Guides
Workplace violence prevention and insurance
OSHA has no workplace violence standard, but California and New York do. How a prevention program works and which policies respond when violence happens.
Workplace violence is a safety problem first and an insurance problem second. Employers must address it under the OSHA General Duty Clause even though there is no federal workplace violence standard, a growing number of states require written prevention plans, and your insurance responds in pieces: workers' compensation for injured employees, liability coverage for injured customers and visitors, and specialty cover for armed attacks. A written program, trained staff and a record of incidents lower the odds of an injury and improve your position with insurers and regulators if one happens.
What the rules require
At the federal level, OSHA's workplace violence page states that there are currently no specific OSHA standards for workplace violence. The agency does enforce the General Duty Clause of the OSH Act for recognized hazards, and its directive CPL 02-01-058 (January 10, 2017) sets procedures for scheduling and conducting workplace violence inspections. OSHA defines workplace violence as any act or threat of physical violence, harassment, intimidation or other threatening behavior at the work site (OSHA). Penalties under the 2026 schedule, which carried the 2025 amounts forward, run up to $16,550 for a serious violation and up to $165,514 for a willful or repeated one (OSHA penalties page; see OSHA recordkeeping, injury rates and insurance).
States fill the gap, and they differ.
- California (California) requires most employers outside health care to maintain a written workplace violence prevention plan under Labor Code section 6401.9 (SB 553), enforceable since July 1, 2024. The plan must name responsible people, involve employees, cover hazard assessment and correction, describe how to report and respond to threats, and include post-incident investigation. Employers must train staff, keep a violent incident log, and retain hazard and incident records for five years and training records for one year, according to the Cal/OSHA guidance. The Standards Board must adopt a general industry standard by December 31, 2026.
- New York (New York) Labor Law section 27-e applies to retail employers with at least ten retail employees. They must adopt a violence prevention policy and train workers, annually or every two years for employers with fewer than 50 retail employees, and employers with 500 or more retail employees statewide must provide silent response buttons starting January 1, 2027 (N.Y. Labor Law section 27-e).
- Other states have rules for particular sectors such as health care or retail, or for particular risks such as domestic violence leave. Check workers' comp and benefits requirements by state and your state labor department; do not assume the California rule is national.
Where the risk concentrates
The Bureau of Labor Statistics counted 5,070 fatal work injuries in 2024, of which 733 were violent acts and 470 were homicides (BLS Census of Fatal Occupational Injuries, released February 19, 2026). OSHA identifies higher-risk groups as workers who exchange money with the public, delivery and rideshare drivers, health care and social service workers, public service workers, customer service agents and people who work alone, and says risk rises with late-night work, high-crime areas, isolated locations and places that serve alcohol. Those are fatality figures; non-fatal assaults are far more common and are less well counted.
A commonly used typology sorts incidents by the attacker's relationship to the business, and it helps because each type calls for different controls.
| Type | Who | Example | Typical control |
|---|---|---|---|
| 1 | Criminal intent, no relationship | Robbery of a store | Cash limits, lighting, cameras, visibility |
| 2 | Customer, patient or client | Assault by an agitated patient | De-escalation training, staffing, layout |
| 3 | Current or former worker | Threat to a supervisor after termination | Reporting channels, threat assessment, exit planning |
| 4 | Personal relationship | Domestic partner arrives at work | Access control, protective-order protocol |
How insurance responds
| Policy | When it responds | Common limit |
|---|---|---|
| Workers' compensation (workers' compensation insurance: how it works) | Employee injured by a customer, stranger or coworker in the course of employment | Employees only; states differ on assaults from purely personal disputes |
| General liability | Visitor, customer or tenant sues alleging negligent security or supervision | Assault and battery or weapons exclusions, or low sublimits; see assault and battery exclusions |
| Umbrella | Excess of general liability | Follows the underlying exclusions |
| Employment practices liability | Hostile environment, retaliation, wrongful termination claims tied to threats | Usually excludes bodily injury; see Employment practices liability insurance (EPLI): what it covers |
| Active assailant or deadly weapon cover | Armed attack; crisis response, liability, lost income | Specialty product; see active assailant insurance: what it covers and what standard policies miss |
| Property and business interruption | Physical damage that follows | Needs physical damage |
Two points matter most. First, workers' comp is the only policy certain to respond to an employee injury, and it pays regardless of fault; the incident goes into your claim history and affects your experience modification rate. Whether a coworker's attack arising from a personal grudge is covered depends on state law. Second, the lawsuits that follow an attack are usually brought by customers or third parties, and the general liability policy is where many carriers have placed their assault and battery exclusions. Read those before an incident, not after. Premises liability standards are state law; see premises liability: how slip-and-fall claims are handled.
Building a prevention program
OSHA's guidance describes the pieces: a zero-tolerance policy that covers employees, clients, visitors and contractors, a worksite assessment, a written program that combines engineering controls, administrative controls and training, prompt investigation, and remediation of reported problems. A practical sequence follows.
- Assign an owner and a small team that includes human resources, operations and security.
- Assess the site against the four types above. Walk the premises at opening and closing hours and look at parking, entrances, cash handling and isolated areas.
- Set controls. Engineering controls (lighting, locks, barriers, cameras, panic buttons) usually come first; administrative controls (staffing, cash limits, visitor sign-in, access reviews) next; training last because it fades.
- Write the policy and reporting procedure. Make it easy to report a threat and impossible to be punished for it.
- Train everyone at hire and yearly, with scenarios for your own setting. Include de-escalation, how to leave safely and what to do in an armed attack.
- Create a threat assessment path. Define who reviews a reported threat, how a termination of a volatile employee is handled, and when to call police.
- Keep an incident log and review it quarterly. California requires one; any employer benefits from it.
- Investigate and revise after every incident or near miss, and update the plan.
- Coordinate with the insurer's loss control representative; see insurance loss control inspections: what to expect.
Record injuries that meet the criteria in OSHA's recordkeeping rules, and report a work-related fatality within 8 hours and an in-patient hospitalization within 24 hours.
A hypothetical
Say a three-store convenience chain in Illinois has had two late-night robberies in a year. Its program might add a second employee on night shifts, a drop safe with a posted cash limit, better lighting at the entrance and cameras covering the register, plus training on how to hand over cash and call for help. The owner asks the broker whether the general liability policy excludes assault and battery, whether workers' comp has an experience mod penalty and whether the security guard contract, if any, names the chain as an additional insured. The program costs money. A single employee injury and a customer lawsuit can cost more, and a documented plan helps with underwriters at renewal. Industry detail for this trade is at Convenience store and gas station insurance.
What underwriters and loss control ask
Expect questions about cash handling, night staffing, security systems, whether you use contracted guards (Security guard company insurance), prior incidents, and whether a written violence policy and training records exist. Hospitality, health care, education, retail and late-night operations get the most scrutiny. For the underlying hazard see building a workplace safety program that cuts claims.
Key takeaways
- OSHA has no workplace violence standard but cites employers under the General Duty Clause; California (since July 1, 2024) and New York (retail) require written programs.
- BLS counted 733 violent-act fatalities, including 470 homicides, among 5,070 fatal work injuries in 2024.
- Workers' comp covers injured employees; third-party lawsuits go to general liability, where assault and battery exclusions are common; armed attacks may need specialty cover.
- A prevention program has an owner, a site assessment, controls, training, a reporting path, an incident log and regular review.
- Check your state's rules and your policy exclusions before an incident.