Workplace Violence Prevention: A Practical Program Guide for 2026 | SafetyRegulatory.com — Workplace Safety Certifications, Training & Careers

Workplace violence is the third-leading cause of fatal occupational injuries in the United States. The Bureau of Labor Statistics Census of Fatal Occupational Injuries (CFOI) reported this ranking for 2022, and the numbers behind it haven’t been improving fast enough to ignore. Nearly every employer, regardless of industry, carries some level of risk.

The good news: most workplaces that get hit weren’t doing the basics. A written program, some environmental controls, and trained supervisors cut risk substantially. This isn’t a compliance formality. It’s a program that actually works.

OSHA’s Current Authority and What California Changed

OSHA does not have a specific workplace violence standard. Instead, the agency enforces against employers using the General Duty Clause, Section 5(a)(1) of the OSH Act, which requires employers to provide a place of employment free from recognized hazards that are causing or likely to cause death or serious physical harm.

OSHA has published voluntary guidelines for two sectors: healthcare and social services, and late-night retail. These guidelines aren’t enforceable as standards, but they describe exactly what OSHA expects to see. If your industry is healthcare or retail and a worker gets assaulted, OSHA will compare your program against those guidelines.

California changed the picture in July 2024. Cal/OSHA’s SB 553 became the first binding workplace violence prevention standard in the country. It applies to nearly all California employers except certain healthcare employers already covered under a separate standard. SB 553 mandates a written workplace violence prevention plan, a violent incident log, training for all employees and supervisors, and an annual review. Violations carry real penalties.

Other states are watching. Washington State has been developing rules along similar lines. Even if your operation is outside California, building your program to SB 553 standards now puts you ahead of whatever comes next.

The Four Types of Workplace Violence

Not every workplace violence incident looks the same, and the prevention approach differs by type.

Type 1 is criminal intent. The perpetrator has no legitimate relationship to the business, such as a robbery at a convenience store or a carjacking of a delivery driver. The attacker is there to commit a crime and the worker is caught in it. Environmental controls, cash-handling procedures, and visibility matter most here.

Type 2 involves a customer, client, or patient. This is the most common type in healthcare, social services, and any public-facing role. A patient in psychiatric distress, a frustrated customer, an intoxicated bar patron. De-escalation training and clear incident reporting protocols are the primary defenses.

Type 3 is worker-on-worker. Co-worker disputes, harassment that escalates, a termination that goes badly. This type demands strong HR policies, clear reporting channels, and supervisors trained to recognize early warning signs before a situation becomes physical.

Type 4 involves a personal relationship brought into the workplace. Domestic violence situations where the abuser shows up at the victim’s job site are the most common example. Employers often don’t think of this as their problem. It is. OSHA’s General Duty Clause doesn’t care where the threat originated if it shows up on your property during work hours.

High-Risk Industries

Healthcare workers face the highest rates of nonfatal workplace violence by a wide margin. NIOSH data consistently shows that patient-on-worker violence (Type 2) drives this. Emergency departments, psychiatric units, and long-term care settings carry the most concentrated risk. Violence is so normalized in some healthcare environments that workers underreport it as “part of the job.” That normalization is a hazard in itself.

Social services workers face similar exposure, often working alone in clients’ homes with no direct line of communication back to a supervisor.

Late-night retail, particularly convenience stores and gas stations, faces concentrated Type 1 risk. The combination of cash on hand, isolation, and late hours creates the conditions for robbery and assault.

Taxi and rideshare drivers work alone, in confined spaces, with strangers. NIOSH has flagged this sector for decades. The risk profile for rideshare drivers mirrors the classic taxi driver pattern.

Corrections officers face elevated Type 2 and Type 3 risk, working in environments where violence is a near-daily possibility. Strong environmental design and direct supervision ratios are the main controls.

Building a Written Workplace Violence Prevention Program

A written program does two things: it makes you think through your exposures before an incident happens, and it gives you a defensible record if OSHA comes knocking after one.

Start with a workplace violence hazard assessment. Walk each work area and ask: who could come into contact with workers here, under what circumstances, and what controls exist? Document what you find. This doesn’t need to be a complex document, but it needs to be real, meaning someone actually walked the job and wrote down what they saw.

The program needs to identify and analyze hazards specific to your location, not a generic template. A corrections facility has different exposures than a hospital outpatient clinic, which has different exposures than a big-box retail store. Generic programs fail because they don’t match the hazard.

Cal/OSHA SB 553 requires a violent incident log, distinct from your regular OSHA 300 log. This log captures every incident of workplace violence, regardless of whether it resulted in injury. Near-misses, threats, and intimidation events get logged. Over time, that log reveals patterns: which shift, which location, which job type sees the most incidents. That’s your priority list for corrective action.

Your program also needs a clear statement of employer commitment, procedures for workers to report incidents without fear of retaliation, and roles and responsibilities assigned by name and position.

Environmental Controls

Physical environment shapes risk more than most employers realize. Lighting matters. Dimly lit parking lots, stairwells, and corridors create both opportunity and the perception of danger. Address both.

Visibility into work areas cuts risk for Type 1 and Type 2 incidents. Convenience stores that removed shelving above four feet to create sightlines to the register saw measurable reductions in robbery rates. The OSHA late-night retail guidelines make this specific.

Entry controls, including keycard access, secured reception areas, and visitor sign-in processes, reduce unauthorized access. In healthcare settings, controlling entry to patient care units is one of the most effective Type 1 controls.

Panic buttons and duress alarms give workers a way to call for help without escalating a volatile interaction. These should be fixed in high-risk workstations and, where feasible, carried by lone workers and home visitors.

Secure areas for workers to retreat to during a violent incident need to be identified in advance, marked clearly, and practiced.

Administrative Controls

No lone-worker policies in high-risk settings are one of the most evidence-backed controls available. Social service workers making home visits, healthcare staff in isolated areas, and retail workers closing alone all carry elevated risk. A buddy system or check-in schedule doesn’t cost much. An assault that results in OSHA enforcement, litigation, and workers’ comp costs a lot.

Communication check-in procedures for workers in the field or in isolated settings give supervisors an escalation path when a check-in is missed. Define what “missed check-in” means, who gets notified, and what happens next. Write it down.

Threat assessment teams, common in larger organizations, bring together HR, legal, security, and management to evaluate reported threats before they escalate. This is a Type 3 and Type 4 control. The goal is early identification and intervention, not punishment.

Clear and retaliation-proof reporting procedures are the backbone of any administrative approach. Workers who see early warning signs and don’t report them are often choosing not to because they’ve seen what happens to people who do. Fix that culture before you build the rest of the program.

Training Requirements

Training needs to be specific to the job, not generic “be aware of your surroundings” advice.

Workers should be able to recognize warning signs of escalating behavior, including verbal aggression, pacing, clenching, invasion of personal space, and fixed stare. These aren’t guarantees of violence, but they’re cues to change approach. Recognizing them early gives workers options that disappear once a situation goes physical.

De-escalation basics include verbal techniques (lower voice, slow speech, use first name, acknowledge frustration), positioning (stand at an angle, create distance, keep hands visible), and knowing when to disengage entirely rather than try to resolve the situation. De-escalation is a skill, and it requires practice, not just a slide deck.

Training must cover your reporting procedures: who to call, what to document, and what happens next. Workers who don’t know how to report incidents after the fact are less likely to report them at all.

Supervisors need an additional layer of training on threat assessment, early intervention conversations, and what to do when a worker reports feeling threatened by a co-worker or personal contact.

Under SB 553, training is required for all employees and supervisors at time of hire and annually after that. Refresher training is required when a new risk is identified or a significant incident occurs.

Post-Incident Response

How an employer responds after an incident shapes whether workers report future incidents. Get this wrong and your reporting data dries up.

Immediate response: medical care first, law enforcement if needed, scene security. Make sure workers not directly involved are removed from the area and know what happened in general terms.

Trauma support is not optional. Vicarious trauma and acute stress responses are real and affect productivity, retention, and future reporting. An Employee Assistance Program (EAP) referral, a peer support conversation, or a debrief with a mental health professional should happen within 24 to 72 hours for workers who witnessed or were directly involved in the incident.

The investigation follows the same root-cause process you’d use for any serious incident: timeline reconstruction, witness interviews, physical evidence review, hazard identification. Two things differ with a workplace violence investigation. First, witness protection matters more here than in a machine-guarding incident. Workers may fear retaliation from a perpetrator who’s still employed or still in the community. Second, the investigation can’t end with “the perpetrator was unstable.” That’s not a corrective action. What condition or control failed that allowed this to happen?

Corrective actions need to close out with timelines and responsible parties, just like any other CAPA process.

What Cal/OSHA SB 553 Signals for the Rest of the Country

California doesn’t usually stop at California. The state’s regulatory model has historically spread to other states on a timeline of three to ten years. Hazard communication, heat illness, and indoor air quality all followed that path.

SB 553 gives federal OSHA a template. It gives other state-plan states a model to reference. Building your workplace violence prevention program to meet SB 553 requirements now, even if you’re in Ohio or Georgia, puts you in a strong position when federal enforcement tightens or your state adopts a similar rule.

The program elements aren’t expensive. A hazard assessment, a written plan, an incident log, and annual training cost time more than money. Start with the hazard assessment. Everything else follows from what you find there.

Sources