Active Shooter and Workplace Violence Preparedness for Healthcare Facilities

Healthcare workers make up roughly 10% of the U.S. workforce, but according to the Bureau of Labor Statistics they experience 48% of all recorded nonfatal workplace violence injuries — more than any other sector of private industry. And the federal rule meant to address it isn't coming soon: in September 2025, OSHA moved its proposed Workplace Violence in Health Care and Social Assistance rule to "Long-Term Action" status, meaning no meaningful federal regulatory movement is expected for at least a year. For healthcare employers, that makes workplace violence preparedness a gap employers have to close themselves, not one they can wait on a regulator to define for them.

The scale of the problem, in verified numbers

The data paints a consistent picture across multiple sources. Among emergency physicians specifically, 91% reported either experiencing violence themselves or having a colleague who had, per a January 2024 American College of Emergency Physicians survey, with 71% saying workplace violence felt worse than the year before. Underreporting compounds the problem: an earlier study found only 12% of healthcare workplace violence incidents were formally reported, and a 2024 Texas Department of State Health Services survey found 46% of nurses didn't report their most recent violence encounter to their employer at all — often because, per the same ACEP survey, 68% of those who did report felt their employer didn't handle it appropriately. The workforce consequences are real: a 2025 Verkada/Harris Poll study found nearly 40% of healthcare workers had considered leaving their role over safety concerns, and the National Council of State Boards of Nursing recorded 138,000 nurses leaving the workforce since 2022.

Two distinct threats that need two distinct trainings

"Workplace violence" in healthcare covers two genuinely different scenarios that shouldn't be trained identically:

• Patient-and-visitor-originated violence and aggression — the far more common scenario, typically arising from a patient's medical condition, confusion, pain, or distress. This is what de-escalation-focused programmes like PMVA (Prevention and Management of Violence and Aggression) training are built for, and it's the right training for the vast majority of day-to-day incidents reflected in the statistics above.
• Active threat / active shooter scenarios — rarer, but categorically different: an armed or otherwise lethal external threat, where de-escalation isn't the primary response strategy. These require a distinct protocol (commonly the DHS "Run, Hide, Fight" framework), distinct facility planning (lockdown procedures, secure zones, communication systems), and distinct staff training that PMVA-style de-escalation training doesn't cover.

Treating these as one training topic under a single "workplace violence" umbrella under-serves both: staff trained only in de-escalation aren't prepared for an active threat scenario, and active-shooter drills don't teach the everyday de-escalation skills that actually address the bulk of the BLS injury statistics.

No federal rule doesn't mean no obligation

OSHA's general duty clause — the requirement to provide a workplace free of recognised hazards — still applies and has been used as the enforcement basis for workplace violence citations even without a dedicated healthcare-specific federal standard. OSHA has also published non-binding guidelines on the topic since 1996, most recently updated in 2016. Several states aren't waiting for federal action either; California has had a mandatory healthcare-specific workplace violence prevention standard in place since 2017, and Oregon OSHA proposed its own healthcare workplace violence rule in 2026. Employers operating in, or hiring staff who trained in, states with their own standards need to know those requirements independently of what happens federally.

Building a defensible preparedness programme without a federal mandate

• Separate the two training tracks — de-escalation/PMVA-style training for the common scenario, active-threat protocol training for the rare but severe one — rather than a single generic "workplace violence awareness" session.
• Fix the underreporting problem directly. With reporting rates as low as 12% in some studies, a workplace violence programme that only reacts to reported incidents is working from a small fraction of what's actually happening. Make reporting genuinely easy and visibly non-punitive.
• Check your state's specific requirements rather than assuming OSHA's general guidelines are the ceiling — California and states following its lead already have binding, healthcare-specific standards.
• Close the loop after a report. The gap between staff who report an incident and staff who feel it was "handled appropriately" (68% said it wasn't, per ACEP) is itself a retention risk, independent of the incident itself.

Frequently asked questions

Is active shooter training required by federal law for healthcare facilities?
Not under a dedicated federal standard at this time — OSHA's healthcare-specific workplace violence rule is currently in Long-Term Action status with no near-term timeline. Some states impose their own binding requirements independently of federal rulemaking.

Should active shooter training replace de-escalation training, or sit alongside it?
Alongside. They address different threat types and the far more common scenario by volume is patient/visitor-originated aggression, which de-escalation training addresses directly and active-shooter protocols do not.

Why is underreporting such a persistent problem?
Multiple studies point to the same pattern: staff don't report because they don't believe it will be handled well, or view violence as "part of the job." Addressing the reporting culture is as important as the training content itself.

Workplace violence preparedness sits at the intersection of staff safety, retention, and regulatory readiness, and 2026's stalled federal rulemaking means employers can't outsource the decision of what "adequate" looks like. Learnsignal's CPD training library includes workplace safety and violence-prevention training for healthcare organisations building out a complete preparedness programme.