The Cal/OSHA Violent Incident Log: What Section 3342 Requires You to Record

California was the first state in the nation to adopt a workplace violence prevention standard written specifically for health care. It is prescriptive about records in a way most standards are not, and the part that trips people up is not the prevention plan. It is the log.

The short answer

Under 8 CCR §3342(d), every violent incident must be recorded in a violent incident log. The log carries eight groups of information, must contain no personal identifying information, and is kept for five years. Hospitals must additionally report to Cal/OSHA within 24 hours or 72 hours depending on severity.

Who this applies to

Section 3342 covers health facilities, home health, emergency medical services, outpatient clinics and drug treatment programs, among others. If you are covered by §3342, you do not also need the general-industry workplace violence plan under Labor Code §6401.9. That law explicitly exempts facilities already covered here.

This is worth knowing because a great deal of general HR guidance written after §6401.9 took effect in July 2024 tells California employers to build that plan without mentioning the healthcare exemption. A hospital needs one plan and one log, not two of each.

The eight field groups

Section 3342(d) enumerates what a log entry contains. Paraphrasing loses the detail, so here they are in order.

1. (d)(1) When and where. Date, time, specific location, and the department or unit.
2. (d)(2) A detailed description of the incident.
3. (d)(3) Who committed it, classified: patient, family member or visitor, stranger, coworker, supervisor or manager, or other.
4. (d)(4) The circumstances at the time. Whether the employee was performing routine duties, and contributing factors such as poor lighting or understaffing.
5. (d)(5) Where it happened by type. Patient room, emergency department, hallway, parking lot, a patient's residence, and so on.
6. (d)(6) The type of incident. Physical attack without a weapon, use of a weapon, threat, sexual assault, animal attack.
7. (d)(7) The consequences. Whether medical treatment was given, what assistance was provided, whether security or law enforcement were contacted, and lost work time.
8. (d)(8) Who completed the entry. Name, title, phone, email and date.

The part people get wrong: no names

The log must omit personal identifying information. Not the assailant's, and not the employee's.

That sounds simple and is awkward in practice, because the incident behind the log entry is somebody's record. The employer obviously knows who was assaulted: it has to treat them, count their lost time, and probably record an OSHA case for the same event. So you end up maintaining two documents about one event, with two different audiences and two different disclosure rules.

The workable pattern is the one OSHA already uses for privacy concern cases on the 300 Log: keep the identity on the underlying record, behind its own access control, and build the log and the report from the fields that are allowed to appear. If your log is a spreadsheet, this is the thing that will eventually go wrong, because a spreadsheet has no way to enforce which column somebody may read.

The two reporting clocks

Separate from the log, general acute care, acute psychiatric and special hospitals report incidents to the Division through its own online system, under §3342(g).

• Within 24 hours if the incident involved a firearm or other dangerous weapon, caused injury, or presents an urgent or emergent threat to the welfare, health or safety of hospital personnel.
• Within 72 hours for every other reportable incident.

The report carries the facility and contact details, date, time and location, a description, the number of employees injured, whether security or law enforcement were involved, whether a continuing threat exists, a unique incident identifier, and whether it was also reported under §342. It shall not include any employee or patient names, per §3342(g)(4)(I).

The judgment call in that list is "urgent or emergent threat". The other two triggers are objective: a weapon was involved or it was not, someone was injured or was not. Whether a threat is urgent is a decision a person has to make and be answerable for, and any system that quietly decides it for you is doing you no favours.

Retention

Violent incident records: five years. Training records: one year. Section 3342(h).

Note this is a different clock from the OSHA 300 Log's five years following the calendar year, and different again from the employee medical record retention of duration of employment plus thirty years. A single incident can generate records under all three.

A practical checklist

• Confirm you are covered by §3342, and if you are, stop any parallel §6401.9 project.
• Check your log captures all eight field groups, not the four or five most incident reports collect.
• Check that no name can reach the log or the Cal/OSHA report, including through a free-text description field. This is where names actually leak.
• Write the 24-hour and 72-hour triggers somewhere a charge nurse can find them at 3am.
• Make sure somebody owns the decision on "urgent or emergent threat", and that the decision is recorded.

Where this fits with everything else

A violent incident that injures an employee is often three records at once: a violent incident log entry, an OSHA 300 case, and possibly a §342 serious injury report on an eight-hour clock. They have different content rules and different deadlines, and they are all about the same event.

carefoundryESC records the incident once and drives all three from it, including the two §3342 clocks, with the log built so that a name cannot reach it. That is part of the California layer, included in every plan and switched on for the organizations that record under Cal/OSHA.

Check the current text

Title 8 is amended, and this article is a summary rather than the regulation. Read §3342 on the Department of Industrial Relations site before relying on any of it for a filing.