Workplace Violence Prevention

Cal/OSHA classifies workplace violence into four types, defined by the attacker's relationship to the workplace. The classification is not academic - each type has different warning signs and demands different controls, and California's violent incident log requires you to record which type occurred.

• Type 1 - Criminal Intent. The perpetrator has no legitimate relationship to the business. Robbery, trespass, or an act of terrorism. Late-night retail, cash-handling and isolated work raise this risk.
• Type 2 - Customer or Client. The perpetrator is someone the business serves: a customer, patient, student, or passenger. This is the most common type in healthcare, social services and retail.
• Type 3 - Worker-on-Worker. A current or former employee attacks or threatens a colleague. Often preceded by a long, visible pattern of escalation that co-workers noticed and did not report.
• Type 4 - Personal Relationship. The perpetrator has a relationship with an employee but not with the business - most often domestic violence that follows a victim to a predictable location: their workplace.

Type 4 deserves particular attention because employers frequently treat it as a private matter. It is not. A workplace is where a victim reliably appears at a known time, which makes it uniquely dangerous. California's law explicitly contemplates employers seeking restraining orders on an employee's behalf.

Classifying an incident correctly drives the correct fix. A Type 1 problem is solved with lighting, cash controls and locks. A Type 3 problem is solved with supervision, reporting culture and HR intervention. Applying the wrong control leaves the real hazard untouched.

Violence is rarely spontaneous. It usually sits at the end of an observable escalation, and the single most consistent finding in post-incident reviews is that somebody noticed something and did not report it - often because it seemed too minor, or they did not want to overreact.

Behavioural indicators worth attention include a marked increase in hostility or irritability, direct or veiled threats, obsessive focus on a grievance, unusual interest in weapons, statements suggesting the person has nothing left to lose, and sudden withdrawal after a period of visible anger. Escalating boundary-testing matters too: refusing to leave, following staff, repeated unwanted contact.

Escalation typically moves through stages. Anxiety shows as agitation, pacing or rapid speech and is the easiest point to intervene. Defensiveness brings challenges to authority, personal insults and refusal to comply. Aggression is the loss of verbal control - shouting, threats, invading space. Physical violence is the point at which de-escalation has failed and only protective action remains.

The practical takeaway is that intervention is easy and effective early, and nearly impossible late. Reporting a concern is not an accusation; it is data. Your obligation is to report what you observed, factually and promptly, and let trained staff assess it. You are never expected to diagnose intent or decide whether a threat is credible.

Both California and New York require training on the hazards of your job, not workplace violence in the abstract. This is the module your employer must extend with site-specific detail.

Recognised risk factors are well documented and consistent across research. Working with the public raises exposure, particularly where people are distressed, intoxicated or waiting. Handling cash or valuables attracts Type 1 events. Working alone or in small numbers, especially at night, removes both deterrence and assistance. Working in high-crime areas, in mobile workplaces such as delivery vehicles, or in uncontrolled-access buildings compounds it. Roles involving enforcement, denial or refusal - security, front desk, benefits, returns - draw hostility structurally, not personally.

Environmental controls that reduce these risks include controlled entry points, adequate exterior and interior lighting, clear sightlines at reception, barriers or counter depth where confrontation is likely, panic alarms or duress buttons, limits on the cash held on site, and layouts that never allow a staff member to be cornered without an exit route.

Identify the following before you need them: your two nearest exits, the position of the nearest alarm or duress device, where staff assemble after an evacuation, and who is on shift with you. Your employer must give you this information in writing under New York's act and as part of the plan under California's.

De-escalation is a set of trained behaviours, not a personality trait. It works because an agitated person is operating from emotional arousal rather than reasoning, and the goal is to lower arousal enough for reasoning to return. You are not trying to win the argument.

Manage yourself first. Your own physiology is contagious. Slow your breathing, drop your vocal pitch and volume slightly below theirs, and slow your speech. People unconsciously mirror the calmest person present if that person stays consistent.

Use position deliberately. Stand at a slight angle rather than square-on, which reads as confrontational. Keep your hands visible and open. Maintain more distance than feels natural - roughly two arm-lengths - and never let the other person come between you and your exit.

Acknowledge before you explain. "I can see this has been frustrating" costs nothing and lowers arousal. Explaining policy to someone who does not yet feel heard reliably escalates them. Offer limited genuine choices, since restoring a sense of control reduces aggression.

• Do not touch the person, even reassuringly.
• Do not say "calm down" - it consistently escalates.
• Do not argue, correct details, or defend policy in the moment.
• Do not stay in an unwinnable interaction out of pride.

Know your stopping point. De-escalation ends the moment threats become specific, a weapon appears, or physical contact occurs. Disengage, move to safety, and summon help. Choosing to leave is a professional decision, not a failure.

When prevention and de-escalation fail, response is measured in seconds and depends almost entirely on decisions you have already made. The widely adopted framework is Run, Hide, Fight, applied in that order of preference.

Run. Evacuation is always the first choice when a route exists. Leave belongings. Move away from the threat, not merely toward the main entrance, which may be where the threat entered. Keep your hands visible as you exit so responders can identify you as a non-threat. Help others move but do not delay your own escape to persuade someone who will not leave.

Hide. If evacuation is not possible, put substantial barriers between yourself and the threat. Lock and barricade the door, turn off lights, silence your phone completely - vibration is audible - and stay out of sight lines from doors and windows. Remain quiet and do not open the door for anyone who is not a uniformed responder.

Fight. A last resort when your life is in immediate danger and escape is impossible. Commit fully, act with others if you can, use improvised weapons and target vulnerable areas.

When responders arrive, keep hands empty, raised and visible. Follow instructions exactly. Do not grab officers or ask questions - the first units are moving toward the threat, not treating casualties. Once safe, go to your designated assembly point so your employer can account for everyone.

SB 553, codified at Labor Code section 6401.9, took effect July 1, 2024. It is the broadest workplace violence law in the country: it applies to virtually all California employers, not just healthcare or retail.

Limited exclusions apply. Healthcare facilities already covered by Cal/OSHA's separate violence prevention standard, certain correctional and law-enforcement facilities, employees teleworking from a location of their own choosing, and workplaces with fewer than ten employees at a given time that are not open to the public are outside its scope.

Covered employers must do four things:

• Establish and maintain a written Workplace Violence Prevention Plan, either standalone or inside the Injury and Illness Prevention Program.
• Provide training when the plan is first established and annually thereafter.
• Maintain a violent incident log for every incident.
• Keep records - training records for one year, incident logs and hazard assessments for five.

Required training content includes the employer's own plan and how to get a free copy, the workplace violence hazards specific to the employee's job, how to report incidents and hazards without fear of reprisal, emergency response procedures, and the strategies employees can use to protect themselves. Training must allow an interactive opportunity for employees to ask questions and receive answers.

Penalties reach $25,000 for a serious violation. Cal/OSHA is directed to adopt a formal standard by December 31, 2026, which is expected to add specificity rather than relax anything.

California's log requirement is what most distinguishes SB 553 from ordinary safety training. Under Labor Code 6401.9 the employer must record information in a violent incident log for every workplace violence incident - not only those causing injury, and not only those involving police.

Each entry must be recorded based on information solicited from the employees who experienced the violence, from witnesses, and from investigation, and must capture:

• The date, time and location of the incident.
• A detailed description of what happened.
• The classification - which of the four types it was.
• Where it occurred and the circumstances, including what the employee was doing at the time.
• The type of violence: threat without physical force, physical force without injury, or physical force causing injury.
• Consequences, including whether security or law enforcement was contacted and what action was taken to protect employees.
• Who completed the log and when.

The log must omit personal identifying information about the people involved. It is a hazard record, not a personnel file. Employees and their representatives are entitled to a copy within fifteen calendar days of request, and the log must be retained for five years.

Your practical obligation is simple: report every incident, including threats that came to nothing. An unreported near-miss is a hazard the employer is not permitted to correct, because they do not know it exists.

New York's Retail Worker Safety Act, at Labor Law section 27-e, takes a narrower but deeper approach than California. It applies to employers with ten or more retail employees in New York State - people working at a store that sells consumer goods.

Covered employers must adopt a written workplace violence prevention policy and provide interactive training. Frequency depends on size:

• All covered employers: training upon hire.
• 50 or more retail employees: annually thereafter.
• 49 or fewer: at least once every two years.

Training must be provided during paid working time and may be delivered digitally, provided it is interactive. Employers must supply the policy and training materials in the employee's primary language where the state has published a translation. The New York State Department of Labor publishes a model policy and model training that employers may adopt.

The act requires genuinely site-specific content that no general course can provide: a list of emergency exits or a floor map with exits marked, the location where staff assemble in an emergency, instructions for the specific emergency devices and security systems in that store, and any store-specific procedures.

From January 1, 2027, retail employers with 500 or more employees statewide must provide employees with a silent response button that summons immediate assistance from a security officer, manager or supervisor.

Reporting is the mechanism that makes every other control work. A hazard that is never reported is never corrected, and the incident logs both states require can only be built from what employees tell their employer.

Report everything, not just assaults. Threats, aggressive behaviour, intimidation, unwanted following, and incidents that ended without harm are all reportable. Near-misses are the cheapest possible source of information about a hazard, because nobody was hurt learning it.

A useful report is factual and specific. Record what was said and done in the person's own words where possible, the date, time and exact location, who was present, what you did in response, and whether security or police were involved. Write it down while your memory is fresh - contemporaneous notes are far more reliable, and far more defensible, than recollection weeks later.

Retaliation is prohibited. California's law expressly requires employers to train employees on how to report without fear of reprisal, and both states' general labour protections prohibit adverse action against an employee for raising a safety concern in good faith. Adverse action includes termination, demotion, schedule reduction, reassignment and exclusion. If you experience it after reporting, that is itself a violation and separately reportable.

You are protected when you report in good faith even if the concern turns out to be unfounded. The standard is honesty, not accuracy.

Both statutes are built around a written plan, and both require that employees be trained on their own employer's plan rather than a generic one. This module tells you what to look for in yours.

A compliant California plan must name the people responsible for implementing it, explain how employees participate in identifying hazards and developing the plan, describe how the employer will communicate with employees about violence, set out emergency response procedures, describe how incidents will be investigated, and state how identified hazards will be corrected. It must also cover how the employer will obtain the active involvement of employees, and how post-incident response and investigation will be handled.

The plan must be available to employees and California requires employers to explain in training how to obtain a free copy. If you have never seen your employer's plan, that is a gap in your training, and you are entitled to ask for it.

Your responsibilities under any plan are consistent:

• Know the reporting procedure and use it.
• Know your site's exits, alarm devices and assembly point.
• Participate honestly in hazard identification - you see hazards supervisors do not.
• Follow the access-control, cash-handling and lone-working rules the plan sets, since these are the controls that were chosen for your actual risks.
• Complete refresher training on schedule.

The plan must be reviewed at least annually, and after any incident, to determine whether the controls actually worked.

What an employer does in the days after an incident determines whether it becomes a corrected hazard or a repeated one.

Immediate response. Secure the area and ensure nobody is in continuing danger. Get medical attention for anyone injured, and remember that psychological injury is real injury. Preserve evidence, including any video, before it is overwritten. Notify the people the plan designates.

Support. Acute stress reactions - difficulty concentrating, disrupted sleep, intrusive memories, avoidance of the location - are ordinary responses to an extraordinary event, not weakness or unfitness. Many employers provide an Employee Assistance Programme; using it is confidential. Colleagues who witnessed the event, or who arrived immediately after, are affected too and are routinely overlooked.

Investigation and correction. The investigation exists to find the hazard, not the culprit. It should establish what happened, what controls existed, whether they were followed, whether they worked, and what must change. California requires the findings to feed back into the plan and requires the violent incident log to be completed regardless of outcome.

Review. Both states expect periodic review of the plan. The honest test is whether anything actually changed: a new duress button, a revised lone-working rule, a lock repaired, a procedure rewritten. A review that concludes "no changes required" after a genuine incident is usually a review that was not really performed.

Prevention is a cycle - identify, control, train, respond, review, correct - and the reporting you do is what keeps the cycle turning.