Healthcare professionals working in hospitals and other settings face heightened risks of workplace violence, often from behaviorally unstable and volatile patients or visitors. A new law signed by Governor Youngkin at the conclusion of the most recent session of the Virginia General Assembly aims to address workplace violence risks by amending Virginia Code § 32.1-127 to require tracking and reporting of workplace violence incidents in certain healthcare facilities. HB2269 - 2025 Regular Session | LIS
The new law requires “hospitals” (as defined below) to establish a workplace violence reporting system to document, track, and analyze incidents of workplace violence, with the goal of improving prevention of such instances. Broadly speaking, covered healthcare employers must implement the following requirements:
- Implement a new reporting system that tracks incidents of workplace violence voluntarily reported by employees with reports to a facility’s chief medical officer and chief nursing officer, at a minimum
- Analyze collected data to make improvements in preventing workplace violence, including improvements achieved through continuing education in targeted areas, including de-escalation training, risk identification, and violence prevention planning
- Notify all employees of the system and provide guidelines on when and how to voluntarily report incidents of workplace violence
- Implement a policy prohibiting discrimination or retaliation against any employee for reporting incidents of workplace violence
- Following the development of governing regulations and beginning July 1, 2026, send annual reports to the Virginia Department of Health containing de-identified and aggregated data of workplace violence incidents
What healthcare facilities are covered?
While the law uses the term “hospital,” it’s important to understand that the definition under current Virginia law includes a broad array of healthcare settings:
"Hospital" means any facility licensed pursuant to this article in which the primary function is the provision of diagnosis, of treatment, and of medical and nursing services, surgical or nonsurgical, for two or more nonrelated individuals, including hospitals known by varying nomenclature or designation such as children's hospitals, sanatoriums, sanitariums and general, acute, rehabilitation, chronic disease, short-term, long-term, outpatient surgical, and inpatient or outpatient maternity hospitals. § 32.1-123. Definitions
That means long-term care hospitals, outpatient surgical centers, and specialty care facilities are all on the hook—not just acute care hospitals.
Who is an “Employee”?
The law also casts a wide net when it comes to who is protected. Covered individuals include:
- Hospital employees
- Credentialed providers
- Contracted or agency staff
- Any other individuals performing healthcare services on-site
In short: if an individual is working in a facility that meets the definition of a hospital, they are covered—whether they are on the payroll or not.
What is meant by “Workplace Violence”?
The law defines “workplace violence” broadly as any act or threat of violence against an “employee: while performing duties on premises. This includes physical attacks with or without weapons, threats of force, sexual assaults or threats, psychological intimidation causing stress or trauma, or any other incident involving the threat of using dangerous weapons or using common objects as weapons or to cause physical harm.
Importantly, violations are reportable whether physical injury occurs or not. The intent of the perpetrator isn’t required — the focus is on actual or threatened harm.
What information must be collected and retained?
Covered healthcare employers must institute a detailed incident reporting system that records each workplace violence incident voluntarily reported and when alleged. Each incident record must include, at minimum, the following elements:
- Date/time of incident
- Description, including job titles of affected staff
- Identity of perpetrator (patient, visitor, employee, other)
- Location within facility
- Type of incident (categorized as defined in the law)
- Response actions taken, including security or law enforcement involvement and policy changes
- Information about the individual who completed the report
How is the collected data used?
At a minimum, the law requires that the data collected be reported to the chief medical officer and the chief nursing officer of the hospital on a quarterly basis. Beginning July 1, 2026, hospitals must submit an annual report to the Virginia Department of Health, stating the total number of voluntarily reported workplace-violence incidents. Detailed content and rules for this report will be established by the State Board of Health in response to the efforts of a new stakeholder work group
What should covered healthcare facilities do now?
Healthcare facilities covered by the new law should take immediate steps to implement the new law, including, but not limited, to the following:
- Review and update existing workplace violence prevention and reporting policies and procedures to meet the requirements of the new law
- Communicate workplace violence and safety policies and the reporting process to all employees, via special announcements and updates to employee handbooks and employee training
- Ensure that contractors and other staff who perform healthcare-related services on the premises are aware of the applicable reporting requirements
- Implement processes and assign appropriate leadership staff to oversee the collection and reporting of data as required by the law
- Set up systems to analyze the data in efforts to implement additional steps to prevent workplace violence
- Keep abreast of regulatory changes that may result from the work of the new stakeholder work group, including regulations implementing the reporting requirements
