A section-by-section template a hospital can copy, mapped to the Joint Commission, CMS, OSHA, and state requirement each section answers.
Most hospitals already have a workplace violence prevention plan. Far fewer have one that anyone outside the safety office could describe, and fewer still have one that reads differently this year than last. Most were approved once and now sit in a shared drive.
That would be harmless if the plan were only a compliance artifact. The Joint Commission requires a program led by a designated individual and an annual worksite analysis with action on its findings. CMS expects a documented risk assessment. OSHA enforces through the General Duty Clause. Nineteen states require a written plan outright. Every one of those obligations produces a dated record of what your organization knew about violence risk, and that record is the first thing anyone reads after something goes wrong.
Our article, Workplace Violence Compliance in Healthcare: Joint Commission, CMS, OSHA, and State Requirements, covers each regulator in detail. This article is the working document underneath it: the template, the requirement each section answers, and the operating decisions that decide whether the plan ever leaves the drive.
A prevention plan is proven by what changed because of it, not its existence alone.
A usable plan has 14 sections, and each maps to a Joint Commission Element of Performance (EP), an OSHA guidance element, or a state requirement.
The plan needs a named owner with budget authority, a governance reporting line, and a data feed. Without those three, it is a binder.
Zero tolerance means nothing until the plan defines it by care setting and by who the person is: patient, visitor, or staff.
A plan that does not change something every year is a dated record of risks you knew about and did not fix.
A workplace violence prevention plan is the written document that names who owns the program, how risk is assessed, what controls and training are in place, how incidents are reported and acted on, and how the whole program is evaluated and revised each year. In practice that means 14 sections, laid out below.
The 14 sections are the overlap of three frameworks a hospital has to satisfy at once. NPG.02.04.01, effective January 2026, supplies the program, training, and worksite analysis requirements across three Elements of Performance. That standard is where the Joint Commission consolidated the five workplace violence Elements of Performance it first enforced in January 2022 (LD.03.01.01 EP 9, HR.01.05.03 EP 29, EC.02.01.01 EP 17, and EC.04.01.01 EPs 1 and 6) when it replaced the National Patient Safety Goals chapter with National Performance Goals. The obligations carried forward with largely cosmetic changes; the old citations did not. If your current plan still maps to the leadership, human resources, or Environment of Care chapters, re-map it to NPG.02.04.01 before your next survey, and cite the standard number rather than the "NPG #2a" label on the Joint Commission website, which does not appear in the manual.
OSHA 3148-06R (2016), which is voluntary guidance, supplies five components:
Management commitment and employee participation
Worksite analysis
Hazard prevention and control
Safety and health training
Recordkeeping and program evaluation
The state layer adds committee composition, retention, and deadlines.
A written program is not one of OSHA's five elements, so a template that substitutes it for the first element has dropped management commitment.
The difference between a plan and a binder is ownership, money, and data, and most plans are missing at least one of the three.
Start with ownership. EP 1 requires a program "led by a designated individual." Across the system-level rollouts I have led, the most common failure is a designated individual with no authority over the budget lines the plan depends on. Name a person who can move money, or who reports to someone who can, when the worksite analysis says something has to change.
Then tie the plan to data. The risk picture sits in four places with four owners: workers' compensation claims, the OSHA 300 log, the security event reporting system, and the clinical event reporting system. If the plan does not say who pulls each, how often, and where they are combined, the annual evaluation will be written from memory. Put the four data owners on the committee and write their deliverables into the plan.
Then decide how the plan rolls down. Across markets, I often see a system plan that every facility files with its own name on the cover and never adapts. The structure that works is a system core and a facility layer. The system owns the policy language, definitions, training tiers, and data standard; each facility owns its worksite analysis, committee, law enforcement contacts, unit controls, and state addendum.
A complete template has 14 sections in five groups: foundation, risk and controls, people, coordination, and sustainment.
Copy these headings into your own document.
Section 1, Purpose and scope: A commitment statement signed by the chief executive officer. Covered facilities and people, including agency staff and volunteers. The policies and procedures the plan governs for preventing and responding to violence.
Section 2, Definitions: The Joint Commission definition in full, including "other behaviors of concern involving staff, licensed practitioners, patients, or visitors." The four NIOSH and OSHA types: Type I (criminal intent), Type II (patients, family members, and visitors), Type III (worker-on-worker), and Type IV (personal relationship). Operational definitions of threat, assault, inappropriate behaviors, and zero tolerance.
Section 3, Leadership and the designated individual: The named individual, reporting line, executive sponsor, and budget authority. How frontline workers participate, not only managers.
Section 4, Committee and governance reporting: Membership by role (nursing, physicians, security, facilities, risk, occupational health, human resources, finance, legal, and communications), charter, and cadence. How often workplace violence data reaches the governing body, and in what format.
Section 5, Worksite analysis and risk assessment: Annual schedule and owner. The proactive review, including walkthroughs for the potential stressors and threat indicators Vistelar Be Alert & Decisive training describes, the incident investigation review, and the review of policies, training, and environmental design against best practices and applicable law.
Section 6, Hazard prevention and controls: Environmental (access, lighting, layout, alarms), administrative (visitor management, flags, zero tolerance response), and staffing and process controls (high-risk unit staffing, sitters). Include what Vistelar training calls operational issues: minimizing waits, telling families about delays before they ask, and cutting steps and forms. Each control carries an owner, a date, and the finding it answers.
Section 7, Training by tier: One shared framework, the 6 Cs of Conflict Management in Vistelar training, across three tiers. Foundational for all staff (non-escalation, recognizing pre-violence behavior, getting help). Enhanced for moderate- to high-risk clinical and direct-service roles, including registration. Stabilization for the emergency department, inpatient behavioral health, psychiatric emergency, and critical care, separate from the security track. Name the program behind each tier, such as these Vistelar Unified Conflict Management System programs: Non-Escalation & De-Escalation, Personal Protection & Safety, and Positive Interventions & Stabilization. Delivered at hire, annually, and on program change, covering de-escalation, nonphysical intervention, and physical intervention as distinct items, with ongoing practice on the job.
Section 8, Reporting, investigation, and trend analysis: The Vistelar reporting standard: every incident, no matter how minor, reported promptly (for example, within 24 hours) in objective, factual language. Required fields cover when, where, and who, interventions tried and their outcomes, injuries and other impacts, and prevention recommendations. Anti-retaliation, investigation triggers, trend analysis ownership, and reconciliation with the OSHA 300 log.
Section 9, Post-incident response and support: Debriefing on the Vistelar model: as soon as practical, with everyone involved, confidential, focused on learning rather than blame, one person documenting, and follow-up debriefs after high-impact incidents. Self-Compassion as the staff support standard: injury care, an honest emotional check, and support framed as strength, not weakness. Follow-up for victims and witnesses, including trauma and psychological counseling or an employee assistance program, and return-to-work support.
Section 10, Communication and behavioral flags: The HIPAA position stated plainly: telling the clinical team that a patient has assaulted staff is a treatment disclosure under 45 CFR §164.506(c) and needs no authorization; disclosure to security or law enforcement to prevent or lessen a serious and imminent threat runs under §164.512(j). Flag criteria, expiration, removal, the rule that a flag never gates medical screening, and a disparity audit. When expectations or a behavioral agreement are explained to a patient, close with a Closure Statement that summarizes them and sets limits.
Section 11, Security and law enforcement: Roles of leaders, clinical staff, security, and external law enforcement. Named contacts at the police department and prosecutor's office, and the documentation standard that office needs.
Section 12, Recordkeeping: Retention schedule for minutes, analyses, individual training records, incident logs, the OSHA 300 log, and the corrective action log.
Section 13, Annual program evaluation: Year-over-year measures, what changed in the plan because of them, and the next revision date.
Section 14, State-specific addendum: One per state of operation, listing the statute, coverage, committee rules, deadlines, training timing, reporting cadence, and retention that differ from the system core.
Every section should answer the surveyor's question: "Show me where this is required and where you did it."
| Plan section | What to include | Requirement it satisfies |
|---|---|---|
| Purpose and scope | Signed commitment, coverage, policies | EP 1 (policies and procedures); OSHA element 1 |
| Definitions | Joint Commission definition, four types, zero tolerance | EP 2 (what constitutes workplace violence); CPL 02-01-058 |
| Leadership and designated individual | Named leader, sponsor, budget authority | EP 1 (designated individual); OSHA element 1 |
| Committee and governance reporting | Roster, charter, minutes, board reporting | EP 1 (multidisciplinary team, governing body reporting); CT, NJ, OH, TX, WA, MN committee rules |
| Worksite analysis | Proactive review, incident investigation, policy and design review | EP 3; 42 CFR §482.15(a)(1); OSHA element 2; CT, NH, NY annual assessments |
| Hazard prevention and controls | Environmental, administrative, staffing controls with owners | EP 3 (act on findings); 42 CFR §482.13(c)(2); OSHA element 3 |
| Training by tier | Foundational, Enhanced, Stabilization on one framework; named programs; hire, annual, program change | EP 2; 42 CFR §482.15(d)(1); OSHA element 4; KY, CA, MN, RI timing rules |
| Reporting, investigation, trends | Prompt objective reporting, required fields, anti-retaliation, investigation, trends | EP 1 (report to analyze trends); EP 3 (investigation); OSHA recordkeeping |
| Post-incident support | Debriefing, Self-Compassion, victim and witness follow-up, counseling access | EP 1 (follow-up and support); KY debriefing; NH follow-up support; OR post-incident interviews |
| Communication and behavioral flags | HIPAA treatment basis, flag criteria and audit | 45 CFR §164.506(c), §164.512(j); EMTALA, ADA, Section 504, Section 1557 constraints |
| Security and law enforcement | Roles, named contacts, prosecution standard | EP 2 (roles of security and law enforcement); NC, VA, VT security provisions |
| Recordkeeping | Retention schedule, training records, action log | OSHA element 5; NJ five-year record; VA and UT two-year retention |
| Annual evaluation | Year-over-year measures, changes made | EP 3 (act on findings); OSHA element 5; NV, MN, WA annual review |
| State addendum | Statute-specific deadlines, composition, reporting | EP 3 (conform to applicable laws); the 19 state plan statutes |
The note to EP 3 requires an analysis of how your policies, training, and environmental design "reflect best practices and conform to applicable laws and regulations." That clause brings state requirements into the accreditation review. If you operate in one of the 19 plan states and your addendum is missing or out of date, it can come up in a survey as well.
State requirements differ in coverage, committee composition, and deadlines, and several changed recently. New York's hospital program law has three different dates. New Hampshire allows Joint Commission compliance to be submitted in lieu of its program requirements. Draft the addendum from the statute, and have counsel review it before it is adopted.
A prevention plan should define zero tolerance by population and care setting, stating what happens next for visitors, patients, and staff.
A zero tolerance statement that does not say what happens next is a poster, and the plan is where it gets teeth.
Most plans include the phrase; few define it. Vistelar training frames the fix as a Conflict Prevention Social Contract: a clear definition of inappropriate behaviors, a zero-tolerance policy for them, and training that empowers every staff member to respond the same way, down to telling a coworker, "That's not how we treat people here." The hard part is the second element. Read literally, zero tolerance means ending the relationship. That works for a visitor, who can be removed or trespassed. It does not work for a patient actively receiving treatment, because a hospital cannot end its relationship with someone it is obligated to screen and stabilize. For staff, it runs through human resources policy and progressive discipline.
So the plan should spell it out by population and care setting:
For visitors: the behaviors that trigger a warning, restriction, or removal, and who can impose each.
For patients: the behaviors that trigger a care plan change, a behavioral agreement, a security standby, or a law enforcement referral, stating that none of those affect medical screening.
For staff: the link to the code of conduct and the reporting pathway for lateral violence.
A policy that promises prosecution without a relationship with the prosecutor's office, built in Section 11, is a promise the organization cannot keep.
When I'm sitting with a chief nursing officer and a chief operating officer on this, it lands in the same place: staff need to know the line is real, and patients and families need to know they will be treated with dignity right up to it. A defined policy does both.
A plan is real when the annual evaluation produces a list of changes, and each change traces back to a finding.
If last year's worksite analysis identified a dark stretch of parking structure or an unstaffed side entrance, and this year's plan is identical, you have created a dated record of a hazard you knew about and did not address.
The fix belongs in Section 13. Require the annual evaluation to produce three things:
This year's data against last year's
A corrective action log with an owner and date for every finding
A short list of what changed in the plan itself
Present all three to the governing body, which EP 1 already requires. Tie the corrective actions to the budget cycle so the finding and the funding request arrive in the same quarter.
"If this year's plan reads exactly like last year's, the date on the cover is the only thing that changed."
Casey Goldschmidt, CEM
Compliance is the starting point. The goal is a culture where staff see their reports lead to real changes.
A workplace violence prevention plan earns its place through a named owner, a data feed, a defined zero tolerance policy, and an annual evaluation that changes something. Write it from the template, map every section to the requirement it answers, and then measure it by what is different a year from now.
This article is general information about regulatory requirements and is not legal advice. Requirements change. Confirm anything you plan to rely on with your own counsel.