Key Takeaways
- There is no federal OSHA standard for workplace violence. In February 2026, a Colorado psychiatric hospital learned that this does not matter.
- California employers have been legally required to maintain a written workplace violence prevention program since July 1, 2024; New York retailers since June 2, 2025.
- Cal/OSHA is required to adopt a full general industry workplace violence prevention standard by December 31, 2026.
- Nine fields are named in the violent incident log requirement, lettered (A) through (I).
- Training records are the outlier at one year. Applying a single one-year rule is a compliance failure across four record types at once.
- What a Workplace Violence Prevention Program Must Contain
- Does OSHA Require a Workplace Violence Prevention Program?
- How the General Duty Clause reaches violence
- What the Tenth Circuit confirmed in February 2026
- Where the federal healthcare rule actually stands
- California SB 553: The 10 Elements Your Written Plan Needs
- Who is covered, and the six exemptions
- The four types of workplace violence
- The Violent Incident Log: Nine Fields the Statute Names
- New York's Retail Worker Safety Act: Policy, Training, Buttons
- How Long to Keep Each Record
- The Document Set an Inspector Asks For
- Building the Program: A 30-Day Sequence
- Frequently Asked Questions
- Where This Leaves You
There is no federal OSHA standard for workplace violence. In February 2026, a Colorado psychiatric hospital learned that this does not matter.
Meanwhile, California employers have been legally required to maintain a written workplace violence prevention program since July 1, 2024, New York retailers since June 2, 2025, and Cal/OSHA is under orders to adopt a full general industry standard by December 31, 2026. This guide covers what the law actually requires you to put on paper: the ten elements of a compliant plan, the nine fields your incident log must capture, and how long you have to keep each document.
Please note: this article is general information, not legal advice. Requirements change, and they vary by state and industry. Confirm your obligations with your safety counsel or your state occupational safety agency before relying on any of it.
What a Workplace Violence Prevention Program Must Contain
A compliant written program, at minimum, contains these ten parts. California codified them in Labor Code section 6401.9, and they have become the working template most employers build from regardless of state:
- 1. Names and titles of the people responsible for implementing the plan
- 2. Procedures for employee involvement, including authorized employee representatives
- 3. Methods for coordinating implementation with other employers on site
- 4. Compliance procedures covering both supervisory and nonsupervisory employees
- 5. Communication and training procedures on workplace violence
- 6. Procedures to identify, evaluate, and correct workplace violence hazards
- 7. Response procedures for actual or potential incidents, including reporting without retaliation
- 8. Post-incident response and investigation procedures
- 9. Plan review and revision procedures
- 10. Any additional procedures required by regulatory agencies
The ten elements every compliant written plan has to address.
Everything else in this guide is about what fills those ten boxes, and what evidence you have to keep afterward.
Does OSHA Require a Workplace Violence Prevention Program?
Federally, there is no standard that says "you must have a workplace violence program." That answer is technically correct and dangerously incomplete.
How the General Duty Clause reaches violence
Section 5(a)(1) of the Occupational Safety and Health Act of 1970 requires every employer to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." That single sentence is how OSHA cites workplace violence, and it is why the absence of a specific standard offers far less protection than employers assume.
The practical trigger is the word recognized. Once violence is foreseeable in your setting, whether through your own incident history, industry data, or warnings your staff has already raised, it becomes a hazard you are expected to address. Your own records can establish recognition against you.
Penalties follow OSHA's standard schedule. Under the agency's 2026 civil penalty adjustments, there was no inflation increase this year, so the 2025 amounts carry forward: $16,550 for a serious or other-than-serious violation, $165,514 for a willful or repeated violation, with willful violations carrying a floor of $11,823, and $16,550 per day for failure to abate. If you want the wider picture, we break down how OSHA classifies violations and sets penalties separately.
What the Tenth Circuit confirmed in February 2026
On February 13, 2026, the Tenth Circuit decided Cedar Springs Hospital v. Occupational Safety and Health Review Commission, No. 24-9519, upholding OSHA citations issued to a Colorado psychiatric hospital over workplace violence. A companion decision, UHS of Delaware v. OSHRC, No. 24-9521, came down alongside it.
The hospital's central argument was jurisdictional. It contended that because the Centers for Medicare and Medicaid Services already regulates hospital safety, OSHA had no business citing it. The court rejected that, holding that CMS oversight of patient safety does not displace OSHA's independent responsibility for employee safety.
Read plainly, the decision closes a defense that healthcare employers had been leaning on. It also confirms at the appellate level that the General Duty Clause is a workable enforcement tool for violence hazards, which raises the stakes for every employer still waiting for a standard before acting.
Where the federal healthcare rule actually stands
OSHA has been working toward a standard for Prevention of Workplace Violence in Healthcare and Social Assistance, docketed as RIN 1218-AD08. A Small Business Advocacy Review panel convened in March 2023 and issued its report on May 1, 2023.
Then it stalled. The Spring 2025 regulatory agenda moved the rule to Long-Term Action, and the date for a notice of proposed rulemaking is now listed as to be determined.
Two things follow. First, a federal healthcare standard is not arriving on any announced schedule. Second, that makes state law and General Duty Clause enforcement the entire operative framework, which is exactly why the sections below matter more than the pending rule does.
California SB 553: The 10 Elements Your Written Plan Needs
Senate Bill 553 amended Labor Code section 6401.7 and created section 6401.9. Cal/OSHA confirms the requirements became enforceable on July 1, 2024.
The plan is not a standalone document in spirit. It sits inside your injury and illness prevention program, must be maintained at all times across all of your facilities, and must be reviewed at least annually, whenever a deficiency becomes apparent, and after any workplace violence incident.
A larger change is coming. Cal/OSHA is required to adopt a full general industry workplace violence prevention standard by December 31, 2026. The statute set the floor; the standard will set the detail. Anyone treating their current plan as finished should expect to revise it.
Who is covered, and the six exemptions
Section 6401.9 reaches all employers, employees, places of employment, and employer-provided housing, with six exemptions listed at subsection (b)(2)(A) through (F):
- Health care facilities already covered by specific workplace violence regulations
- Employers complying with those specified healthcare regulations
- Department of Corrections and Rehabilitation facilities in compliance with applicable standards
- Law enforcement agencies with confirmed POST compliance
- Employees teleworking from a location of their choosing not under the employer's control
- Workplaces with fewer than 10 employees present at a time, not open to the public, that comply with the injury and illness prevention program regulation
Note what the last one does not say. It is not a blanket small-employer exemption. Fewer than ten employees is only half the test; if the public can walk in, you are covered. A six-person shop with a customer counter has a plan obligation. A six-person back office does not.
The four types of workplace violence
Cal/OSHA classifies incidents into four types, and your log has to identify which applies:
- Type 1: violence committed by a person who has no legitimate business at the worksite
- Type 2: violence directed at employees by customers, clients, patients, students, inmates, or visitors
- Type 3: violence against an employee by a present or former employee, supervisor, or manager
- Type 4: violence committed in the workplace by a person who does not work there but has, or is known to have had, a personal relationship with an employee
The typology is not academic. Type 2 dominates in healthcare and retail and calls for environmental and staffing controls. Type 4 arrives through the front door because of a domestic situation and calls for access control and a way for an employee to flag a threat confidentially. A single generic "violence policy" tends to fail at least two of the four.
The Violent Incident Log: Nine Fields the Statute Names
Most coverage stops at "you must keep a violent incident log." Labor Code 6401.9(d)(2) is far more specific than that. Nine fields are named, lettered (A) through (I):
| Field | What it records |
|---|---|
| (A) | The date, time, and location of the incident |
| (B) | The workplace violence type or types involved |
| (C) | A detailed description of the incident |
| (D) | Perpetrator classification: client or customer, family or friend, stranger, coworker, supervisor, partner or spouse, relative, or other |
| (E) | Circumstances: usual duties, poor lighting, rushed, low staffing, working alone or isolated, unable to get help, community setting, unfamiliar location |
| (F) | Where it happened: workplace, parking lot, or other area |
| (G) | Incident type: physical attack without a weapon, attack with a weapon or object, threat of force, sexual assault or threat, animal attack, or other |
| (H) | Consequences, including whether security or law enforcement was contacted and what protective actions were taken |
| (I) | Name and job title of the person completing the entry, and the date completed |
Three details employers get wrong.
Entries must be built from real accounts. Each one draws on information from the employees who experienced the violence, witness statements, and investigation findings. A manager's one-line recollection written a week later does not meet the standard.
Redaction is a separate obligation. Your internal investigation file can name people. The log itself is accessible on request, so personally identifiable information has to come out of the version you hand over. Keeping one document that serves both purposes is how confidential information gets disclosed.
Field (E) is doing quiet work. It asks whether the employee was working alone, short-staffed, in poor lighting, or unable to summon help. Answer it honestly across a year of entries, and you have documented a pattern of correctable conditions. Answer it dishonestly, and you have created a written record that contradicts your own hazard assessment.
Keep the log for at least five years. Where an incident causes a recordable injury, it also flows into your OSHA 300 log, so check your Forms 300, 300A and 301 obligations at the same time.
New York's Retail Worker Safety Act: Policy, Training, Buttons
New York took a narrower, retail-specific route under Labor Law section 27-e. It covers every employer with 10 or more retail employees in the state.
Late-night hours, cash handling, and lone working are named risk factors under the New York policy.
The timeline shifted once. The act originally took effect 180 days after enactment, on March 4, 2025. A 2025 amendment pushed the policy and training obligation to June 2, 2025 and replaced the original panic button provision with the silent response button rule described below.
The state's model policy sets out four things a compliant policy must contain:
- A list of risk factors, including late-night or early-morning hours, exchanging money with the public, working alone or in small numbers, and uncontrolled access into the workplace
- Methods the employer may use to prevent incidents, including systems for employees to report them
- Information on federal and state laws covering violence against retail workers, remedies available to victims, and a statement that local laws may also apply
- A statement that retaliation against workers who complain is against the law
Training frequency scales with headcount. Employees are trained on hire, then annually where the employer has 50 or more retail employees, or every two years where it has fewer than 50.
From January 1, 2027, retailers with 500 or more employees statewide must provide a silent response button that summons a security officer, manager, or supervisor. It can be fixed in an accessible location, wearable, or app-based, and location tracking is permitted only while the button is active.
The pairing to notice is that New York specifies a policy and training obligation while California specifies a program and recordkeeping obligation. A retailer operating in both states needs both, and one document will not satisfy the two.
How Long to Keep Each Record
The retention rule most employers get wrong is that the periods are not uniform.
| Record | Minimum retention |
|---|---|
| Hazard identification, evaluation, and correction records | 5 years |
| Violent incident log | 5 years |
| Incident investigation records | 5 years |
| Training records | 1 year |
| Cal/OSHA Form 300 | 5 years |
Training records are the one-year outlier in an otherwise five-year program.
Training records are the outlier at one year. Applying a single five-year rule across the whole program is harmless and often sensible. Applying a single one-year rule is a compliance failure across four record types at once, and it is the more common mistake because training records are the ones people handle most often.
The Document Set an Inspector Asks For
Compliance is proven with documents, not intentions. When an inspector arrives, the folder needs to hold:
- The written plan, current, dated, and naming the responsible individuals
- The violent incident log, in a redacted form you can hand over
- Hazard identification, evaluation, and correction records, showing what you found and what you fixed
- Training records, showing who was trained, when, and on what
- Investigation records for each incident
- Evidence of the annual review, plus reviews triggered by incidents or observed deficiencies
Compliance is proven with dated documents, not with intentions.
That last item is the one most often missing. The plan itself usually exists. Proof that anyone looked at it in the last twelve months usually does not, and an undated plan invites the assumption that it was written once and shelved. Our guide to what an OSHA inspector asks for on arrival covers the wider document expectations.
Building the Program: A 30-Day Sequence
For an employer starting from nothing, this order front-loads the work that carries legal weight.
- 1. Days 1 to 5: confirm your coverage. Check headcount, public access, state, and industry against the exemptions before you write anything.
- 2. Days 6 to 10: assign ownership. Name the responsible individuals by title. Element one of the plan cannot be satisfied by a department.
- 3. Days 11 to 15: run the hazard assessment. Walk the site for the field (E) conditions: lone working, low staffing, poor lighting, uncontrolled access, cash handling.
- 4. Days 16 to 20: draft the plan against the ten elements. Treat them as a checklist and confirm each one is addressed explicitly, not implied.
- 5. Days 21 to 25: build the log and the reporting route. Set up all nine fields, plus a redaction step and a reporting channel with a written anti-retaliation guarantee.
- 6. Days 26 to 30: train and document it. Deliver training on the plan, on how to report, and on the hazards specific to your site, then file the roster.
Set your annual review date on day 30 while you are still thinking about it. Because violence is only one of the hazards a full program has to address, it is worth reading this alongside where violence sits among the main workplace hazards and your baseline duties under the OSH Act.
Frequently Asked Questions
There is no federal standard requiring one. OSHA enforces workplace violence through the General Duty Clause, Section 5(a)(1), which requires a workplace free from recognized hazards. California and New York impose their own written requirements.
Ten elements under California Labor Code 6401.9: responsible persons, employee involvement, coordination with other employers, compliance procedures, communication and training, hazard identification and correction, emergency response and non-retaliatory reporting, post-incident investigation, plan review, and any agency-required additions.
Six categories: covered health care facilities, employers meeting specified healthcare regulations, compliant Corrections facilities, POST-compliant law enforcement, teleworkers at locations outside employer control, and workplaces with fewer than 10 employees that are not open to the public.
A record required by Labor Code 6401.9(d)(2) capturing nine specific fields for every incident, including date and time, violence type, description, perpetrator and circumstance classifications, location, incident type, consequences, and who recorded it. Keep it at least five years.
Type 1 is by someone with no legitimate business at the site. Type 2 is by customers, clients, patients, students, inmates, or visitors. Type 3 is by a current or former employee, supervisor, or manager. Type 4 is by someone with a personal relationship to an employee.
Five years for hazard identification and correction records, violent incident logs, and investigation records. Training records require only one year, which is the exception employers most often miss.
Where This Leaves You
The gap between "no federal standard exists" and "we have no obligation" is where citations happen. A workplace violence prevention program is now required in writing in California, required as a policy and training program for New York retail, and enforceable everywhere else through a clause that a federal appeals court has just confirmed reaches violence hazards.
The employers who handle this well treat it as a documentation exercise with a legal deadline rather than a values statement. Ten plan elements. Nine log fields. Five years of records, except training at one. A dated annual review that proves someone looked.
If your plan does not currently answer all ten elements, that is the afternoon's work. Start there, and set the review date before you close the file.
Which requirement is causing your team the most difficulty, and are you working across more than one state? Share your situation in the comments, and send this to whoever owns your written safety programs.
A written workplace violence prevention program only works when your people are trained on it. Our New York OSHA 10-Hour and 30-Hour courses cover the general industry safety requirements your program sits inside.
Explore New York Courses
