OSHA and Workplace Violence in Healthcare: What Hospitals Are Actually Required to Do

By the MGM Solutions team — life-safety RTLS specialists since 2002.

Healthcare workers absorb a disproportionate share of the workplace violence that occurs in the
United States. Every hospital security director knows this. What is less well understood is the
regulatory position it creates, because the most common assumption — “there is no OSHA standard,
so there is no OSHA exposure” — is wrong.

OSHA has cited healthcare employers for workplace violence hazards for years without a
violence-specific standard, using the General Duty Clause. Understanding how that
works is the difference between a defensible program and a surprise inspection.

This article covers what the General Duty Clause actually requires, what a written prevention
program has to contain, how state rules and accreditation requirements stack on top, and where duress
technology genuinely helps — along with the parts it cannot help with at all.

This is an overview for planning purposes, not legal advice. Requirements change and vary by
state. Verify current federal and state obligations with your compliance counsel.

The General Duty Clause Is the Enforcement Mechanism

Section 5(a)(1) of the Occupational Safety and Health Act requires employers to furnish a workplace
free from recognized hazards likely to cause death or serious physical harm. There is no list of
hazards attached. When OSHA cites a hospital for workplace violence, it generally must establish four
things: a hazard existed, the employer or the industry recognized it, the hazard was causing or likely
to cause serious harm, and a feasible means of abatement existed.

The second and fourth elements are where healthcare employers get caught. Recognition is
easy for OSHA to establish in healthcare — the industry publishes on it constantly,
OSHA has issued guidelines specifically for healthcare and social service workers, and most hospitals
have their own incident data proving they knew. And feasible abatement is easy to establish
because other hospitals are already doing it: risk assessments, staffing and design changes,
training, alarm and duress systems.

The practical consequence is that your own incident log is simultaneously your best management tool
and, if nothing was done about what it shows, the strongest evidence against you.

Federal rulemaking for a healthcare-specific workplace violence standard has been in progress for
several years, and several states have enacted their own requirements ahead of it. Because the status
of both changes, confirm the current federal rulemaking stage and your state’s rules directly rather
than relying on any article, including this one.

What a Defensible Program Contains

Whether you are working from OSHA’s healthcare guidelines, a state rule, or accreditation
requirements, the expected elements are consistent.

Note the third row. In OSHA’s hierarchy of controls, engineering controls rank above administrative
ones. A duress alarm system is an engineering control — and one of the few available in a
clinical setting, since you cannot redesign an emergency department around violence risk without
affecting care.

Under-Reporting Is the Hidden Compliance Problem

Healthcare workplace violence is widely acknowledged to be under-reported, for reasons that are
entirely human: the incident felt “part of the job,” the patient was medically or cognitively
impaired, the reporting form takes fifteen minutes, or nothing came of the last report.

Under-reporting creates a specific regulatory trap. If your log shows six incidents a year while a
staff survey shows most nurses experienced verbal or physical aggression in the past month, an
inspector will read the gap as evidence the program is not functioning — and your hazard
analysis was built on numbers you now cannot defend.

Two things reliably move reporting: making it take seconds rather than minutes, and visibly acting
on what comes in. A duress system contributes to the first by generating a timestamped, located record
of an activation automatically, so the event exists in the data even if the narrative report is filed
later.

Where Duress Technology Genuinely Helps

A wireless staff duress system addresses a narrow and important slice of the problem: shortening
the interval between “this is going bad” and “help is here,” and documenting what happened.

• Discreet activation. A wearable badge button can be pressed without escalating
  the situation, unlike shouting for help or reaching for a wall-mounted panel across the room.
• Location that means something. An alert that says “help needed” is nearly
  useless; an alert that says which room is actionable. This is why we use infrared for room-level
  confirmation — infrared does not pass through walls, so a read means presence in that room
  rather than a probability — with 433 MHz active RFID carrying the alert building-wide through
  walls and floors.
• Automatic documentation. Every activation is a timestamped record with location,
  responder acknowledgement, and response interval. That is program-evaluation data you cannot get from
  narrative reports.
• Coverage where assaults actually happen. Parking lots, garages, and the walk to
  the car at shift change are consistently among the highest-risk locations and are outside the reach
  of most fixed alarm systems.

That last point is the one we built the platform around. SecurTRAK covers staff duress,
patient elopement prevention, infant security, and asset tracking on a single infrastructure, indoors
and outdoors. A badge that only works inside the building stops protecting the nurse at the
moment the parking lot starts. Our
wireless staff duress page covers the
deployment, and
staff
duress systems compared puts the options side by side.

What Technology Will Not Do

We would rather be direct about this than have it discovered after purchase. A duress system does
not reduce the number of violent incidents; it reduces the time you are alone in one. It does not
substitute for staffing, for de-escalation training, for behavioral health capacity, or for a visitor
management policy. It will not fix a culture where reporting is discouraged.

And it fails completely if staff do not wear the badge or do not trust that pressing it brings
anyone. Adoption is an operational problem, not a technical one: response drills, published response
times, and visible follow-up on every activation are what make the button meaningful.

Where Accreditation and CMS Requirements Overlap

OSHA is not the only body with an interest here. Accreditation standards address workplace violence
prevention through risk assessment, reporting, training, and follow-up, and federal participation
requirements address patient and environmental safety more broadly. The good news is that the
underlying evidence is the same: a documented risk assessment, defined controls, trained staff,
reliable incident data, and proof of program evaluation.

Build the evidence once and map it to each framework. See
RTLS and
Joint Commission compliance and
CMS
Conditions of Participation and RTLS for how we approach the documentation side.

Frequently Asked Questions

Related reading:
Why Hospitals Need
Wireless Staff Duress Systems  • 
RTLS for Behavioral
Health  • 
How Hospitals Reduce
Liability with RTLS