California SB 553: the workplace violence prevention plan, the log and the checks behind them

01

What SB 553 and Labor Code 6401.9 require

Senate Bill 553 was signed on September 30, 2023. It amended Labor Code section 6401.7 and added California Labor Code section 6401.9, which became operative on July 1, 2024. Its central duty is short: "An employer shall establish, implement, and maintain an effective workplace violence prevention plan." The plan must be in writing, "available and easily accessible to employees", and "in effect at all times and in all work areas".

The section defines workplace violence as "any act of violence or threat of violence that occurs in a place of employment", and it does not include lawful acts of self-defense or defense of others. A threat of violence is any verbal or written statement, including texts and social media messages, or any behavioral or physical conduct, that conveys or is reasonably perceived to convey an intent to cause physical harm or to place someone in fear of physical harm, and that serves no legitimate purpose. The law then sorts incidents into four types, which the log records:

• Type 1: violence by a person who has no legitimate business at the worksite, including violent acts by anyone who enters the workplace or approaches workers with the intent to commit a crime.
• Type 2: violence directed at employees by customers, clients, patients, students, inmates or visitors.
• Type 3: violence against an employee by a present or former employee, supervisor or manager.
• Type 4: violence in the workplace by a person who does not work there but has, or is known to have had, a personal relationship with an employee.

For security and janitorial teams, Types 1 and 2 are the everyday ones: the trespasser in a garage at night, the shopper who shoves a day porter.

02

Who is covered, and who is not

The section applies to employers, employees, places of employment and employer-provided housing in California, with a short list of exceptions in subsection (b). According to the statute, it does not apply to:

• health care facilities, service categories and operations covered by Cal/OSHA's separate workplace violence prevention in health care standard, title 8 section 3342, and employers that comply with section 3342;
• facilities operated by the Department of Corrections and Rehabilitation, if in compliance with section 3203;
• law enforcement agencies that meet the conditions set out in the statute;
• employees teleworking from a location of their choice that is not under the employer's control;
• places of employment where there are "less than 10 employees working at the place at any given time" and that are not accessible to the public, if the places are in compliance with section 3203.

Read the last exception carefully. It is not a small-business exemption. A small office that is closed to the public may qualify; a small retail store, clinic, bank branch or apartment leasing office that the public can walk into does not, however few people work there. Cal/OSHA can also order an otherwise exempt employer, by an order to take special action, to comply with the section.

Where more than one employer works at the same place, the plan must include "methods to coordinate implementation of the plan with other employers, when applicable". Contract security, the after-hours janitorial contractor and the property manager each owe the duty to their own employees, so agree in writing, in each plan and in the post orders, how a threat reported to a custodian reaches the security team and each employer's log. At a multiemployer worksite, the employer whose employees experienced the incident records it in its log and must also give a copy of that log to the controlling employer.

03

What the written plan must contain

The plan may be "a stand-alone section in the written injury and illness prevention program" required by title 8 section 3203, the Injury and Illness Prevention Program, or a separate document. Either way, Cal/OSHA's FAQ says it must be "specific to the hazards and corrective measures for each work area and operation". A company that provides officers or custodians to twenty sites cannot rely on one generic plan that describes none of them. Cal/OSHA's Workplace Violence Prevention for General Industry page offers a model written plan as a starting point.

Labor Code 6401.9(c) lists what the plan must include. In summary:

1. The names or job titles of the people responsible for implementing it.
2. Effective procedures for employee involvement in developing and implementing the plan, including identifying and correcting hazards, designing training, and reporting and investigating incidents.
3. Methods to coordinate with other employers at the same place.
4. Procedures to accept and respond to reports of workplace violence, and to prohibit retaliation against an employee who makes one.
5. Procedures to ensure that supervisors and employees comply with the plan.
6. Procedures to communicate with employees, including "how an employee can report a violent incident, threat, or other workplace violence concern to the employer or law enforcement without fear of reprisal", and how concerns will be investigated and employees told the result.
7. Emergency response procedures: "effective means to alert employees of the presence, location, and nature of workplace violence emergencies", evacuation or sheltering plans that fit the worksite, and how to obtain help from staff assigned to respond, security personnel and law enforcement.
8. Training procedures, covered below.
9. Procedures to identify and evaluate hazards, including scheduled periodic inspections.
10. Procedures to correct hazards "in a timely manner", consistent with section 3203.
11. Procedures for post-incident response and investigation.
12. Procedures to review the plan's effectiveness and revise it: at least annually, when a deficiency is observed or becomes apparent, and after a workplace violence incident.

A plan can have every heading and still fail if the reporting route, the inspections and the corrections (items 4, 6, 9 and 10) exist on paper and nowhere else.

04

The violent incident log: what goes in it

"The employer shall record information in a violent incident log for every workplace violence incident." Cal/OSHA's Workplace Violence Prevention in General Industry fact sheet for employers (June 2024) makes the point directly: the log covers "all incidents of workplace violence even if the incident did not result in injury". Threats count.

The statute says the information in the log "shall be based on information solicited from the employees who experienced the workplace violence, on witness statements, and on investigation findings". Each entry must include at least:

• the date, time and location of the incident;
• the workplace violence type or types (1, 2, 3 or 4);
• a detailed description of the incident;
• a classification of who committed the violence: in the statute's words, "a client or customer, family or friend of a client or customer, stranger with criminal intent, coworker, supervisor or manager, partner or spouse, parent or relative, or other perpetrator";
• the circumstances at the time, such as whether the employee was completing usual job duties, working in "poorly lit areas", rushed, working during a "low staffing level", "isolated or alone", unable to get help, or in an unfamiliar or new location;
• where it happened: the workplace, a "parking lot or other area outside the workplace", or another area;
• the type of incident: a physical attack without a weapon (including pushing, grabbing or spitting), an attack with a weapon or object, a threat of physical force or of the use of a weapon or other object, a sexual assault or threat, an animal attack, or other;
• the consequences, including whether security or law enforcement was contacted and their response, and the actions taken to protect employees from a continuing threat or other hazards;
• the name and job title of the person who completed the entry, and the date it was completed.

Personal identifying information that would identify any person involved in a violent incident must be left out of the log. The FAQ confirms that "employers may develop their own violent incident log, as long as the information recorded in the log complies with the requirements listed in LC 6401.9 (d)(2)".

Look again at the circumstances field. Poor lighting, working alone and short staffing are the conditions a facility or security team can see and change. A log that also says the garage lights had been out for a week, and when that was first reported, tells the reader what to fix.

05

Hazard inspections, training and how long records are kept

Inspections. The plan's hazard identification procedures must include "scheduled periodic inspections", and inspections are also required "when the plan is first established, after each workplace violence incident, and whenever the employer is made aware of a new or previously unrecognized hazard". The law does not set the interval for the periodic ones; the plan does. The statute does not use the words risk assessment, but these inspections, with the required evaluation of the hazards they find, do that job, and they are repeated rather than done once. In a building, walk what the log's circumstances field asks about: lighting in parking lots, garages and stairwells; doors that should close and latch; places where one person works alone; and the means of calling for help.

Correction. A hazard found must be corrected "in a timely manner". Section 3203(a)(6) asks for correction based on the severity of the hazard, and where an imminent hazard cannot be abated without endangering people, removing exposed employees from the area except those needed to correct it.

Training. Employees must be trained when the plan is first established and annually after that, with "training material appropriate in content and vocabulary to the educational level, literacy, and language of employees". Training covers the plan, how to get a copy at no cost and how to take part in it; the definitions and requirements of section 6401.9; how to report incidents or concerns without fear of reprisal; job-specific hazards, the corrective measures in place, how to seek assistance to prevent or respond to violence, and strategies to avoid physical harm; the violent incident log and how to obtain records; and an opportunity for interactive questions and answers with someone who knows the plan. Additional training is required when a new or previously unrecognized hazard is identified or the plan changes.

Records. According to section 6401.9(f):

• records of workplace violence hazard identification, evaluation and correction: at least five years;
• training records: at least one year, including the dates, a summary of the content, the names and qualifications of the trainers, and the names and job titles of everyone who attended;
• violent incident logs: at least five years;
• records of workplace violence incident investigations: at least five years, and they must not contain medical information.

Hazard identification, evaluation and correction records, training records and violent incident logs must be made available to employees and their representatives, upon request and without cost, for examination and copying "within 15 calendar days of a request". All four kinds of record must be made available to Cal/OSHA on request.

06

Where the record fails, and what SiteClara does about it

Plans rarely fail on paper. They fail in the parking garage at 11 p.m. A custodian tells the night officer that a man in the stairwell shouted at her; it is mentioned at pass-down and never written down. The broken light on level 3 was reported three times to whoever was at the lobby desk, and each time the report stopped there. When an officer is finally assaulted, the violent incident log has one entry, and the questions it asks, about lighting, staffing and working alone, can only be answered from memory.

SiteClara works on that everyday layer: the checks and reports in the building that the plan depends on. A printed QR poster goes at each location, such as a garage level, a stairwell, a loading dock or a side entrance, with an optional NFC tag behind it. Staff scan the code or tap the tag on their own phone, with no app to install, and sign in with a link. They see the checks due at that location, such as lights working, door latched or area clear, and mark each one done, or say what stopped them. A problem, such as a light out, a door propped open or a broken lock, is reported there with a photo and goes onto the team's list of jobs until someone closes it.

The supervisor sees what is due, done and missed, and can record why a check was missed; a job that needs the building manager can be escalated to them to answer. Each day the supervisor reviews and approves a report that goes to nominated management or client contacts at 8 a.m. the next morning, showing what was reported, completed and still open, and how the scheduled checks went. When an investigation asks when a hazard was first reported and what happened to it, that record answers with dates and names.

07

Questions people ask

Who is not covered under SB 553?

Subsection (b) of California Labor Code section 6401.9 leaves out health care facilities and operations covered by Cal/OSHA's health care standard, title 8 section 3342, and employers that comply with it; Department of Corrections and Rehabilitation facilities in compliance with section 3203; law enforcement agencies that meet the statute's conditions; employees teleworking from a location of their choice that is not under the employer's control; and places of employment with "less than 10 employees working at the place at any given time" that are not accessible to the public, if the places are in compliance with section 3203. Cal/OSHA can still order an exempt employer to comply.

What are considered threats under SB 553?

California Labor Code section 6401.9 defines a threat of violence as "any verbal or written statement, including, but not limited to, texts, electronic messages, social media messages, or other online posts, or any behavioral or physical conduct, that conveys an intent, or that is reasonably perceived to convey an intent, to cause physical harm or to place someone in fear of physical harm, and that serves no legitimate purpose." A threat is workplace violence in its own right, so it goes in the violent incident log even when nobody is hurt.

What information must be included in an SB 553 incident log?

Under subsection (d) of California Labor Code section 6401.9, each entry records at least the date, time and location; the workplace violence type; a detailed description; who committed the violence; the circumstances at the time; where it happened; the type of incident; the consequences, including whether security or law enforcement was contacted; and the name and job title of the person who completed the entry, with the date. The log must leave out "any element of personal identifying information sufficient to allow identification of any person involved in a violent incident". The full list is in the log section above.

What does SB 553 primarily expand?

Mainly the duties of California employers: under California Labor Code section 6401.9, most employers must now keep a written workplace violence prevention plan, a violent incident log, and hazard and training records. The text of Senate Bill 553 (2023) also amended Code of Civil Procedure section 527.8 so that, from January 1, 2025, a collective bargaining representative of an employee who has suffered unlawful violence or a credible threat of violence, as well as the employer, may seek a workplace violence restraining order. Before filing, the employer or representative must give the employee "an opportunity to decline to be named in the temporary restraining order."

08

Where to read more, and a list to take away

Start with the statute itself, California Labor Code section 6401.9. Cal/OSHA's Workplace Violence Prevention for General Industry page has the model plan and the fact sheets for employers and workers, and the Workplace Violence Prevention in General Industry FAQ answers common questions about the log and the plan. Follow the rulemaking for title 8 section 3343 on the advisory meetings page, and read title 8 section 3203 alongside the plan if you keep it inside your IIPP.

Before your next annual review, check that:

• each site's plan names the people responsible and describes that site's own hazards and corrective measures;
• contractors and host employers at shared sites have agreed how reports and incidents pass between them;
• every employee, on every shift, knows how to report a threat or concern and that retaliation is prohibited;
• every incident, including threats and incidents with no injury, has a log entry with all the required fields and no personal identifying information;
• scheduled hazard inspections happen at the planned interval and after every incident, and what they found is recorded;
• each hazard found has an owner and a date, and someone checks it was corrected;
• hazard, log and investigation records go back five years and training records one year; hazard, training and log records can be produced to employees within 15 calendar days, and all of them to Cal/OSHA on request;
• the plan has been reviewed within the last year and after the last incident, and still matches what happens on site.