Workplace Violence: The Proactive Policies OSHA Expects from Small Healthcare Practices (OSHA General Duty Clause)

Workplace violence is one of the most serious safety risks in healthcare, and OSHA has made it clear that employers cannot ignore it. Under the OSHA General Duty Clause, 29 U.S.C. 654(a)(1), every employer must furnish a workplace free from recognized hazards that are likely to cause death or serious physical harm; OSHA treats workplace violence in healthcare as one of those recognized hazards when risk factors are present and unaddressed. 

For small healthcare practices, a single assault, serious threat, or repeated harassment can trigger an OSHA inspection, workers’ compensation claims, and reputational damage, as well as loss of key staff who no longer feel safe. OSHA has issued specific guidance and fact sheets on workplace violence in healthcare and social services, describing the elements of an effective prevention program that inspectors expect to see when they investigate. 

This article explains how the General Duty Clause applies to workplace violence in small outpatient settings, what enforcement looks like, and how clinics with limited budgets can build a compliant prevention and response program. It offers concrete, low-cost controls, a case study, a self-audit checklist, and governance tips so that a small practice can demonstrate that it recognized the hazard and took reasonable steps to abate it.

Violence in healthcare is not limited to large emergency departments or psychiatric units. OSHA’s own publications note that healthcare staff face elevated risks of verbal threats, physical assaults, and other aggressive behaviors from patients, visitors, and even coworkers.  In a small clinic, a single violent event can close the office for the day, traumatize staff, and lead to costly regulatory scrutiny.

Although there is currently no specific OSHA standard for workplace violence, the agency uses the General Duty Clause to enforce employer responsibilities where hazards such as violence are well recognized and feasible abatement methods are available.  For small practices, this means that “we are too small” is not a defense; if there are known risks and no meaningful controls, OSHA may cite under the General Duty Clause after a serious incident.

This article connects the legal obligation under the General Duty Clause with practical actions a small clinic can take. It describes how to identify your own risk factors, what OSHA expects in a basic written workplace-violence program, and how to operationalize these expectations using the people and tools you already have.

Understanding Legal Framework & Scope Under OSHA General Duty Clause

The OSHA General Duty Clause, 29 U.S.C. 654(a)(1), requires each employer to furnish to each of its employees “employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm.” A General Duty Clause citation generally requires OSHA to prove four elements:

1. A hazard existed.

2. The hazard was recognized by the employer or industry.

3. The hazard was likely to cause death or serious physical harm.

4. There was a feasible and useful method to correct or materially reduce the hazard.

OSHA has repeatedly stated in guidance and enforcement documents that workplace violence in healthcare can meet these criteria, because the risk factors (such as working with volatile patients, handling medications, and working in isolated areas) are well documented and widely recognized.  When those risk factors are present and feasible prevention measures are not in place, OSHA may allege a General Duty Clause violation following a serious violent incident.

There is no federal OSHA standard that spells out detailed workplace-violence requirements for all healthcare settings, unlike standards for bloodborne pathogens or PPE. Instead, OSHA relies on the General Duty Clause plus its workplace-violence guidelines and related standards (for example, recordkeeping and training requirements) to frame expectations. States with their own OSHA-approved plans may adopt more specific workplace-violence rules, but the General Duty Clause still provides a baseline. 

For a small clinic, understanding this framework reduces risk in three ways:

• It clarifies that workplace violence is not “just part of the job” but a legally recognized hazard.

• It signals that OSHA expects a prevention program scaled to the size and risk level of the practice.

• It gives a structure for documentation so that, after a complaint or incident, the clinic can demonstrate that it identified risks and took reasonable steps to abate them, reducing the likelihood and severity of citations.

OSHA is the primary federal enforcement body for workplace safety in private-sector healthcare settings, including small clinics and physician practices, either directly or through a state-plan OSHA agency.  The General Duty Clause is enforced through inspections and citations following:

• Employee complaints alleging unsafe conditions, including threats or assaults.

• Referrals from other agencies or law enforcement after a violent incident.

• Programmed inspections focused on healthcare hazards in certain regions or sectors.

• Follow-up inspections to verify that previously cited hazards have been corrected.

In the context of workplace violence, common triggers for an OSHA inspection include a severe assault resulting in hospitalization, multiple reports of threats or harassment, or patterns of incidents that suggest the employer is not recognizing and managing the hazard. OSHA guidance on healthcare workplace violence stresses the need for a written program, hazard assessments, incident reporting, and training; inspectors often look for these elements. 

State agencies, workers’ compensation carriers, and malpractice insurers may also review workplace-violence policies when evaluating claims or premiums. While they do not enforce the General Duty Clause, their findings can influence OSHA’s view of whether a hazard was recognized and whether reasonable controls were in place.

Although the heading refers to HIPAA, this section functions as your operational playbook for meeting OSHA’s General Duty Clause expectations on workplace violence in a small practice. Each control below is tied to the General Duty Clause’s requirement to identify recognized hazards and implement feasible abatement measures.

Before you implement individual controls, designate a “Workplace Violence Prevention Lead” in your practice. This can be the office manager, practice administrator, or a senior clinician who will coordinate the program, maintain documentation, and serve as the point of contact during any OSHA inquiry.

1. Create a concise written workplace-violence prevention policy.

• Implementation: Draft a one- to two-page policy that defines workplace violence (including threats, harassment, stalking, and physical assaults), states zero tolerance, describes how to report concerns, and explains that retaliation is prohibited. Reference the General Duty Clause commitment to a safe workplace.

• Evidence to retain: Final signed policy, date of adoption, and any staff acknowledgment forms or electronic attestations.

• Low-cost approach: Use OSHA’s healthcare workplace-violence guidance as a template for key elements, simplifying the language for your outpatient setting.

2. Conduct a focused workplace-violence hazard assessment of your clinic.

• Implementation: Walk through the site during normal operations and identify where staff may be exposed to aggression: reception, exam rooms, check-out, parking areas, and any isolated spaces. Note factors such as long waits, billing disputes, or high-acuity behavioral health patients.

• Evidence to retain: A simple grid or checklist listing locations, risk factors, and existing controls, signed and dated by the Workplace Violence Prevention Lead.

• Low-cost approach: Reuse a basic risk matrix (low/medium/high) and update it annually or after any serious incident; this demonstrates ongoing hazard recognition under the General Duty Clause.

3. Implement basic engineering and administrative controls.

• Implementation: Based on your assessment, add low-cost barriers and process changes such as keeping a clear exit path behind the front desk, using furniture placement to avoid staff being cornered in exam rooms, providing secure storage for medications, and setting clear rules around visitor behavior.

• Evidence to retain: Notes showing which risks led to which control, dated photos of layout changes, and any vendor invoices for small improvements (for example, door viewers, buzzers, or signage).

• Low-cost approach: Prioritize the top three risks (for example, front desk confrontations, after-hours staff leaving alone, or high-risk patients in small rooms) and address those first with minimal hardware or workflow changes.

4. Establish a simple incident and threat reporting process.

• Implementation: Create a one-page form or electronic template for staff to document any threats, aggressive behavior, assaults, or stalking. Include fields for date, time, location, parties involved, description, and immediate response. Require staff to complete a report for any incident that makes them feel unsafe, not just physical injuries.

• Evidence to retain: A workplace-violence incident log maintained by the Prevention Lead, with follow-up notes on corrective actions and communication to affected staff.

• Low-cost approach: Use a shared spreadsheet or basic practice-management note type labeled “Workplace Violence Incident” to avoid purchasing new software.

5. Train staff in de-escalation and response protocols.

• Implementation: At least annually, provide short training sessions on recognizing escalating behavior (yelling, pacing, clenched fists), using calm communication, knowing when to exit a room, and when to call 911. Tie this to your violence-prevention policy and the General Duty Clause requirement to protect employees from recognized hazards.

• Evidence to retain: Training agendas, sign-in sheets, slides or handouts, and any post-training quiz results.

• Low-cost approach: Use OSHA and NIOSH educational materials, along with role-play scenarios during staff meetings, instead of paid external trainers.

6. Create a post-incident response and support process.

• Implementation: Define steps to take after an incident: ensure medical care, notify law enforcement if appropriate, complete incident documentation, debrief with staff, and adjust controls as needed. Include clear timelines for management to follow up with affected employees.

• Evidence to retain: Written post-incident procedures, records of debrief meetings, any letters to staff summarizing changes made, and documentation that you evaluated whether additional controls were feasible.

• Low-cost approach: Incorporate post-incident review into your existing staff huddles or monthly meetings.

7. Integrate workplace violence into existing safety and quality meetings.

• Implementation: Add “Workplace Violence / Staff Safety” as a standing agenda item at regular staff or quality meetings. Review any incidents, near misses, and risk concerns, and document changes to processes or layout.

• Evidence to retain: Meeting minutes noting discussions and decisions related to workplace violence.

• Low-cost approach: Use existing meeting structures rather than creating a new committee.

By implementing these controls and tying them explicitly to the General Duty Clause, a small practice can show OSHA that it recognizes the hazard of workplace violence and has taken reasonable, feasible steps to reduce it, even with lean staff and limited resources.

Case Study

A small primary care clinic with eight employees operates in a suburban area with a growing population of patients with complex behavioral health and substance use issues. Over six months, staff report several incidents: a patient shouting profanities at the front desk over a billing dispute, a family member slamming doors and blocking an exam room doorway, and multiple threatening phone calls after a controlled-substance prescription was not refilled early. No one is physically injured, but staff feel increasingly unsafe.

The clinic has no written workplace-violence policy, no formal incident log, and no training beyond a brief orientation comment that “we try to stay calm with difficult patients.” After a particularly severe episode in which a patient throws a chair in the waiting room, a staff member files a complaint with OSHA alleging that the employer is not protecting employees from violence.

During the inspection, OSHA interviews staff and reviews documents. Inspectors find that the employer was aware of escalating aggressive behavior, that such behavior is recognized by OSHA and the healthcare industry as a serious hazard, and that feasible controls (such as a policy, training, incident logging, and basic layout changes) were not implemented.  OSHA issues a General Duty Clause citation, noting the lack of a workplace-violence prevention program and recommending specific abatement measures drawn from its healthcare guidelines.

If the clinic had implemented the operational controls described earlier, the outcome might have been different. A written policy and incident log would show that management recognized the hazard. Training materials and meeting minutes would demonstrate that staff were taught to respond and that management reviewed incidents and adjusted controls. Even if an incident still occurred, OSHA may have viewed the clinic’s efforts as a good-faith attempt to meet the General Duty Clause, potentially reducing the severity of citations and penalties.

Use this table to conduct a self-audit of your workplace-violence program and document compliance with the OSHA General Duty Clause in the context of workplace violence.

Completing this checklist and retaining it with supporting documents helps demonstrate that your clinic treats workplace violence as a recognized hazard and actively manages it, which is central to compliance under the General Duty Clause.

Common Audit Pitfalls to Avoid Under OSHA General Duty Clause

Because OSHA evaluates workplace violence under the General Duty Clause, its focus is on whether hazards were recognized and addressed with feasible controls. The following pitfalls frequently undermine a small practice’s position during an inspection.

1. Assuming that no written policy is needed because “we are a small, friendly clinic.”

• Error: Relying on informal norms instead of adopting a written workplace-violence policy that sets expectations and reporting channels.

• Legal reference and consequence: Failing to formalize recognition of workplace-violence hazards and prevention measures can support a General Duty Clause citation by demonstrating lack of systematic abatement.

2. Ignoring verbal threats and near-misses because “no one was hurt.”

• Error: Not documenting or responding to incidents that do not result in injury.

• Legal reference and consequence: OSHA considers patterns of threats and near-misses as evidence that a recognized hazard exists; failure to log and respond may show that the employer did not take feasible steps to reduce risk, supporting a General Duty Clause violation.

3. Failing to train staff on how to recognize and respond to escalating behavior.

• Error: Assuming that clinical experience alone prepares staff to manage aggression without structured training.

• Legal reference and consequence: OSHA’s guidance for healthcare stresses training as a core element of workplace-violence prevention programs; lack of training can be cited as a failure to implement feasible abatement measures under the General Duty Clause.

4. Not revisiting controls after a serious incident.

• Error: Treating a violent event as an isolated occurrence and returning to “business as usual” without reviewing and strengthening controls.

• Legal reference and consequence: Post-incident inaction can demonstrate that the employer knew of a serious hazard and failed to implement additional feasible measures, increasing the likelihood and severity of General Duty Clause citations.

5. Leaving high-risk areas (such as front desk or isolated exam rooms) unprotected.

• Error: Allowing staff to be cornered, or to work alone with aggressive patients, without clear escape routes or communication methods.

• Legal reference and consequence: OSHA’s healthcare workplace-violence guidance highlights environmental design and staffing patterns as key controls; failing to address obvious high-risk areas can be viewed as ignoring feasible abatement options under the General Duty Clause.

Avoiding these pitfalls and replacing them with documented policies, training, reporting, and targeted controls substantially lowers both the real risk of staff harm and the regulatory risk of a General Duty Clause citation.

An effective workplace-violence program is not just a notebook on a shelf; it is a pattern of behavior, expectations, and leadership decisions. For small practices, culture and governance can be simple, but must be intentional.

Leadership should clearly communicate that workplace violence is a safety issue, not a customer service failure. This means explicitly telling staff that reporting threats and aggressive behavior is expected, that reports will be taken seriously, and that retaliation is prohibited. Reinforcing this message at staff meetings and during annual training makes it part of everyday culture rather than an “extra” topic. 

Governance starts with assigning ownership. Designate a Workplace Violence Prevention Lead and ensure they have time to monitor incident logs, coordinate training, and report trends to the practice owner or managing physician. Incorporate workplace-violence review into regular safety or quality discussions, even if those meetings are brief.

Finally, establish simple metrics, such as the number of incidents logged, training completion rates, and the number of corrective actions implemented each year. These metrics demonstrate continuous monitoring and improvement, which align with OSHA’s expectations that employers systematically address recognized hazards under the General Duty Clause.

Workplace violence in healthcare is a recognized hazard, and OSHA uses the General Duty Clause to hold employers accountable when they fail to manage that risk. For small healthcare practices, a practical, documented workplace-violence prevention program is not optional; it is the main way to show OSHA that you have identified hazards and adopted feasible controls to protect your staff.

A concise policy, a focused hazard assessment, basic engineering and administrative controls, structured reporting, and regular training from the backbone of a compliant program. Taken together, these elements also make your clinic a safer, more stable place to work, improving retention and morale.

Immediate next steps for a small clinic:

1. Draft and adopt a one- to two-page workplace-violence prevention policy that cites your obligation under the General Duty Clause and explains how staff should report incidents.

2. Conduct a quick but thorough hazard assessment of your facility, prioritizing front desk, exam rooms, and parking areas, and document the findings.

3. Set up an incident and threat log and train staff to use it for all concerning behaviors, not just physical assaults.

4. Provide at least one short de-escalation and response training session for all staff within the next quarter, using OSHA-guided content tailored to your practice.

5. Schedule a brief annual review of your workplace-violence program as part of your broader safety or quality plan, and adjust controls after any serious incident.

Recommended compliance tool: A Workplace Violence Prevention Log and Rapid-Response Checklist that allows small healthcare practices to document staff concerns, track escalating behaviors, record incident details, and verify that corrective actions align with OSHA’s General Duty Clause expectations.

• OSH Act of 1970 – Section 5(a)(1) General Duty Clause

• Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers (OSHA Publication 3148)

• Healthcare Worker Safety and Health – OSHA