The Joint Commission requires an annual worksite analysis and action on what it finds. Here is how to run one, step by step, from building the team to proving next year that something changed.
Most hospitals already know where their next serious assault will likely happen. The charge nurse on nights knows. The officer covering the emergency department waiting room knows. The registration clerk who gets screamed at every weekend knows. What many organizations lack is an annual process that puts what they know next to the data and turns it into dated actions with names on them.
Under the Joint Commission's NPG.02.04.01, Element of Performance 3 (EP 3) requires an annual worksite analysis and requires the hospital to act on what it finds. The accompanying note defines a worksite analysis as a proactive analysis of the worksite, an investigation of the hospital's own incidents, and an analysis of how policies, procedures, training, education, and environmental design reflect best practices and conform to applicable laws and regulations. That last clause pulls your state's requirements inside the accreditation requirement. This is the January 2026 version of the requirement. When the Joint Commission replaced its National Patient Safety Goals chapter with National Performance Goals, the worksite analysis that used to sit at EC.02.01.01 EP 17 became NPG.02.04.01 EP 3, and the incident investigation duty from EC.04.01.01 folded into the same standard. Workplace violence left the Environment of Care chapter entirely. If your worksite analysis policy or committee charter still cites EC.02.01.01 or EC.04.01.01, update it: the obligation carried forward, but those citations are retired.
In our article Workplace Violence Compliance in Healthcare: Joint Commission, CMS, OSHA, and State Requirements, I made the case that every regulator makes you write down what you know about violence risk, and that the file is both the compliance record and the exhibit. The worksite analysis is the document in that file most likely to be presented and shelved. Compliance is the floor here, and it is worth meeting precisely. This is a working method for making the analysis change something on the units.
EP 3 asks for three things: a proactive look at the worksite, an investigation of your own incidents, and a review of policy, training, and design against best practice and law.
The data sits in four systems with four owners. Naming one person to aggregate it is the first real decision.
Walk the building by unit and by time of day. A waiting room at 2:00 p.m. and the same room at 2:00 a.m. are two different worksites.
Every finding needs a risk rank, an owner, a due date, and defined proof of completion.
A workplace violence worksite analysis is a structured annual review of where, when, how, and to whom violence occurs in your facility, combining incident data, a physical walkthrough, a process review, and staff input to produce a ranked list of hazards with owners and deadlines. You conduct one in eight steps: name a lead and build a multidisciplinary team, pull and reconcile the data, walk the building by unit and shift, review staffing and process drivers, interview staff on every shift, risk-rank the findings, build an action plan with owners and dates, and report to the governing body. A ninth step happens a year later, when the next analysis opens by checking the last one.
The Occupational Safety and Health Administration (OSHA) guidelines for healthcare and social service workers, OSHA 3148-06R (2016), name Worksite Analysis and Hazard Identification as the second of its five components. It is voluntary guidance, not a standard, enforceable only as evidence that a hazard was recognized and abatement was feasible.
The surveyor crosswalk in Workplace Violence Compliance in Healthcare lists what a surveyor will ask for under EP 3: the completed analysis, dated within twelve months; evidence it was proactive rather than only retrospective; incident investigation records; and documented actions taken in response, with owners and dates. That last cell fails most often, so build the process backward from it.
The analysis needs one named lead with the authority to convene departments and push a finding onto a capital list. Under EP 1, that is usually the program's designated leader or someone reporting to them. Choose for reach, not availability.
The team should look like the hospital, not the security department. I once worked for an organization that put workplace violence prevention entirely on security. An analysis built only by responders describes the moment of violence in detail and misses most of what led up to it. A working team includes:
Nursing: unit leaders and frontline nurses from high-risk areas, who see antecedents first.
Security: response data, post orders, and an honest account of where coverage is thin.
Environmental services: in every room on every shift, often alone.
Human resources and employee health: workers' compensation, exit interviews, and victim follow-up.
Risk and quality: incident trends, claims, and patient safety goals.
Front-of-house staff: registration and unit secretaries, the first line and the most overlooked.
Facilities: much of what you find will be a door, a light, or a sightline.
Include at least two frontline staff who supervise no one. Some state laws set the mix. New Jersey requires at least half of the violence prevention committee to be health care workers who provide direct patient care, and Connecticut requires at least half of the workplace safety committee to be nonmanagement employees. The analysis is better for it either way.
The first job is getting incident data into one place. When I sit with a chief operating officer on this, the problem is rarely that nobody tracks violence. Workers' compensation sits with risk or the third-party administrator, the OSHA 300 log with occupational health, security events in one system, and clinical events in another. Four owners, four vocabularies, and nobody whose job is the total. Assign that job by name, then pull at least twelve months of:
Clinical event reports: every workplace violence event in the patient safety reporting system.
Security reports and assist calls: including stand-by calls never written up, which are an early warning.
OSHA 300 logs: any discrepancy with your internal incident log is a finding in itself.
Workers' compensation claims coded by cause: most are coded by injury type, so expect to recode by hand the first year.
Near misses and threats: verbal, written, and anything that stopped short of contact.
Staff surveys: perceived safety by unit and role, and willingness to report.
Exit interviews: the share of separations attributed to violence. The published assumption, from the American Hospital Association's 2025 report prepared by the University of Washington Harborview Injury Prevention and Research Center (cited in The Cost of Workplace Violence in Healthcare: Building the Business Case for Culture Change), is a conservative 3.0% of clinical, healthcare support, and protective services separations. Your own number is in your exit interviews, almost certainly uncoded. Add the field.
Scope the pull to the Joint Commission definition, which runs in every direction among staff, licensed practitioners, patients, and visitors. Counting only patient-on-staff assault misses lateral violence and visitor threats. Tag each incident by unit, shift, hour, role harmed, and source, so the data answers where, when, and to whom before the walkthrough starts.
Check report quality while you have them open. The Vistelar training emphasizes that staff should report every incident, no matter how minor, promptly (for example, within 24 hours), in objective language, with the interventions attempted and their outcomes. A report that says only "patient became aggressive" cannot be ranked, and debrief notes often hold the contributing factors it left out.
The walkthrough is the proactive half of EP 3, and it must happen on more than one shift. A unit inspected at 10:00 a.m. on a Tuesday is not the unit night staff work in: lighting changes, staffing drops, and security coverage thins. Walk every high-risk area after dark, including the route staff take from the parking structure to the time clock.
Walk it the way the Vistelar training teaches staff to Be Alert & Decisive. Look for the potential stressors that make escalation more likely: overstimulation from noise, light, and crowding; real or perceived threats, including a visible security presence; and unmet urgent needs such as water, toileting, privacy, and pain management. Ask where staff can spot early threat indicators, and whether each area supports a planned response: an escape route, a way to get help, and a support person within reach.
| Area | What to look for | The after-hours question |
|---|---|---|
| Entrances | Public versus badge-only doors, propped doors, greeting before treatment areas | Which entrances stay open overnight, and who sees them? |
| Waiting rooms and registration | Sightlines, desk barriers, a second exit, how waits are communicated | Is the desk staffed alone late, and how does that person call for help? |
| Treatment rooms | Layout, throwable objects, staff position relative to the exit | Are high-risk rooms clustered where fewer staff work at night? |
| Lighting and sightlines | Dark corridors, blind corners, stations that cannot see their rooms | Which lights on timers leave a corridor dark? |
| Alarms and duress | Whether devices exist, are tested, and route to a responder | Does response time change after day shift leaves? |
| Egress | Two ways out of every staff work area | Are secondary exits locked or blocked overnight? |
| Parking and exterior | Lighting, cameras, escorts, the walk to the staff entrance | How do staff reach their cars at shift change? |
Record each finding with a photograph and the time of day.
Most hazards that drive escalation are operational, not physical. The Vistelar training calls these operational issues and treats them as an often-overlooked conflict reducer. When the data shows waiting room incidents clustering from 7:00 p.m. to 11:00 p.m., the walkthrough explains part of it. The rest is usually what the person in that room was told about the wait, and how many times. Review these drivers against the incident clusters:
Waits and throughput: whether anyone tells the waiting room about a delay before people ask.
Boarding: how long behavioral health and admitted patients hold in the emergency department, and where.
Pain management: whether delays or disagreements appear in incident narratives.
Visitor management: whether staff know how to restrict a visitor with a history of threats.
Staffing and response: coverage by shift, sitters, and response time.
Then interview staff on every shift, including environmental services, transport, registration, and security. Where do you feel least safe, and when? What happened when you last reported something? Did anything change after last year's analysis? If staff never heard of it, the report reached a committee and stopped.
Finally, review the written program as the EP 3 note requires: training against EP 2 (de-escalation, nonphysical intervention, and physical intervention as distinct, role-based content) and your written plan against your state's requirement. Check whether training is tiered by risk on one shared framework, such as the 6 C's of Conflict Management in the Vistelar training, and whether the units where incidents cluster have the tier their risk calls for.
A list of forty findings in the order they were discovered is a backlog, not an action plan. Score each one on likelihood (using your own data) and severity, then add the column most risk matrices leave out: how hard the fix is.
That column matters twice. First, momentum. Every analysis turns up easy wins: a dead light, a door that will not latch, a duress button routed to an unstaffed phone. Fix them within thirty days and say so publicly; staff who see a change in a month believe the next analysis is worth their time. Second, the law. As Workplace Violence Compliance in Healthcare explains, California courts use a sliding scale: the more burdensome the precaution, the more foreseeability is required, and low-burden measures need only ordinary foreseeability. A light, a lock, or a visitor policy is exactly what your own analysis will name.
| Finding | Risk | Owner | Due | Evidence of completion |
|---|---|---|---|---|
| Parking stairwell unlit after 10:00 p.m. | High | Facilities director | 30 days | Work order closed; night photo; follow-up walk logged |
| Registration desk lacks a second exit or barrier | High | Vice president of operations | Interim plan 30 days; capital this cycle | Interim duress plan; capital request number and decision |
| Behavioral health duress alarms untested | High | Security manager | 14 days | Test log with response times |
| Night staff unaware of visitor restriction policy | Medium | Nursing director | 60 days | Huddle sign-ins by shift |
| Exit interviews do not code violence | Medium | Human resources director | 90 days | Coded field live; first quarterly report to committee |
Capital items need different treatment, not just a later date. The record needs an interim control with its own owner and date, plus a capital request with a number and a decision. A finding marked "pending capital" for three years reads the same to a surveyor and to a plaintiff's attorney.
"An analysis that names a hazard and assigns nobody to it is not a compliance document. It is a confession with a date on it."
Casey Goldschmidt, CEM
The analysis is finished when the governing body has seen it and the actions are tracked to completion, not when the binder is printed. EP 1 requires that reporting, and a surveyor will look for the minutes.
What I see over and over across health systems is a workplace violence report read aloud as a line item in an environment of care committee, captured in the minutes, and left there. That is a report out, not a decision. When you present to leadership, lead with three things and put the rest in an appendix:
What we found: the top five ranked hazards, where and when they occur.
What we already fixed: the easy wins closed before the meeting, with dates.
What we need decided: capital and policy items, each with an interim control and a decision date.
Attach cost where you can. The approach in The Cost of Workplace Violence in Healthcare (workers' compensation by cause, lost and restricted days, violence-attributed turnover, and backfill) turns a hazard list into a business case.
Next year, open the new analysis by reading the old one. Every prior finding gets a status: closed with evidence, open with a reason and new date, or accepted with a documented rationale. In Cedar Springs Hospital, Inc. v. OSHRC (10th Cir. 2026), the court found abatement feasible partly from what the hospital did after it was cited. The window in which a known hazard sits unabated creates the exposure, and its length is within your control.
A worksite analysis is a team, a data set, a walk at the right hours, a ranked list, and an action plan with names and dates. Run it that way and your file stops being a record of what you knew and becomes a record of what you did.
This article is general information about regulatory requirements and is not legal advice. Requirements change. Confirm anything you plan to rely on with your own counsel.
This blog covers topics that include: Compliance · Joint Commission · Worksite Analysis