Your Workplace Violence Policy Is Written. Can You Prove It Runs?

Most hospitals have a workplace violence prevention policy. Far fewer can produce, on request, the evidence that it operates: the risk assessments that informed it, the incident reports it generated, the training records behind it, and the documented response when something happened.

That distinction is now the whole compliance question. Regulators have moved past asking whether a plan exists.

What changed

The Joint Commission's 2026 posture reflects a shift that has been building for several years. Hospitals are expected to move beyond reactive measures and implement structured, well documented prevention strategies. The emphasis in 2026 is on showing these processes are actively implemented and documented, not just written as policies.

Read that carefully, because it describes a different kind of survey. A binder satisfies the old test. Only an operating record satisfies this one.

The federal picture is more exposed than it looks

There is a common misreading of the federal position. As of 2026, no specific OSHA standard mandates a written workplace violence prevention plan for healthcare, and the proposed rule sits in long term action status. Some organizations treat that as permission to wait.

It is not. Federal OSHA can still cite healthcare employers under the General Duty Clause for recognized, preventable hazards, and workplace violence in healthcare is about as well recognized a hazard as exists. Federal data recorded 740 fatal work injuries due to violent acts in 2023. Across 2021 and 2022, healthcare and social assistance reported 41,960 nonfatal workplace violence cases, which was 72.8% of all such cases in private industry.

A hazard that well documented in the public record is difficult to describe as unforeseeable.

States are not waiting for the federal rule

California moved first and moved broadly. SB 553 took effect July 1, 2024 and requires all California employers to maintain a written prevention plan specific to each physical work site, train employees on it, and maintain records. Penalties reach $25,000 per serious violation. Separately, Cal/OSHA must adopt a healthcare specific standard by December 31, 2026.

For multi state health systems this is the harder problem. Compliance is no longer one program measured against one standard. It is a program that has to hold up against the strictest jurisdiction you operate in.

Facilities without a documented, operating program carry compliance, accreditation, and litigation risk at the same time.

The staffing cost is the argument that lands with finance

Violence prevention is usually framed as a compliance expense, which puts it in competition with every other compliance expense. The workforce number reframes it.

In a 2024 National Nurses United survey of roughly 1,000 nurses, 60% of those who experienced violence considered leaving their jobs. Replacing a single registered nurse costs an average of $60,090. Set those side by side and the math is uncomfortable in a useful way. A program that prevents a handful of departures a year pays for itself, and that is before counting citations, settlements, or the accreditation consequences of a failed survey.

What an operating program looks like on paper

If a surveyor asked today, these are the artifacts that answer the question:

• A site specific risk assessment, dated, with named findings rather than general categories.
• An incident reporting record that includes near misses. Underreporting is the most common weakness, and a report volume that looks low is usually evidence of a reporting problem rather than a safety one.
• Training records tied to named roles, not a single all staff module.
• Documented post incident response, including what changed afterward.
• Evidence of cross functional ownership. Programs that sit entirely inside security tend to stall. The ones that work pull in patient care, HR, and communications.
• An annual third party review with written findings, which is the cleanest way to show the program was tested by someone with no stake in the result.

The defensibility question

Every item above exists to answer one question a surveyor, a plaintiff's attorney, or a board member will eventually ask: what did you know, and what did you do about it?

An organization that can answer with dated findings and documented remediation is in a fundamentally different position than one holding a policy document. The policy describes intent. The record demonstrates it.