Workplace Violence Prevention Plan | Labor Code 6401.9

The plan is a written program, not a policy statement. A policy announces that the company prohibits threats and violence. A plan names the person responsible for implementation, sets out how hazards are identified and corrected, explains how an employee reports a threat without fear of reprisal, and fixes what happens in the first hour after an incident. Section 6401.9 requires employers to establish, implement, and maintain an effective written plan, and Cal/OSHA reads those three verbs separately. A binder drafted once and never revisited fails the maintenance test whatever the drafting quality.

Two neighboring documents get confused with it. The first is the Injury and Illness Prevention Program every California employer already owes under title 8, section 3203 of the California Code of Regulations. The plan may sit inside the IIPP as a dedicated section or stand alone, but it cannot be diluted into general safety language: the statutory elements must appear in identifiable form. The second is the emergency action plan under 29 CFR 1910.38. Active shooter response belongs there and is cross-referenced here, not merged, which is also why this document stays separate from employee handbook policies on harassment and discipline.

California Senate Bill 553 (Cortese) created Labor Code section 6401.9 and made it enforceable on July 1, 2024. The scope is wide: all employers, all employees, all places of employment, and employer-provided housing. The exceptions are narrow and frequently misread. They cover sites where fewer than 10 employees are present at any given time, that are not accessible to the public, and where the employer already complies with the IIPP regulation; teleworkers at a location of their own choosing; healthcare facilities under title 8, section 3342; and correctional and law enforcement facilities. Miss any one of the three conditions in the small-employer exception and the exception disappears. A ten-person office with a public reception desk is covered.

The statute enumerates what the plan must contain: responsible persons, active involvement of employees and their authorized representatives, coordination with other employers at shared worksites, compliance procedures for supervisory and nonsupervisory staff, communication and training, hazard identification and correction, incident response, reports accepted without retaliation, post-incident investigation, and review for effectiveness at least annually, whenever a deficiency becomes apparent, and after any incident. Subdivision (d) adds a violent incident log entry for every incident, drawn from employee accounts, witness statements, and investigation findings, with personal identifying information stripped out. Hazard records, logs, and investigation files are kept five years, training records one year. The Cal/OSHA overview of workplace violence prevention requirements in general industry is the authoritative reference on scope.

Outside California there is no federal standard, which is not the same as no exposure. Section 5(a)(1) of the Occupational Safety and Health Act, at 29 U.S.C. 654(a)(1), obliges every employer to furnish a workplace free of recognized hazards. In Secretary of Labor v. Integra Health Management, Inc., OSHRC Docket No. 13-1124, the Review Commission affirmed general duty citations against an employer whose field worker was killed by a client with a known violent history.

Any California employer that fails even one prong of the small-employer exception needs a workplace violence prevention plan on file today, and that is most of them. Retail, hospitality, self-storage, veterinary clinics, gyms: if the public walks through the door, headcount is irrelevant. The cash-handling and late-hours profile is the classic Type 1 risk, robbery by someone with no legitimate business at the site, and it drives everything from drop-safe procedures to closing-shift staffing. Social services, home health, and education face the Type 2 pattern, where the aggressor is a client, patient, or student.

Terminations generate their own demand for the document. Type 3 violence, by a current or former employee against a coworker or manager, is where a plan earns its keep: the threat assessment protocol has to exist before the meeting is scheduled. Threats surface through a workplace harassment complaint form far more often than through a security call. Type 4 covers violence brought in by someone close to an employee: domestic violence that follows a victim to work is a hazard in the statutory sense, and California employers can seek a restraining order on the employee's behalf under Code of Civil Procedure section 527.8.

Two edge cases justify a closer look. Multi-employer sites, staffing placements, and building-wide security arrangements trigger the duty to coordinate with other employers, which puts that language in the vendor contract as much as in the plan, the same allocation logic that governs a master services agreement with security and staffing vendors. Employer-provided housing is covered too.

• The designation of responsible persons names individuals by job title rather than by name, with a documented alternate for each. Inspectors routinely ask the front-desk employee who runs the plan, and an answer of "I think HR does" is treated as evidence it was never implemented.
• The employee involvement procedure records how nonsupervisory employees and any authorized representative took part in developing and revising the plan, with a sign-in and comment log. It is the element employers most often skip.
• The hazard identification and correction methodology sets a scheduled inspection cycle plus event-driven assessments after an incident, a new operation, or a report of a new hazard. Findings feed a correction table recording the control applied and the completion date, the record that must survive five years.
• The reporting and anti-retaliation procedure gives employees more than one channel, including a route that bypasses the direct supervisor, and states that contacting law enforcement is never a disciplinary matter.
• The violent incident log is drafted to subdivision (d): date, time, and location; the type of violence; a narrative; the classification of the person who committed the violence and of the circumstances; the consequences; and the name, job title, and date of the person completing the entry.

California remains the only state with a general industry mandate covering employers of every kind, and enforcement is routine rather than theoretical. Inspectors open workplace violence questions during unrelated inspections, and section 6401.9 violations are cited under the same machinery as any other Title 8 breach. The Standards Board is finalizing a dedicated general industry regulation to sit alongside section 3342 for healthcare. Training is annual, not one-time.

New York legislates industry by industry. The Retail Worker Safety Act requires retail employers with at least 10 employees in the state to adopt a written retail workplace violence prevention policy and train on it. Employers with fewer than 50 retail employees train every two years after the initial session, larger ones annually, and a silent response button obligation attaches at 500 or more retail employees statewide. Labor Law section 27-b covers public employers separately.

Texas legislated for healthcare only. Chapter 331 of the Health and Safety Code, added by Senate Bill 240, requires hospitals, nursing facilities, ambulatory surgical centers, freestanding emergency medical care facilities, and qualifying home health agencies to seat a prevention committee including a registered nurse, a physician providing direct patient care, and a security employee. Enforcement runs through licensing discipline rather than citations, which is not the softer option it sounds like.

Illinois runs two statutes that are easy to confuse: the Health Care Violence Prevention Act, which imposes program and reporting duties on hospitals, and the Workplace Violence Prevention Act, which lets an employer petition for a protective order covering an employee threatened at work. Washington and Oregon regulate healthcare settings, Washington through RCW 49.19. Multistate operators should draft one master plan to the California standard and append state riders, alongside the rest of their US employment compliance documents, because the California elements are a superset of nearly every other regime.

You start by identifying the state and the operating profile of the site. Selecting California turns on the section 6401.9 element set, the violent incident log, and the annual review language; a healthcare setting in Texas or Illinois swaps in the committee structure and the licensing-based reporting duties instead. From there the form asks for the job titles responsible for implementation, then walks through the facts that set your hazard profile: public access, cash handling, hours of operation, lone working, and off-site visits.

The hazard assessment section then generates a starting inventory of risks matched to that profile, which you edit, adding the controls in place and target dates for the rest. The file exports with attachments formatted in the same style as the employee write-up and incident documentation form: violent incident log, training roster, hazard correction table, post-incident checklist.

The most common failure is adopting the Cal/OSHA model plan verbatim. The model is a resource guide, not a compliant document, and it arrives with generic hazards. An inspector reading a plan that lists no site-specific hazards for a store with one closing employee and a cash drawer draws the obvious conclusion. The second failure is the log: employers wait for a serious injury, when the statute requires a record for every incident, including threats where nobody was touched.

Training is the third recurring gap. Plans are rolled out with a single session and left alone, missing both the annual cycle and the duty to retrain when the plan changes. Fourth, employers document nothing about employee involvement, a required element that cannot be back-filled credibly. Fifth, and the one that generates the fastest penalties, records are not produced within 15 calendar days when an employee asks. Finally, many never revisit the plan after an incident, though post-incident review is written into the statute. A plan that has never been revised is a plan that has never been implemented.