OSHA Workplace Violence Prevention: The Program Requirements That Apply Without a Standard

If you are waiting for OSHA to publish a workplace violence standard before you build a prevention program, you are working from outdated information — and you are exposed right now. There is no federal OSHA workplace violence standard. The healthcare rulemaking everyone has been tracking has stalled. Yet OSHA continues to cite employers and collect six-figure penalties under existing authority. In May 2024, a Florida healthcare employer faced $101,397 in proposed OSHA penalties for failing to protect workers from violence, with no workplace violence standard on the books. This post lays out what an OSHA-defensible workplace violence prevention program requires today, who is exposed, and why the absence of a standard makes your documentation matter more, not less.

⚡ TL;DR: OSHA regulates workplace violence through the General Duty Clause — Section 5(a)(1) of the OSH Act — not a dedicated standard. The proposed healthcare standard (RIN 1218-AD08) has stalled to “To Be Determined.” Enforcement has not. A documented program built on the OSHA 3148 framework is both the prevention tool and the citation defense.

Is there an OSHA workplace violence standard?

No. OSHA has no specific workplace violence standard. It enforces workplace violence through the General Duty Clause, OSH Act §5(a)(1), which requires employers to keep workplaces free of recognized hazards likely to cause death or serious harm, using directive CPL 02-01-058 to guide inspections.

That distinction matters more than it sounds. Most safety managers build their compliance programs around specific standards — a permissible exposure limit to monitor, a written program to file, a checklist to follow. Workplace violence has none of that at the federal level. The “rule” is the General Duty Clause: furnish a workplace “free from recognized hazards that are causing or are likely to cause death or serious physical harm.” When violence is a recognized, foreseeable hazard in your operation and a feasible control exists that you have not implemented, OSHA can cite you. CPL 02-01-058 — Enforcement Procedures and Scheduling for Occupational Exposure to Workplace Violence — is the internal directive inspectors use to build those cases.

What are OSHA’s workplace violence prevention requirements for employers?

Because there is no standard, the requirement is the General Duty Clause itself: identify recognized violence hazards and abate them with feasible controls. OSHA’s voluntary Guidelines (OSHA 3148) define the program an inspector expects to see — management commitment, hazard analysis, controls, training, incident recordkeeping, and program evaluation.

In practice, OSHA 3148 is the de facto standard. It is voluntary on paper, but a published OSHA guideline plus a recognized hazard is the textbook posture for a General Duty Clause citation. If your operation has a foreseeable violence risk and OSHA has already told the industry what a reasonable program looks like, an inspector can argue the controls were both known and feasible. Treat OSHA 3148 as the expectation, not the suggestion.

What does an OSHA-defensible workplace violence prevention program include?

Per OSHA 3148: a written policy with management commitment and worker participation, a worksite hazard analysis, engineering and administrative controls, employee and supervisor training, incident reporting/investigation/recordkeeping, and periodic program evaluation. The documented incident record is both the prevention tool and the General Duty Clause defense.

Break that into the six components an inspector looks for:

Management commitment and worker participation — a written policy, assigned responsibility, and a channel for workers to report threats without reprisal.
Worksite hazard analysis — review injury and incident logs, threat reports, and physical and operational risk factors to identify high-risk areas, tasks, and times.
Hazard prevention and control — engineering controls (alarms, barriers, lighting, access control, panic buttons), administrative controls (staffing levels, visitor management, de-escalation protocols, lone-worker procedures), and behavioral controls.
Training — recognition, de-escalation, and response training for employees and supervisors, role-appropriate and documented.
Incident reporting, investigation, and recordkeeping — log incidents and near-misses, investigate root cause, and document corrective action.
Program evaluation — periodic review and update as risks change.

The thread running through all six is documentation. When there is no checklist to point to, your hazard analysis, your control decisions, and your incident log are the record that shows you took the hazard seriously.

What happened to OSHA’s proposed workplace violence standard for healthcare?

The healthcare and social assistance standard (RIN 1218-AD08) completed its SBREFA small-business review on May 1, 2023, but the Spring 2025 regulatory agenda moved the proposed rule to the long-term category with the NPRM date listed as “To Be Determined.” It is not on a near-term publication track as of mid-2026.

This is the part most coverage gets wrong. The standard was real — a narrow rule aimed at the highest-exposure sector, built around Type II violence from patients and visitors. The small-business review wrapped in May 2023, and a proposed rule was slated at various points for December 2024 and June 2025. Then the Spring 2025 Unified Regulatory Agenda reclassified it to long-term with no NPRM date. The momentum on a dedicated federal mandate has decelerated. The narrative that “a new OSHA workplace violence rule is imminent” is out of date.

A second signal points the same direction: a July 1, 2025 Federal Register notice proposed a General Duty Clause limitation for “inherently risky professional activities” — an appetite to constrain the clause’s reach in certain contexts, not expand it. The accurate practitioner read is not “get ready for the new rule.” It is “the standard is not coming soon, but your exposure has not moved.”

Can OSHA fine my company for workplace violence without a standard?

Yes. Under the General Duty Clause, OSHA can cite an employer that fails to address a recognized, foreseeable violence hazard when feasible abatement exists. In May 2024 a Florida healthcare employer faced $101,397 in proposed OSHA penalties for failing to protect workers from violence — with no workplace violence standard on the books.

That penalty is the answer to anyone who treats the missing standard as a missing obligation. The General Duty Clause has teeth. Inspections are most often triggered by complaints, severe-injury or fatality reports, or referrals — there is no national emphasis program for workplace violence, though CPL 02-01-058 does allow programmed inspections in recognized high-risk settings. But once an inspector is on site responding to a complaint or an incident, the absence of a documented program is exactly what builds the citation.

What are the OSHA penalties for a workplace violence citation in 2026?

The standard General Duty Clause penalty schedule applies: up to $16,550 per serious violation and $165,514 per willful or repeat violation, with $16,550 per day for failure to abate. There was no 2026 inflation adjustment, so 2025 amounts carry forward.

There is no separate penalty tier for workplace violence — a violence citation runs through the same General Duty Clause math as any other recognized-hazard case. The Florida penalty above cleared $100,000 on a single repeat General Duty Clause citation, plus an other-than-serious citation for failing to report the hospitalization within 24 hours. For context on the asymmetry: a single willful violation costs up to $165,514. An iSi industrial hygiene and safety assessment that surfaces the gap before an inspector does costs a fraction of that. The math on building the program first is not close.

What is Type II workplace violence?

Type II violence is committed by the people an organization serves — patients, clients, customers, students, or visitors. It is the most common category in healthcare and social assistance and the focus of OSHA’s stalled healthcare rulemaking because it is both prevalent and reasonably foreseeable and controllable by employers.

The “foreseeable and controllable” piece is why OSHA built its rulemaking and its OSHA 3148 guidelines around Type II. A patient in a psychiatric unit, a customer in a late-night retail store, a client in a social services office — these are not random external actors. They are people the organization invited into a known setting, which makes the risk predictable and the controls reasonable to require.

Which industries does OSHA target for workplace violence?

Healthcare and social assistance carry the highest exposure, but the General Duty Clause reaches any industry where violence is a recognized hazard — late-night retail, corrections, social services, education, and any employer with a documented threat or incident history.

The General Duty Clause is industry-agnostic. It does not care whether you run a hospital or a fabrication shop. What it cares about is whether worker-directed violence is a recognized hazard in your operation and whether a feasible control exists that you skipped. A documented threat history, lone or night work, cash handling, or a prior incident can establish recognition in a sector no one associates with workplace violence. If you have an incident log with violence entries and no program addressing them, that log is the recognition element of a future citation.

Do Kansas, Oklahoma, Texas, Missouri, or Nebraska require a workplace violence prevention plan?

None of these states has a general-industry workplace violence statute, so federal OSHA’s General Duty Clause is the operative authority across iSi’s core region. California is the outlier — SB 553 requires a general-industry workplace violence prevention plan effective July 1, 2024 — relevant only for multi-state employers with California operations.

For employers in Kansas, Oklahoma, Texas, Missouri, and Nebraska, this simplifies the picture: there is no state plan mandate to layer on top of the federal requirement. The General Duty Clause is the whole obligation, and OSHA 3148 is the roadmap for meeting it. The complication arrives only when a regional manufacturer or operator has facilities in a state like California, where a specific written-plan, training, and recordkeeping mandate applies in addition to the federal clause.

Are state workplace violence laws stricter than federal OSHA?

Yes, where they exist. California (general industry SB 553, and a separate healthcare workplace violence standard since 2017) and several other states impose specific written-plan, training, and recordkeeping mandates that exceed the federal General Duty Clause. In states without such laws, the federal clause sets the floor.

This is the practical asymmetry for multi-state employers. A facility in Wichita is governed by the General Duty Clause and OSHA 3148. The same company’s facility in Sacramento must meet SB 553’s specific plan, training, and recordkeeping requirements and the federal clause. A handful of other states impose healthcare-specific workplace violence prevention requirements. The federal clause is never the ceiling — it is the floor that applies everywhere, with stricter state mandates stacking on top where they exist.

How is workplace violence enforcement different from a regular OSHA standard?

A standard tells you exactly what to do; the General Duty Clause does not. To cite under the clause, OSHA must prove a recognized hazard, foreseeability, serious harm, and a feasible abatement the employer skipped. That makes documentation — your hazard analysis, controls, and incident record — the decisive factor, because there is no checklist to point to.

This inverts how most safety managers think about defense. With a specific standard, compliance is binary: you met the permissible exposure limit or you did not. With the General Duty Clause, the fight is over the four elements, and your own records are the evidence on both sides. A documented hazard analysis showing you assessed the risk and implemented controls is the strongest defense available. An empty file — no analysis, no incident tracking, no corrective action record — hands OSHA the recognition and feasibility elements for free.

What should an employer do now, before any federal standard exists?

Build the OSHA 3148 program now: written policy, worksite hazard analysis, layered controls, documented training, and an incident log with corrective-action tracking. Doing so both reduces incidents and creates the General Duty Clause defense — and positions you ahead of any future federal standard or state law.

The sequence is straightforward:

Run a worksite hazard analysis. Pull your injury logs, threat reports, and incident history. Identify the high-risk areas, tasks, and times. This is the document that establishes you assessed the hazard.
Layer in feasible controls. Engineering controls where the risk is physical (lighting, barriers, access control, panic buttons); administrative controls where it is operational (staffing, visitor management, de-escalation protocols, lone-worker procedures).
Train and document. Recognition, de-escalation, and response training for employees and supervisors, recorded and role-appropriate.
Stand up an incident log with corrective-action tracking. Log incidents and near-misses, investigate root cause, and document what you changed. This record is the prevention engine and the citation defense at once.
Review and update. Risks shift. A program that was current two years ago can become the evidence of a recognized-but-unaddressed hazard.

This is the same enforcement mechanism that drives OSHA’s broader catch-all citations — for a fuller picture of how the General Duty Clause works across hazards beyond violence, see our breakdown of General Duty Clause citations and what triggers them.

Where iSi fits

The hard part of a workplace violence program is not knowing OSHA 3148 exists — it is producing a hazard analysis, control set, training record, and incident-tracking system that holds up when an inspector or your insurance carrier asks for it. iSi builds and documents safety programs for manufacturers and operators where the safety manager owns environmental and EHS compliance without deep specialty training. We run the worksite hazard analysis, structure the layered controls, build the training and recordkeeping framework, and keep it current as the regulatory picture shifts — so the documentation that defends you actually exists before you need it.

Talk to us before an incident or a complaint puts you on OSHA’s calendar. Call (316) 264-7050 or contact our team to scope a workplace violence prevention program for your facility.