Six Laws Require Workplace Violence Training. Two Say How Long to Keep the Proof.

We read six US workplace violence mandates that require employers to train staff on a recurring basis. Only two set a retention period for the training record, and both set it at one year. Four set a five year period for incident records. Not one protects the training record for longer than the record of the violence.

What We Checked

Workplace violence prevention has become the fastest moving corner of US employment compliance. California brought nearly every employer in the state into scope in 2024. New York added retail in 2025. Texas covered its hospitals. Washington has regulated health care settings since 2020.

Kentucky added annual training for health facilities. Each of those laws tells employers to train people. We wanted to know something narrower and more practical: what each one says about the record that proves you did.

How we framed it

We read six mandates in full, from the statute text or the enforcing agency's own publication, and recorded two things for each: how long the training record must be kept, and how long the incident record must be kept. This is not the complete set of US workplace violence law. At least nineteen states require some form of prevention plan, and we make no claim to have read them all. These six were chosen because they are the broadest in coverage or the most recent, and because each one could be verified end to end from a primary source.

• Six mandates, five states. Four are health care specific, one is retail specific and one covers general industry.
• All six require recurring training. That part is settled and not in dispute anywhere.
• Only two set any retention period for the training record. Both set it at one year.
• Four set a retention period for incident records. All four set it at five years.
• Not one sets a longer period for training than for incidents. The asymmetry runs the same direction in every instrument we read.

Our interest in this

We make MyPass LMS, which organisations use to run and evidence exactly this kind of training, so we have a stake in the conclusion that the evidence side is underbuilt. Every figure below carries the statute or agency page it came from, so none of it has to be taken on trust. This is a description of what the law says, not legal advice.

The Six Mandates

Coverage differs sharply between them, so the first question for any employer is not what the rule says but whether it applies at all.

California's general industry rule is the one that changed the landscape, because it is the only mandate here that is not tied to an industry. Almost every employer in the state is covered, with narrow exemptions for teleworkers, some corrections and law enforcement settings, and non-public workplaces with fewer than ten people present at any time.

The Pattern Across All Six

Set the two retention figures side by side for all six mandates and the asymmetry is the finding. It held in every instrument we read, including the two that set no period at all.

Why the asymmetry exists

It is not carelessness. Incident records serve several masters at once. They feed enforcement, they support injury claims, they inform the hazard assessment the employer is separately required to redo, and they can become evidence in litigation that takes years to arrive. Five years is a reasonable floor for a document doing all of that.

The training record serves one function in the eyes of the drafters: demonstrating that the training happened. Once the next annual cycle completes, the previous record looks superseded, and a one year floor follows naturally from an annual cadence.

Why that reasoning does not survive contact with a claim

The difficulty is that the training record stops being a compliance artefact the moment something goes wrong. In a negligence claim, what an employer knew and what it had told its staff becomes the central question, and the relevant training may be several cycles old.

• The statutory floor is not the practical floor. One year is what the regulator can demand. It is not what a plaintiff's lawyer will ask for, and it is not what the employer will wish it had.
• Other laws reach further back. Discrimination and injury claims carry their own limitation periods, which are routinely longer than the training record is required to survive.
• Destroying on schedule is still a decision. An employer that disposes of training records at twelve months because the statute permits it has chosen a position it will have to defend later.

Which is why the sensible reading of a one year rule is that it is a floor beneath the employer's real exposure rather than a guide to it.

California Splits Its Own Rules Four Ways

One jurisdiction is worth isolating, because it is the only one that breaks the question down by record type rather than setting a single period.

Three of those four categories sit at five years. The fourth, the one documenting that employees were trained, sits at one. The distinction is deliberate, written into separate subsections of the same statute, and it tells you precisely how the drafters ranked the four documents.

What California actually requires in the log

The violent incident log is also the most prescriptive document in any of the five mandates, which is worth knowing before assuming an existing incident form will do. Each entry has to record the date, time and location, the type of violence, a detailed description, who committed it, the circumstances, where in the workplace it happened, the consequences including any security or law enforcement response, and the name, job title and completion date of whoever filled it in. Personal identifying information has to be stripped out.

An employer can meet the training mandate perfectly and still fail an inspection on the log, because they are separate obligations with separate record rules and only one of them looks like training.

What No Retention Period Actually Means

Two of the five mandates, Texas and New York retail, set no retention period for anything. That is easy to misread as the lighter obligation. It is usually the heavier one.

• The duty does not disappear. Both still require the training. An employer that cannot show it happened has not satisfied the mandate, whatever the statute omits about filing.
• Silence shifts the burden. Where a statute names a period, keeping the record that long is a defence. Where it names none, the employer decides, and that decision gets judged after the fact.
• Other obligations fill the gap. Texas requires incidents to run through the facility's existing occurrence reporting system and the plan to be reviewed annually by a committee reporting to the governing body. New York requires the policy and training to be delivered on hire and annually, in writing, in the employee's primary language where the state publishes one.

So the practical answer in a no-period jurisdiction is to apply the longest period any of your other obligations demands, and to be able to say why you chose it.

What Is Coming

This area is still moving, which is the main reason to date anything you write down about it.

• New York's silent alarm duty starts 1 January 2027. Retail employers with 500 or more retail employees must provide access to silent alarm buttons, or employer-provided mobile or wearable alternatives that do not track location unless triggered.
• California must adopt a general industry regulation by 31 December 2026. SB 553 set that deadline and Cal/OSHA's own page confirms it. A discussion draft circulated in April 2026 would widen coverage to employer-provided transportation, narrow the small-workplace exemption and put a five year period on records of threats, incidents and corrective actions. Until the Standards Board adopts it, Labor Code 6401.9 is the operative text.
• The industry-specific pattern is spreading. Four of the five mandates here are confined to health care or retail, which is how harassment training legislation began before it broadened.

Anyone building a system around today's six should assume the list grows and the fields differ, rather than hard-coding a single rule. The California deadline alone means this page will need revisiting in January.

How We Did It

• Sample. Six mandates across five states, each requiring employers to provide recurring workplace violence prevention training. This is a sample, not a census. At least nineteen states impose some form of workplace violence plan duty, and several of those may carry training obligations we have not read. We selected these six for breadth of coverage, recency, and because each could be verified end to end from a primary source. Voluntary guidance, federal General Duty Clause enforcement and public-employer-only rules were excluded.
• Sources. Statute text from the enacting legislature, or the enforcing agency's own publication. No law firm summaries, no vendor guides, no secondary trackers. Every row links to the document it was read from.
• Questions fixed before collection. Covered employers, in-force date, training frequency, training record retention, incident record retention.
• Coding. 'None set' means the instrument we read sets no period. It does not mean no record is needed, and it does not rule out a period living in another law that applies to the same employer.
• Checked. Every figure read from source on 31 October 2026. Next re-check April 2027.
• Disclosure. We make MyPass LMS. No product, ours included, is scored anywhere in this study.

What This Study Cannot Tell You

• This is not legal advice. It describes what instruments say. Whether a given employer is covered, and what it should therefore do, is a question for counsel who knows the facts.
• Coverage tests are genuinely hard. Employee counts, facility licences and what counts as a retail workplace all carry definitions we have summarised rather than reproduced.
• Other laws stack on top. General record keeping duties, injury reporting rules and collective agreements can impose longer periods than anything here.
• Six is our sample, not the total. At least nineteen states require a prevention plan of some kind, and the training obligations inside several of those are not reflected here. A state missing from this page is not a state without a duty.
• California is mid-rulemaking. A general industry standard must be adopted by 31 December 2026, so the California rows are the most likely to change first.

How MyPass LMS Handles This

This is the vendor section. Read it as a description of our own design decisions rather than as a finding.

Two decisions came directly from the rows in the table above:

• Retention is set per obligation, not per tenant. An employer covered by two of these mandates, or by one of them plus a harassment mandate, holds different periods against different records at the same time.
• Superseded is not deleted. Because the practical exposure outlives the statutory floor, an old completion stays retrievable after the next annual cycle replaces it.

If you are mapping obligations across states, our guide to harassment training requirements by state covers the other half of this landscape, and tracking and evidencing training across a workforce covers the mechanics. The compliance training overview explains where this sits in the product, and the plans are published rather than quoted.

The bottom line

Six laws, five states, one consistent pattern. Every instrument that sets an incident period sets it at five years. The record showing that staff were trained to prevent that incident gets one year, or no instruction at all, and not one of the six protects it for longer.

That is a defensible choice by drafters focused on enforcement, and a poor guide for an employer focused on defence. The limitation period on the claim that will ask about your training is longer than the period any of these laws requires you to keep the answer.

So the useful question for any system that holds this data is not whether it can produce a completion report. It is whether it can still produce the right one in year four, for a course that no longer exists, in the shape the jurisdiction asks for.

Frequently asked questions

Which states require workplace violence prevention training?

We verified six across five states: Washington, California and Kentucky for health care, California for general industry, Texas for health care facilities, and New York for retail employers with ten or more retail employees. At least nineteen states impose a prevention plan duty, so this is a sample rather than the full list.

How long must workplace violence training records be kept?

Of the six we read, only California sets a period, and it is one year under both Labor Code 6401.9 and Title 8 section 3342. Washington, Kentucky, Texas and New York set none. Because other claims reach further back, one year is a statutory floor rather than a safe practice.

Does California SB 553 apply to small employers?

Mostly yes. Labor Code 6401.9 covers all employers, with narrow exemptions including teleworkers at a location the employer does not control and workplaces with fewer than ten employees present at any time that are not open to the public.

What has to go in a violent incident log?

Under California Labor Code 6401.9 the log records date, time and location, the type of violence, a detailed description, who committed it, the circumstances, where it happened, the consequences, and who completed the entry. Personal identifying information must be removed.

Sources

• Washington RCW chapter 49.19, Safety, health care settings, sections 49.19.010, 49.19.030 and 49.19.040, via the Washington State Legislature.
• California Labor Code section 6401.9, subsections (b), (d), (e) and (f).
• Cal/OSHA, Workplace Violence Prevention in General Industry fact sheet for employers, Department of Industrial Relations.
• California Code of Regulations Title 8 section 3342, Violence Prevention in Health Care, subsections (a), (f) and (h), via the Department of Industrial Relations.
• Texas Senate Bill 240, 88th Regular Session, enacting Health and Safety Code chapter 331, sections 331.001, 331.002 and 331.004, via the Texas Legislature.
• New York State Department of Labor, Retail Worker Safety Act guidance overview.
• Kentucky Revised Statutes 216.707 and 216.709, annual violence prevention training and the reporting and recordkeeping duty, via the Kentucky Legislature.
• Cal/OSHA, Workplace Violence Prevention Guidance and Resources, Department of Industrial Relations: the Standards Board must adopt a general industry standard no later than 31 December 2026.
• Cal/OSHA general industry workplace violence discussion draft circulated April 2026, with public comment closing 1 June 2026. The draft is not the operative text and may change before adoption.
• Every figure read from the statute text or the enforcing agency's own publication on 31 October 2026. Laws change. This page is not legal advice and should not be relied on as a substitute for counsel.