Workplace Violence Compliance in Healthcare:
Joint Commission, CMS, OSHA, & State Requirements

 By Casey Goldschmidt, CEM | Chief Operating Officer, Vistelar 

A health system can pass its accreditation survey with excellent marks in the same year its reported workplace violence incidents rise forty percent.

That is not a scandal. It is the system working as designed. A survey asks whether the program exists. It does not ask whether it worked.

Most compliance writing on this subject stops there, treats the gap as an indictment, and moves on. The gap is real, but it is not the interesting part. The interesting part is what happens to everything you produce in order to close it.

Because every regulator in this article requires you to write down what you know about violence risk in your building. The Joint Commission requires an annual worksite analysis. OSHA requires the injury log. CMS requires a documented risk assessment. Twenty-one states require an assessment, a plan, an incident log, or some combination, and nineteen of them require the written plan.

That file is the compliance requirement. It is also the exhibit. And the organizations that get hurt are not the ones that failed to build it. They are the ones that built it, filed it, and did nothing about what was in it.

I have sat through these surveys on both sides of the table. This article covers all four regulators and what each requires, cited by number so you can look it up, which states impose a real prevention-plan obligation and which only criminalize assault, and what the record you are compelled to create does for you and to you when something goes wrong.

The definition is broader than most programs are scoped for, and it is worth quoting in full because the last clause is the one that matters:

An act or threat occurring at the workplace that can include any of the following: verbal, nonverbal, written, or physical aggression; threatening, intimidating, harassing, or humiliating words or actions; bullying; sabotage; sexual harassment; physical assaults; or other behaviors of concern involving staff, licensed practitioners, patients, or visitors.

"Other behaviors of concern" is a catch-all, and "staff, licensed practitioners, patients, or visitors" means it runs in every direction. A physician humiliating a nurse is in scope. So is a nurse bullying a technician. Programs built solely around patient-on-staff assault are scoped to a fraction of the definition they are being surveyed against.

One frequently repeated version of this definition begins "verbal, written, or physical aggression." That is the Department of Labor's definition, quoted inside the Joint Commission's 2018 Sentinel Event Alert. It is not the standard, and it drops "nonverbal."

What changed in January 2026, and what did not

Very little changed substantively, and the framing that circulates about it is wrong in a specific way.

Sentinel Event Alert 59 (April 2018, revised June 2021) was never an enforceable standard. Its own language asks that organizations "consider" its suggestions "or reasonable alternatives." It has not been formally retired.

The enforceable obligations began on January 1, 2022, as five Elements of Performance across four standards: LD.03.01.01 EP 9 (the program), HR.01.05.03 EP 29 (training), EC.02.01.01 EP 17 (worksite analysis), and EC.04.01.01 EPs 1 and 6, both revised to add workplace violence to the incidents a hospital must continually monitor, internally report, and investigate.

All five carried forward. The first three became NPG.02.04.01 EPs 1 through 3 with essentially cosmetic wording changes, and the EC.04.01.01 incident reporting and investigation content is now inside EP 1's requirement for "a process to report incidents in order to analyze incidents and trends" and EP 3's requirement for "an investigation of the hospital's workplace violence incidents." Workplace violence moved out of the physical environment chapter entirely. If your program still maps these obligations to an Environment of Care citation, the citation is retired even though the obligation is not.

There is no federal OSHA standard for workplace violence in healthcare.

The proposed rule, RIN 1218-AD08, was moved to Long-Term Actions in the Unified Agenda published September 22, 2025, with the proposed rule date changed to "To Be Determined," and it remained there in the agenda released July 3, 2026. Long-Term Actions means the agency does not expect to act within twelve months.

There is also no National Emphasis Program and no healthcare workplace violence Regional Emphasis Program. The only regional instrument is a Region II directive governing follow-up on Hazard Alert Letters.

What exists instead is OSH Act §5(a)(1), 29 U.S.C. §654(a)(1):

Each employer shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees.

Enforcement procedures are in CPL 02-01-058, "Enforcement Procedures and Scheduling for Occupational Exposure to Workplace Violence," dated January 10, 2017 and still current. It expressly identifies healthcare as a high-risk industry and gives setting-specific guidance for hospitals, residential treatment, and field work.

The guidance document everyone cites is OSHA 3148-06R (2016), Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers, first issued in 1996. It is voluntary guidance, not a standard, and it is enforceable only derivatively, as evidence that a hazard was recognized and that abatement was feasible. Note that OSHA's own healthcare webpage still calls it the 2015 edition, which is a stale page describing the superseded 3148-04R.

A written program is not one of the five. It appears earlier, in the introduction, as a recommendation: a written program "offers an effective approach to reduce or eliminate the risk of violence." Substituting it for element 1 drops management commitment, which is the element OSHA weights most heavily in General Duty Clause cases. That substitution is common and it is a meaningful error in a document about defensibility.

(One wrinkle worth knowing so you are not caught out: OSHA's own document lists these twice, and the narrative sentence on page 5 uses slightly different wording, including "employee participation" rather than "worker participation." Both appear in the same publication. The section headings govern.)

What is Enforceable and What is Not

The right column cannot be cited against you directly. It is how the left column gets proven.

 The documents on the right cannot be cited against you directly. They are how the documents on the left get proven. 

Four bills are pending in the 119th Congress. They come up constantly in internal materials, usually merged into one, and they do entirely different things.

The Save Healthcare Workers Act

H.R.3178 (Rep. Madeleine Dean) and S.1600 (Sen. Cindy Hyde-Smith), both introduced May 5, 2025, would make assaulting a healthcare worker a federal crime. It is a criminal statute. It touches OSHA rulemaking not at all and would impose no compliance obligation on your organization.

Note the name. It is the Save Healthcare Workers Act, not an acronym. The SAVE Act, the Safety from Violence for Healthcare Employees Act, was the predecessor in the 118th Congress. Writing "SAVE" in a board memo is a small thing that tells a legislative affairs colleague you got it from a secondary source.

The Workplace Violence Prevention for Health Care and Social Service Workers Act

H.R.2531 (Rep. Joe Courtney) and S.1232 (Sen. Tammy Baldwin, referred to the Senate HELP committee), is the one that would create an obligation. It would direct the Department of Labor to issue an enforceable OSHA standard, which is the thing the agency has affirmatively shelved.

It also carries a Medicare hook that gets overstated, so state it carefully. The bill would condition Medicare participation on compliance for hospitals and skilled nursing facilities not otherwise subject to the OSH Act or an approved state plan. That is a jurisdictional gap-filler aimed at facilities OSHA cannot reach, such as state and local government employers in states without an approved plan. It is not a blanket Medicare condition, and describing it as one will not survive a conversation with anyone who has read it.

Nothing has moved.

All four bills sit at their 2025 committee referrals. No hearing, no markup, no floor action as of August 2026. Cosponsors continue to accumulate, which is accretion rather than progress and is easy to mistake for momentum in a tracking report.

"The bills would compel a standard the agency has already parked. Building a program around either is building around a schedule nobody controls."

Which is the argument for reading the next section carefully, because the enforceable obligation that is actually growing is not federal at all.

California

• Citation:  8 CCR §3342
• Core Requirement:  Written plan, hazard ID, violent incident log, initial and annual training, incident reporting to Cal/OSHA
• Covered:  Health facilities, home health and hospice, EMS, drug treatment, outpatient correctional medical
• Effective:  Log and reporting April 1, 2017; plan and training April 1, 2018

Connecticut

• Citation:   Conn. Gen. Stat. §19a-490q
• Core Requirement:  Safety committee at least half non-management, annual risk assessment, written plan
• Covered:  Health care employers with 50+ employees
• Effective:  In force since 2011; risk assessment by Oct 1 and plan by Jan 1, annually  

Now the part that most compliance content leaves out. 

Every requirement above compels you to create a written record of what you know about violence risk. Then, if something happens, that record is what a plaintiff's lawyer, an OSHA inspector, or a surveyor reads first. 

Three things follow, and the third is the one that matters.

First: correct who can actually sue you

In most states, an employee assaulted at work cannot sue their employer in tort. Workers' compensation is the exclusive remedy for injuries arising out of and in the course of employment, and recharacterizing the injury as negligent security does not escape it. It is still an employee suing an employer over a work injury.

This is worth being blunt about, because nearly every article and vendor deck in this category tells risk managers that an assaulted nurse will bring negligent hiring, retention, and supervision claims. In most jurisdictions that is wrong, and it misdirects the program.

The exceptions are narrow and state-specific. The intentional-tort exception generally requires that the employer itself committed, directed, or ratified the assault, and a failure to prevent a foreseeable assault is negligence rather than intent. A handful of states apply a deliberate-intent or substantial-certainty test instead, which is broader but still demanding. Assaults arising from a purely personal quarrel imported into the workplace can fall outside comp entirely, which opens the tort door and closes the benefits door at the same time.

Nonsubscriber states are the clearest exception, and the leading case is a warning rather than an opening. In Texas West Oaks Hospital v. Williams, a psychiatric technician injured by a patient could sue his employer because the hospital did not subscribe to workers' compensation. He lost anyway. The Texas Supreme Court held his claim was a health care liability claim under the state's medical liability act, which reaches employee plaintiffs and not only patients, and dismissed it for failure to serve the required expert report. Losing the comp bar does not mean losing every defense.

The model case is a hospital sued after an employee's daughter was abducted and murdered in its parking ramp. She was a business visitor, not an employee, so exclusivity was irrelevant and the hospital faced a full negligent security case.

Second: foreseeability is not presumed

The claim that foreseeability is "presumed" in healthcare because industry violence data is extensive appears in a great deal of vendor content. No jurisdiction applies that rule. Foreseeability is an element the plaintiff must prove, and in several major jurisdictions the standard is more demanding than ordinary negligence, not less.

Courts use one of four tests: the specific harm rule, prior similar incidents, the totality of the circumstances, or a balancing test weighing foreseeability and gravity of harm against the burden of prevention.

California is worth following in detail, because its leading case is a hospital parking lot shooting and because the law moved after it. Isaacs v. Huntington Memorial Hospital (1985) held that prior similar incidents were helpful but not necessary. Then it was narrowed. Ann M. (1993) held that a high degree of foreseeability is required before a duty to hire security guards attaches, and that it can rarely be shown without prior similar incidents. Sharon P. (1999) applied that to an underground parking garage and found no duty. The line that emerged is a sliding scale, confirmed in Delgado (2005): the more burdensome the precaution, the more foreseeability is required, and simple, low-burden measures need only ordinary foreseeability.

For a hospital that means the analysis turns on what you were asked to do. A demand that you should have posted armed guards faces a high bar. A demand that you should have fixed a light, locked a door, or changed a visitor policy faces a much lower one, and those are the measures your own worksite analysis is most likely to have named.

Anyone citing Isaacs alone is citing forty-year-old law, and opposing counsel will say so.

Third: the record you are required to keep is the proof of notice

Here is where the first two points converge, and it is the reason this article exists.

Foreseeability is not presumed. But in emergency departments, behavioral health units, and parking structures it is often easy to establish on the facts, for a reason hospitals create themselves. Incident reporting systems, security logs, the annual worksite analysis the Joint Commission requires, the OSHA 300 log, the risk assessment CMS requires, and the incident records twenty-one states require all generate a documentary record of actual notice.

In the parking ramp case, the evidence that sank the hospital included its own rape-awareness seminars, which had warned employees that thirty percent of rapes begin or occur in parking lots. The hospital's own safety education proved it knew.

And in the Tenth Circuit case decided this February, the hospital's own post-citation fixes proved abatement had been feasible before the citation.

 "Every regulator requires you to write down what you know. Both of the leading cases turned on a hospital's own documents."  

The conclusion is not to document less. That is unlawful, it fails every requirement in this article, and it is worse on the facts, because a thin file in a setting with obvious risk reads as indifference rather than as innocence.

The conclusion is that an unremediated known risk is the worst available posture, and it is the one a compliant-but-inert program produces by default. A program that generates a worksite analysis every year and acts on none of it has manufactured, at annual intervals, a dated record of everything it knew and did not fix.

That is not a documentation problem. It is the difference between a compliance program and a safety program, and it is visible in the file either way.

Two things get confused here, and the confusion has operational consequences: staff withhold safety-relevant information because someone told them HIPAA forbids sharing it.

Telling the clinical team that a patient has assaulted staff is treatment. It is permitted under 45 CFR §164.502(a)(1)(ii) and §164.506(c), and no authorization is required. Handoff, the responding physician, the sitter: all treatment.

On minimum necessary, be precise, because a privacy officer will be. §164.502(b)(2)(i) exempts disclosures to a health care provider for treatment from the minimum necessary standard. Sharing inside your own organization is technically a use rather than a disclosure, and uses are governed by role-based access under §164.514(d). The result is the same either way, but the reasoning differs, and policies that cite the wrong one invite an argument you do not need.

45 CFR §164.512(j) is a different pathway for a different purpose. It permits disclosure to avert a serious and imminent threat, to someone reasonably able to prevent or lessen it, including the target. That is the authority for telling security or law enforcement, not for routine care team communication. It carries three limits: the threat must be serious and imminent, so a history of violence alone does not qualify; the recipient must be able to act on it; and the disclosure must be consistent with applicable law, which pulls in state duty-to-warn rules.

It also carries a protection almost nobody mentions. A covered entity acting under §164.512(j) is presumed to have acted in good faith if the belief rests on actual knowledge or on a credible representation by someone with apparent knowledge or authority. That presumption is what a charge nurse making a fast decision at two in the morning is entitled to rely on.

Two limits to carry into policy. §164.512(j)(2) restricts using information learned during treatment intended to affect criminal propensity, though only for the law enforcement identification pathway rather than generally. And stricter regimes override: 42 CFR Part 2 for substance use disorder records, plus state mental health confidentiality law.

Flagging patients: no law exists, and that is the finding

Many organizations flag patients with a history of violence in the record. Someone always asks whether that is lawful.

There is no federal statute or regulation squarely on point, and I could locate no CMS, OCR, or Joint Commission guidance either. The absence is itself worth knowing, because it means the constraints are indirect and easy to miss:

• EMTALA. A flag may never gate medical screening or stabilization. If a flag changes whether or how fast someone is seen, that is a problem independent of the flag.

• Disability and civil rights law. The published work on behavioral flags points toward disproportionate application to patients with psychiatric and substance use diagnoses, and reports differences by race and payer, with downstream effects on care. If that pattern holds in your own data, that is where discrimination exposure lives, under the ADA, Section 504, and Section 1557. The practical implication is to audit your own flags for disparity rather than to assume the published pattern does or does not describe you.

• In the absence of regulation, the published literature is the nearest thing to a standard. Work on flag criteria, review cycles, removal processes, and disparity auditing is what an expert witness would likely reach for.

So the practical answer is that flagging is not prohibited, and an unstructured flagging practice with no defined criteria, no expiration, no removal pathway, and no equity audit is a real exposure sitting inside a compliance vacuum.

Regulators can require that training happened. They cannot require that it worked.

That is not a criticism of the regulators. It is a description of what a rule can do. A surveyor can verify a curriculum, a completion record, and a date. Nobody has designed a survey that can verify whether a nurse in her eleventh hour actually does something different when a family member starts shouting.

But there is a third thing between those two, and it is the one worth measuring. Not whether the training happened, which a surveyor already checks. Not whether it worked, which nobody can check. Whether the organization created the conditions for it to be used.

That one is answerable, and answerable from documents you already hold. Did the worksite analysis produce actions with owners and dates. Did anything change because an incident was reported. Did anyone practice, or only attend. Those are audit questions, not culture questions, and an organization that cannot answer them has found the real gap in its program without needing a surveyor to point at it.

Which means every requirement in this article is a floor, and the floor is real and worth meeting. What sits on top of it is a separate decision that no regulator will make for you, and the two get confused constantly because they use the same documents.

If you want the operational half, it is the skills your staff need. If you want the financial half, it is what the problem is actually costing you. This article is only the part that says you have to.

The part compliance cannot do for you

An article can tell you which four regulators reach you, what each one requires, which citation to look it up under, and what the file does when someone reads it later. Most compliance officers do not have all of it in one place.

What an article cannot do is close the gap between the analysis and the meeting. It cannot get four departments to agree on who owns the worksite analysis. It cannot sit across from a prosecutor who has never met anyone from your organization. And it cannot make anyone act on the finding in a document that has already been written, filed, and forgotten, which is the failure mode every case in this article turns on.

Those are not research problems. They are the same organizational problem underneath all of it: the requirement produces a document, and a document is not an action.

The bottom line

Compliance is not the enemy of a real workplace violence program. It is the floor one gets built on, and the floor is now specific enough to be worth meeting precisely: three Elements of Performance, two Conditions of Participation, one General Duty Clause, and whatever your state requires.

But notice what all four regulators have in common. Every one of them makes you write down what you know. The worksite analysis, the risk assessment, the injury log, the incident record. That file is how you demonstrate compliance, and it is the first thing anyone reads afterward.

Which means the question that decides your exposure is not whether the documents exist. It is whether anything happened because of them.

If your last worksite analysis identified a risk that is still there, you do not have a documentation problem. You have a dated record of a hazard you knew about, which is the precise thing the two leading cases in this area turned on.

The fix is not a bigger binder. It is a short, honest look at your last analysis and an answer to one question: what changed because of it?