Introduction
New York requires employers with 10 or more retail employees to maintain a written workplace violence prevention policy and provide interactive training. New Jersey imposes a comparable mandate only on covered health care facilities. Every other employer in both states still has a legal obligation under the federal OSHA General Duty Clause, which carries no template and no safe harbor.
That last sentence is where most compliance officers get caught. The absence of a statute is not the absence of a duty.
Key takeaways
- New York Labor Law Section 27-e took effect June 2, 2025 and covers employers with 10 or more retail employees in the state.
- Employers with 500 or more retail employees in New York must provide silent response buttons beginning January 1, 2027.
- New Jersey's mandate reaches hospitals, nursing homes, state and county psychiatric hospitals, and state developmental centers, and requires a violence prevention committee that is at least half direct patient care workers.
- Employers outside both statutes are governed by Section 5(a)(1) of the OSH Act, under which OSHA has successfully cited and fined employers for foreseeable assaults.
- The Bureau of Labor Statistics recorded 470 workplace homicides in 2024, up from 458 in 2023.
What does New York actually require?
The Retail Worker Safety Act, codified at New York Labor Law Section 27-e, applies to any employer with 10 or more retail employees working in New York State. It took effect June 2, 2025, after amendments pushed the original March 3, 2025 date back by three months.
Covered employers have two obligations today and a third arriving in 2027.
Obligation one: a written retail workplace violence prevention policy. The statute specifies the minimum contents. The policy must list the factors or situations in the workplace that might place retail employees at risk of violence. It must describe the methods the employer may use to prevent incidents. It must inform employees about federal and state laws concerning violence against retail workers and the remedies available to victims, and note that local laws may also apply. And it must state clearly that retaliation against anyone who complains about workplace violence, or who testifies or assists in a proceeding under the law, is unlawful.
Obligation two: interactive workplace violence prevention training. The training must be delivered in an interactive format, and employees must also receive a written copy of the training material. The New York State Department of Labor has published a model policy and a model training program, which covered employers may adopt directly or replace with their own equivalent program. Content must cover the requirements of the Act itself, measures workers can take to protect themselves, de-escalation tactics, emergency procedures and exit and meeting locations, how to use security alarms and worksite-specific emergency devices, and the responsibilities of supervisors and managers before, during, and after an emergency.
Under the amendments, NYSDOL must make the model policy and training available in the twelve most common non-English languages spoken in New York State, based on the most recent American Community Survey. Employers must provide a translated copy to an employee whose primary language is not English only where NYSDOL has published that translation. Where it has not, an English version satisfies the requirement.
Obligation three, effective January 1, 2027: silent response buttons. Employers with 500 or more retail employees in New York State must provide employees with a silent response button that requests immediate assistance from a security officer, manager, or supervisor, and must train employees on its use. This requirement was amended from the original "panic button" language. Eighteen months is not a long lead time for a hardware rollout across a store footprint, and this is the requirement most likely to be discovered late.
Two coverage questions that trip employers up
Does the Act reach non-retail employers? It can. NYSDOL guidance clarifies that the Act applies to employers whose employees work in a retail setting, even when those employees are not employed by the retail store and are not involved in selling goods. A cleaning contractor whose staff service retail locations falls within the Act. If your workforce sets foot inside a covered store as part of the job, run the analysis rather than assuming the answer.
Are restaurants covered? Generally no. The Act reaches a store that sells consumer commodities at retail and is not primarily engaged in the sale of food for consumption on the premises. Restaurants and delis that sell prepared food fall outside. Mixed-format operations should not assume the exclusion applies without examining the primary business.
Consult employment counsel on coverage. The point of this section is that the coverage question is not obvious, and getting it wrong is a documentation failure rather than a good-faith defense.
What does New Jersey require?
New Jersey has not enacted a general private-sector workplace violence prevention mandate. Its statute is sector-specific.
The Violence Prevention in Health Care Act, at N.J.S.A. 26:2H-5.20, directs covered health care facilities to build programs addressing physical violence and credible threats of violence against employees. Covered facilities include general and specialty hospitals, nursing homes, state and county psychiatric hospitals, and state developmental centers.
The structure of the obligation is worth reading closely, because it is more prescriptive than New York's on governance and recordkeeping.
A violence prevention committee within six months. At least 50 percent of the members must be direct patient care workers. The remainder must be individuals experienced in violence prevention. This is a composition requirement, not a suggestion, and it is the element most commonly satisfied on paper only.
A written violence prevention plan within eighteen months. The plan must identify workplace risks and specify methods to reduce each identified risk, including training, job design changes, staffing, security, equipment, and physical facility modifications. A risk that is identified and then not addressed in the plan is a documented gap that will be read against the facility later.
Annual violence prevention training familiarizing workers with the facility's plan.
Personnel trained to recognize predictive factors. The facility must have staff sufficiently trained to identify aggressive and violent predicting factors and to respond to and manage violent disturbances appropriately.
A five-year record of violent acts. The facility must keep a record of all violent acts against employees at work, maintained for at least five years after the reported act. Employees, their authorized representatives, and the Department of Health and Senior Services have access to that record.
A post-incident response system that offers and encourages counseling whenever a worker is threatened or assaulted, plus a prohibition on retaliation against employees who report.
New Jersey public employers operate under the state's Public Employees Occupational Safety and Health program, since New Jersey's state OSHA plan covers public employees only. Private employers in New Jersey answer to federal OSHA.
If neither statute covers you, are you off the hook?
No. This is the most consequential section of this article.
There is no federal OSHA standard specific to workplace violence. What exists is Section 5(a)(1) of the Occupational Safety and Health Act of 1970, the General Duty Clause, which requires every employer to furnish a place of employment free from recognized hazards that are causing or are likely to cause death or serious physical harm. Courts have interpreted the clause to mean that an employer has a legal obligation to provide a workplace free of conditions the employer or the industry recognizes as hazardous, where a feasible method to abate the hazard exists.
Four elements have to be established for a citation to stand. A hazard existed. The hazard was recognized, either by the employer or by the industry. The hazard was causing or likely to cause death or serious physical harm. And a feasible means of abatement existed that the employer did not use.
The second element is where most employers create their own exposure. Employer recognition can be established by the organization's own conduct. If you already provide some de-escalation training, you have recognized the hazard. If an employee reported a threat to a supervisor and it was documented, you have recognized the hazard. If prior incidents exist in your incident log, you have recognized the hazard. Partial measures are evidence of awareness, and awareness without adequate abatement is the citation.
OSHA's field guidance for these inspections is CPL 02-01-058, Enforcement Procedures and Scheduling for Occupational Exposure to Workplace Violence. It instructs compliance officers on how to scope an inspection, how to establish employer and industry recognition, and how to structure the citation. Inspections are generally triggered by complaints, referrals, or a fatality or catastrophe investigation. Reading the document your inspector will be working from is the cheapest preparation available.
The enforcement posture is not theoretical. In the Integra Health Management matter, the Occupational Safety and Health Review Commission affirmed a serious General Duty Clause citation after a service coordinator was killed by a client with a documented history of violent behavior. The Commission found a direct nexus between the work performed and the risk of violence, found employer recognition based in part on the training the company already provided and on safety concerns the worker had raised to supervisors, and found the proposed abatement measures feasible.
The scale of the underlying hazard supports recognition arguments across a wide range of industries. The Bureau of Labor Statistics Census of Fatal Occupational Injuries recorded 5,070 fatal work injuries in the United States in 2024. Fatalities from violent acts totaled 733. Homicides accounted for 64.1 percent of that category, with 470 fatalities, up from 458 in 2023. Among protective service occupations, homicides accounted for 97 of 281 fatalities.
What belongs in a written plan
Whether you are drafting to satisfy a statute or to establish abatement under the General Duty Clause, the components are largely the same. A defensible plan contains:
A documented risk assessment. Physical environment, employee-to-public interaction points, cash handling, isolated or late-night work, staffing levels, access control, and the organization's own incident history. Assessment findings must be dated and preserved. An undated assessment cannot establish when you knew what.
Identified controls mapped to identified risks. Engineering controls such as access control, lighting, sightlines, barriers, and alarms. Administrative controls such as staffing patterns, visitor policies, weapons policies, and check-in procedures. Training as the third layer, never the first.
A reporting mechanism people will actually use. Multiple channels, a named recipient, a stated timeframe, and an explicit non-retaliation guarantee. Underreporting is the single most common failure mode, and it is usually a design problem rather than a culture problem.
A defined threat assessment and case management process. What happens after a report arrives. Who evaluates it, against what criteria, with what authority to act. This is the component most plans omit entirely, and it is covered in depth in our companion article on behavioral threat assessment.
Emergency response procedures, including active assailant response, evacuation and shelter locations, and the specific responsibilities of supervisors and managers.
Post-incident protocols, including medical response, employee support and counseling, incident documentation, notification obligations, and a review process that feeds findings back into the risk assessment.
A review cadence. Annual at minimum, and after every significant incident.
The documentation that matters if you are ever cited
Compliance officers tend to think in terms of the program. Regulators and plaintiffs' counsel think in terms of the file. What survives scrutiny is not what you did but what you can prove you did, with dates.
Maintain and retain the following: the dated risk assessment and each subsequent revision; the written plan with version history; training rosters with dates, content delivered, and employee acknowledgments; the incident and threat log, including reports that were assessed and closed without action; committee or team meeting minutes where required; abatement decisions with the reasoning, including the reasoning for measures you considered and declined; and vendor or consultant assessment reports.
That sixth item deserves emphasis. Documenting why you declined a control, with a contemporaneous rationale, is materially stronger than having no record of the decision at all. A reasoned rejection is a defensible business judgment. Silence looks like inattention.
Frequently asked questions
Does New Jersey require a workplace violence prevention plan for private employers? Not generally. New Jersey's statutory mandate at N.J.S.A. 26:2H-5.20 applies to covered health care facilities, including hospitals, nursing homes, state and county psychiatric hospitals, and state developmental centers. Private employers outside health care remain subject to the federal OSHA General Duty Clause, which imposes a duty to address recognized hazards even without a specific standard.
Who is covered by the New York Retail Worker Safety Act? Employers with 10 or more retail employees working in New York State. The Act applies to stores selling consumer commodities at retail that are not primarily engaged in selling food for consumption on the premises. State guidance indicates it can also reach employers whose workers perform services inside retail settings without being employed by the store.
When do silent response buttons become mandatory in New York? January 1, 2027, for employers with 500 or more retail employees in New York State. Covered employers must provide the button and train employees on its use.
Can OSHA cite an employer for workplace violence when there is no specific standard? Yes. OSHA cites under Section 5(a)(1) of the OSH Act, the General Duty Clause. The Occupational Safety and Health Review Commission has affirmed such citations where a recognized hazard, a nexus to the work performed, and feasible abatement measures were established.
How often does workplace violence prevention training need to be repeated? Requirements vary by jurisdiction and employer category. New Jersey's health care statute requires annual training. New York requires interactive training under the Retail Worker Safety Act, with recurrence requirements set by the statute and NYSDOL guidance. Employers relying on training as General Duty Clause abatement should treat annual delivery as the practical floor and document every session.
What triggers an OSHA workplace violence inspection? Under CPL 02-01-058, inspections generally follow complaints, referrals, or a fatality or catastrophe investigation. A single serious incident is enough to open an inspection that examines the adequacy of the entire program.
We already have a policy in the handbook. Is that sufficient? Rarely. A handbook statement establishes that the employer recognized the hazard, which satisfies one element of a General Duty Clause citation without satisfying the abatement element. A policy without a risk assessment, controls, training records, and a case management process can strengthen a regulator's argument rather than weaken it.
Where Falcon fits
Falcon's workplace violence investigations and training practice builds custom programs for organizations of all sizes: threat assessments, active shooter response planning, and workplace violence prevention training. Falcon Associates are former federal, state, and local law enforcement officers, and the team includes Certified Protection Professionals and Licensed Clinical Social Workers, which matters when a program has to hold up as both a security control and a behavioral assessment function. Learn more about the team.
If a matter escalates to litigation or a regulatory proceeding, Falcon associates are available for criminal and civil testimony. See our article on what makes a credible expert witness. For organizations evaluating personal security exposure at the executive level, our risk-based guide to executive protection covers a related question.
Contact Falcon to discuss an assessment of your current program.