Workplace Violence Prevention Plans: OSHA & State Requirements

8/9/2026

For most of the last three decades, workplace violence prevention was a best practice. There was no federal standard requiring a plan, and OSHA enforced sporadically through the General Duty Clause.

That has changed. California now requires nearly every employer in the state to maintain a written workplace violence prevention plan, maintain a violent incident log, and train employees annually. New York has imposed requirements on retail employers. A growing set of states mandates plans in healthcare and the public sector. For multi-state employers, the practical question is no longer whether to have a plan but whether the plan you have satisfies the strictest jurisdiction you operate in.

The Federal Picture

There is no general OSHA standard specifically requiring workplace violence prevention programs for most private employers.

What exists instead:

• The General Duty Clause. Section 5(a)(1) of the OSH Act requires employers to furnish a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA has cited employers under this clause where workplace violence was a recognized hazard in the industry, the employer knew or should have known of it, and feasible abatement measures existed and were not implemented.
• Establishing a General Duty Clause violation is demanding, but OSHA has done it — most often in healthcare, social services, late-night retail, and corrections, where violence is a documented industry hazard.
• Enforcement guidance and recommended practices for healthcare and social service settings, which — while not themselves enforceable standards — establish what OSHA considers feasible abatement, and are therefore what a citation will be measured against.
• Recordkeeping. Injuries resulting from workplace violence are recordable on the OSHA 300 log under the ordinary criteria.

[VERIFY whether OSHA has finalized a workplace violence prevention standard for healthcare and social assistance — this has been in rulemaking.]

State Mandates

California — the broadest requirement

California's workplace violence prevention law applies to nearly all employers in the state, not just high-risk industries. Covered employers must:

• Establish and maintain a written Workplace Violence Prevention Plan, which may be a standalone document or incorporated into the Injury and Illness Prevention Program
• Include procedures for employee involvement, hazard identification and correction, incident response, emergency response, and post-incident investigation
• Maintain a violent incident log recording each incident, with specified detail, regardless of whether an injury occurred
• Provide training at plan rollout and annually thereafter, in a manner employees understand
• Retain records — the incident log, hazard assessments, and training records — for specified periods

[VERIFY the covered-employer definition, the limited exemptions, and each retention period against Labor Code section 6401.9.]

The incident log is the requirement most employers underestimate. It captures a broader set of events than most reporting systems do — including incidents involving no injury and incidents involving customers, patients, or visitors — and it must be maintained contemporaneously, not reconstructed.

New York — retail employers

New York's Retail Worker Safety Act requires covered retail employers to adopt a workplace violence prevention policy and provide training, with additional obligations — including panic button provisions — for larger employers. [VERIFY the size thresholds, training frequency, and the effective date of the panic button provision, which was modified after enactment.]

Healthcare and public sector mandates

A number of states impose workplace violence prevention requirements specifically on healthcare facilities, and several impose them on public employers. Requirements typically include a written plan, a hazard assessment, incident reporting and tracking, training, and in some cases specific security measures.

[VERIFY the current list of states — it has grown steadily and requirements differ substantially.] See our HR Training by State resources.

The Four Types of Workplace Violence

Effective planning starts by recognizing that these have different perpetrators, different warning signs, and different controls.

Type II is the most common source of injury across the economy, driven by healthcare and social services. Type III and IV generate the most fatalities per incident and are where HR's role is most direct.

What the Plan Must Contain

Whether required by statute or adopted voluntarily, an adequate plan covers:

1. Policy statement — prohibited conduct defined concretely, including threats, intimidation, stalking, and weapons possession, with the scope covering employees, contractors, customers, and visitors
2. Hazard assessment — a documented evaluation of workplace-specific risks by location, role, shift, and function, reviewed periodically and after any incident
3. Engineering and administrative controls — access control, alarm systems, visibility and lighting, safe rooms, staffing levels, cash handling, procedures for high-risk tasks such as home visits or late-night solo work
4. Reporting procedures — multiple channels, an explicit statement that all threats are reported regardless of perceived seriousness, and a guarantee of no retaliation for reporting
5. Response procedures — who is notified, who assesses, what interim measures are available, when law enforcement is involved
6. Emergency procedures — evacuation, shelter, lockdown, communication, and reunification
7. Threat assessment process — described below
8. Post-incident procedures — medical care, investigation, employee support and counseling, debrief, and corrective action
9. Training — for all employees, with additional content for managers
10. Recordkeeping — incident log, assessments, training records, retained per applicable requirements

Threat Assessment

The single most valuable component, and the one most policies omit.

Establish a multidisciplinary team — HR, security, legal, and where appropriate an outside threat assessment professional, EAP, and local law enforcement liaison. Define who convenes it and how quickly.

Assess behavior, not profiles. There is no reliable demographic or personality profile of a person who becomes violent. Assessment focuses on observable behavior on a pathway toward violence: grievance formation, ideation, research and planning, preparation, breach, and attack. Behaviors of concern include escalating grievance, threats direct or veiled, fixation on a person or cause, weapons acquisition or unusual interest, boundary probing, and a marked change in behavior or a significant personal loss.

Assess and manage — do not simply eliminate. The instinct on receiving a threat report is to terminate immediately. Sometimes that is right. But termination is a destabilizing event that removes the organization's visibility into the person and can accelerate rather than reduce risk. The decision on how and when to separate someone of concern is a threat management decision, not only an HR decision, and it should be made by the team with a safety plan in place.

Avoid rigid zero-tolerance language that forecloses judgment. A policy requiring automatic termination for any statement construed as a threat produces two bad outcomes: employees stop reporting because they do not want a colleague fired over a frustrated remark, and the organization loses the ability to manage a genuine case deliberately. State that all reports are assessed and that responses range from coaching through termination and law enforcement referral.

Termination Is the Highest-Risk Moment

Where a termination involves any elevated concern, plan it:

• Conduct the meeting early in the week and early in the day, so support resources are available
• Choose a location with clear egress for the employee and for those present
• Have security aware, present or nearby, without staging a spectacle that humiliates the person
• Coordinate system and building access revocation to the exact effective time
• Arrange return of property in a way that does not require a later confrontation
• Provide EAP information and, where warranted, transition support — treating someone with dignity is both right and a genuine risk-reduction measure
• Consider notification to affected employees, and any need for a workplace restraining order
• Do not conduct a high-risk termination without HR present, and never by a lone manager

Domestic Violence Spillover

Type IV violence enters the workplace through an employee's personal life, and the workplace is often the one location where a perpetrator reliably knows the victim will be.

Practical measures: designate a confidential point of contact, offer safety planning support including schedule and location changes, parking escorts, and screening of calls and visitors; support the employee in obtaining a protective order, and — where available under state law — pursue a workplace restraining order that covers the premises; provide security with photographs and vehicle information with the employee's consent; and know your state's leave entitlements for victims of domestic violence, which many states provide.

Handle all of this with the employee, not around them. Employees experiencing domestic violence generally understand their own risk better than anyone else in the building, and unilateral action taken without them can escalate the danger.

Frequently Asked Questions

Is a workplace violence prevention plan legally required?

There is no general federal standard, but OSHA enforces through the General Duty Clause where violence is a recognized industry hazard. California requires plans of nearly all employers in the state, New York imposes requirements on retail employers, and a number of states mandate plans in healthcare and the public sector.

What is a violent incident log?

A contemporaneous record of workplace violence incidents with specified detail, required under California's law. It captures a broader set of events than most reporting systems — including incidents with no injury and those involving customers or visitors.

Should we have a zero-tolerance workplace violence policy?

Prohibit the conduct absolutely, but avoid language mandating automatic termination for any perceived threat. Rigid automatic consequences suppress reporting and remove the ability to manage a genuine threat deliberately. State that all reports are assessed and responses vary.

Who should be on a threat assessment team?

HR, security, and legal at minimum, with access to an outside threat assessment professional, EAP, and a law enforcement liaison. Define who convenes it and the required response time.

Are workplace violence injuries recordable on the OSHA 300 log?

Yes, under the ordinary recordability criteria. Injuries resulting from workplace violence are treated like any other work-related injury for recordkeeping.

What should we do when an employee discloses domestic violence?

Work with them, not around them. Offer a confidential contact, safety planning, schedule and location adjustments, escorts, and visitor screening; support a protective order and, where state law allows, a workplace restraining order; and check your state's leave entitlements for victims.

The Bottom Line

If you operate in California, you need a written plan, an incident log, and annual training regardless of industry — that requirement is broad and specific. Everywhere else, build the plan to the same standard anyway: a documented hazard assessment, multiple reporting channels with no retaliation, a real threat assessment team, and a deliberate protocol for high-risk terminations. The plan is cheap; the incident is not.

For structured instruction, explore our OSHA Training Courses, review the Glossary of OSHA and Safety Terms, or see our Manager & Supervisor Training.