California Workplace Violence Prevention in Healthcare Law

California healthcare employers must build, maintain, and annually review a written Workplace Violence Prevention Plan (WVPP) under Title 8 of the California Code of Regulations, Section 3342. The plan has to be tailored to each unit, service, or operation in the facility, and it has to cover hazard assessment, corrective measures, training, post-incident response, and recordkeeping. California workplace violence prevention in healthcare is governed by this one regulation, and Cal/OSHA enforces it through inspections and citations.¹

Which Facilities Have to Comply

Section 3342 reaches well beyond acute care hospitals. It covers any facility organized and operated for the diagnosis, care, or treatment of human illness where patients are admitted for 24 hours or longer. That includes general acute care hospitals, psychiatric hospitals, skilled nursing facilities, intermediate care facilities, hospice facilities, and congregate living health facilities.²

It also covers home health care, home-based hospice, emergency medical services (including when provided by firefighters and emergency responders), drug treatment programs, and outpatient medical services provided to incarcerated people in correctional and detention facilities.¹

What the Regulation Counts as Workplace Violence

Section 3342 defines workplace violence as any act or threat of violence that occurs at the work site, with an exception for lawful self-defense. Two situations are specifically included: any threat or use of physical force against an employee that results in, or has a high likelihood of resulting in, injury, psychological trauma, or stress; and any incident involving the threat or use of a firearm, dangerous weapon, or common object used as a weapon. Neither requires an actual physical injury.¹

Incidents are classified into four types, and this classification shows up in the incident log:

Type 1: someone with no legitimate business at the facility, such as a person entering to commit a crime.
Type 2: a patient, visitor, or person accompanying a patient.
Type 3: a current or former employee, supervisor, or manager targeting a coworker.
Type 4: someone who does not work at the facility but has a personal relationship with an employee.

What the Written Plan Must Contain

The WVPP has to be specific to the hazards and corrective measures of each unit, service, or operation. One facility-wide document will not satisfy the regulation when different units face different risks. The plan can live inside an existing Injury and Illness Prevention Program or stand on its own.¹

Required elements include active involvement of employees and their representatives in developing, implementing, and reviewing the plan; a clear procedure for contacting law enforcement during all work shifts; and a written policy prohibiting retaliation against any employee who reports a violent incident or calls law enforcement.

Hazard Assessment

The plan must describe procedures for assessing both the physical environment and patient-related risks. On the environmental side, the assessment must look at, at a minimum:¹

Employees working alone or in isolated areas, including night and early morning shifts.
Poor lighting and blocked sightlines.
Missing physical barriers between staff and people who may pose a risk.
Inadequate escape routes.
Alarm system gaps, including areas where alarms are not operational or cannot be reached.
Unauthorized entry points through staff-only doors or emergency exits.
Furnishings or objects in patient-contact areas that could be used as improvised weapons.
Storage of pharmaceuticals, currency, or other high-value items that attract criminal activity.

On the patient side, the assessment must consider a patient’s mental status or conditions that could cause unpredictable or aggressive behavior, medication type and dosage, any known history of violence, and any disruptive or threatening behavior already displayed. A review of all workplace violence incidents from the previous year is also mandatory, and its findings feed into the corrective measures the employer adopts.

Engineering Controls and Correction Deadlines

Hazards must be corrected in a timely manner, and the regulation sets hard deadlines. Imminent hazards require immediate action. Serious hazards that could realistically cause death or serious physical harm must be addressed within seven days. If a permanent fix cannot be completed in that window, interim measures must be in place while the permanent solution is pursued.¹

Corrective measures must include engineering and work-practice controls that eliminate or minimize exposure. The regulation calls out specific requirements:

Enough trained staff on each shift to prevent and immediately respond to incidents. A staff member whose other duties prevent an immediate response does not count as available.
Clear visibility or an immediate means of communication in all areas accessible to patients or the public. Where privacy or layout prevents direct sightlines, alarms are required. Surveillance cameras, mirrors, better lighting, and buddy systems are listed as options.
Treatment areas, patient rooms, and common spaces arranged so a patient or obstacle cannot block an employee’s access to doors or alarms.
Removal, securing, or control of furnishings and objects that could be used as improvised weapons in areas where potentially violent patients are expected.
A security plan to prevent unauthorized firearms and weapons from entering, using tools such as weapon detectors, remote surveillance, or a registration process at designated public entrances.
Sufficient staffing, including security staff, to maintain order and respond to incidents promptly.

Training

Training is required when the plan is first established, annually after that, and whenever an employee is newly hired or newly assigned to covered duties. It must be specific to the employee’s facility and job responsibilities.¹

At a minimum, training must cover warning signs that a situation could turn violent, strategies for avoiding physical harm, the role of security personnel, how to report incidents to law enforcement, and resources available after an incident, including employee assistance programs.

Employees who may need to confront or control aggressive individuals get additional training on factors that predict aggression, the cycle of an assault, and de-escalation techniques.

Post-Incident Response

When an incident happens, the employer’s response must include all of the following:¹

First aid or medical treatment for any injured employee.
Identification of all employees involved in the incident.
Individual trauma counseling made available to all affected employees, not only those physically hurt.
A debriefing held as soon as possible with involved employees, supervisors, and security personnel.
If a patient was involved, a review of that patient’s risk factors and whether the designated risk reduction measures were in place.
Evaluation of whether the plan’s corrective measures, including staffing and alarm availability, were implemented and effective.
Solicitation of the injured employee’s and other involved personnel’s views on what caused the incident and what could have prevented it.

Incident Log and Record Retention

Every workplace violence incident gets a log entry, injury or not. The log must capture the date, time, and specific location; a description of the incident; the violence type (1, 2, 3, or 4); the consequences; and whether law enforcement was contacted. Personal identifying information must be kept out of the log.¹

Because investigation records may contain patient details, employers also need to handle them consistently with HIPAA’s Privacy Rule, which protects information such as names, addresses, birth dates, and physical or mental health conditions.³

Retention periods split by record type. Hazard assessments, correction records, incident logs, and investigation files must be kept at least five years. Training records, including content summaries and attendance lists, must be kept at least one year.

Annual Review

The WVPP must be reviewed at least once a year with employees and their representatives participating. The review assesses whether the plan is working and whether corrective measures adopted since the last review have been effective. Any problems identified have to be corrected promptly. A review that simply re-approves last year’s plan without examining the past year’s incidents will not satisfy the regulation.¹

Does SB 553 Also Apply?

No. California’s general workplace violence prevention law, SB 553, codified at Labor Code Section 6401.9, applies to nearly all employers in the state, but healthcare facilities, service categories, and operations covered by Section 3342 are explicitly exempt. The exemption also extends to any employer that voluntarily complies with Section 3342. Section 3342’s requirements are more detailed than the general-industry standard, so compliance with it already exceeds what SB 553 requires.⁴

Penalties for Noncompliance

Cal/OSHA enforces Section 3342 through inspections and citations. Violations can be classified as serious when there is a realistic possibility that death or serious physical harm could result from the hazard. As of 2025, the maximum penalty for a serious violation is $25,000. Willful or repeat violations carry a maximum of $162,851 and a minimum of $11,632.⁵

Penalties can stack when multiple units or shifts each have their own deficiencies. Alongside the financial exposure, an abatement order can force immediate changes to staffing or facility layout, which is often the more disruptive consequence.

1
Department of Industrial Relations. California Code of Regulations Title 8 Section 3342 – Violence Prevention in Health Care
2
Department of Industrial Relations. California Code of Regulations Title 8 Section 3342 FAQs
3
Centers for Medicare & Medicaid Services. HIPAA Basics for Providers: Privacy, Security, and Breach Notification Rules
4
California Legislative Information. California Labor Code Section 6401-9
5
Department of Industrial Relations. Cal/OSHA Increases Civil Penalty Amounts for 2025