OSHA Compliance
OSHA Publication 3148: The Five WVP Program Components
OSHA Publication 3148 defines five program components for healthcare workplace violence prevention. Here is what each requires and the documentation an inspector reviews.
OSHA Publication 3148 is the agency's voluntary guidance, "Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers." It defines five program components — management commitment, worksite analysis, hazard control, training, and recordkeeping — that OSHA uses to judge whether a healthcare employer has made a good-faith effort to address violence as a recognized hazard.
#Why these five components matter
Because OSHA has no specific workplace-violence standard, it evaluates healthcare employers under the General Duty Clause §5(a)(1) — and the yardstick it uses is the five-component framework in Publication 3148 (Source: OSHA 3148). Structure your written program under these five headings and an inspector's checklist becomes your table of contents. Leave a component undocumented and you have created the gap a citation is built around.
The same five components also map cleanly onto Texas Chapter 331's required elements and the Joint Commission's functional requirements, so building to Publication 3148 is rarely wasted effort.
#Component 1 — Management commitment and worker participation
This is the foundation, and it is the component facilities most often treat as implied rather than documented. OSHA looks for two things: visible leadership ownership and genuine frontline involvement.
What to document:
- A management-commitment statement signed by senior leadership.
- A standing committee with a roster, charter, and meeting minutes.
- Evidence that frontline workers helped build the program — survey results, feedback channels, committee seats for direct-care staff.
An inspector reads the absence of worker participation as a sign of a "paper program." Notably, this dovetails with Chapter 331, which requires a committee that includes a registered nurse providing direct patient care — direct-care voice is a legal requirement, not a nicety. See our program development work for how this committee is stood up and documented.
#Component 2 — Worksite analysis and hazard identification
A worksite analysis is the dated, facility-specific record that you looked for the hazard before it became an incident. OSHA expects three inputs:
| Input | What it produces |
|---|---|
| Records review | Trends from your incident log, OSHA 300 Log, and prior reports |
| Walkthrough survey | Physical hazards — sightlines, egress, alarm coverage, access points |
| Employee survey | Near-misses and concerns the data never captured |
The output is a written hazard inventory by area or unit, dated and signed. This is the same artifact the Joint Commission requires as an annual worksite analysis, so the work is reusable. Our workplace violence risk assessments service produces this document in survey-defensible form. High-acuity settings such as emergency departments warrant their own unit-level analysis.
#Component 3 — Hazard prevention and control
Identifying a hazard without controlling it is, in OSHA's framing, recognizing a hazard you failed to abate — the worst position in a §5(a)(1) case. Controls fall into three tiers:
- Engineering controls — physical changes: panic alarms, controlled access, visibility improvements, safe rooms.
- Administrative and work-practice controls — staffing patterns, flagging processes, visitor management, response protocols.
- Behavioral controls — de-escalation skills delivered through training (Component 4).
The critical evidence is a hazard-control log that ties each control to a specific identified hazard and an implementation date. "Panic alarms planned" is not abatement; "panic alarms installed in triage on [date]" is. The log is what separates a real program from an aspirational one.
#Component 4 — Safety and health training
Training is where Publication 3148, Chapter 331, and the Joint Commission converge most tightly. Each expects substantive, documented education for all applicable staff — including contracted, agency, and per-diem personnel.
What to document:
- A curriculum outline covering de-escalation, reporting, and facility-specific risks — content, not just an attendance sheet.
- Dated, signed rosters reconciled against your full census.
- Delivery at the required cadence: at least annually under Chapter 331; at orientation, annually, and on program change under the Joint Commission (HR chapter).
- Instructor qualifications and any competency or attestation evidence.
VIGILO delivers this as de-escalation training and broader healthcare staff training that doubles as survey evidence, in English and Spanish.
#Component 5 — Recordkeeping and program evaluation
The final component closes the loop. Recordkeeping means the OSHA 300 Log, 300A Summary, and 301 Incident Reports are maintained under 29 CFR 1904 and reconciled against your internal WVP incident log — a mismatch is both a recordkeeping violation and a credibility problem. Our guide to OSHA 300 Log recordkeeping for workplace violence injuries covers what belongs on the log.
Program evaluation means a dated annual review that shows the program was examined and revised. This is also the Chapter 331 annual plan evaluation and the recurring obligation that keeps a program alive between inspections — handled on a fixed cadence through an annual program review.
#Turning the five components into one binder
The five components are not five projects. Built once and organized under the Publication 3148 headings, they produce a single program of record that answers OSHA, Texas Chapter 331, and the Joint Commission together. If you are unsure which components you can already prove, a flat-fee survey-readiness audit scores all five — and the corresponding Chapter 331 and Joint Commission elements — in one document.