Skip to main content
    QHSEtech
    Updated 22 September 2026
    Software Guide · Reviewed 22 September 2026

    Workplace violence prevention: the log and the clock

    California Labor Code section 6401.9 separates the prevention plan, violent incident log, hazard/correction records, training records and investigation files. Evaluate their required contents, retention and access separately. An employee’s right to obtain specified records within 15 calendar days is not blanket access to the investigation file.

    Jump to the 7 products

    Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn · Content date: 22 September 2026

    On this page (7 sections)

    What is actually required, and where

    SB 553 was signed in September 2023 and the resulting Labor Code section became effective and enforceable on 1 July 2024. Covered California employers must establish, implement and maintain an effective written workplace violence prevention plan naming who is responsible for it, maintain a violent incident log informed by investigation findings and retain separate investigation records, review the plan annually, and train employees — including on how to report an incident without fear of retaliation. Cal/OSHA: workplace violence prevention guidance and resources; Cal/OSHA: workplace violence prevention for general industry; California Labor Code section 6401.9

    Outside California, determine the applicable requirements separately. Federal OSHA addresses workplace violence through guidance and the general duty clause rather than a dedicated standard, and several states have their own healthcare-specific rules. In Great Britain, violence and aggression at work is managed under general health and safety duties with HSE guidance. Do not assume California’s record rules apply elsewhere; map each operation to its own requirements. US OSHA: workplace violence; Great Britain HSE: violence and aggression at work

    So evaluate on three concrete things rather than on a feature list: whether the log captures what the statute asks for, whether the retention and production clocks are actually enforced, and whether a worker can report an incident in a way that is protected from the person they are reporting about. Everything else is secondary.

    Three obligations software either meets or does not

    The violent incident log

    Under section 6401.9(d), the incident log must omit personal information that could identify people involved. Retain it for at least five years. Test required fields, a qualifying threat without injury, correction history and the separate investigation file.

    Production within 15 days

    Section 6401.9(f)(6) gives employees and representatives access to hazard/correction records, training records and incident logs within 15 calendar days, without cost. Investigation files have a different access boundary; test the correct export and record the request and delivery.

    Reporting without retaliation

    Employees must be told how to report without fear of retaliation. That is an access-control question: confirm a report can be routed away from the person it concerns, as with a whistleblowing channel.

    The demonstration: request the records and start a stopwatch

    1

    Log a threat that caused no injury

    Most incident systems are built around injuries. Establish that a threat, verbal abuse or an incident with no physical harm can be recorded as a first-class entry rather than squeezed into a near-miss form.

    2

    Attach the post-incident investigation

    Link the investigation to the incident while retaining separate permissions. Section 6401.9(f)(4) requires at least five years and excludes medical information as defined there; do not attach the restricted file to the employee log export.

    3

    Report an incident involving a supervisor

    Establish whether the report can be routed away from that person, who can see it, and whether anyone can grant themselves access. This is the retaliation protection in practice.

    4

    Request the records as an employee

    Request hazard/correction records, training records and the incident log using an employee role. Verify the log omits identifying personal information, the investigation remains restricted, and delivery is recorded within the applicable deadline without cost.

    5

    Try to edit a closed entry

    Change a historic log entry and establish whether the original is retained and the change attributed. A log that can be quietly rewritten is not a record.

    Documented duress or violence-related capabilities

    The rule below identifies a scoped response capability. An alert or panic button does not establish a compliant prevention plan, incident log, investigation file or record-production process. Test those requirements separately, including the distinct products and modules in the quote. Most cards are admitted by a panic or duress alert; only a minority name a record of violent incidents, which is the part the incident-log obligation depends on, so check the capability printed on each card before treating it as a log.

    Ordered by how closely our sources document this process, not by quality. Sponsored placements are labelled. How lists are ordered

    Same rule for every product: tagged “Emergency Response”, “Emergency Management”, “Mass Notification”, “Lone Worker Safety”, “Safety Management” or “Workplace Violence Prevention” or assigned primary category “Lone Worker Safety”, with a sourced duress alert or workplace-violence capability in its record, or one the vendor stated to us, labelled as vendor-stated. 7 qualify.

    Questions that separate candidates

    Can a threat with no injury be logged as a first-class entry?
    Is the investigation linked but kept under separate access and retention controls?
    Can retention distinguish at least five years for hazards, logs and investigations from at least one year for training?
    Can a closed log entry be edited, and is the original retained?
    How long does record production actually take, end to end?
    Can an employee receive the required records without exposing a restricted investigation or identifying information in the log?
    Can a report be routed away from the person it concerns?
    Can anyone grant themselves access to a restricted case, and is that logged?
    Are training records retained and produced on the same clock?
    Does the annual plan review generate a dated record?

    Sources and evaluation limits

    5 sources

    California: Cal/OSHA: workplace violence prevention guidance and resources; Cal/OSHA: workplace violence prevention for general industry; California Labor Code section 6401.9. Federal and Great Britain: US OSHA: workplace violence; Great Britain HSE: violence and aggression at work. Original source review: 22 September 2026. The California statute and agency guidance were rechecked on 27 September 2026 for record classes, privacy, retention and access.

    Section 6401.9(f) requires at least five years for hazard identification, evaluation and correction records, incident logs and investigation records, and at least one year for training records. Cal/OSHA can request all four classes; the employee-access provision names the first three, excluding investigation files. California Labor Code section 6401.9

    Nothing here is legal advice, and whether you are a covered employer, and under which rules, is a determination for the people accountable for it. Healthcare settings have separate requirements in California and in several other states, which this page does not cover. Confirm the operative text rather than relying on this summary.

    The listed capabilities do not establish an end-to-end workplace violence prevention system. This page ranks nothing and tests nothing hands-on. We publish no figures on incidence or on the effect of any programme, because we have not measured them and have not verified published figures worth repeating.

    Related Guides

    Whistleblower Management SoftwareIncident Management SoftwareLone Worker Safety SoftwareEmergency Response SoftwareTraining Management SoftwarePolicy Management Software

    More related guides

    Frequently Asked Questions

    Who does California SB 553 cover?
    Broadly, California employers in general industry, with some exclusions, under Labor Code section 6401.9, effective and enforceable from 1 July 2024. Healthcare settings are subject to separate requirements. Whether you are covered is a legal determination rather than a software question — confirm it with the people accountable before scoping a platform around it.
    What is a violent incident log?
    The log records each covered incident using information from employees, witnesses and investigation findings, while omitting identifying personal information as required by section 6401.9(d). Keep the log for at least five years and distinguish it from the separately retained investigation file. Test a qualifying threat without injury and a privacy-preserving export.
    Why does the 15-day rule matter for software selection?
    Because it converts a filing problem into a retrieval problem. Records of hazard identification, training and the violent incident log must be made available to an employee or their representative, free of charge, within 15 calendar days of a request. Test end-to-end retrieval and delivery, including any manual work, without including investigation files in the employee export solely because they are linked to the same incident.
    Can we use our existing incident management system?
    Possibly, and it is worth testing rather than assuming either way. The questions are whether a non-injury threat is a first-class record, whether retention is enforced rather than advisory, whether a report can be routed away from the person it concerns, and whether you can produce the records quickly. If your incident tool does all four, a separate purchase may be unnecessary.
    What applies outside California?
    Confirm each jurisdiction and activity separately. Federal OSHA addresses workplace violence through guidance and the general duty clause rather than a dedicated standard, several states have healthcare-specific rules, and Great Britain manages violence and aggression under general health and safety duties. California’s specific record and access rules should not be treated as universal.