How to set up workplace violence reporting
Short answer
Report every act or threat of workplace violence, even with no injury, because most programs see only part of it. OSHA has no violence standard and uses its General Duty Clause. Accredited hospitals face Joint Commission rules. Use one short report, protect the reporter, review monthly.
What counts as workplace violence?
OSHA defines it as any act or threat of physical violence, harassment, intimidation or other threatening behavior at work. It runs from verbal abuse to assault and can involve employees, clients, customers and visitors.
Ask staff to report all of it, including close calls such as a thrown object that missed. Record the first account in the reporter's own words.
Why violence goes unreported, and the fixes
OSHA and GAO (2016) say healthcare violence goes underreported. BLS counted healthcare and social assistance as 73 percent of nonfatal violence cases in 2018. Its rate was 10.4 per 10,000 full-time workers against 2.1 for all private industry, on days-away cases only.
| Barrier or mistake | What fixes it |
|---|---|
| Seen as part of the job | Say all acts and threats count, from anyone |
| Reporting takes too long | Short report by text or QR code first |
| Nothing happens afterward | A named owner and a reply |
| Fear of blame | Ask about the setting, not the worker |
| Patient behavior excused as illness | Report anyway, so care plans and staffing can change |
| Few reports read as proof of safety | Treat low counts as a question, not an answer |
What to capture
Capture these in a short first report.
| Field | Why it matters |
|---|---|
| Role: patient, resident, visitor, customer, co-worker | Sets the response path |
| Type: physical, threat, verbal, sexual, weapon | Shows severity |
| Where, when, what staff were doing | Finds hot spots |
| Trigger, warning signs, earlier alert | OSHA's retail form asks about earlier threats |
| Staffing at the time | Shows if coverage mattered |
| Injury, care given, time lost | Feeds the recordability check |
| Security or police response, support offered | Shows follow-up happened |
A simple severity scale to adapt
| Tier | Example | Response |
|---|---|---|
| 1 | Threat or verbal abuse, no contact | Report; review monthly |
| 2 | Physical contact, no injury | Same-day manager review and support |
| 3 | Injury needing treatment | Recordable? Investigate. |
| 4 | Serious injury, weapon or sexual assault | Security or police now, leaders told, OSHA 24-hour check |
After an incident, in order
Five steps, in this order.
- Make people safeSeparate, call for help, secure the area.
- Care and supportMedical care first, then support and counseling for victim and witnesses.
- Report and preserveReport the same shift. Keep footage, notes and any weapon or object.
- Check OSHAIs it work-related and recordable? OSHA has no general exception for violence. Sexual assault is a privacy concern case: keep the name off the log.
- Investigate and fixFix the setting and process, not just reminders. Report patterns to the safety committee or governing body.
What OSHA, the Joint Commission and CMS ask
OSHA has no standard, but hospitals face clear expectations.
| Source | What it asks | Who |
|---|---|---|
| OSHA General Duty Clause | No violence standard. Keep work free of recognized hazards | All employers |
| Joint Commission LD.03.01.01 EP 9 | Designated leader, incident analysis, victim support, governing body reports | Accredited and critical access hospitals, from January 1, 2022 |
| Joint Commission EC.02.01.01 EP 17 | Annual worksite analysis that includes investigating violence | Same |
| Joint Commission EC.04.01.01 EP 1 and EP 6 | Track and investigate safety and security incidents, violence included | Same |
| Joint Commission HR.01.05.03 EP 29 | Training that covers reporting | Same |
| CMS QSO-23-04-Hospitals | Assess patients for risk of harm to others; train staff. CMS recommends refreshers at least every two years | Hospitals |
Check your state and accreditor too.
Retail and industrial sites
OSHA names higher-risk work: working alone or in isolated areas, handling money with the public, and high-crime areas. For late-night retail, require reports of all assaults and threats and keep logs.
OSHA's retail controls include drop safes with limited-cash signs, ties with local police, and training in conflict resolution and nonviolent response. Plants and warehouses see co-worker and outsider threats; route to HR and security. Assaults go on the OSHA 300 log if they qualify.
How IncidentKit changes the job
Staff report by text or QR code. Lauren asks the follow-up questions, then drafts the form. A person reviews and signs. Routing sends it to security, the manager and the safety lead.
Analytics show hot spots by location, shift and cause. Corrective actions carry an owner, due date and evidence. Industrial packs and OSHA exports are rolling out.
The parts of IncidentKit behind this
- Incident reporting: The full record holds who, what, where, harm, evidence and what happens next.
- QR and quick report: Scan a QR code, fill in three fields, and the incident is on record.
- Lauren, the AI assistant: Tell Lauren what happened. She asks, fills the form, and a person signs.
- Routing and escalation: Severity decides who gets paged, and it escalates if nobody acts.
- Analytics: See which rooms, shifts and equipment keep showing up in your incidents.
- Corrective actions (CAPA): Every fix has an owner, a date and proof. Unverified fixes keep it open.
Frequently asked questions
Is there an OSHA standard for workplace violence?
No specific one. OSHA enforces through the General Duty Clause and publishes guidance. Some states and accreditors add rules.
Is workplace violence recordable on the OSHA 300 log?
Yes, when the injury is work-related and meets the recording criteria. OSHA has no general exception for violence. A threat with no injury is not recordable.
What does the Joint Commission require for workplace violence?
Since January 1, 2022, accredited and critical access hospitals need a violence prevention program. It needs a designated leader and team, incident analysis, victim and witness support, and governing body reports (LD.03.01.01 EP 9).
Should staff report violence from patients who cannot control their behavior?
Yes. Excusing it removes the data needed to protect staff and adjust care. CMS expects training, enough staff and ongoing assessment of patients for aggressive behavior. Report the behavior, trigger and what helped.
Sources
- OSHA: Workplace violence
- OSHA: Workplace violence in healthcare
- OSHA 3153: Recommendations for workplace violence prevention programs in late-night retail establishments (2009)
- OSHA: Recordkeeping FAQ 5-2, workplace violence and work-relatedness
- BLS: Workplace violence in healthcare, 2018
- GAO-16-11: Additional efforts needed to help protect health care workers from workplace violence
- The Joint Commission: Workplace violence prevention resource compendium for hospitals
- CMS: QSO-23-04-Hospitals, workplace violence, November 28, 2022
Reviewed against the sources above on Oct 5, 2026. Rules change: confirm current requirements with the issuing body or your counsel before relying on any summary.
Start with one incident.
Create your kit in about ten minutes and report the first incident the same day. Free to start, no card.