Physical Security: New CA Workplace Law

KPMG Regulatory Insights

• Physical Security Importance: Increasing risk and regulatory attention on physical security as both part of a sound security risk program, as well as part of a sound ethics and compliance program.
• Expansive Application: Nearly all employers operating in the state of California must adopt and implement a Workplace Violence Prevention Plan. Companies should look to consider adopting standards across the company, as appropriate.
• Prescriptive Approach: The new law includes detailed requirements for the content of the Plan, an ongoing incident log, and reporting on hazard identification and correction.
• Operational Impact: New requirements will impact Legal and Compliance in areas such as Code of Conduct, Ethics Hotline, employee training, case management, and change management.

 __________________________________________________________________________________________________________________________________________________

March 2024

Physical security grows as a primary tenet of not only a sound security risk program, but a sound ethics and compliance program. In line with this risk and heightened regulatory and legal attention to this matter, California has codified a new law that will affect nearly all employers.

Beginning July 1, 2024, a new law will go into effect in the state of California that requires nearly all California employers to adopt and implement a Workplace Violence Prevention Plan (hereinafter, Plan) as well as conduct employee training and maintain incident logs. California Senate Bill No. 553 was signed into law in September 2023 and will be enforced by the California Division of Occupational Health and Safety (Cal/OSHA) as of the July 1, 2024, effective date.  

Applicability. The law applies to all employers, employees, places of employment, and employer-provided housing in California with certain exemptions including:

• Employers covered by Cal/OSHA’s Violence Prevention in Health Care regulation (Section 3342 of Title 8 of the California Code of Regulations).
• The Department of Corrections and Rehabilitation and certain law enforcement agencies.
• Employees teleworking from a place of the employee’s choice and not under the control of the employer.
• Places of employment that have fewer than 10 employees working at any given time and are not accessible to the public.

Definition. For purposes of the law, “Workplace Violence” is defined as any act of violence or threat of violence that occurs in a place of employment including but not limited to:

• The threat or use of physical force against an employee that results in, or has a high likelihood of resulting in, injury, psychological trauma, or stress, regardless of whether the employee sustains an injury.
• An incident involving a threat or use of a firearm or other dangerous weapon, including the use of common objects as weapons, regardless of whether the employee sustains an injury.
• Four types of workplace violence:
  • Type 1: workplace violence committed by a person who has no legitimate business at the worksite and includes violent acts by anyone who enters the workplace or approaches workers with the intent to commit a crime.
  • Type 2: workplace violence directed at employees by customers, clients, patients, students, inmates, or visitors.
  • Type 3: workplace violence against an employee by a present or former employee, supervisor, or manager.
  • Type 4: workplace violence committed in the workplace by a person who does not work there but has or is known to have had a personal relationship with an employee.

Requirements. The new law focuses on providing physical protection for employees and thereby requires “covered” California employers to:

• Establish, implement, and maintain an effective workplace violence prevention plan that details specific information, including procedures for:
  • Identifying the individuals responsible for implementing and maintaining the Plan.
  • Involving employees in developing, implementing, and reviewing the Plan. 
  • Coordinating implementation of the Plan with other employers, as applicable.
  • Accepting and responding to reports of workplace violence and prohibiting retaliation against employees who make reports of workplace violence.
  • Responding to actual or potential workplace violence.
  • Developing and providing training.
  • Compliance with the Plan. 
  • Communicating with employees regarding workplace violence matters.
  • Effecting post-incident response and investigation.
  • Reviewing the effectiveness of the Plan and revising the Plan as needed.
• Maintain a workplace violence incident log for all incidents (including information as required by the law).
• Train employees, at least annually, on the Plan, including how to report workplace violence, how to seek assistance to prevent violence, and strategies to avoid physical harm.
• Maintain records of workplace violence hazard identification, evaluation, and correction.

Further, under provisions of this law, employers are permitted to seek a temporary restraining order on behalf of the employees that have suffered harassment, violence, or threat of violence at the workplace.

Compliance Dates. The law becomes effective July 1, 2024, and covered employers are required to have a Plan in place as of that date. The law further requires Cal/OSHA to propose standards regarding the workplace violence prevention plan no later than December 1, 2025, and to adopt standards regarding a Plan no later than December 31, 2026. Recently, Cal/OSHA published a model workplace violence prevention plan which entails required information necessary for “general industry” employers to comply with the requirements set forth by the new law.