There is no federal OSHA workplace violence standard for healthcare. There is a General Duty Clause, a four-part test, and an inspector who reads your own records to apply it.
The most common thing hospital leaders believe about OSHA and workplace violence is that there is a standard for it. There is not. Federal OSHA has never issued a workplace violence standard for healthcare, and the rulemaking that would create one is parked with no date attached.
Some leaders assume accreditation work covers OSHA. Others conclude OSHA cannot reach them on workplace violence. Neither is true: OSHA cites hospitals for workplace violence today under a single sentence of the 1970 statute, and a federal appeals court affirmed one of those citations in February 2026.
What OSHA requires is less specific than a standard and, in some ways, harder to satisfy. The General Duty Clause asks whether you knew about a hazard, whether there was a reasonable way to fix it, and whether you did. The answers come from documents your organization already produced.
This article goes deeper on the OSHA layer of our article Workplace Violence Compliance in Healthcare: Joint Commission, CMS, OSHA, and State Requirements. OSHA compliance is the floor of a workplace violence program, and the organizations that clear it most easily are the ones that built for the bedside rather than for the inspector.
Federal OSHA has no healthcare workplace violence standard. The proposed rule, RIN 1218-AD08, has sat in Long-Term Actions since September 2025, and there is no National Emphasis Program.
Enforcement runs through the General Duty Clause, OSH Act §5(a)(1), which requires OSHA to prove four elements: exposure, recognition, serious harm, and a feasible method of abatement.
Accreditation does not protect you. In February 2026 the Tenth Circuit held that CMS and accreditation compliance do not displace an OSHA citation.
Healthcare cannot easily claim it did not know. The Joint Commission, CMS, and state law already require hospitals to assess this hazard, so the real question is what you did with what you found.
No. Federal OSHA has no workplace violence standard for healthcare. It enforces workplace violence hazards through the General Duty Clause, OSH Act §5(a)(1), which requires every employer to keep its workplace free of recognized hazards that are causing or are likely to cause death or serious physical harm.
The proposed healthcare rule, RIN 1218-AD08, was moved to Long-Term Actions in the Unified Agenda published September 22, 2025, with its proposed rule date changed to "To Be Determined," and it remained there in the agenda released July 3, 2026. There is no National Emphasis Program and no healthcare workplace violence Regional Emphasis Program. What OSHA does have is an enforcement directive, CPL 02-01-058, dated January 10, 2017, and still current, which expressly identifies healthcare as a high-risk industry.
The document everyone cites is OSHA 3148-06R (2016), Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers. It is voluntary guidance, not a standard, and it matters anyway, because it is usable as evidence that a hazard was recognized and that abatement was feasible. Its five components are:
Management commitment and employee participation
Worksite analysis
Hazard prevention and control
Safety and health training
Recordkeeping and program evaluation
OSHA has to prove four elements, and every one of them is answered by records the hospital created. CPL 02-01-058 states them plainly: the employer failed to keep the workplace free of a hazard to which its own employees were exposed; the hazard was recognized; the hazard was causing or was likely to cause death or serious physical harm; and there was a feasible and useful method to correct the hazard. In healthcare, the first and third are rarely in serious dispute, so the case is usually fought over the second and fourth.
| General Duty Clause element | What OSHA must show | What your records show |
|---|---|---|
| Exposure | Your own employees were exposed to a foreseeable violence hazard | Incident reports, the OSHA 300 log, and security logs for the units where incidents occur |
| Recognized hazard | You or your industry knew the hazard existed | Prior incidents, worksite analyses, committee minutes, and healthcare's status as a named high-risk industry |
| Serious harm | The hazard caused or was likely to cause death or serious physical harm | Injury severity on the 300 log, days away and restricted duty, workers' compensation claims |
| Feasible abatement | A feasible and useful method existed to correct the hazard | Your own corrective actions with owners and dates, or their absence, measured against OSHA 3148-06R |
Recognition can be shown two ways: the employer knew, or the industry knew. Healthcare loses the second argument before it starts, because OSHA has published healthcare-specific guidance since 1996 and names the sector as high-risk in its own directive. The more useful question is what your records say about where you knew it, when you knew it, and what you did next. A worksite analysis naming the emergency department waiting room as a hot spot is recognition, and so is an incident trend reported to your safety committee.
Healthcare sits in a position few other industries share, and it changes how this element plays out. Most employers are asked to recognize a hazard. Hospitals are required to go looking for it, on a schedule, by every other regulator they answer to. The Joint Commission requires an annual worksite analysis under NPG.02.04.01. CMS, through QSO-23-04-Hospitals, expects a patient risk assessment strategy and the identification of patients at risk for intentional harm to self or others. Nineteen states require a written prevention plan. And the OSHA 300 log records every assault serious enough to cost work time. Each of those is a self-assessment the hospital performs, signs, and files.
When an OSHA-recordable assault happens, the question of whether the hazard was known has usually been answered already, in the hospital's own handwriting. It is difficult to tell an inspector you did not know a hazard existed when your accreditor, your CMS surveyors, and your state all required you to find it, and you did.
Feasibility asks whether a reasonable method existed to eliminate or materially reduce the hazard. OSHA looks at what the guidance recommends, what comparable hospitals do, and what you did yourself. That last source is the one leaders underestimate. Controls you piloted in one unit and never spread, and training you scoped for one department and not the next, are evidence that abatement was feasible. Feasible abatement is also broader than hardware. Vistelar training calls operational issues an often-overlooked way to reduce conflict: minimizing wait times, telling people about a delay before they have to ask, and cutting steps and paperwork. Those are administrative controls in the 3148-06R sense, and few controls are cheaper. Management commitment is the first 3148-06R element, and a program that lives in a binder, with no leadership ownership visible in the minutes, reads poorly here.
An inspector starts with your injury and illness records and then looks for everything those records missed. CPL 02-01-058 directs inspectors to review injury and illness records from five years prior for injuries associated with workplace violence, then, whenever possible, to check for incidents that never reached the OSHA log:
Workers' compensation and insurance records
Police and security reports
First-aid and near-miss logs
Workplace violence hazard assessments
Safety and health meeting minutes
They also ask about training and review the written plan.
Those records live with at least four different owners: workers' compensation with human resources or risk, the 300 log with employee health, security events with security, and clinical events with quality. Across the health systems I have worked with, those data sets rarely meet in one place until something forces them to, and an inspection is a bad day to learn that your security reports show far more incidents in a unit than your 300 log does. The gap usually opens at the point of report. Vistelar training teaches staff to report every incident, no matter how minor, promptly (for example, within 24 hours) and in objective language: "raised their voice and stepped closer," not "became hostile." Reports written that way reconcile across systems.
Assaults resulting in days away or restricted duty are recordable on the OSHA 300 log, and an elevated days away, restricted, or transferred rate can make an establishment selectable for a programmed inspection that arrives without a complaint or a referral. Under-recording to suppress the rate is not a way out; it creates independent recordkeeping exposure, and the discrepancy shows immediately.
On penalties, the current maximums are $165,514 per violation for willful or repeated violations and $16,550 for serious violations. Failure to abate adds up to $16,550 per day beyond the abatement date, generally capped at 30 days, so a single unabated violation can reach roughly $496,500. These are the 2025 amounts carried into 2026 because the 2026 inflation adjustment was cancelled.
Passing your Joint Commission survey is not a defense to an OSHA citation, and a federal appeals court said so in 2026. On February 13, 2026, the Tenth Circuit issued a published opinion in Cedar Springs Hospital, Inc. v. OSHRC, No. 24-9519, affirming a General Duty Clause citation against a psychiatric hospital for workplace violence. It held that compliance with CMS requirements and accreditation standards does not displace OSHA. It noted that an accreditor "is a private entity, not an agency exercising regulatory authority."
Across markets, I often see leaders treating NPG.02.04.01, the National Performance Goal that took effect in January 2026, as their OSHA answer. The two systems ask different questions. A survey asks whether the program exists. The General Duty Clause asks whether a recognized hazard was left in place when a feasible fix was available. The survey checks that a worksite analysis was done; OSHA checks what happened to its findings.
The records that demonstrate compliance are the same records that prove notice, and the Tenth Circuit case shows how. The court found abatement feasible partly on the strength of what the hospital did after it was cited. Evidence of effectiveness came, in the court's words, "not only from experience at other hospitals but also from Cedar Springs' actions following the citation." The fixes it made afterward helped show those fixes were feasible all along.
Documenting less is the wrong lesson. A thin file in a setting with obvious risk reads as indifference rather than innocence, and it fails the requirements that compel the records in the first place. So is hesitating on fixes. The better lesson is that the window in which a known hazard sits unremediated is the window that creates the exposure, and its length is entirely within your control.
"Every finding left without action stays on file as something you knew and did not fix."
Casey Goldschmidt, CEM
Recognition also does not depend on which department wrote the document. Any hazard identified in a workplace violence assessment, a security vulnerability assessment, or a risk management review should be treated as a known hazard for OSHA's purposes, because once it is written down, the organization knew. That is why best practice is to pair every assessment with a written mitigation plan, phased so the highest-risk findings move first. Each finding gets an owner, a target date, and a status someone outside the safety department can read. A correction that cannot be finished this year gets an interim control and a documented reason rather than silence. Committee minutes should show decisions, not report-outs, and debriefs feed the same file: held as soon as practical, with everyone involved, and framed as learning rather than blame. A finding with a plan attached shows an organization working the problem. A finding without one is proof of notice and nothing else.
The federal bill that would create an OSHA obligation has not moved, so build to the requirements already in force. The Workplace Violence Prevention for Health Care and Social Service Workers Act, H.R.2531 and S.1232, would direct the Department of Labor to issue an enforceable OSHA standard, the very thing the agency has shelved. The Save Healthcare Workers Act, H.R.3178 and S.1600, would make assaulting a hospital worker a federal crime and fund voluntary hospital security grants; it imposes no employer obligation. All four bill numbers sit at their 2025 committee referrals with no hearing, markup, or floor action as of October 2026.
A program built to the five 3148-06R components, with real worksite analysis and documented abatement, already satisfies the General Duty Clause and will be most of the way to whatever a future standard requires.
If you operate in a state with its own OSHA plan, the federal picture is only part of your obligation. OSHA describes state plans as programs that must be at least as effective as federal OSHA, and 22 cover both private-sector and public workers. Seven others, including Connecticut, Illinois, New Jersey, and New York, cover only public employees, so private hospitals there stay under federal OSHA while still owing their state's own workplace violence statute.
California went furthest past the federal floor. Cal/OSHA's healthcare workplace violence standard, Title 8 §3342, requires a written plan, hazard identification, a violent incident log, initial and annual training, and incident reporting to Cal/OSHA. Nineteen states now require a written prevention plan, and our article Workplace Violence Compliance in Healthcare maps all of them.
Build the program, and the records OSHA wants will exist because the program produced them.
I once worked for an organization that put workplace violence prevention entirely on security and safety. It kept us in reactive mode, with plenty of response data and little evidence of prevention. What changed it was a dedicated, multidisciplinary workplace violence committee with nursing, quality, human resources, legal, and communications at the table, an hour a month, and the authority to assign actions.
When I sit down with a chief nursing officer and a chief operating officer, the fastest conversation is about the four data sets: workers' compensation, OSHA recordables, security events, and clinical events. Put them in one view with one owner for the aggregate, and you see where risk concentrates, you can show an inspector you knew and acted, and you can put a real number on what workplace violence costs.
Training follows the same logic: one shared framework, tiered by risk. In Vistelar training the framework is the 6 C's of Conflict Management, with Context, Contact, and Closure for every interaction and Conflict, Crisis, and Critical when one escalates. The Foundational tier reaches every role, the Enhanced tier adds de-escalation for higher-risk roles, and the Stabilization tier adds structured physical response in the emergency department and behavioral health. Dated individual completion records turn that training into documented, feasible abatement.
OSHA does not tell hospitals what to build; it asks whether they knew about a hazard, whether a fix was feasible, and whether they made it, and it answers those questions from the hospital's own records. Treat the General Duty Clause as the floor, build a risk-tiered, data-driven program on top of it, and the records will follow.
This article is general information about regulatory requirements and is not legal advice. Requirements change. Confirm anything you plan to rely on with your own counsel.
This blog covers topics that include: Compliance · OSHA Requirements