Laws and requirements for violence prevention

The United States has no federal OSHA standard for workplace violence, even in healthcare, but that does not mean there are no rules. Hospitals are held to account through the general duty clause of the Occupational Safety and Health Act, state laws such as Minnesota's hospital violence statute, the accreditation standards of the Joint Commission and the conditions that the Centers for Medicare and Medicaid Services set for hospitals that take Medicare patients. This lesson sets out what each of these requires, who has which duties, and how Northbridge turns those requirements into a working plan.

The general duty clause and OSHA's guidelines

Section 5(a)(1) of the OSH Act, the general duty clause, requires every employer to provide a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm. Federal OSHA, and state plans such as MNOSHA under Minnesota's own law, have cited hospitals, psychiatric facilities and nursing homes under the general duty clause after serious assaults on staff, where the hazard was recognized in the industry and feasible controls existed but had not been used.

OSHA has not issued a workplace violence standard. It began the formal process for a healthcare and social assistance standard and held a small business review panel in 2023, but no proposed rule has been published. A federal bill, the Workplace Violence Prevention for Health Care and Social Service Workers Act, has been introduced in several Congresses, most recently in 2025, and has not become law. In the meantime, OSHA's main guidance is its publication 3148, Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers, last updated in 2016. It describes five building blocks of a program:

• Management commitment and worker participation: leaders make violence prevention a priority, give it resources, and involve frontline staff in every step.
• Worksite analysis: reviewing records, surveying staff and inspecting the workplace to find where, when and how violence happens.
• Hazard prevention and control: engineering controls such as alarms and room layout, and administrative controls such as staffing, flagging and policies.
• Safety and health training: for all staff, with more for those at higher risk, covering the program, warning signs, de-escalation and how to get help.
• Recordkeeping and program evaluation: recording incidents, tracking trends and reviewing whether the controls work.

Minnesota Statutes section 144.566

Minnesota is one of several states that require hospitals to have a written workplace violence plan. Section 144.566, passed in 2015 and strengthened in 2023, covers hospitals licensed in the state. Its main requirements are:

• A written preparedness and incident response plan tailored to the hospital's own hazards and units, available to workers at all times, and reviewed and updated at least once a year.
• A committee that includes nonmanagerial workers, nonclinical staff, administrators and patient safety experts helps develop and carry out the plan. An existing committee, such as the safety committee, may do this.
• Hazard assessments of each area, including parking lots, outdoor areas and community risks, at a set frequency, with checklists or other tools.
• Review of every incident from the previous year, whether or not anyone was injured.
• Reporting procedures that let workers document risks and report incidents without reprisal, with investigation, feedback to workers and access to police or social services help on every shift.
• Training for all workers at orientation, before working independently and every year, covering de-escalation, warning signs, the plan and how to report, and coping resources such as critical incident stress debriefing and the employee assistance program, plus cultural competency training.
• Staffing requests: a procedure for workers to request additional staffing because of violence risk, with each request and any written reason for a denial kept on file.
• Annual review with the committee, covering the plan's effectiveness, incident numbers and injuries by unit, staffing, security risks and any reports of discrimination or abuse by security staff.
• Sharing and submission: the plan and annual review go to direct care staff, their union and local police, and since January 1, 2025, to the commissioner of health each year.
• No interference: the hospital may not discourage a worker from contacting police or the commissioner about an act of violence, or retaliate against them for doing so. The commissioner may fine a hospital up to 10,000 dollars for noncompliance, after a 30-day correction period.

Joint Commission and CMS requirements

Since January 1, 2022, the Joint Commission has required accredited hospitals to have a workplace violence prevention program. The main elements of performance are:

• Leadership (LD.03.01.01, EP 9): a workplace violence prevention program led by a designated individual and developed by a multidisciplinary team, with policies and procedures, a reporting system, follow-up and support for victims and witnesses, and reporting of incidents and data to the governing body.
• Annual worksite analysis (EC.02.01.01, EP 17): a yearly analysis of the program, with action taken to reduce the risks found.
• Monitoring and investigation (EC.04.01.01, EPs 1 and 6): a process for continuously monitoring, internally reporting and investigating safety and security incidents, including workplace violence, and the use of that data in improvement.
• Training (HR.01.05.03, EP 29): education at hire, every year and when changes occur, covering roles and responsibilities, the program, de-escalation, nonphysical intervention skills, physical intervention techniques where appropriate, responding to emergency incidents and reporting.

Criminal law, civil rights and privacy

• Criminal law. Assaulting a health care worker is a crime. Minnesota, like many states, treats some assaults on health care workers more severely than other assaults, and hospital staff may report an assault to police. Section 144.566 forbids the hospital from discouraging them.
• Civil rights law. Under Title VII of the Civil Rights Act and the Minnesota Human Rights Act, employers can be responsible for harassment of employees by patients and visitors on grounds such as race or sex when they know or should know about it and fail to act, as Lesson 9 explains.
• HIPAA. The privacy rule allows a hospital to use and share patient information with its own workforce for treatment and operations, and to disclose information needed to prevent or lessen a serious and imminent threat to the health or safety of a person. Flagging, covered in Lesson 3, fits within these rules when it shares only what staff need.
• CMS. Hospitals that take Medicare patients must meet conditions of participation, including the patient's right to care in a safe setting. In 2022, CMS reminded hospitals that a safe setting includes safety for staff, and surveyors can cite hospitals that fail to address violence.

Duties of employers, supervisors and workers

Whatever the jurisdiction, the duties fall into a familiar pattern:

How Northbridge organizes it

At Northbridge, Joanne Pelletier is responsible for the workplace violence preparedness plan, and the safety committee serves as the plan committee required by section 144.566. The plan is reviewed every year in December and submitted to the commissioner of health in January. Each unit has its own hazard assessment. Joanne keeps a simple compliance checklist so that nothing required by the statute or the Joint Commission is missed.

The checklist is a short script that Joanne updates before each committee meeting. Each item is marked done or not, with the date it was last done; anything not done, or done more than a year ago, is flagged.

from datetime import date

today = date(2026, 11, 2)
items = [  # (requirement, last done or None)
    ("written policy reviewed",            date(2026, 1, 20)),
    ("organization-wide risk assessment",  date(2025, 10, 14)),
    ("unit assessments: Emergency",        date(2026, 6, 3)),
    ("unit assessments: 4 West",           None),
    ("results shared with committee",      date(2025, 10, 28)),
    ("alarm system tested",                date(2026, 9, 30)),
    ("annual training completion report",  date(2026, 3, 31)),
    ("incident review for last year",      date(2026, 2, 17)),
]
for name, done in items:
    if done is None:
        status = "MISSING"
    elif (today - done).days > 365:
        status = f"OVERDUE ({(today - done).days} days)"
    else:
        status = "ok"
    print(f"{name:<38} {status}")

written policy reviewed                ok
organization-wide risk assessment      OVERDUE (384 days)
unit assessments: Emergency            ok
unit assessments: 4 West               MISSING
results shared with committee          OVERDUE (370 days)
alarm system tested                    ok
annual training completion report      ok
incident review for last year          ok

The output tells the committee exactly where the gaps are: the 4 West unit assessment has never been done, and the organization-wide assessment and the sharing of its results with the committee are more than a year old. Both go on the action list for the next month.

From paper to practice

Inspectors and surveyors look past the binder. A plan can tick every legal box and still fail the worker who is alone with an agitated patient at three in the morning. When the safety committee reviews the Northbridge plan each year, it asks a few practical questions that go beyond the checklist:

• Does every worker on every shift know how to call for help, and does the help actually arrive quickly? The answer comes from drills and alarm tests, not from the policy.
• Do staff learn about a patient's history of violence before they walk into the room, not after?
• Do the people who were hurt, and the people who saw it, hear what changed as a result of their report?
• Are the units with the most incidents getting the most attention, training and resources?
• Are agency staff, students, physicians, volunteers and contractors covered by the same information and training as employees?

The last question matters more than it seems. Violence often falls on the people with the least information: a float nurse who does not know the unit, an agency certified nursing assistant on a first shift, a student, or a transporter who moves patients all over the building and never attends a unit huddle. A plan that reaches only permanent staff on day shift leaves the most exposed workers unprotected.

Joanne also checks that the plan treats violence as a shared problem rather than a personal failing. The wording matters. A policy that says staff must "prevent escalation" can be read as blaming the worker who was assaulted. Northbridge's version says that the hospital is responsible for providing the controls, training and support, and that staff are responsible for using them and reporting what happens.