Workplace violence prevention for behavioral health programs: OSHA, the Joint Commission and Texas

Why behavioral health programs plan for it

OSHA's fact sheet on workplace violence in healthcare reports that from 2002 to 2013, serious workplace violence incidents (those that needed days off to recover) were four times more common in healthcare than in private industry on average, that patients were the source of most of them, and that psychiatric aides had the highest rate of violent injuries with days away from work. It also notes that many incidents are never reported. Those numbers are a decade old; the pattern is why OSHA, the Joint Commission and the Texas Legislature all treat healthcare and social service settings as places where violence is foreseeable.

In an outpatient or IOP program the risks are specific and predictable: a client who arrives intoxicated or in withdrawal, a family member angry about a discharge or a release of information, a client told they're being moved to a higher level of care, a positive drug screen, a counselor alone in an office late in the evening group, a parking lot after dark. A program that has written those down and decided what to do about each one is most of the way to what every rule below asks for.

What OSHA can enforce

Question	Answer	Source
Is there an OSHA workplace violence standard?	No. OSHA's overview says there are currently no specific OSHA standards for workplace violence.	OSHA, workplace violence
Then what can OSHA cite?	The General Duty Clause: each employer must keep its workplace free from recognized hazards that are causing or likely to cause death or serious physical harm. OSHA's directive tells inspectors to gather evidence on whether the employer, or its industry, recognized the hazard of violence, and whether feasible ways to prevent or reduce it were available.	OSH Act section 5(a)(1); CPL 02-01-058
Does that reach behavioral health?	Yes. The directive (effective January 10, 2017) names healthcare and social service settings as places where workplace violence is reasonably foreseeable, and OSHA's settings include community mental health clinics and drug abuse treatment clinics.	CPL 02-01-058; OSHA, healthcare workplace violence
What doesn't meet the threshold?	For a complaint inspection, the violence or threat must have caused, or been likely to cause, death or serious physical harm. Bullying, intimidation and harassment generally don't meet those criteria on their own. Where the hazard is noted but a citation's criteria aren't met, the Area Director can send a Hazard Alert Letter instead.	CPL 02-01-058
Is a standard coming?	OSHA has been working on one for healthcare and social assistance, aimed at violence by patients, clients and visitors (a small business review panel finished on May 1, 2023). Until one is issued, the General Duty Clause and the guidelines are the frame.	OSHA, workplace violence SBREFA
Do injuries from an assault go on the OSHA 300 log?	If you keep one. Outpatient care centers (NAICS 6214) and offices of other health practitioners (6213) are on OSHA's list of partially exempt industries and don't keep injury and illness records unless asked in writing; employers with 10 or fewer employees are also exempt. Every employer still reports a work-related death within 8 hours and an inpatient hospitalization, amputation or eye loss within 24 hours. Residential programs should check their own industry code against the list.	29 CFR 1904 Subpart B App. A; 1904.39

The practical point: when OSHA looks at a violent incident, the question is what you knew and what you could reasonably have done. A dated worksite analysis, an incident log that someone reviews, and training records are your answer to both.

The OSHA 3148 program, part by part

OSHA 3148 says the risk factors can be reduced or eliminated by a written, comprehensive workplace violence prevention program, and OSHA describes it in parts. Its prevention program pages and the hospital eTool group them as below. The guidelines are voluntary; they are also the yardstick an inspector is likely to use for "feasible."

Part	What OSHA describes	What it looks like in a small outpatient program
Management commitment and employee involvement	A written program, a zero-tolerance policy that covers workers, patients, clients, visitors and contractors, managers held accountable, and workers involved in finding hazards and choosing fixes.	A two-page policy signed by the director; one named leader; counselors and front-desk staff on the team that does the analysis, because they know which hallway and which hour.
Worksite analysis	A hazard, threat and security assessment: review incident records, inspect the worksite, and survey employees.	Once a year and after any serious incident: a walk-through (below), last year's incident reports, and a short anonymous staff survey asking where and when they feel unsafe.
Hazard prevention and control	Engineering and administrative controls chosen from the analysis. OSHA's examples include secure rooms with video and visual surveillance, door locks, and furniture arranged so staff can't be trapped; it says its examples aren't the full set.	Counselor's chair nearest the door; a way to call for help from every office; visitor sign-in; a rule that no one runs the last group of the night alone; a written plan for clients who arrive under the influence.
Safety and health training	Train all staff to recognize and defuse verbal abuse before it becomes physical, and on what to do in an emergency, including when to call 911.	De-escalation training at hire and on a schedule, plus a short yearly review of your own policy, the alert method and the reporting form.
Recordkeeping and program evaluation	Records of incidents to assess risk and measure progress; a uniform reporting system, regular review of reports and trends.	Every incident, including threats and verbal assaults, on one form; a quarterly look at counts and trends; a yearly evaluation of whether the fixes worked.

OSHA 3148 sorts settings into hospitals, residential treatment, non-residential treatment and service (small neighborhood clinics and mental health centers), community care and field work. An IOP, PHP or outpatient counseling program falls under non-residential treatment; a residential program under residential treatment. Read the section for your setting: its examples are more specific than the summary above.

The Joint Commission: which programs, which requirements

The Joint Commission added workplace violence requirements program by program, each announced in an R3 Report:

Accreditation program	Effective	Announced in
Hospitals and critical access hospitals	January 1, 2022	Joint Commission, 2021
Behavioral health care and human services (BHC)	July 1, 2024	R3 Report Issue 42 (December 2023): three new requirements and one revised
Home care	January 1, 2025	R3 Report Issue 45

So an accredited IOP, PHP, outpatient or residential program surveyed under the behavioral health care manual is held to these now, not just pointed to them as a model. The four BHC requirements:

Standard	What it asks for (paraphrased)	The evidence a surveyor will look for
LD.03.01.01 EP 9 (new)	A workplace violence prevention program led by a designated individual and developed by a multidisciplinary team, with policies and procedures to prevent and respond to violence, a process to report incidents so incidents and trends can be analyzed, follow-up and support for victims and witnesses (including counseling when needed), and reporting of incidents to the governing body.	The policy; the leader's name; the team list; the incident form; minutes or reports showing incidents went to the board or owner.
EC.02.01.01 EP 17 (new)	A worksite analysis related to the program every year, and action to reduce or resolve the safety and security risks it finds. The analysis looks at the site itself, the program's incidents, and whether its policies, training and environment reflect best practices and the law.	This year's dated analysis and the fix list with what was done.
EC.04.01.01 EP 1 (revised)	The program's process for monitoring, internally reporting and investigating environment of care problems now names workplace violence incidents.	Incident reports, the investigation of each, and the quarterly environment of care review that covers them.
HRM.01.05.01 EP 17 (new)	Training, education and resources on the program at hire, every year, and whenever the program changes, suited to each role: recognizing and reporting workplace violence, de-escalation, and intervention.	Training records for every staff member, with dates that line up with hire dates and policy changes.

The Joint Commission's definition of workplace violence is broader than OSHA's citation threshold. It takes in threats and verbal, written and physical aggression, including bullying, sabotage, harassment and physical assault, involving staff, clients or visitors. Your incident form and training should use the broad definition even though OSHA wouldn't cite most of those events. The Joint Commission's workforce safety resource center has tools for each piece. A physical assault of a staff member that causes severe harm can also be a sentinel event; see sentinel events and root cause analysis, including the list that takes effect January 1, 2027.

EP numbers move between editions. Look each one up in your current E-dition before you cite it in a policy. The Joint Commission's other behavioral health expectations are in our Joint Commission behavioral health checklist.

Texas: who SB 240 covers

Senate Bill 240 (88th Legislature, 2023) added Health and Safety Code chapter 331, effective September 1, 2023 (bill history). It applies to a list of licensed facilities:

• hospitals and mental hospitals;
• freestanding emergency medical care facilities and ambulatory surgical centers;
• nursing facilities, and home and community support services agencies licensed to provide home health services, that employ at least two registered nurses.

Each must adopt, carry out and enforce a written workplace violence prevention policy and plan (by September 1, 2024), set up or assign a committee that includes at least one direct-care registered nurse, review the plan at least once a year, train staff every year, offer immediate post-incident services including any acute medical treatment needed, and never discourage staff from calling law enforcement or retaliate against someone who reports in good faith (enrolled bill).

What it doesn't cover: a chemical dependency treatment facility, an outpatient mental health clinic or a counseling practice isn't on the list, so a freestanding IOP or outpatient program in Texas isn't subject to chapter 331 unless it operates under one of those licenses (for example, a hospital-based program). It's still a good model: a committee with front-line staff, a written plan, yearly review, post-incident care and no retaliation are the same things the Joint Commission asks for. Texas licensing rules for substance use programs, and what they require for incidents, are summarized in the consulting guide to 26 TAC 564.

The yearly worksite analysis, room by room

Walk the program with two or three staff, at the hours you actually run, and write down what you find. What we look at in an outpatient program:

• Front desk and waiting room: who can come in, whether visitors sign in, whether the person at the desk can see the door and get help without leaving the desk.
• Counseling offices: the staff chair between the client and the door, nothing heavy or sharp within reach, and a way to call for help that works from that room (a phone, a duress button, an agreed code word).
• Group rooms: two exits if the room has them, furniture that can't block the way out, and what happens when a group runs late and the building empties.
• Drug screen collection: the most common place for a tense conversation; who is present, and where the results are discussed.
• Hard conversations: discharges, transfers to a higher level of care, positive screens, release-of-information refusals. Decide who is present and where they happen.
• Clients who arrive intoxicated or in withdrawal: the written procedure, who decides, and who calls for transport.
• Working alone: early openings, last groups, telehealth from an empty office, home or community visits.
• Outside: parking lot and walkway lighting, where staff park, and walking out together after evening groups.
• Records: last year's incident reports, near misses, and the staff survey. Patterns by time, day and room usually point to the fix.

Rate each finding the way you rate hazards in your hazard vulnerability analysis, which already has a "workplace violence / active threat" line, and give each fix an owner and a date. Several items overlap with the safety and security section of environment of care rounds, so check them monthly there and in depth once a year here. Your ligature risk assessment is a separate walk-through for self-harm risks, but the same rooms.

After an incident

1. Safety and care first. Call 911 when anyone is in danger or hurt; get medical care for anyone injured.
2. Report it internally on your incident form the same day. For a licensed Texas chemical dependency program, the internal report is due within 24 hours (the full list of clocks is on the incident reporting timelines page).
3. Check the outside clocks: OSHA within 8 hours for a work-related death and 24 hours for an inpatient hospitalization, amputation or eye loss; the state if a client was involved in a reportable incident; your accreditor's sentinel event policy if the harm was severe.
4. Support the people involved: the staff member, witnesses and other clients. The Joint Commission's EP 9 expects follow-up and support for victims and witnesses, including counseling when needed.
5. Investigate and fix: what happened, what made it possible, what changes. Feed it into the next quarterly review and, if it changed your risks, into the worksite analysis and the emergency operations plan.
6. Tell the governing body. Workplace violence incidents go to leadership and the board or owner as part of regular reporting.

The program checklist

Everything a Joint Commission surveyor, an OSHA inspector or your own board is likely to ask for, with how often:

Item	How often	Where it comes from
Written workplace violence prevention policy, with the definition, reporting, response and no-retaliation	Reviewed yearly	OSHA 3148; LD.03.01.01 EP 9
A named program leader and a multidisciplinary team that includes front-line staff	Kept current	LD.03.01.01 EP 9; OSHA 3148
Worksite analysis (walk-through, incident review, staff survey) with a dated fix list	Yearly, and after a serious incident	EC.02.01.01 EP 17; OSHA 3148
Incident reports for every event, including threats and verbal aggression, each one investigated	Same day	EC.04.01.01 EP 1; your licensing rules
Trend review of incidents, with what changed	Quarterly	LD.03.01.01 EP 9; OSHA 3148
Report to the governing body	At least yearly; serious incidents promptly	LD.03.01.01 EP 9
Training on recognizing, reporting and de-escalating, suited to each role	At hire, yearly, and when the program changes	HRM.01.05.01 EP 17; OSHA 3148
Post-incident support for victims and witnesses	After each incident	LD.03.01.01 EP 9; OSHA 3148
Active threat exercise as one of your emergency exercises	As your emergency plan sets	Your emergency management plan
OSHA 300 log and 300A summary, if your industry isn't partially exempt	Ongoing; 300A posted February 1 to April 30	29 CFR 1904

The yearly items are on the behavioral health compliance calendar with the rest of the year's safety work.

Where Comply fits

Comply isn't an incident reporting system, and no client information goes into it. It runs the recurring work around one: the yearly hazard vulnerability analysis with its workplace violence line, monthly environment of care rounds whose safety and security section checks visitor sign-in, key control and outside lighting, an emergency exercise schedule whose scenarios include an active threat, with drills 4 to 12 months apart and a written critique, the quarterly incident, grievance and complaint review, the yearly evaluation of your security management plan, and the OSHA 300A posting each February. The training tracker keeps each direct-care staff member's de-escalation certification and flags it before the date on the card. Every "no" becomes a fix with an owner and a due date, and the proof goes into the survey binder.

Need the policy written? Cima Consulting's program policy and procedure manual ($7,500) includes security and workplace violence policies, and a mock survey ($6,500) tests the program the way a surveyor would.

Questions

Does OSHA require a workplace violence prevention program?

There's no OSHA workplace violence standard. OSHA can cite an employer under the General Duty Clause when violence is a recognized hazard likely to cause death or serious physical harm and feasible steps to reduce it weren't taken. Its guidelines for healthcare and social service workers (OSHA 3148) are voluntary, but they describe what "feasible" looks like.

What is OSHA 3148?

OSHA's publication "Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers." It recommends a written program built on management commitment and employee involvement, a worksite analysis, hazard prevention and control, safety and health training, and recordkeeping and program evaluation, with examples for hospitals, residential and non-residential treatment, community care and field work.

Do the Joint Commission's workplace violence requirements apply to behavioral health programs?

Yes. They applied to hospitals and critical access hospitals from January 1, 2022, and to accredited behavioral health care and human services organizations from July 1, 2024 (LD.03.01.01 EP 9, EC.02.01.01 EP 17, EC.04.01.01 EP 1 and HRM.01.05.01 EP 17). Home care followed on January 1, 2025.

Does Texas SB 240 apply to an IOP or outpatient program?

Not to a freestanding one. Health and Safety Code chapter 331 covers hospitals, mental hospitals, freestanding emergency medical care facilities, ambulatory surgical centers, and nursing facilities and home health agencies that employ at least two registered nurses. A chemical dependency treatment facility or counseling practice isn't on the list.

How often do staff need workplace violence training?

For Joint Commission behavioral health programs: at hire, every year, and whenever the program changes (HRM.01.05.01 EP 17). OSHA 3148 recommends training all staff to recognize and defuse escalating behavior and on emergency response. Track it like any other required training.

What counts as workplace violence?

The Joint Commission's definition is broad: threats and verbal, written or physical aggression, including bullying, sabotage, harassment and assault, involving staff, clients or visitors. OSHA's General Duty Clause cases focus on violence that caused or was likely to cause death or serious physical harm. Record everything that meets the broad definition.

Do we have to keep an OSHA 300 log?

Not if you're partially exempt. Outpatient care centers and offices of other health practitioners are on OSHA's partially exempt list, and employers with 10 or fewer employees are exempt. Everyone must report a work-related death within 8 hours and an inpatient hospitalization, amputation or eye loss within 24 hours.

More in this set: the hazard vulnerability analysis, the emergency operations plan, incident reporting timelines and sentinel events and root cause analysis.

Sources

• OSHA, Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (OSHA 3148); Workplace violence overview, prevention programs and healthcare workplace violence; Workplace Violence in Healthcare: Understanding the Challenge (OSHA 3826).
• OSHA, CPL 02-01-058, Enforcement Procedures and Scheduling for Occupational Exposure to Workplace Violence (effective January 10, 2017); OSH Act section 5; workplace violence SBREFA panel.
• 29 CFR Part 1904: Subpart B Appendix A, partially exempt industries; 1904.39, reporting fatalities and severe injuries.
• The Joint Commission, R3 Report Issue 42: Workplace Violence Prevention in Behavioral Health Care and Human Services; New, revised workplace violence prevention requirements for BHC organizations; requirements for hospitals coming in 2022; R3 Report Issue 45 (home care); workplace violence prevention program resources.
• Texas Health and Safety Code chapter 331; Texas Legislature, SB 240 (88R), enrolled and bill history.

This guide is general information, not legal advice; the official text of each rule controls. Cima Consulting and Comply aren't law firms. Comply isn't affiliated with or endorsed by OSHA, The Joint Commission or the State of Texas.