new hazards are identified

Element 5: Incident Response and Investigation

Immediate response:

1. Ensure safety of all employees — evacuate, provide medical attention; where no clinic or hospital is near, a trained first-aid provider must be available (1910.151(b); construction 1926.50(c))
2. Secure the scene and call law enforcement as appropriate
3. Notify management and activate emergency response plan
4. Document the incident while details are fresh; a recordable case goes on the OSHA 300 Log and 301 report within seven calendar days (29 CFR 1904.29(b)(3))

Investigation:

• Conduct a thorough root cause analysis — what happened, why, contributing factors
• Interview witnesses and involved parties
• Review security footage and access records
• Identify program failures — what controls failed or were missing?
• Develop corrective actions to prevent recurrence

Post-incident support:

• Provide Employee Assistance Program (EAP) referrals
• Offer critical incident stress debriefing for affected employees
• Allow time off for employees involved in traumatic incidents
• Follow up on workers' compensation claims
• Communicate with all employees about actions taken (without compromising investigations)

Recordkeeping Requirements

OSHA Recordkeeping (29 CFR 1904)

An injury from violence in the work environment is presumed work-related (1904.5(a)), and it is recordable on the OSHA 300 Log when it results in (1904.7(a)):

• Death
• Days away from work
• Restricted work or job transfer
• Medical treatment beyond first aid
• Loss of consciousness
• A significant injury or illness diagnosed by a PLHCP

An injury from a sexual assault is a privacy concern case: the employee's name stays off the log (1904.29(b)(6), (b)(7)(ii)). Psychological trauma after an incident is recorded only if the employee voluntarily provides a health care professional's opinion that the mental illness is work-related (1904.5(b)(2)(ix)), and it is then a privacy concern case too (1904.29(b)(7)(iii)).

Other Federal Rules That Reach a Violent Incident

• Reporting. A work-related death must be reported to OSHA within 8 hours (1904.39(a)(1)), and an in-patient hospitalization, amputation, or loss of an eye within 24 hours (1904.39(a)(2)).
• Emergency action plans. Where an OSHA standard requires an emergency action plan, it covers how to report emergencies and how to evacuate (1910.38(a), (c)(1)-(2)); lockdown and shelter steps fit naturally in it. Construction sites follow 1926.35.
• Retaliation. Employees must be able to report injuries without retaliation (1904.35(b)(1)(iv)), and Section 11(c) of the OSH Act protects safety complaints (29 CFR Part 1977).

California SB 553 Requirements

California employers must maintain:

• Violent incident log: Recording date, time, location, type, circumstances, and response for every incident. Retained for 5 years (6401.9(f)(3))
• Training records: Dates, content, trainer names and qualifications, attendees. Retained for 1 year minimum (6401.9(f)(2))
• Hazard and investigation records: Retained for 5 years (6401.9(f)(1), (f)(4))
• Written WVPP: Available to employees, their representatives, and Cal/OSHA at all times (6401.9(c)(1))

Recommended Documentation

Beyond legal requirements, maintain:

• Threat assessment records
• Restraining orders and protective orders involving employees
• Security audit reports
• Training attendance and evaluation records
• Investigation reports with corrective actions
• Program evaluation reports

Industry-Specific Considerations

Healthcare

Healthcare professionals and social assistants are on OSHA's list of higher-risk workers:

• Patient aggression: Emergency departments, psychiatric units, dementia care
• Visitor confrontations: ICU waiting areas, end-of-life situations
• Drug-seeking behavior: Emergency departments, pharmacies
• Bites and scratches: An assault that exposes a worker to blood triggers a confidential post-exposure evaluation and follow-up (29 CFR 1910.1030(f)(3))
• OSHA's guidelines (OSHA 3148) provide detailed recommendations
• Some states require healthcare violence prevention programs; California has a separate healthcare rule (8 CCR 3342)

Construction

Construction faces unique violence risk factors:

• Multi-employer worksites with unfamiliar workers
• Disputes over work quality, territory, or access
• Isolated work locations with limited communication
• Tools and equipment that can become weapons
• Substance abuse issues on some sites
• Traffic confrontations during road work
• Trespassers on active construction sites

Retail

Late-night and small retail operations face elevated robbery risk:

• Cash handling procedures are critical
• Adequate lighting and visibility
• Security cameras: visible deterrent
• Staffing: Avoid single-worker shifts in high-risk locations
• Training on robbery response (comply, observe, report)

Legal Liability Beyond OSHA

Employers face legal exposure from multiple sources:

1. OSHA General Duty Clause: Citations and penalties
2. Workers' compensation: Generally covers injuries from work-related assaults, under state law
3. Negligence lawsuits: "Negligent hiring," "negligent security," "negligent supervision"
4. EEOC: If violence is related to harassment or discrimination
5. State laws: Specific workplace violence statutes (California and others)
6. Premises liability: Inadequate security for visitors and customers

The legal standard is foreseeability — could the employer have reasonably anticipated the risk? Previous incidents, industry data, and failed controls all establish foreseeability.

Program Evaluation

Annual Review

Evaluate program effectiveness annually by reviewing:

• Incident data: Trends in frequency, severity, and type
• Near-miss reports: Leading indicators of program gaps
• Employee surveys: Perception of safety, willingness to report
• Training effectiveness: Knowledge retention, behavior change
• Control measures: Are engineering controls functioning? Are policies being followed?
• Response times: How quickly are threats assessed and addressed?

Continuous Improvement

• Update the risk assessment when workplace conditions change
• Revise training content based on new threats and lessons learned
• Benchmark against industry best practices
• Incorporate employee feedback into program updates
• Track leading indicators (near-misses, threats reported) not just lagging indicators (injuries)

Conclusion

Workplace violence prevention is no longer optional: it is a legal duty under the General Duty Clause wherever the hazard is recognized, a written-plan requirement in California, a moral obligation, and a business necessity. The cost of a comprehensive prevention program pales in comparison to the human suffering, legal liability, and business disruption caused by a workplace violence incident.

Start with an honest risk assessment, build a written program with management commitment, train all employees on recognition and response, and establish dependable reporting and investigation procedures. Use digital tools to track training completion, manage incident documentation, and maintain the records that demonstrate your commitment to a safe workplace.

Tools & related reading

• Document it: Emergency Action Plan Builder · OSHA 301 Incident Form · Toolbox Talk Generator
• Related guides: OSHA Safety Training Requirements 2026 · Emergency Action Plans for Construction · Is There an OSHA Heat Standard? (General Duty Clause context)
• 2026 OSHA penalty schedule · penalties by state

Sources & verification: OSHA's workplace violence page (with BLS CFOI 2023 figures), OSHA 3148, and Field Operations Manual Chapter 4 on osha.gov; California Labor Code 6401.9 on leginfo.legislature.ca.gov; 29 CFR 1904, 1910.38, and 1903.15(d) on the eCFR. All read October 6, 2026. General guidance, not legal advice.