Businesses in California must prepare workplace violence prevention plans by next summer under a first-in-the-nation state law that some attorneys have called vague and tricky to implement.

California became the first state with a job violence law that applies to a broad swath of industries, after Gov. Gavin Newsom (D) signed the measure late last month. It and others already have regulations to protect health-care employers from such harm.

The new law requires employers to have an “effective” program to prevent workplace violence in place by July 1, when the California Division of Occupational Safety and Health will begin enforcement. But that mandate alone, without further guidance, leaves employers guessing about what to include in the plan.

“What does it mean to be effective,” said Rachel Conn in San Francisco, chair of Conn Maciel Carey LLP’s California practice. “That’s always a battle out here in California.”

Across the state, 57 workers died from homicides at private employers in 2021, the last year data is available from the US Bureau of Labor Statistics. That total jumps to 376 nationwide for the same time period.

Three weeks before the legislation was introduced in February, seven agricultural workers in Half Moon Bay were shot to death, allegedly by a co-worker.

Cal/OSHA’s following investigation led to two employers being cited for 41 violations, including several that accused them of not including workplace violence as part of a state-required injury and illness prevention plan. Among the concerns cited by Cal/OSHA were failing to take actions after a prior non-fatal shooting, not screening job applicants for past on-the-job violence, and failing to have procedures for alerting workers to an active shooter. The employers are appealing the charges.

Safety Regulator

Cal/OSHA had begun drafting a workplace violence standard in 2017, but said it wouldn’t likely have a final rule until 2024, at the earliest.

With the signing of the new law, Cal/OSHA said it will move to meet the law’s December 2026 deadline for enacting a follow-up rule. However, the agency hasn’t said what guidance materials, such as model programs and frequently asked questions, it may provide to comply with the existing law.

“We’re advising clients to hang tight for a little while before starting to put anything down in writing,” said attorney Ilana Morady, a partner with Seyfarth Shaw LLP in San Francisco. “Let’s wait to see if a model program gets published by Cal/OSHA.”

Joseph Hoag, a partner with Davis Wright Tremaine LLP in Seattle, said that while Cal/OSHA has required hospitals to have workplace violence plans since 2017, the agency hasn’t produced a model template for the health-care providers.

Cal/OSHA’s eventual rulemaking may add additional mandates beyond the law’s requirements, said Jonathan Vick, a partner with Atkinson, Andelson, Loya, Ruud & Romo in Cerritos, Calif.

Vick expects the standard, which will have to go through the public comment and hearing process, to fill many of the law’s gaps.

What is ‘Effective?’

The law doesn’t set out specific mandates for employers drafting the plans, such as lighted parking lots, active shooter drills, or physical barriers between store clerks and customers.

It says the plan must include procedures for responding to “actual or potential” emergencies. The procedures include having an alert system, establishing how to contact police or private security staff, and having a shelter-in-place or evacuation plan.

And the law requires plans to be specific to each workplace, meaning that Cal/OSHA wouldn’t likely approve of an employer with multiple locations using the same plan for every site, Conn said.

In fact, a large workplace might need multiple plans to deal with hazards specific to each department, she said.

Worker advocacy groups also are awaiting more specific requirements from Cal/OSHA.

“We look forward to Cal/OSHA’s prompt action to improve worker safety from violence through enforcement and education,” said Stephen Knight, executive director of Worksafe Inc. in Oakland, Calif.

Worksafe continues to advocate for Cal/OSHA to adopt protections the group has long called for, Knight said. Among the recommendations are requiring employers to address protecting workers from active shooter incidents and specifying that educating workers be done by “qualified” trainers.

Open Questions

The law sets out mandates for writing and updating plans, training, and tracking violent acts.

“When you get into the details and applications of this new law, unfortunately, I think it does have real potential to create confusion,” said Hoag, who sees the potential for inspectors citing “gotcha violations.”

For example, the law requires employers to detail how they will “obtain the active involvement” of workers and unions.

Joshua Henderson, a principal with Jackson Lewis P.C. in San Francisco, voiced concerns about what Cal/OSHA would find acceptable.

“What does it mean to obtain the active involvement of employees in developing the plan?” Henderson said. “Do you seek volunteers? Is a survey sufficient to meet that requirement?”

The attorneys also said Cal/OSHA needs to clarify how the law applies to sites with multiple employers such as construction sites or buildings shared by several tenants.

Henderson said construction subcontractors should assume they’ll need a plan and coordinate it with the prime contractor or site manager.

“This does not appear to be something an employer can delegate to a host employer,” Henderson said.

Tracking Credible Threats

California will require employers to investigate any attack or “credible” threat, including verbal threats and threats appearing on social media. They also must keep the investigation documents for at least five years.

While companies are prohibited from including “personal identifying information” in reports, they are required to detail the attack, the employer’s response, and specify if the attack involved a sexual assault.

Employers are also required to provide upon request an incident report to their workers and union representatives.

“There are a lot of circumstances where it’s going to be very clear who this person was and what kind of assault this was,” Hoag said. “It seems to be to a violation of privacy, but it’s required.”

Conn said the privacy issue shows complying with the law will require more than working with a security department. Coordination is also needed with human resources, training, safety, and legal departments.

“It takes a team to look at it,” Conn said.