Workplace violence prevention is the fastest-growing US training mandate. California's SB 553 requires covered employers with 10 or more employees to maintain a written prevention plan and train their workforce on it, with Cal/OSHA enforcement active. At least nine other states have proposed similar legislation, and healthcare and retail carry the highest exposure.
A mandate that arrived quickly and is spreading
Most compliance training categories evolved slowly. Workplace violence prevention has not. California moved first with SB 553, requiring covered employers with 10 or more employees to have an active written prevention plan and a trained workforce by 1 July 2024, with Cal/OSHA enforcement beginning in earnest during 2025.
Since then, at least nine other states have proposed comparable legislation for the 2026 session. Healthcare and retail are consistently identified as the highest-exposure sectors, and healthcare specifically has faced sustained regulatory attention on this issue.
If you operate in California you already have obligations. If you operate elsewhere, the reasonable planning assumption is that something similar is coming, and building the programme now is considerably cheaper than building it under a deadline.
| This article is general information rather than legal advice. Workplace violence requirements vary by state, sector and employer size, and the legislative picture is moving quickly. Confirm your obligations with qualified counsel or your EHS lead. |
What the California rule actually requires
SB 553 is the template other states are drawing on, so it is worth understanding even outside California. Broadly, covered employers must:
- Maintain a written Workplace Violence Prevention Plan, which is a standing document rather than a one-off assessment.
- Train employees on the plan, including how to report incidents and what the response procedure is.
- Maintain a violent incident log recording incidents, which is separate from general injury reporting.
- Keep records of training and of incident investigations, available for inspection.
- Review and update the plan, including after an incident.
The training element is not standalone. It is training on your specific plan, which means generic off-the-shelf content alone will not satisfy it. Employees need to know your reporting route, your escalation path and your hazards, not a general description of workplace violence.
The four types of workplace violence, and why the categorisation matters
Prevention planning generally works from four recognised categories, and the distinction matters because the controls differ entirely:
- Type 1, criminal intent, where the perpetrator has no legitimate relationship to the business. Robbery is the common example, and controls are largely physical and procedural.
- Type 2, customer or client violence, where the perpetrator is a customer, patient, student or service recipient. This is the dominant category in healthcare and retail, and it is where de-escalation training earns its place.
- Type 3, worker on worker, which overlaps with harassment and bullying prevention and depends heavily on reporting culture.
- Type 4, personal relationship violence entering the workplace, often domestic in origin, where the controls involve access management and supporting the affected employee.
A programme that treats workplace violence as a single undifferentiated topic tends to produce generic content that helps with none of these. Assess which types your roles and sites are realistically exposed to, and train accordingly.
What good training actually covers
- Your specific plan: what it says, where to find it, and who owns it.
- Recognising warning signs and escalating behaviour, with examples drawn from your actual environment rather than generic scenarios.
- De-escalation techniques appropriate to the role. A hospital triage nurse and a retail cashier need different approaches, and generic de-escalation content serves neither well.
- The reporting route, explicitly. This is the single most important element, because a prevention programme depends on incidents being reported rather than absorbed as part of the job.
- What happens after a report, including investigation and support, since employees who do not believe reporting achieves anything stop reporting.
- Role-specific hazards for lone workers, night shift staff, cash-handling roles and anyone working in isolated conditions.
| The hardest problem in this area is under-reporting, particularly in healthcare and retail where verbal abuse is often normalised as part of the role. Training that does not explicitly address whether minor incidents should be reported will produce a violent incident log that understates reality, which undermines both the plan and any later defence. |
How this connects to your other mandates
Workplace violence prevention overlaps with training you may already run, and treating the categories as entirely separate creates duplication and gaps:
- Harassment prevention overlaps with Type 3 worker-on-worker violence, and state harassment requirements already mandate related content in several jurisdictions.
- OSHA general duty obligations apply to recognised hazards regardless of whether a specific standard exists.
- Healthcare organizations face additional expectations from accreditation bodies, on top of state mandates.
- Lone worker rules, including Washington's isolated-worker requirements expanded in January 2026, cover overlapping populations.
Mapping these together usually reveals that one well-designed programme with role-specific modules serves several obligations, rather than four separate courses covering adjacent ground.
What to document, and why it decides your position
As with most compliance areas, the programme is judged on what you can evidence:
- The written plan itself, with version history showing review dates.
- Training completion by named individual, with dates, including for new hires and role changes.
- The violent incident log, maintained contemporaneously rather than reconstructed.
- Investigation records and any corrective actions taken.
- Evidence that the plan was reviewed after incidents and periodically.
The training records matter for a specific reason. If an incident occurs and the affected employee had not completed prevention training, or completed it years earlier with no refresher, that gap becomes central to any subsequent examination. Automatic assignment and renewal tracking is how organizations avoid discovering the gap afterwards.
The bottom line
Workplace violence prevention has moved from best practice to mandate faster than any comparable training category, led by California's SB 553 and with at least nine states considering similar rules. Training must cover your specific plan rather than generic content, address the type of violence your roles actually face, and make the reporting route unmistakable. Document the plan, the training by named individual, the incident log and the reviews, because that documentation is what your position rests on.
MyPass LMS assigns training automatically by role, location and state, tracks renewals, and keeps dated audit-ready records. See the compliance solution, browse safety courses, or start a 15-day free trial.
Frequently asked questions
Is workplace violence prevention training required?
In California, yes. SB 553 requires covered employers with 10 or more employees to maintain a written Workplace Violence Prevention Plan and train employees on it, with Cal/OSHA enforcement active. At least nine other states have proposed similar legislation, and healthcare and retail face the highest exposure.
What does SB 553 require employers to do?
Maintain a written workplace violence prevention plan, train employees on that plan including reporting procedures, keep a violent incident log, retain training and investigation records for inspection, and review and update the plan periodically and after incidents.
What are the four types of workplace violence?
Type 1 is criminal intent with no relationship to the business. Type 2 is customer or client violence, dominant in healthcare and retail. Type 3 is worker on worker. Type 4 is personal relationship violence entering the workplace. Controls differ substantially between them.
Can off-the-shelf courses satisfy workplace violence training requirements?
Not on their own where the rule requires training on your specific plan. Bought content can cover general principles and de-escalation well, but employees must also be trained on your own reporting route, escalation path and site-specific hazards, which requires a supplementary module.
What records should we keep for workplace violence prevention?
The written plan with version history, training completion by named individual with dates, a contemporaneous violent incident log, investigation records and corrective actions, and evidence of periodic and post-incident plan reviews.
Why is under-reporting a problem in these programmes?
Because prevention depends on incidents being recorded. In healthcare and retail especially, verbal abuse is often normalised as part of the job, so training must state explicitly which incidents should be reported, or the incident log will understate reality and weaken both the plan and any later defence.