Healthcare Workplace Violence Laws: What Hospitals, Care Homes and Home Health Must Do

This guide is for information only and is not legal advice. Requirements change and details matter. Confirm the current text of any law with your counsel before making compliance decisions.

Last reviewed: October 2026. Healthcare workplace violence laws share one core demand: staff must be able to summon help fast, someone must respond, and the employer must be able to show the system works. California's Cal/OSHA §3342 requires hospitals, home health and other covered employers to provide, where applicable, "an alarm system or other effective means" for staff to summon help. New Jersey's rules list personal alarm devices and panic alarms, Oregon lets home health staff refuse visits without a communication device, and New York, Washington, Minnesota, Texas and Illinois require violence prevention plans or programs. There is no federal OSHA standard (the General Duty Clause applies), accredited hospitals must run a Joint Commission workplace violence program, and in Europe, Sweden requires quick help and alarms wherever violence can occur.

The short version

• Help fast, a responder, proof it works. That is the common thread. Every law here requires a risk assessment and a plan, and the ones that get specific ask how staff summon help and whether it actually works.
• Several laws name the alarm. California requires "an alarm system or other effective means" to summon aid. New Jersey lists personal alarm devices and panic alarms. Washington, Minnesota and New York make alarms part of the mandatory plan or assessment. See the box below.
• You choose the tool, and you own the result. No law names a brand. But California makes you look for places where alarms don't work, and New Jersey and Sweden require maintenance and checks. An alarm nobody carries, or one with a flat battery, is a failed control.
• Home health and community staff are covered too. California §3342, Washington RCW 49.19 and Texas (since the 2025 expansion) all reach home health. Oregon goes further: home health staff can refuse a visit to a patient they believe may assault them unless they have a communication device that can signal an assault, or a second employee with them.
• Accreditation adds a layer. The Joint Commission's program requirements apply to accredited hospitals regardless of state law.

Where the law names an alarm or a way to summon help

Everywhere else, the law sets the outcome and leaves the tool to you. You still have to show it works.

What these laws have in common

1. A written plan, built with frontline staff. Washington, Texas, New York and California all require employee or union involvement, often through a committee.
2. A risk assessment, repeated. Usually annual. California lists blocked or non-working alarm systems as hazards to look for.
3. A way to summon help. Named most directly in California ("an alarm system or other effective means") and New Jersey. Elsewhere it sits inside "physical security", "alarms and communication systems" or "security systems, alarms, emergency response".
4. Someone who actually responds. California says staff designated to respond must not have other assignments that stop them responding immediately to an alarm.
5. Training and records. Incident logs, investigations, annual training. Washington and SB 553 require records kept for five years.
6. Attention to working alone. Washington requires procedures to reduce time spent alone in high-risk areas. SB 553's incident log includes "isolated or alone, unable to get help or assistance" as a category.

United States: federal

OSHA

OSHA states plainly that there are no specific OSHA standards for workplace violence. It enforces through the General Duty Clause of the OSH Act, 29 U.S.C. 654(a)(1), which requires a workplace free from recognized hazards likely to cause death or serious physical harm. Inspectors follow enforcement directive CPL 02-01-058 (effective January 2017).

OSHA's voluntary Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (OSHA 3148, 2016 revision) are the practical reference. They are not a regulation, but they list "panic buttons or paging system at workstations or personal alarm devices worn by employees" as hospital engineering controls, and for staff working alone: "ensure workers have means of communication, either cell phones or panic buttons."

OSHA's proposed healthcare workplace violence rule (RIN 1218-AD08) sits in the Long-Term Actions list of the 2026 Unified Agenda, with no proposal date. A federal bill, the Workplace Violence Prevention for Health Care and Social Service Workers Act (H.R. 2531 / S. 1232, introduced April 2025), would require an OSHA standard and lists "personal alarm devices" among controls. It has not moved past committee.

Sources: OSHA, Workplace violence; OSHA 3148 (2016); Unified Agenda, RIN 1218-AD08; H.R. 2531. Checked October 2026.

CMS

CMS memo QSO-23-04-Hospitals (November 2022) did not create a new Condition of Participation. It reminds hospitals that existing conditions on care in a safe setting (42 CFR 482.13(c)(2)) and emergency preparedness (42 CFR 482.15) cover workplace violence, and that surveyors will cite deficiencies.

Source: CMS QSO-23-04-Hospitals. Checked October 2026.

The Joint Commission

Since January 2022, accredited hospitals and critical access hospitals must run a workplace violence prevention program: a designated leader and multidisciplinary team, an annual worksite analysis, incident reporting and investigation, and training at hire, annually and when the program changes. Under the Accreditation 360 restructure effective January 2026, these requirements moved into the National Performance Goals as NPG.02.04.01 ("The hospital has a workplace violence prevention program"), with incident reporting under NPG.11.01.01. The Joint Commission says no new concepts were added. The requirements do not name any device.

Sources: Joint Commission R3 Report Issue 30 (2021); National Performance Goals, hospital program (effective January 2026). Checked October 2026.

United States: states

California

California has the most detailed rules in the country, and two separate regimes.

Cal/OSHA §3342, Workplace Violence Prevention in Health Care. In force since April 2017. It covers health facilities, home health and home-based hospice, emergency medical services and medical transport, drug treatment programs, and outpatient medical services to the incarcerated. Covered employers need a written Workplace Violence Prevention Plan, an environmental risk assessment, a violent incident log, annual review and training. The corrective measures include, as applicable:

• "an alarm system or other effective means by which employees can summon security and other aid to defuse or respond to an actual or potential workplace violence emergency" (§3342(c)(11)(G));
• alarm systems or other effective means for an employee entering an area where patient privacy or layout prevents line of sight (§3342(c)(11)(B));
• staff designated to respond must not have other assignments that would prevent them "from responding immediately to an alarm to assist other staff" (§3342(c)(11)(I)).

The risk assessment must look for obstacles to accessing alarm systems and locations where alarm systems don't work. General acute care, acute psychiatric and special hospitals must report incidents to Cal/OSHA within 24 hours if there is injury, a weapon or an urgent threat, otherwise within 72 hours.

SB 553, Labor Code §6401.9. In force since July 2024 for most other California employers. It exempts facilities covered by §3342, so hospitals and home health follow §3342, not SB 553. SB 553 requires a written plan including "effective means to alert employees of the presence, location, and nature of workplace violence emergencies" and procedures to get help from responders, security and law enforcement. A permanent Cal/OSHA standard under SB 553 must be adopted by December 31, 2026; as of October 2026 it is still at the discussion-draft stage.

California hospitals also have a separate security plan duty under Health and Safety Code §1257.7, which lists "protective measures, including alarms and access control" among what the plan's authors must understand.

Sources: 8 CCR §3342; Labor Code §6401.9; Cal/OSHA general industry rulemaking; H&SC §1257.7. Checked October 2026.

New York

New York's hospital law is Public Health Law §§2832 and 2832-a (Chapter 618 of the Laws of 2025), signed December 12, 2025 and in effect since September 2026. General hospitals and nursing homes must have a workplace violence prevention program within 12 months of the effective date, and from January 1, 2027 general hospitals must carry out an annual security assessment and adopt a safety and security plan with employee involvement. The assessment must consider protective factors including "alarms and communication systems", and the plan's methods "may include" alarms and communication systems. The law also sets security staffing for emergency departments.

Public hospitals and other public employers are also covered by the Workplace Violence Prevention Act (Labor Law §27-b), which requires a risk evaluation that considers working alone and a written program for employers with 20 or more employees.

Sources: NY Senate, S5294-B / Chapter 618 of 2025; NY DOL, Workplace safety. Checked October 2026.

New Jersey

The Violence Prevention in Health Care Facilities Act (N.J.S.A. 26:2H-5.17 et seq., 2008) covers general, special and psychiatric hospitals and nursing homes. Its rules (N.J.A.C. 8:43E-11) require a violence prevention committee, written plan, risk assessment, training, incident reporting and post-incident response. The rules have the most specific device language of any state in this guide: facilities must install where necessary, and maintain, measures including "alarm systems, ... cell phones, personal alarm devices, codes, drop phones, panic alarms", and assign and train staff to respond to each alarm system in use. The 2023 Health Care Heroes Violence Prevention Act added criminal penalties for threats against health care workers and signage, not new device duties.

Sources: N.J.A.C. 8:43E-11.8; NJ DOH memo on the Health Care Heroes Violence Prevention Act (2023). Checked October 2026.

Washington

RCW 49.19 covers hospitals, home health, hospice and home care agencies, evaluation and treatment facilities, behavioral health programs and ambulatory surgical facilities. Employers need a written plan, developed with a safety committee and reviewed every year, which must address "security systems, alarms, emergency response, and security personnel available" and "procedures to mitigate employees time spent alone working in areas at high risk for workplace violence". Training is due within 90 days of hire, and every violent act must be recorded and kept for five years. Since January 2026 (HB 1162) each incident must also be investigated, with summaries to the committee.

Sources: RCW 49.19; HB 1162 (2025). Checked October 2026.

Texas

SB 240 (2023), Health and Safety Code Chapter 331, required hospitals, nursing facilities, home health agencies with two or more RNs, ambulatory surgical centers, freestanding emergency facilities and mental hospitals to adopt a workplace violence prevention policy and plan by September 1, 2024. That includes a committee with a direct-care nurse, annual training, an incident response and investigation system, and post-incident support. SB 463 (2025) widened coverage to all licensed home and community support services agencies with two or more RNs, intermediate care facilities and state supported living centers, with compliance due by September 1, 2026. The plan must "address physical security and safety"; the law does not name alarms or devices.

Sources: SB 240 (88R); SB 463 (89R). Checked October 2026.

Illinois

Illinois has two laws. The Health Care Violence Prevention Act (210 ILCS 160, in force since 2019) covers hospitals, retail health care facilities and veterans homes. Their workplace violence prevention program must comply with OSHA's guidelines for health care and social service workers, the same guidelines that list panic buttons and personal alarm devices among recommended controls. Providers must also offer immediate support to staff after an incident and may not discourage staff from reporting violence to the police or the state.

Public Act 104-0526 (signed June 2026) tightens the Act from January 1, 2027. The program must classify workplace violence into four types and include worker participation (nurses included), worksite analysis, hazard prevention and control, training, and a system for staff to report violence by patients and visitors. Violence against staff in the emergency department must be logged on a state template, which the Department of Public Health must publish by November 30, 2027. From May 2028, providers file an annual summary, with fines of up to $500 a day for failing to submit it.

A separate act (405 ILCS 90) covers mental health and developmental disability facilities.

Sources: 210 ILCS 160; SB 2713, enrolled text (Public Act 104-0526). Checked October 2026.

Other states

• Minnesota (Minn. Stat. §144.566): hospitals must review annually "the sufficiency of security systems, alarms, emergency responses, and security personnel availability" and submit their plans to the state. Source
• Connecticut (C.G.S. §19a-490q, 2011): health care employers with 50+ employees need a safety committee, annual risk assessment and written plan, and must report assaults to police within 24 hours. Source
• Oregon (ORS 654.412 to 654.423): workplace violence programs for health care employers, extended to home health and hospice by SB 537 (2025). Oregon also gives home health staff a direct right: they may refuse to treat a patient they believe may assault them unless a second employee is with them, or unless they are "equipped with a communication device that allows the employee to transmit one-way or two-way messages indicating that the employee is being assaulted" (ORS 654.421). An Oregon OSHA rule for these settings was proposed in 2026, with a planned effective date of January 2027. Sources: ORS chapter 654; Oregon OSHA proposed rule notice (2026)
• Maryland (Labor and Employment §§5-1101 to 5-1103): hospitals need a workplace safety committee and violence prevention program. Source
• Pending: Massachusetts and Pennsylvania both have healthcare workplace violence bills in progress as of October 2026.

A 2026 study in Health Affairs Scholar found that 48 states had at least one workplace violence law affecting health care by mid-2024, most of them criminal penalties for assaulting health workers. Only about a third required violence prevention plans. Source

United Kingdom

There is no UK statute specific to healthcare violence. The duty comes from general law: the Health and Safety at Work etc. Act 1974 (s.2) and the Management of Health and Safety at Work Regulations 1999 (reg. 3 risk assessment). Under RIDDOR 2013, physical violence at work that causes death, a specified injury or more than seven days off must be reported. HSE's guidance for health and social care says risk assessments should cover alarm systems and lone working, and that "telephones, mobile phones, radios, automatic warning devices and emergency alarms" can be control measures. HSE also says that devices alone will not prevent incidents; they help when used with robust procedures.

NHS England Violence Prevention and Reduction Standard (version 2, December 2024). Under the 2026/27 NHS Standard Contract, NHS trusts and foundation trusts must implement it, and other providers must use all reasonable endeavours. It requires a self-assessment against 43 indicators, a board-level sponsor, an action plan, risk assessments on the risk register, and board review at least twice a year. It does not specify devices.

Lone working in the NHS. NHS Employers guidance (2022) says that where staff regularly visit patients alone, employers should put in place a safe system of work including "a means of discreetly raising the alarm, known as a lone worker safety device". NHS Supply Chain runs a framework with a dedicated lot for lone worker devices until August 2027.

Sources: HSE, violence in health and social care; RIDDOR 2013 reg. 2; NHS England VPR standard; NHS Employers, lone workers (2022); NHS Supply Chain framework. Checked October 2026.

European Union and Sweden

The EU Framework Directive 89/391/EEC requires every employer to assess and prevent risks. Violence is not named, but it is covered as a workplace risk. The need is real: in EU-OSHA's 2022 survey, 32% of health and social care workers reported exposure to violence or verbal abuse from patients or clients, twice the all-sector rate. There is no EU directive on workplace violence yet. The European Parliament asked for one on psychosocial risks in October 2026, and the Commission's Quality Jobs Act consultation (July 2026) raises protection against third-party violence. A proposal is expected around the end of 2026.

Sweden is the most explicit. Since January 2025, chapter 5 of AFS 2023:2 (replacing AFS 1993:2) requires employers where violence or threats can occur to ensure "att arbetstagarna har möjlighet att snabbt få hjälp" (that workers can quickly get help). Where needed for safety there must be an alarm to summon help, set routines for who receives the alarm and what happens next, regular drills, and maintenance and checks of the alarm equipment. Lone work with a tangible risk of violence is not allowed at all (5 kap. 7 §).

Elsewhere in the Nordics, Norway's new regulation chapter 3A (in force January 2026) asks employers to consider alarm equipment maintenance and ways to call for help, and Denmark's psychosocial work environment order (in force July 2026) restricts lone work where there is a particular risk of violence.

Sources: Directive 89/391/EEC; EU-OSHA, health and social care in figures (2024); AFS 2023:2; Arbetsmiljöverket, våld och hot; Norway, forskrift kap. 3A; Denmark, BEK 605/2026. Checked October 2026.

Comparison table

Related guides: lone worker laws by country, for home health and community staff who work alone, and the NY Retail Worker Safety Act.

How teams meet these requirements

Most of what these laws ask for is paperwork and people: plans, assessments, training, a responder who actually comes. The one physical piece most of them point to is the same. When something goes wrong, a member of staff has to be able to call for help fast, quietly if need be, and someone has to receive it. Then you have to prove it works.

A staff alarm that does that has a few non-negotiables:

• Carried by the person. A fixed panic button behind the reception desk helps the receptionist. It doesn't help a nurse in a patient room, a psychiatric unit corridor or a client's home. California's line-of-sight rule exists for exactly this.
• One discreet action. Shouting or unlocking a phone in a confrontation escalates it. A press on a worn button doesn't.
• A named responder. The alert has to reach security, a charge nurse or a duty manager who is free to respond, as California requires.
• Proof it is live. California asks you to find places where alarms don't work. New Jersey and Sweden require maintenance and checks. A dead battery is a failed control.

Shortcut Labs builds Flic, a wireless button platform for staff alerting. In healthcare we keep it to one job: a staff alarm. It is not a patient call system, not a medical device and not patient monitoring.

• On site: staff wear a Flic button that connects through Flic Hubs installed around the building, so the alert shows which hub it came through and which part of the building to go to. The alert goes to your responders by app notification, SMS, email or an integration with the systems you already run.
• Home health and community staff: the button pairs with an app on the worker's phone, so a press sends the alert from wherever the visit is.
• Proof it works: Flic Device Manager tracks battery, connectivity and press history across every button and hub. When California asks where your alarms don't work, or New Jersey and Sweden ask for maintenance and checks, you have the record instead of a guess.
• Enough for everyone: priced so every member of staff can carry one, not just the people on the highest-risk ward.

An alarm is one control in your plan, alongside the training, staffing and responders the laws require. Flic supports your workplace violence prevention program; it does not replace legal review of your obligations.

Talk to us about your staff safety plan. Tell us your setting and your state or country, and we'll show you where a staff alarm fits and where it doesn't.

Frequently asked questions

Is there a federal law requiring workplace violence prevention in US healthcare?

Not a specific one. OSHA has no workplace violence standard and enforces through the General Duty Clause. Its proposed healthcare rule is a long-term action with no proposal date, and the federal bill introduced in 2025 has not left committee. The binding requirements come from states such as California, New York, New Jersey, Washington and Texas, and from Joint Commission accreditation.

Does California require panic buttons for nurses?

California requires covered health care employers, including hospitals and home health, to provide, as applicable, "an alarm system or other effective means" for employees to summon security and other help, plus alarms or other means where staff enter areas without line of sight (Cal/OSHA §3342). The law doesn't say "panic button" or name a technology. The employer chooses, the alarm must work, and someone must be free to respond.

Does SB 553 apply to hospitals?

No. SB 553 (Labor Code §6401.9) exempts facilities covered by Cal/OSHA §3342, which includes hospitals, home health and hospice. Those employers follow §3342, which is stricter.

What are hospital duress alarm requirements in the US?

California §3342 requires an alarm system or other effective means for staff to summon aid. New Jersey's rules list personal alarm devices and panic alarms among measures to install where necessary and maintain. Washington, Minnesota and New York require the plan or annual assessment to address alarms, and Texas requires the plan to address physical security. No state names a specific system, so the hospital chooses and must be able to show it works.

Does the Joint Commission require panic buttons?

No. Accredited hospitals must have a workplace violence prevention program with a designated leader, annual worksite analysis, incident reporting and training (now NPG.02.04.01). The requirements do not name any device. A staff alarm can be one of the controls your worksite analysis leads to.

What must a healthcare workplace violence prevention plan include?

In most states: a written plan developed with frontline staff, a risk assessment repeated at least annually, controls for the risks found (often including how staff summon help), training, an incident log and investigations, and post-incident support. California and Washington are the most detailed.

Do home health workers need lone worker devices?

California §3342, Washington RCW 49.19 and Texas Chapter 331 all cover home health, and staff alone in a client's home need a way to get help. Oregon is the most direct: under ORS 654.421 a home health worker may refuse to treat a patient they believe may assault them unless they have a communication device that can send a message that they are being assaulted, or a second employee with them. In the UK, NHS Employers guidance says staff who regularly visit patients alone should have a lone worker safety device as part of a safe system of work.

What does the NHS require on violence against staff?

NHS trusts and foundation trusts must implement NHS England's Violence Prevention and Reduction Standard under the NHS Standard Contract: self-assessment, a board sponsor, an action plan and board review at least twice a year. The underlying legal duty is the Health and Safety at Work Act 1974 and the 1999 Management Regulations, with RIDDOR reporting for serious violent injuries.

---

This guide is provided for general information by Shortcut Labs and is not legal advice. Verify current requirements with qualified counsel in your jurisdiction.