Violent incident logs: What different states now require of healthcare employers

Workplace violence in healthcare has moved from a topic to a regulated record, and it has done so state by state rather than nationally. The result is that the log itself is broadly the same document everywhere, and what you must do with it is not.

The short answer

Roughly twenty states now impose healthcare-specific workplace violence duties. There is no federal standard yet, though OSHA has a proposed one. The log is largely common ground. The obligations that follow it are where states diverge, and that is what determines your process.

Why there is no single answer

Absent a federal standard, each state has legislated on its own timeline and with its own theory of what makes workplaces safer. Broadly, three patterns:

• Log and report. Record every incident, and notify the regulator within a fixed window when it meets a severity threshold. California is the clearest example.
• Log and investigate. Record every incident and investigate it, reporting patterns internally to a safety committee. Washington takes this approach.
• Plan and train. Require a written prevention plan, annual training and a hazard assessment, with lighter record obligations.

Many states combine elements. The point is that reading one state's requirements and generalizing is how multi-state employers get this wrong.

Which states require a healthcare workplace violence program

At least twenty states have now legislated. This is the current picture for the states with healthcare-specific requirements. Where we have written the detail up, the state links to it. Requirements change and several states amended theirs in 2026, so confirm against the current statute before relying on any row.

Legislation was also introduced in 2026 in Kentucky, Missouri and Utah, and a federal bill (H.R.2531, the Workplace Violence Prevention for Health Care and Social Service Workers Act) is before Congress. The trend runs one way.

California: log, then two clocks

8 CCR §3342 was the first healthcare-specific workplace violence standard in the country. It requires a violent incident log with eight defined field groups and, critically, no personal identifying information. Records are kept five years.

Hospitals then report to the Division within 24 hours where there was an injury, a firearm or other dangerous weapon, or an urgent or emergent threat, and within 72 hours otherwise. The report also excludes names.

One thing worth knowing if you operate in California: Labor Code §6401.9, the general-industry workplace violence law, exempts facilities covered by §3342. You need one plan, not two. Detail in our guide to the §3342 log.

Washington: log, then investigate every one

Washington's RCW 49.19 asks for something different in kind. Rather than a reporting clock keyed to severity, it requires the employer to investigate every violent incident and to bring a recurring data summary to its safety committee.

That is a heavier ongoing obligation than California's in one sense and a lighter one in another: no scramble against a 24-hour clock, but no incidents that quietly need nothing either.

What this means if you operate in more than one state

Three practical consequences.

1. Keep the log per establishment, not per system. The fields are similar enough that a single format usually works, but the follow-on duties attach to the site.
2. Do not standardize on your largest site's process. It is the natural instinct and it produces either a scramble at sites with a reporting clock, or pointless investigations at sites without an investigation duty.
3. Write down who decides. Every one of these regimes contains at least one judgment call, and severity thresholds are the most common. Somebody has to own it and the decision has to be recorded.

What the log should hold, wherever you are

If you are building this now and want a format that survives your state changing its mind, capture the union of the common requirements:

• When, where and in which department.
• A description of the incident.
• Who committed it, by category rather than by name.
• The circumstances and contributing factors, including staffing and lighting.
• Location type and incident type.
• Consequences: treatment, assistance, security or law enforcement involvement, lost time.
• Who completed the entry.

And build it so that no name can reach it, including through a free-text description. That is the single most common way personal information ends up in a document that is supposed to be anonymized, and a spreadsheet cannot enforce it.

Where this is heading

Federal OSHA has a proposed standard for workplace violence prevention in healthcare and social assistance. More states are legislating. The sensible assumption is that the log is permanent and the follow-on duties will keep multiplying, which argues for holding the underlying record once and generating each state's document from it rather than keeping several logs.

That is how carefoundryESC handles it: one violent incident record, with the California and Washington layers generating their own outputs and clocks from it. See how jurisdiction compliance works.

Verify your own state

State requirements change, and this article is an overview rather than legal advice. Confirm your obligations against your own state's current statute and regulations, or with counsel, before designing a process around them.