# How to set up workplace violence reporting

> Report every act or threat of workplace violence, even with no injury, because most programs see only part of it. OSHA has no violence standard and uses its General Duty Clause. Accredited hospitals face Joint Commission rules. Use one short report, protect the reporter, review monthly.

Source: https://incidentkit.ai/use-cases/workplace-violence-reporting · Updated Oct 5, 2026

For: Safety, security or nurse leader building a violence reporting process

## What counts as workplace violence?

OSHA defines it as any act or threat of physical violence, harassment, intimidation or other threatening behavior at work. It runs from verbal abuse to assault and can involve employees, clients, customers and visitors.

Ask staff to report all of it, including close calls such as a thrown object that missed. Record the first account in the reporter's own words.

## Why violence goes unreported, and the fixes

OSHA and GAO (2016) say healthcare violence goes underreported. BLS counted healthcare and social assistance as 73 percent of nonfatal violence cases in 2018. Its rate was 10.4 per 10,000 full-time workers against 2.1 for all private industry, on days-away cases only.

| Barrier or mistake | What fixes it |
| --- | --- |
| Seen as part of the job | Say all acts and threats count, from anyone |
| Reporting takes too long | Short report by text or QR code first |
| Nothing happens afterward | A named owner and a reply |
| Fear of blame | Ask about the setting, not the worker |
| Patient behavior excused as illness | Report anyway, so care plans and staffing can change |
| Few reports read as proof of safety | Treat low counts as a question, not an answer |

## What to capture

Capture these in a short first report.

| Field | Why it matters |
| --- | --- |
| Role: patient, resident, visitor, customer, co-worker | Sets the response path |
| Type: physical, threat, verbal, sexual, weapon | Shows severity |
| Where, when, what staff were doing | Finds hot spots |
| Trigger, warning signs, earlier alert | OSHA's retail form asks about earlier threats |
| Staffing at the time | Shows if coverage mattered |
| Injury, care given, time lost | Feeds the recordability check |
| Security or police response, support offered | Shows follow-up happened |

### A simple severity scale to adapt

| Tier | Example | Response |
| --- | --- | --- |
| 1 | Threat or verbal abuse, no contact | Report; review monthly |
| 2 | Physical contact, no injury | Same-day manager review and support |
| 3 | Injury needing treatment | Recordable? Investigate. |
| 4 | Serious injury, weapon or sexual assault | Security or police now, leaders told, OSHA 24-hour check |

## After an incident, in order

Five steps, in this order.

1. **Make people safe** Separate, call for help, secure the area.
2. **Care and support** Medical care first, then support and counseling for victim and witnesses.
3. **Report and preserve** Report the same shift. Keep footage, notes and any weapon or object.
4. **Check OSHA** Is it work-related and recordable? OSHA has no general exception for violence. Sexual assault is a privacy concern case: keep the name off the log.
5. **Investigate and fix** Fix the setting and process, not just reminders. Report patterns to the safety committee or governing body.

## What OSHA, the Joint Commission and CMS ask

OSHA has no standard, but hospitals face clear expectations.

| Source | What it asks | Who |
| --- | --- | --- |
| OSHA General Duty Clause | No violence standard. Keep work free of recognized hazards | All employers |
| Joint Commission LD.03.01.01 EP 9 | Designated leader, incident analysis, victim support, governing body reports | Accredited and critical access hospitals, from January 1, 2022 |
| Joint Commission EC.02.01.01 EP 17 | Annual worksite analysis that includes investigating violence | Same |
| Joint Commission EC.04.01.01 EP 1 and EP 6 | Track and investigate safety and security incidents, violence included | Same |
| Joint Commission HR.01.05.03 EP 29 | Training that covers reporting | Same |
| CMS QSO-23-04-Hospitals | Assess patients for risk of harm to others; train staff. CMS recommends refreshers at least every two years | Hospitals |

Check your state and accreditor too.

## Retail and industrial sites

OSHA names higher-risk work: working alone or in isolated areas, handling money with the public, and high-crime areas. For late-night retail, require reports of all assaults and threats and keep logs.

OSHA's retail controls include drop safes with limited-cash signs, ties with local police, and training in conflict resolution and nonviolent response. Plants and warehouses see co-worker and outsider threats; route to HR and security. Assaults go on the OSHA 300 log if they qualify.

## How IncidentKit changes the job

Staff report by text or [QR code](https://incidentkit.ai/product/quick-report). [Lauren](https://incidentkit.ai/product/lauren) asks the follow-up questions, then drafts the form. A person reviews and signs. [Routing](https://incidentkit.ai/product/routing-and-escalation) sends it to security, the manager and the safety lead.

[Analytics](https://incidentkit.ai/product/analytics) show hot spots by location, shift and cause. [Corrective actions](https://incidentkit.ai/product/corrective-actions) carry an owner, due date and evidence. Industrial packs and OSHA exports are rolling out.

## Before and after

- **Before:** Staff treat violence as part of the job.
  **After:** A short text or QR code report takes minutes.
- **Before:** Reports go to security, HR or a supervisor's notebook.
  **After:** One record routes every report to the right people.
- **Before:** Nobody knows which units or shifts have the most incidents.
  **After:** Patterns by place, shift and trigger show where to act.
- **Before:** Reporters hear nothing back, or get blamed.
  **After:** Each report gets an owner and a reply.

## Frequently asked questions

### Is there an OSHA standard for workplace violence?

No specific one. OSHA enforces through the General Duty Clause and publishes guidance. Some states and accreditors add rules.

### Is workplace violence recordable on the OSHA 300 log?

Yes, when the injury is work-related and meets the recording criteria. OSHA has no general exception for violence. A threat with no injury is not recordable.

### What does the Joint Commission require for workplace violence?

Since January 1, 2022, accredited and critical access hospitals need a violence prevention program. It needs a designated leader and team, incident analysis, victim and witness support, and governing body reports (LD.03.01.01 EP 9).

### Should staff report violence from patients who cannot control their behavior?

Yes. Excusing it removes the data needed to protect staff and adjust care. CMS expects training, enough staff and ongoing assessment of patients for aggressive behavior. Report the behavior, trigger and what helped.

## Sources

- [OSHA: Workplace violence](https://www.osha.gov/workplace-violence)
- [OSHA: Workplace violence in healthcare](https://www.osha.gov/healthcare/workplace-violence)
- [OSHA 3153: Recommendations for workplace violence prevention programs in late-night retail establishments (2009)](https://www.osha.gov/sites/default/files/publications/OSHA3153.pdf)
- [OSHA: Recordkeeping FAQ 5-2, workplace violence and work-relatedness](https://www.osha.gov/faq/5-2)
- [BLS: Workplace violence in healthcare, 2018](https://www.bls.gov/iif/factsheets/workplace-violence-healthcare-2018.htm)
- [GAO-16-11: Additional efforts needed to help protect health care workers from workplace violence](https://www.gao.gov/products/gao-16-11)
- [The Joint Commission: Workplace violence prevention resource compendium for hospitals](https://digitalassets.jointcommission.org/api/public/content/ebf48f21371341808e962e09dd363dbd)
- [CMS: QSO-23-04-Hospitals, workplace violence, November 28, 2022](https://www.cms.gov/files/document/qso-23-04-hospitals.pdf)

## Related

- [Joint Commission accreditation: surveys and sentinel events](https://incidentkit.ai/compliance/accreditation/joint-commission)
- [Injury reporting and retaliation: 29 CFR 1904.35 and 11(c)](https://incidentkit.ai/compliance/osha/employee-reporting-and-retaliation)
- [OSHA 300 Log: how to fill it out, column by column](https://incidentkit.ai/compliance/osha/osha-300-log)
- [Workplace Injury Reporting: Steps, Deadlines, Records](https://incidentkit.ai/use-cases/workplace-injury-reporting)
- [Incident reporting software for behavioral health](https://incidentkit.ai/solutions/behavioral-health)
- [Patient safety event reporting software for hospitals](https://incidentkit.ai/solutions/hospitals)