OSHA · Primary source

OSHA and Healthcare Workplace Violence: What Is Actually Required

There is no OSHA workplace violence standard — for healthcare or any industry. What exists is enforceable and specific: the General Duty Clause of the OSH Act, an enforcement directive (CPL 02-01-058), advisory guidelines (Publication 3148), and recordkeeping rules that reach assault injuries. This page states each precisely, including the rulemaking status as of the August 2026 Unified Agenda — because in this market, precision about what OSHA does not require is as valuable as knowing what it does.

Section 01

Start with the honest answer: there is no standard

OSHA has never promulgated a workplace violence standard. Enforcement runs through Section 5(a)(1) of the OSH Act — the General Duty Clause: “Each employer shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees.”

To cite an employer under the General Duty Clause, OSHA must establish four elements (Field Operations Manual, CPL 02-00-163, Ch. 4): the employer failed to keep the workplace free of a hazard to which employees were exposed; the hazard was recognized; it was causing or likely to cause death or serious physical harm; and a feasible and useful method existed to correct it. In healthcare workplace violence cases, the hazard-recognition and feasible-abatement elements are typically carried by the industry literature and OSHA’s own guidelines — which is why a documented program is the defense.

And one procedural fact that deflates fear-based selling: under the enforcement directive, a General Duty Clause workplace violence citation requires National Office approval — an Area Office cannot issue one on its own. These citations are real, and comparatively rare. Buy a program because the hazard and the record demand one, not because a vendor waved a citation at you.

Section 02

The enforcement directive: CPL 02-01-058

CPL 02-01-058, “Enforcement Procedures and Scheduling for Occupational Exposure to Workplace Violence” (effective January 10, 2017), is the current directive — it canceled CPL 02-01-052 (2011), so citing the older number dates your materials by a decade. It gives compliance officers the inspection procedures for workplace violence and names healthcare among the high-risk settings: hospitals, residential treatment (nursing homes included), non-residential treatment, community care, and field work such as home healthcare.

Where hazards do not support a citation, the directive provides for Hazard Alert Letters — formal notice that a recognized hazard exists. Treat one as a documented warning: it becomes part of the record OSHA reads on any return visit.

Section 03

Publication 3148: guidelines, by their own words

OSHA’s *Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers* (Publication 3148, current edition 3148-06R, 2016) recommends a program built on five components: management commitment and employee participation; worksite analysis; hazard prevention and control; safety and health training; and recordkeeping and program evaluation.

The document describes itself precisely: “This guidance document is advisory in nature and informational in content. It is not a standard or regulation, and it neither creates new legal obligations nor alters existing obligations.” So the five components are not mandatory — their power is evidentiary. In a General Duty Clause case they are what hazard recognition and feasible abatement look like on paper, which is why VIGILO builds the written program under the five 3148 headings: the inspector’s checklist becomes your table of contents.

Section 04

The rulemaking, stated precisely (August 2026)

OSHA opened a rulemaking for Prevention of Workplace Violence in Health Care and Social Assistance (RIN 1218-AD08) with a Request for Information on December 7, 2016 (81 FR 88147), and completed the SBREFA small-business review panel on May 1, 2023. No proposed rule has ever been published.

In the Spring 2025 regulatory agenda the rulemaking moved to Long-Term Actions, and the Unified Agenda published August 14, 2026 keeps it there with the proposed-rule date listed as “To Be Determined.” A Long-Term Actions listing signals no expected regulatory action within the coming year — and even a published proposal would face a comment period and a final rule before anything became enforceable.

The planning consequence: build to the obligations that exist — the General Duty Clause plus, in Texas, HSC Chapter 331 — structured on the five 3148 components so any future rule lands as an update, not a rebuild. Track the status in our rulemaking explainer.

Section 05

Recordkeeping: where OSHA definitely reaches you

  • 29 CFR 1904.7 — a work-related assault injury is recordable on the OSHA 300 Log under the general criteria (death, days away, restricted duty or transfer, medical treatment beyond first aid, loss of consciousness, or a significant diagnosed injury). There is no workplace violence exception.
  • 29 CFR 1904.29(b)(7) — privacy-concern cases: only sexual assault qualifies. A physical assault that is not sexual is not automatically a privacy case — a precision point widely gotten wrong.
  • 29 CFR 1904.39 — report a fatality within 8 hours; an in-patient hospitalization, amputation, or loss of an eye within 24 hours. Violent events are not exempt.
  • Reconcile the 300 Log against your internal WPV incident log quarterly — a mismatch between the two is the first thing an inspector cross-checks.

Section 06

Texas has no state OSHA — and what that means

Texas is under federal OSHA jurisdiction for private employers. There is no “Texas OSHA” and no state-plan workplace violence standard. The state acts through licensure instead: HSC Chapter 331 requires the written program, committee, training, and annual evaluation for covered facility classes, enforced at the HHSC survey rather than by an OSHA inspector.

Elsewhere, only California has a mature healthcare-specific state OSHA standard (8 CCR §3342, fully in force since April 2018). Oregon’s proposed rule (OAR 437-002-0150) closed comment August 31, 2026 with a projected January 2027 effective date; Washington (RCW 49.19) and New York (Labor Law §27-b, public employers) impose statutory duties. For a Texas facility, the operative pair is federal OSHA’s General Duty Clause plus Chapter 331 — and, if accredited, the Joint Commission.

Section 07

The CMS angle, kept in proportion

CMS addressed workplace violence in memo QSO-23-04-Hospitals (November 28, 2022), applying existing Conditions of Participation — chiefly 42 CFR §482.13(c)(2), each patient’s right to care in “an environment that a reasonable person would consider to be safe,” plus the emergency-preparedness CoPs at §482.15. The memo is survey guidance to state agencies; there is no workplace-violence-specific Condition of Participation, and the framing is patient-safety-anchored. Accurate statement: CMS surveyors can reach violence-related failures through the safe-environment CoP; “CMS requires a WVP program” overstates it.

Section 08

Claims you will hear that are not true

  • OSHA requires a workplace violence prevention program.” No standard exists; the General Duty Clause requires addressing recognized hazards, which a program evidences.
  • OSHA’s workplace violence rule is imminent / in its comment period.” The rulemaking sits in Long-Term Actions, NPRM “To Be Determined,” with no proposed rule ever published.
  • Publication 3148’s five elements are mandatory.” The document itself says it creates no legal obligations.
  • You will be fined if you don’t have a program.” A General Duty Clause WPV citation requires all four elements plus National Office approval — real, and not routine.
  • Texas OSHA requires…” Texas has no state plan; there is no Texas OSHA.
  • All assault injuries are privacy cases on the 300 Log.” Only sexual assault qualifies under 1904.29(b)(7).
  • CMS requires a workplace violence program under the CoPs.” The QSO memo applies the existing safe-environment CoP; no WPV-specific CoP exists.

VIGILO is an independent consultancy with no affiliation to OSHA or CMS. We state what the record supports — the credibility of the whole program depends on it.

Section 09

What VIGILO builds against this framework

The OSHA compliance engagement delivers the written program under the five Publication 3148 headings, the worksite-analysis and hazard-control log a compliance officer asks for first, the 300-Log reconciliation process, and the cross-map to Chapter 331 and the Joint Commission — one program, three regimes. If a citation or inspection is already in motion, citation-remediation works the abatement clock.

Key dates

Dates that matter

  1. Dec. 7, 2016

    Request for Information

    OSHA opens the healthcare workplace violence rulemaking record (81 FR 88147).

  2. Jan. 10, 2017

    CPL 02-01-058

    The current enforcement directive takes effect, canceling CPL 02-01-052 (2011).

  3. May 1, 2023

    SBREFA panel concludes

    The small-business review that precedes a proposed rule is completed. No NPRM follows.

  4. Spring 2025

    Moved to Long-Term Actions

    The rulemaking leaves the Proposed Rule stage of the regulatory agenda.

  5. Aug. 14, 2026

    Unified Agenda

    RIN 1218-AD08 remains in Long-Term Actions; NPRM date “To Be Determined.”

Primary sources

  • OSH Act §5(a)(1) — the General Duty Clause; OSHA Field Operations Manual CPL 02-00-163, Ch. 4 (the four citation elements).
  • OSHA CPL 02-01-058 — Enforcement Procedures and Scheduling for Occupational Exposure to Workplace Violence (Jan. 10, 2017; cancels CPL 02-01-052).
  • OSHA Publication 3148-06R (2016) — Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (advisory).
  • Unified Agenda of Regulatory and Deregulatory Actions (pub. Aug. 14, 2026) — RIN 1218-AD08, Long-Term Actions.
  • 29 CFR 1904.7, 1904.29(b)(7), 1904.39 — recordkeeping and reporting; CMS QSO-23-04-Hospitals (Nov. 28, 2022); 42 CFR §482.13(c)(2).

Frequently asked

Frequently asked questions

Does OSHA require a workplace violence prevention program in healthcare?

No standard requires one. OSHA enforces workplace violence through the General Duty Clause, §5(a)(1), which requires employers to address recognized hazards likely to cause death or serious physical harm — and a documented prevention program is how a healthcare employer demonstrates it has. Publication 3148 supplies the recommended architecture but is advisory by its own text.

Can OSHA cite a hospital for workplace violence without a standard?

Yes — under the General Duty Clause, if it establishes four elements: employee exposure to the hazard, hazard recognition, likelihood of death or serious physical harm, and a feasible correction method. Under CPL 02-01-058, such citations also require National Office approval, which keeps them comparatively rare. Hazard Alert Letters are the more common outcome and still create a record.

Is the federal healthcare workplace violence rule coming soon?

Nothing on the record says so. As of the Unified Agenda published August 14, 2026, RIN 1218-AD08 sits in Long-Term Actions with the proposed-rule date “To Be Determined.” The SBREFA panel concluded May 1, 2023, and no proposed rule has ever been published.

Do workplace violence injuries go on the OSHA 300 Log?

Yes, when they meet the general recording criteria of 29 CFR 1904.7 — days away, restricted duty, medical treatment beyond first aid, and so on. There is no workplace violence exception. Only sexual assault qualifies as a privacy-concern case under 1904.29(b)(7), and 1904.39’s 8-hour fatality and 24-hour hospitalization reporting rules apply to violent events like any other.

Does Texas have its own OSHA workplace violence standard?

No. Texas is a federal-OSHA state for private employers, with no state plan and no state OSHA standard. Texas regulates healthcare workplace violence through licensure instead — HSC Chapter 331 and its implementing rules — enforced at the HHSC survey.

Find out where your program stands

A Survey-Readiness Audit scores your program against the General Duty Clause record, Publication 3148's five components, Texas Chapter 331, and the Joint Commission — in one document.

CallRequest an Audit