Insights / Workplace

Healthcare Workplace Violence Rules Are Tightening: Utah, New Hampshire, and Oregon

By Warren Pulley · November 8, 2026

Several states moved this fall to require healthcare employers to track, report, and prevent workplace violence, including threats and intimidation, not just physical assaults. The opportunity for hospitals is to treat the new reporting systems as an early-warning tool, not a compliance chore.

What changed?

Utah: hospital reporting systems due November 1

Under H.B. 380 and Utah Code § 26B-2-245, licensed general acute and specialty hospitals had until November 1, 2026, to bring their workplace violence reporting systems and policies into full compliance, according to the state's Division of Licensing and Background Checks.¹ The FAQ says the reporting system must collect the date and time, a description of the incident, the victim's job category, the perpetrator type (patient, visitor, or employee), and the immediate response; be communicated to all staff and included in orientation; spell out when and how to report to the employer, hospital security, and law enforcement; and use the data to improve prevention, training, and de-escalation.

New Hampshire: monthly reporting starts November 20

New Hampshire's adopted rules, Lab 1800, take effect November 20, 2026.² Health facilities must report incidents of workplace violence and hostile words to the state Department of Labor monthly, using the "Healthcare Workplace Violence Survey" form, without patient names or identifying information. The rules define categories such as threat of harm, attempted and completed physical assault, and premeditated action.

Oregon: broader coverage and a wider definition

On October 22, 2026, Oregon OSHA announced final healthcare workplace violence rules implementing Senate Bill 537.³ According to a summary by the law firm Ogletree Deakins, the new rule (OAR 437-002-0150) covers hospitals, ambulatory surgical centers, home health agencies, and home hospice programs; defines workplace violence to include threats, harassment, and intimidation; requires an incident log; and adds safety committee consultation on investigation procedures, periodic assessments, annual plan reviews, and training.

My take: threats are data

The common thread is that these rules count more than injuries. New Hampshire counts hostile words. Oregon counts threats and intimidation. Utah asks who the perpetrator was and what the immediate response was. That is exactly the information a threat assessment team needs, because serious violence is often preceded by behavior that worried someone first.

The risk is that the data sits in a compliance spreadsheet. A log tells you what happened. A team tells you what to do about the patient, visitor, or employee whose behavior is escalating. The best programs I've seen connect the two: incident reports feed a small multidisciplinary team that meets regularly, looks for repeat names and patterns, and builds management plans.

What should healthcare leaders do now?

1. Make reporting simple. If it takes more than a few minutes, staff will stop doing it, especially for verbal threats.
2. Close the loop. Tell staff what happened after they reported. Silence teaches people that reporting is pointless.
3. Route concerning reports to a team. Security, nursing leadership, behavioral health, HR, and risk should review threats, not just assaults.
4. Flag repeat behavior. A visitor who has threatened staff twice is a case, not two incidents.
5. Protect reporters. Oregon's rule expressly ties reporting to anti-retaliation protection. Make that true everywhere.
6. Train for de-escalation and response, and review the plan every year.

Rules vary by state and change. Confirm your obligations with counsel and your state agency.

Further reading from my books

Integrated BTAM includes applications for healthcare and a 90-day rollout plan for a threat assessment program. The BTAM Case Workbook provides intake, triage, case management, and monitoring forms. The Prepared Leader covers scoring threats and building a culture where warning signs are reported. Related: The Termination Meeting That Prevents Workplace Violence.

Sources

1. Utah Department of Health and Human Services, Division of Licensing and Background Checks, “FAQ: Workplace violence reporting requirements” (hospitals)
2. New Hampshire Department of Labor, adopted rules Lab 1800, Health Care Workplace Violence Prevention Program (#14704, effective Nov. 20, 2026)
3. National Law Review (Ogletree Deakins), “Oregon Finalizes Healthcare Workplace Violence Rules,” Oct. 28, 2026

This is general information and commentary, not legal advice. Facts are as reported by the sources above on the dates shown.