Twenty States, One Standard:
Compliance That Never Finishes

In September, New York’s workplace violence prevention requirements for hospitals and nursing homes take effect. Covered facilities are working toward that date now.

For everyone else, the more useful question is not what New York requires. It is what the pattern means.

At least 20 states have enacted laws requiring hospitals and other health care employers to take specific steps, including prevention plans, site assessments, training, and reporting or recordkeeping. Each was written separately. Each defines its own scope, its own deadlines, its own documentation standard.

California went further, extending requirements to nearly all employers rather than health care alone. New York extended to retail in 2025 before reaching hospitals and nursing homes this year. Virginia expanded its health care reporting framework in 2026.

An organization that operates in four states can hold four different compliance postures, built at four different times, by four different teams.

Read across them and the variation is mostly in scope and timing. The substance converges on three obligations.

A state may require one, two, or all three. None requires anything outside them. An organization built for all three is compliant in the states that mandate it and defensible in the states that do not.

Employers in states without workplace violence legislation remain subject to the federal General Duty Clause, and to ordinary negligence exposure where a known risk went unaddressed. Mandates set a floor. They do not set a ceiling, and their absence is not a safe harbor.

Which reframes the September date. It is not New York’s deadline so much as a marker of where the standard has moved. The organizations least disrupted by it are the ones that were not waiting to be told.