Workplace Violence Prevention in Healthcare

A workplace violence prevention program in a hospital has to satisfy two separate regulatory regimes at once, and they are not the same thing. The Joint Commission requires an affirmative, documented program — risk assessment, an incident reporting system, annual data review, and post-incident support — as a condition of Hospital and Critical Access Hospital accreditation. OSHA has no equivalent standalone standard; it reaches workplace violence through the General Duty Clause, Section 5(a)(1) of the OSH Act, using its own 2015 guidelines document as the benchmark for what a “recognized hazard” looks like in a healthcare setting. A program built only to satisfy one of these will have gaps against the other.

These are two different kinds of obligation. The Joint Commission standard is a proactive accreditation requirement: a surveyor checks the program exists and works, whether or not an incident has happened. OSHA’s General Duty Clause is a reactive enforcement mechanism: an inspector can only cite it after receiving a complaint, investigating an incident, or opening a programmed inspection, and only by proving the hazard was recognized and a feasible fix existed. Meeting the Joint Commission standard does most of the work toward defensibility under the General Duty Clause, but the two are legally distinct and neither guarantees compliance with the other.

What “workplace violence” means in a healthcare setting

OSHA and the wider occupational-safety literature classify workplace violence into four types by the perpetrator’s relationship to the workplace:

Type I — criminal intent. The perpetrator has no legitimate business relationship to the workplace (e.g., a robbery).
Type II — customer/client. The perpetrator is a patient, patient’s family member, or visitor receiving or connected to services at the facility.
Type III — worker-on-worker. An employee or former employee is the perpetrator.
Type IV — personal relationship. The perpetrator has a personal relationship with an employee (e.g., domestic violence that follows an employee to work).

In hospitals, Type II dominates: violence from patients in behavioral or medical crisis, patients under the influence of substances, or family members and visitors under acute stress, concentrated in emergency departments, behavioral health units, and geriatric/dementia care areas. Both the Joint Commission standards and OSHA’s guidelines are written with this pattern as the primary target, though a complete program has to cover all four types.

The federal enforcement backstop: OSHA’s General Duty Clause

No OSHA standard specifically regulates workplace violence — federal rulemaking on this has been proposed repeatedly but never finalized. In its absence, OSHA enforces through the General Duty Clause (Section 5(a)(1) of the OSH Act), which requires employers to furnish a workplace “free from recognized hazards that are causing or are likely to cause death or serious physical harm.” A General Duty Clause citation requires OSHA to establish four elements: the employer failed to keep the workplace free of a hazard; the hazard was recognized (by the employer, the industry, or a recognized authority); it was causing or likely to cause death or serious physical harm; and a feasible, useful method existed to correct it.

For workplace violence, OSHA’s own Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (Publication 3148, first issued 1996, most recently updated 2015) functions as the industry-recognized benchmark that establishes the “recognized hazard” element — the same role a consensus standard plays for other General Duty Clause citations where no vertical standard exists. OSHA enforces citations under this framework per its own directive on occupational exposure to workplace violence, and area offices weigh whether an employer implemented the core elements the guidelines describe:

A written, zero-tolerance workplace violence prevention program covering all workers, patients, visitors, and contractors.
A facility-specific hazard assessment identifying risk factors (working alone, poor visibility and lighting, lack of a means to summon help, inadequate staffing during high-risk periods, unrestricted public access to clinical areas).
Engineering controls (physical barriers, panic buttons, controlled access, sightlines) and administrative controls (staffing, scheduling, flagging patients with a history of violence).
Training for staff appropriate to their exposure — recognizing escalation, de-escalation technique, and reporting procedure.
Incident recordkeeping and investigation, with prompt corrective action.
A multidisciplinary prevention committee that includes direct-care staff, not just management and security.

A number of states (California’s Title 8 §3342 being the most prescriptive) have gone further and adopted their own mandatory workplace violence prevention standards for healthcare employers, with specific requirements for the written plan, log, and training that go beyond what federal OSHA requires. Where a state-plan state has such a standard, it applies in place of the General Duty Clause route, and a hospital in that state should treat the state standard, not this guide, as its baseline.

The Joint Commission’s programmatic requirements

The Joint Commission adopted new and revised workplace violence prevention requirements for its Hospital and Critical Access Hospital accreditation programs, spanning the Environment of Care (EC), Human Resources (HR), and Leadership (LD) chapters. Unlike the General Duty Clause, these are affirmative, survey-checked requirements — a hospital has to demonstrate the program exists and functions, independent of whether an actual incident has occurred. The requirements cluster around four components:

Leadership commitment and a defined program. Hospital leadership establishes a workplace violence prevention program as an organizational priority, with defined responsibility for who owns it.
Worksite risk assessment. The hospital conducts an environmental and operational risk assessment for workplace violence — considering factors like unit type, physical layout, patient population, and prior incident history — and uses it to drive prevention planning, not just as a documentation exercise.
A reporting system. Staff need a defined process to report workplace violence incidents and near-misses, including a mechanism that does not expose them to retaliation for reporting. Reported incidents feed into a facility-level dataset, not just an incident-by-incident file.
Data review and post-incident support. The hospital reviews and trends reported incidents at a set cadence to identify improvement opportunities, and provides support to affected staff after an incident — medical evaluation, psychological/trauma-informed support, and a defined path back to duty.

Training is a connecting thread across all four: staff, licensed practitioners, and volunteers receive orientation and ongoing education on the organization’s workplace violence prevention program, tailored to their role and unit’s risk profile.

A note on sourcing. jointcommission.org blocks automated retrieval, so the specific standard and element-of-performance numbers for this requirement package were not independently confirmed against the current accreditation manual for this page. The four-component structure above (leadership/risk assessment/reporting/data-and-post-incident-support) reflects the well-established, widely reported shape of the requirement. Before citing a specific EP number to a surveyor or auditor, confirm it against your hospital’s current E-dition manual or Joint Commission Connect account rather than this page.

Building one program that satisfies both

Because the Joint Commission requirement is the more specific and more frequently surveyed of the two, the practical sequencing for most hospitals is to build to the Joint Commission’s four components first, then check the result against the General Duty Clause elements:

Stand up a multidisciplinary committee — risk/patient safety, security, nursing leadership, behavioral health, human resources, and frontline staff representation. This satisfies both the Joint Commission’s leadership-commitment expectation and OSHA’s guideline on staff-inclusive program design.
Run the risk assessment at the unit level, not just facility-wide. Emergency departments, behavioral health units, and units that board psychiatric patients carry materially different risk profiles than, say, a same-day surgery unit. A single facility-wide risk score misses this and won’t hold up to either a Joint Commission surveyor or an OSHA inspector asking why a specific unit’s controls don’t match its actual exposure.
Build the reporting system around psychological safety. The most common failure mode in workplace violence programs is underreporting — staff treat patient-generated violence as “part of the job” and don’t report it. A reporting mechanism that visibly does not penalize the reporter, and that is simple enough to use in the moment, is what actually produces the incident data both frameworks assume you have.
Define post-incident support before you need it. Medical evaluation, access to psychological support, and a documented return-to-duty process should exist as policy, not be improvised after the first serious incident — both because it’s the right response to a traumatized employee and because the absence of a defined process is itself evidence of a program that only exists on paper.
Review data at least annually, and act on the trend. A hospital that reviews incident data but never changes staffing, environmental controls, or training in response to what the data shows has satisfied the letter of a reporting requirement without the substance of a prevention program — and that gap is exactly what a General Duty Clause citation targets after a serious incident.

Where the two frameworks diverge

The practical difference shows up in timing and proof. The Joint Commission checks for the program’s existence and function on a survey cycle, regardless of whether anything has gone wrong — a hospital can be cited for a missing risk assessment or reporting system even with a clean incident history. OSHA’s General Duty Clause route is retrospective and incident- or complaint-driven: an inspector generally shows up after something happened, or after a complaint, and has to prove the hazard was both recognized and feasibly correctable. A hospital that is current on its Joint Commission workplace violence requirements will, in practice, usually already have the documentation (a risk assessment, a training record, an incident log, a demonstrated response to trends) that also defeats a General Duty Clause citation — but the reverse isn’t automatically true, since a hospital could satisfy a bare-minimum interpretation of “we have a policy” without ever having tested whether the risk assessment or reporting system actually functions the way a surveyor expects.

What this page does not cover

This guide addresses hospital and critical access hospital workplace violence prevention programs under the Joint Commission and OSHA frameworks specifically. It does not cover: active-shooter response planning (a distinct emergency-preparedness discipline), workplace violence prevention laws specific to individual states beyond noting that they exist and can be stricter than the federal floor, or violence prevention program requirements for non-hospital settings such as outpatient clinics, home health, or long-term care, which sit under different accreditation programs and, in some cases, different OSHA guidance documents.

Frequently asked questions

Does OSHA have a specific workplace violence standard for hospitals?

No federal OSHA standard specifically addresses workplace violence. OSHA enforces through the General Duty Clause instead, using its 2015 Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (Publication 3148) as the recognized-hazard benchmark. Some state-plan states, notably California, have adopted their own mandatory standards that go further than the federal floor.

What are the Joint Commission’s workplace violence prevention requirements?

They span the Environment of Care, Human Resources, and Leadership chapters of the Hospital and Critical Access Hospital accreditation manuals, and require, in substance: leadership commitment to a defined program, a worksite risk assessment, a staff reporting system protected from retaliation, and periodic data review paired with post-incident support for affected staff.

What is “Type II” workplace violence?

It’s the classification, used across the occupational-safety literature, for violence committed by someone receiving a service at the facility — in a hospital, typically a patient or a patient’s visitor. It’s the dominant type of workplace violence in healthcare settings and the primary target of both the Joint Commission standards and OSHA’s guidelines.

How often does a workplace violence risk assessment need to be updated?

Neither framework specifies a universal fixed interval in the way some other CMS/Joint Commission requirements do; the operating expectation is that the assessment is reviewed at least annually and revisited whenever a significant incident, a unit change, or a shift in patient population suggests the prior assessment no longer reflects actual risk.

Does Joint Commission compliance automatically satisfy OSHA’s General Duty Clause?

Not automatically, but a hospital that is genuinely current on the Joint Commission’s risk-assessment, reporting, training, and post-incident-support requirements will typically already hold the documentation that also defeats a General Duty Clause citation. The two are legally separate mechanisms, so treat them as complementary rather than assume one substitutes for the other.

What counts as post-incident support under the Joint Commission standard?

In substance: medical evaluation for the affected employee, access to psychological or trauma-informed support, and a defined process for returning to duty. The specific service model (in-house employee health, an EAP, an external trauma response contract) is left to the hospital, but the standard expects the support to exist as policy, not be improvised after the fact.

Workplace Violence Prevention in Healthcare: Joint Commission Standards and the OSHA General Duty Clause

Ask about Workplace Violence Prevention in Healthcare: Joint Commission Standards and the OSHA General Duty Clause