OSHA’s long-anticipated workplace violence prevention final rule for healthcare and social assistance settings represents the most significant federal regulatory development for healthcare facility security in a generation. The rule, which has been in development since 2016 and finalized in phases through 2024-2025, requires healthcare employers to develop, implement, and maintain workplace violence prevention plans—with specific provisions addressing physical environment risk factors that intersect directly with facility access control planning.
For healthcare facility directors and security professionals, understanding how the rule translates to access control requirements—and documentation obligations—is essential for both compliance and practical security improvement.
What the Rule Requires
The OSHA workplace violence prevention final rule requires healthcare employers to:
Develop a written workplace violence prevention plan that addresses specific risk factors in the work environment, including physical environment factors that contribute to violence risk
Conduct a workplace violence hazard assessment that systematically identifies conditions that may contribute to workplace violence, including physical environment conditions (inadequate lighting, blind spots, isolated work areas, insufficient access to help)
Implement controls to address identified hazards, including engineering controls (physical environment modifications), administrative controls (policies and procedures), and work practice controls
Provide training to all employees on the workplace violence prevention plan and their specific roles
Record and investigate incidents using a standardized recordkeeping approach
Conduct annual review of the plan with employee involvement
Physical Environment Risk Factors the Rule Addresses
The rule’s hazard assessment requirements specifically call out physical environment conditions that contribute to workplace violence risk. For facility directors, these translate directly to facility infrastructure and access control considerations:
Lighting Deficiencies The rule requires assessment of lighting adequacy in areas where employees work, including parking lots, parking structures, corridors, waiting areas, and any areas where employees may be isolated. Lighting that creates shadows, blind spots, or inadequate visibility during night shifts represents a recognized risk factor that requires remediation.
Healthcare facility parking areas—where staff walk to and from vehicles during night shifts—are specifically referenced in OSHA guidance as environments where lighting assessment is required. IES RP-20 standards for healthcare facility parking provide a technical benchmark for adequate illumination.
Limited Access to Help Areas where employees work in isolation—without the ability to quickly summon help—require specific assessment. This includes examination rooms with no duress call capability, registration areas with limited visibility to security, and remote facility areas staffed by single employees.
The engineering control response to isolated work area risk is typically a combination of duress button installation, camera coverage, and communication system access. The access control dimension involves ensuring that response personnel can access the area quickly when help is needed.
Waiting Area and Public Space Design Emergency department waiting areas, psychiatric unit access points, and other high-density patient interaction areas present documented violence risk factors. Physical environment controls may include:
- Secured entry vestibules between waiting areas and clinical treatment spaces
- Counter heights that prevent patient-to-staff reaches
- Security officer positioning with clear sightlines to high-risk areas
- Panic button placement within reach of all registration and triage staff
Security Response Time to Incidents The rule implicitly requires that security response be available within a timeframe that prevents escalation of violent incidents. For large campuses with dispersed security coverage, this may require additional security staffing, security post repositioning, or communication system improvements that enable faster response.
Access Control as an Engineering Control
OSHA’s hierarchy of controls for workplace violence hazards places engineering controls above administrative and work practice controls in priority. Access control is explicitly an engineering control—physical measures that prevent hazardous conditions or exposures without requiring ongoing employee action.
Engineering controls specifically applicable to workplace violence prevention through access control include:
Secured Entry Points in High-Risk Areas Psychiatric units, emergency departments, and behavioral health settings where patient violence risk is elevated require secured entry that prevents unauthorized public access. Card-access-controlled doors with airlock vestibules for visitor processing represent appropriate engineering controls for these environments.
Duress System Integration Fixed and wireless panic buttons that alert security instantly are engineering controls that address the “limited access to help” risk factor. Modern duress systems integrate with access control platforms to provide location context with the alert—security receives the specific door or room location, not just an indiscriminate alarm.
Dedicated Security Staff Entry In healthcare facilities where security officers respond to workplace violence incidents, access control systems should be configured to allow rapid security access to all areas without requiring credential-by-credential entry through secured doors. Security staff with appropriate access levels should be able to move through the facility during an incident without being impeded by normal access restrictions.
Patient-to-Staff Interaction Barriers In high-risk intake and assessment areas, physical barriers—whether traditional security glass, half-height counters, or controlled-access service windows—represent engineering controls for staff protection. The access control system should complement these physical barriers by controlling who can enter the area behind them.
Documentation Requirements
The rule requires healthcare employers to document their hazard assessment process, the controls implemented in response to identified hazards, and the rationale for control selection. For access control, this means:
Hazard Assessment Documentation Document the physical environment conditions assessed, the assessment methodology, identified risk factors related to physical environment, and the risk level assigned to each identified hazard.
Control Selection Rationale Document the access control and physical security measures selected to address each identified physical environment risk factor, and why those controls were chosen as appropriate responses to the assessed risk level.
Implementation Records Document when physical environment improvements were implemented, including lighting upgrades, duress system installations, camera additions, and access control modifications made in response to the hazard assessment.
Effectiveness Review The annual plan review must include assessment of whether implemented controls have been effective in reducing workplace violence risk. For access control measures, this includes reviewing access event logs for evidence that controls are functioning as designed and reviewing incident data to assess whether measures have reduced incidents in targeted areas.
Compliance Timeline
OSHA’s implementation timeline for the workplace violence prevention rule included phased compliance dates based on employer size. Healthcare facility directors should verify their organization’s specific compliance deadlines and the current implementation requirements for their employer category.
Regardless of specific compliance dates, the practices required by the rule—systematic hazard assessment, documented engineering controls, annual review—represent sound security management practices that deliver value independently of regulatory compliance.
Frequently Asked Questions
Does the OSHA workplace violence rule preempt state workplace violence prevention requirements for healthcare? No. Federal OSHA standards establish minimum requirements; states with OSHA-approved state plans may have more stringent requirements. California, for example, has required healthcare-specific workplace violence prevention plans since 2017. Healthcare organizations operating in states with state OSHA programs should verify compliance with applicable state requirements, which may be more demanding than the federal standard.
How should healthcare facilities prioritize physical environment improvements when they cannot address all identified hazards immediately? The rule requires implementation of controls “as soon as feasible” for identified hazards, with prioritization based on risk level. Immediate-risk hazards (areas where violent incidents are actively occurring, isolated work areas with no access to help) should receive the highest priority. Multi-year capital plans for physical environment improvements should document the prioritization rationale and the interim administrative controls in place while engineering controls are planned.
Does the workplace violence rule require security cameras in all areas of a healthcare facility? No. Camera installation is an appropriate engineering control for specific identified risk factors—blind spots, isolated work areas, after-hours access points—but the rule does not mandate camera coverage everywhere. The hazard assessment drives the control selection; camera installation is appropriate where it addresses a specific identified risk factor.
How does the rule affect temporary and agency healthcare workers? The employer hosting the temporary or agency worker is responsible for ensuring that the worker is covered by a workplace violence prevention plan and receives appropriate training. Host healthcare employers cannot shift this responsibility to the staffing agency. Practical implementation requires either providing agency workers with host employer WVPP training or confirming that agency workers have received equivalent training from their agency.
