What has to be reported, to whom, and on what clock, and why the follow-up record you attach to each report matters as much as the report itself.
Every hospital has an incident reporting system. Far fewer have a reporting process, and the difference shows up the first time a nurse asks what happened to the report they filed last month.
Workplace violence incident reporting obligations come from several directions at once: the Joint Commission, OSHA, the sentinel event process, and a growing list of states. Each lives in a different system, with a different owner, on a different clock.
Our article Workplace Violence Compliance in Healthcare: Joint Commission, CMS, OSHA, and State Requirements covers each regulator in full. This article focuses on the operational side: what must be reported and to whom, what follow-up is required, the frontline standard that makes reports usable, and how to turn four disconnected systems into one picture.
Every report starts an obligation, and the organizations that get this right treat the follow-up record as part of the report.
NPG.02.04.01 requires an internal process to report and analyze incidents and trends, follow-up and support for victims and witnesses, investigation of incidents, and reporting to the governing body.
OSHA imposes two separate duties: record qualifying injuries on the 300 log within seven calendar days, and report a fatality within 8 hours and an inpatient hospitalization, amputation, or loss of an eye within 24 hours.
Staff stop reporting when nothing changes. In a 2026 survey, 46% of nurses who experienced an incident did not report it, and 9% of those who did felt supported by leadership.
Every report is proof of notice. A report with no follow-up record documents a known risk; a report with one documents an organization working the problem.
Healthcare workplace violence incident reporting requirements are the combined obligations to capture every incident internally for trend analysis, investigate it, support the people involved, report the data to the governing body, record qualifying injuries with OSHA, and notify any outside body the Joint Commission or your state names. No single regulator lists all of it, which is why most programs do some of it well and miss the rest.
NPG.02.04.01, effective January 2026 under Goal 2 (the culture-of-safety goal), requires in element of performance (EP) 1 "a process to report incidents in order to analyze incidents and trends." From January 2022 this sat in EC.04.01.01 EPs 1 and 6; in January 2026 that content moved into EP 1's reporting process and EP 3's investigation requirement, with NPG.11.01.01 EP 3 still naming workplace violence among the security incidents to monitor, report internally, and investigate. If your hospital policy still cites EC.04.01.01, the citation is retired even though the obligation is not. Scope matters too. The Joint Commission definition reaches verbal, nonverbal, written, and physical aggression and "other behaviors of concern involving staff, licensed practitioners, patients, or visitors," so a process built only for patient-on-staff assault is scoped to a fraction of what it will be surveyed against.
NPG.02.04.01 EP 1 requires reporting of incidents to the governing body. The standard sets no frequency, but a surveyor will ask for minutes showing the data was reported, and Texas requires an annual committee review reported to the governing body. Set a cadence and keep the minutes.
An assault on an employee is recordable when it meets OSHA's general recording criteria: death, days away from work, restricted work or transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury diagnosed by a licensed health care professional (29 CFR 1904.7). It goes on the 300 log and 301 incident report within seven calendar days of learning about it, and an injury from a sexual assault is a privacy concern case, so the name stays off the log (29 CFR 1904.29). Reporting is separate: under 29 CFR 1904.39, an employer must report a work-related fatality to OSHA within 8 hours and an inpatient hospitalization, amputation, or loss of an eye within 24 hours, by phone or online. The call does not replace the log entry.
The Sentinel Event chapter makes several workplace violence events sentinel events in their own right, including homicide of a staff member, visitor, or vendor on site, sexual assault of the same, and physical assault leading to death, permanent harm, or severe harm. That is an independent channel from NPG.02.04.01, and programs often miss it. At the far end, an Immediate Threat to Health or Safety under APR.09.04.01 can lead to a Preliminary Denial of Accreditation, a decision posted publicly on Quality Check, and an accreditor must notify CMS of an immediate jeopardy within two business days.
The state layer is where timelines get specific. New Hampshire, Virginia, Utah, and Oklahoma require incident reports to state agencies on set cycles (see the reporting map table). California's 8 CCR §3342 requires a violent incident log and incident reporting to Cal/OSHA. Maine bars interfering with anyone making a report, and Texas requires confidential, non-retaliatory reporting. The note to EP 3 asks the worksite analysis to examine whether your program conforms to applicable laws and regulations, which brings these state duties into the accreditation review.
Each workplace violence event has its own recipient and clock, from the internal reporting process to OSHA, the Joint Commission, and state agencies. The table below maps them.
Most reporting failures are routing failures: the event reached one system and never the others.
| Event type | Who it goes to | Timeline | Requirement source |
|---|---|---|---|
| Any workplace violence incident, including verbal threats and lateral incidents | Internal incident reporting process, for analysis of incidents and trends | Set by hospital policy; Vistelar training recommends promptly, for example within 24 hours | NPG.02.04.01 EP 1 |
| Workplace violence incident data and trends | Governing body | Cadence set by hospital policy; annual committee review in Texas | NPG.02.04.01 EP 1; Texas Health & Safety Code ch. 331 |
| Each workplace violence incident | Internal investigation, feeding the annual worksite analysis | Investigation per policy; worksite analysis annually, with action on findings | NPG.02.04.01 EP 3 and note |
| Victims and witnesses of an incident | Follow-up and support, including trauma and psychological counseling if necessary | Per hospital policy | NPG.02.04.01 EP 1 |
| Employee injury meeting OSHA recording criteria | OSHA 300 log and 301 incident report | Within 7 calendar days of learning of it | 29 CFR 1904.7; 29 CFR 1904.29 |
| Work-related employee fatality | OSHA | Within 8 hours | 29 CFR 1904.39 |
| Inpatient hospitalization, amputation, or loss of an eye | OSHA | Within 24 hours | 29 CFR 1904.39 |
| Homicide, sexual assault, or assault causing death, permanent harm, or severe harm of staff, visitor, or vendor on site | Joint Commission sentinel event process | Comprehensive systematic analysis and action plan within 45 business days; reporting to the Joint Commission strongly encouraged, not required | Comprehensive Accreditation Manual for Hospitals, Sentinel Event chapter |
| Workplace violence incidents (New Hampshire) | State Department of Labor; state health care workplace safety commission | Monthly; annually | RSA ch. 277-C |
| Workplace violence incidents (Virginia) | Internal reporting; state health department | Quarterly internal; annual report from July 1, 2026 | Va. Code §32.1-127 |
| Workplace violence incidents (Utah) | Chief medical and nursing officers; the state | Quarterly; annually, compliance by November 1, 2026 | Utah Code §26B-2-244 |
| Assaults on medical care providers (Oklahoma) | State health department | Annually | 63 O.S. §1-114.3 |
The internal report is the only row that captures everything, so every other row should draw from it.
The Joint Commission's requirements do not stop at the report. NPG.02.04.01 EP 1 requires follow-up and support for victims and witnesses, and EP 3 requires investigation and action. Several states add their own: Kentucky requires post-incident debriefing, New Hampshire follow-up support, Oregon post-incident interviews, and Washington prompt investigation of every incident with systemic-cause and staffing analysis. Follow-up has three layers, and a program needs all of them on paper.
The NPG.02.04.01 EP 1 language is specific: follow-up and support "including trauma and psychological counseling, if necessary." Witnesses are named alongside victims, and they are the people programs forget. Vistelar training teaches the individual side as Self-Compassion: get injuries treated, honestly check your emotional health, take part in the debrief, talk with someone you trust, and use the employee assistance program or a counselor when needed, because seeking help "is not a sign of weakness." The organization's job is to make that path short. A pamphlet in a break room is not follow-up. A leader who checks in within the shift, a warm handoff to the employee assistance program, and a documented second check a few days later are.
Vistelar training treats Debriefing as structured reflection soon after the incident: as soon as practical, with everyone involved, confidential, focused on learning rather than blame, one person documenting, and follow-up debriefs for the most impactful incidents. Its questions (what risk factors were present, whether policies were followed, where communication broke down, what earlier warning signs appeared) are the same questions an EP 3 investigation has to answer. Run the debrief well and half the investigation is written.
Investigation without correction is a research project. Every finding needs an owner, a target date, a status, and, when the fix takes longer, an interim control with a documented reason. That is the record a surveyor asks for under EP 3.
A reporting process is only as good as the reports going into it, and most are written at the end of a 12-hour shift. The Vistelar Closure Skills give frontline staff one standard. All workplace violence incidents, no matter how minor, get reported promptly (for example, within 24 hours) through the channels your policy specifies. Reports use objective language and direct quotes rather than conclusions. "The visitor raised his voice, said 'You'll regret this,' and stepped within two feet of the nurse" tells an investigator something; "the visitor became hostile" does not.
Every report covers:
When, where, and who
Interventions tried and their outcomes
Testimony from those involved and witnesses
Injuries, emotional impacts, and property damage and how each was handled
The reporter's prevention recommendations
The prevention recommendations field is the most underused, and the person closest to the incident usually knows the answer. Vistelar training puts it plainly: "The incident isn't over until appropriate reporting has occurred."
Standards hold only if every role and shift learns them the same way. That is part of why Vistelar moved from train-the-trainer to content licensing after its independent evaluation (University of Wisconsin-Milwaukee) showed skill decay: licensed content stays current, reaches night shift and registration as easily as the emergency department, and comes with a sustainment partner. Reporting is a skill, and skills fade without practice.
Underreporting is a rational response to what staff have watched happen after earlier reports. Matching staff accounts against hospital records, Arnetz and colleagues (2015) found that 88% of staff who reported a violent event on the survey had no entry in the electronic incident reporting system, and even counting informal reports to supervisors, 48% never reported it at all. In a 2026 Nurse.org survey of 2,090 nurses, 54% of those who experienced an incident reported it and 46% did not, and the leading reason was that they did not believe anything would change. Of those who did report, 40% saw no action taken and 9% felt supported by leadership.
If the last three reports went nowhere, why would anyone file a fourth? The loop is broken at the back end, not the front. Kim and colleagues (2023) found a strong violence-reporting culture was associated with a stronger link between violence and burnout, not a weaker one. Reporting into a system that does not respond teaches people something about the organization. (We wrote more about this in Incident Reporting Isn't Enough: What Your Team Isn't Telling You.)
Fixing the reporting feedback loop is mostly operational:
Decide in writing what happens after a report.
Tell every reporter what changed, or why nothing could yet, within a set number of days.
Share de-identified "you reported, here's what we did" examples in huddles.
Protect reporters from retaliation in practice, not only policy.
Include the front of house: registration and unit secretaries catch a great deal of behavior before it reaches a treatment area and are often the least likely to think their incident counts.
Expect volume to rise when this works.
The data leadership needs already exists, split across four systems with four owners: clinical event reporting with patient safety or quality, security event reporting with security, workers' compensation claims with risk management or the third-party administrator, and the OSHA 300 log with occupational health. Our article The Cost of Workplace Violence in Healthcare: Building the Business Case for Culture Change makes the same point about cost: the sum is nobody's job.
In the system-level rollouts I have led, a handful of decisions made once has done more than any new platform:
Agree on one definition and one set of categories across all four systems.
Give each incident a shared reference that follows it from the report to the claim and the log entry.
Reconcile monthly, because a discrepancy between the 300 log and the internal log is visible to anyone who looks, and an inspector will look.
Put all four owners on the workplace violence committee with a standing deliverable.
Report one picture to the governing body: incidents by unit and type, severity, days lost, claims, and the status of every corrective action.
Plan ahead while you build the unified view. Utah's compliance date lands November 1, 2026, and the rules will keep moving. A structure built to answer one regulator's form gets rebuilt every time a form changes; one built around a clean, unified incident record can answer whatever gets asked next.
Every report your staff file is a dated record that the organization knew, and it is what a plaintiff's lawyer, an OSHA inspector, or a surveyor reads first. Foreseeability is not presumed in healthcare, but hospitals generate the evidence of notice themselves. In the hospital parking ramp case (Small v. McKennan Hospital), the hospital's own rape-awareness seminars for employees became evidence that it knew of the risk. In Cedar Springs Hospital, Inc. v. OSHRC (10th Cir. 2026), the court held that accreditation and CMS compliance do not displace OSHA and found abatement feasible partly from fixes the hospital made after it was cited. The window in which a known hazard sits unremediated is what creates exposure.
The answer is not to report less. Reporting less fails every requirement in this article, and a thin file in a high-risk unit reads as indifference. The answer is to attach a follow-up record to every report:
The debrief
The investigation finding
The corrective action with owner and date
The support offered to the people involved
Findings that cannot be fixed this quarter go into a written mitigation plan, phased so the highest-risk items move first, with interim controls meanwhile.
One obstacle, HIPAA, is usually imaginary. Telling the next shift's care team that a patient has assaulted staff is a permitted use for treatment under 45 CFR §164.506(c) and needs no authorization; disclosure to security or law enforcement to prevent or lessen a serious and imminent threat runs under 45 CFR §164.512(j).
"A report without a follow-up record is a dated admission. A report with one is proof you were working the problem."
Casey Goldschmidt, CEM
Reporting is three things at once: a frontline skill, a routing map across four systems, and a follow-up record that proves the organization acted. Get all three in place and your reports stop being a liability on file and start being the data that changes the culture within the walls.
This article is general information about regulatory requirements and is not legal advice. Requirements change. Confirm anything you plan to rely on with your own counsel.