Virginia Healthcare Workplace Violence Compliance

Virginia’s workplace violence legislative story has moved fast and in two directions at once. In March 2025, Governor Youngkin vetoed the general industry mandate that would have covered all Virginia employers with 100 or more employees. On the same day, he signed two healthcare-specific bills into law. Virginia healthcare employers who followed the veto news and concluded there was nothing to do missed the story entirely.

The healthcare mandate is in effect. The requirements are expanding. A second compliance deadline arrives in less than two months. And Virginia now has a new governor — Abigail Spanberger — who signed additional workplace violence legislation on April 6, 2026, reinforcing that the legislative direction in Virginia is not reversing under the new administration.

This article covers what Virginia hospitals are required to do, what the approaching July 2026 deadline means, what the April 2026 legislation adds, and what the 2027 general industry outlook means for non-healthcare Virginia employers watching the trajectory.

What HB 2269 and SB 1162 Actually Require

House Bill 2269 and its companion Senate Bill 1162 were signed by Governor Youngkin on March 24, 2025, and took effect July 1, 2025. They amend Virginia Code § 32.1-127 to require Virginia hospitals to establish and maintain a workplace violence incident reporting system.

The law’s requirements are more substantive than the headline “reporting system” language suggests. Covered hospitals must:

• Establish a workplace violence incident reporting system that documents, tracks, and analyzes any incident of workplace violence voluntarily reported by employees. The system must capture the type of violent act, the date, time, and location of the incident, whether the person committing the act was a patient, visitor, co-worker, supervisor, or other person, and the nature of any resulting injury.
• Report data internally on a quarterly basisto the hospital’s chief medical officer and chief nursing officer. Internal reporting is not optional — it is a statutory requirement, and it creates the same governing body knowledge problem that makes annual reporting requirements consequential in Texas and Ohio: once leadership has received the quarterly data, documented awareness of patterns without corrective action becomes evidence.
• Use the analysis to make improvementsin preventing workplace violence. The law specifically requires that the system’s findings be used to make improvements, including continuing education in targeted areas such as de-escalation, risk identification, and violence prevention planning. Data collection without corrective action does not satisfy this requirement.
• Adopt anti-retaliation protections for employees who report incidents or seek assistance in connection with workplace violence. The prohibition on discrimination or retaliation against reporting employees is explicit.
• Establish a security plan based on a risk assessment for every hospital with an emergency department, with associated training requirements. This requirement predates HB 2269 but is now reinforced and expanded by the 2025 and 2026 legislation.

Importantly, the law’s definition of “employee” is broad. It includes any employee of the hospital and any healthcare provider credentialed by the hospital or engaged by the hospital to perform healthcare services on the premises — meaning contracted clinical staff, credentialed physicians, and on-site vendor personnel are covered, not just direct hospital employees.

The July 1, 2026 Deadline: Annual VDH Reporting

The initial compliance deadline — establishing the reporting system and beginning internal quarterly reports — was July 1, 2025. That deadline has passed.

The next deadline is approaching: beginning July 1, 2026, Virginia hospitals must submit annual reports to the Virginia Department of Health containing de-identified and aggregated data on workplace violence incidents. The detailed content and format requirements for this report are being established by the State Board of Health through a stakeholder workgroup process.

For hospitals that have not yet built a functioning reporting system — or that built one but have not been conducting meaningful quarterly analysis — July 1, 2026 is the more consequential deadline. The VDH annual report requires data that can only come from a system that has been operating continuously since July 2025. A hospital that scrambles to implement a reporting system in June 2026 will not have eleven months of data to report.

April 2026: HB 1489 and the Expanding Requirements

On April 6, 2026, Governor Abigail Spanberger — Virginia’s new governor, who took office in January 2026 — signed House Bill 1489, which expands and clarifies workplace violence reporting requirements for hospitals with emergency departments. This legislation is already in effect.

HB 1489 represents Virginia’s second significant legislative action on healthcare workplace violence in thirteen months. Key additions:

• Public aggregated data reporting.The Virginia Department of Health is now required to publish an annual summary of aggregated workplace violence data by health planning region. The first public report is due by December 31, 2027. This creates institutional accountability beyond the hospital level — regional patterns will be visible to the public, to regulators, and to plaintiffs’ attorneys.
• Confidentiality protections reinforced. Facility-level data and information submitted to the Virginia Department of Health under this law is confidential and exempt from disclosure under the Virginia Freedom of Information Act. This protects hospitals from having their specific incident data surfaced in litigation through FOIA requests — an important distinction from states where regulatory filings are public records.
• Board of Health regulations by January 2027.The Board of Health is directed to promulgate implementing regulations by January 1, 2027. Those regulations will define the specific data elements, formats, and submission procedures for VDH reporting — details that hospitals currently building their reporting infrastructure need to track.

HB 1489 was one of a wave of Virginia workplace violence bills in 2026. Additional legislation — including SB 535, HB 1522, HB 1318, SB 738, and SB 291 — passed both houses of the General Assembly in early 2026, further amending and clarifying the requirements of Virginia Code § 32.1-127. The cumulative effect is that Virginia’s hospital workplace violence compliance framework is becoming substantially more detailed and more demanding with each legislative session.

The General Industry Outlook: What’s Coming for Non-Healthcare Employers

The general industry mandate — House Bill 1919, which would have required all Virginia employers with 100 or more employees to maintain a written workplace violence prevention policy by January 1, 2027 — was vetoed by Governor Youngkin in March 2025. His stated rationale: workplace violence is a criminal matter, not a regulatory one, and existing VOSH authority is sufficient.

That veto does not represent a permanent policy position by the Commonwealth. Governor Youngkin was term-limited and left office in January 2026. Governor Spanberger’s signature on HB 1489 within her first months in office signals a legislative posture that is clearly more receptive to workplace safety mandates than her predecessor’s.

House Bill 1620, which survived the 2025 session, directed the Virginia Department of Labor and Industry to convene a workgroup evaluating the prevalence of workplace violence in Virginia. That workgroup’s report is due to the General Assembly by December 1, 2026 — precisely timed to inform the 2027 legislative session. A workgroup report documenting the scope of the problem, combined with a new administration already demonstrating willingness to act, makes a 2027 general industry mandate highly probable.

For Virginia employers outside healthcare, the practical implication is straightforward: the organizations that build voluntary programs now — before the mandate exists — will manage the 2027 legislative requirement as an update to an existing program. Those that wait will be building from scratch on a deadline, at elevated cost, without the institutional knowledge that comes from having operated a program through at least one annual review cycle. The full Virginia compliance guide covers both the healthcare mandate and the general industry trajectory in detail.

How Virginia Compares to Other State Healthcare Mandates

Virginia’s healthcare mandate is narrower in scope than Texas SB 240 — which after SB 463 covers eight facility types including nursing facilities, ambulatory surgery centers, freestanding EDs, psychiatric hospitals, limited-services rural hospitals, and HCSSAs (home health and hospice) — and than California SB-553 — which covers all industries. Virginia currently covers hospitals and facilities with emergency departments. But its trajectory is toward expanded coverage, and its recent legislative activity is among the most rapid of any state in the country.

The distinguishing feature of Virginia’s approach is the public data reporting requirement established by HB 1489. California has the Violent Incident Log, which is a facility-level internal document. Ohio HB 452 has the attestation through the ODH Juvare platform. Virginia will have regional public reporting — aggregated and de-identified at the facility level, but visible to the public at the regional level by December 2027. That regional visibility creates a form of competitive and reputational accountability that facility-level compliance metrics do not.

For health systems operating across multiple states, Virginia’s requirements are best managed as part of a coordinated multi-state framework. The shared architectural foundation — written prevention plan, risk assessment, incident reporting, training, anti-retaliation — is consistent across all active mandates. Virginia’s specific additions — the reporting system design, the quarterly CMO/CNO reports, the VDH annual submission, and the confidentiality framework — are configurations on that foundation, not a separate program. See our national healthcare compliance guide for a full picture of the state mandate landscape.

What Virginia Hospitals Should Do Now

• Verify your reporting system is functioning. The system required by HB 2269 must document, track, and analyze incidents. A system that merely collects incident reports without analysis does not satisfy the statutory requirement. The analysis must be demonstrably used to make improvements.
• Confirm quarterly CMO/CNO reporting is occurring. Internal quarterly reporting is a statutory requirement. If it has not been happening since July 2025, the gap in the reporting record needs to be addressed before the July 2026 VDH submission.
• Begin preparing for the July 2026 VDH annual report. The Board of Health regulations defining the exact requirements are not yet final, but hospitals should be aggregating and de-identifying the data they have been collecting since July 2025 in anticipation of the submission format. Monitor VDH communications as regulations are promulgated.
• Review your security plan currency. HB 1489 and the 2026 legislation reinforce the security plan requirement for hospitals with emergency departments. If the plan was built in 2023 or 2024 and has not been reviewed against the current legislative requirements, it needs reassessment.
• Track the Board of Health regulations. The regulations implementing HB 1489 are due by January 2027. Those regulations will define the specific data elements and submission formats for VDH reporting. Hospital compliance and legal teams should be monitoring VDH rulemaking activity beginning in summer 2026.

Primary Sources

The current text of Virginia’s hospital workplace violence requirements is codified at Virginia Code § 32.1-127. The Virginia Department of Health will publish the reporting format and requirements as Board of Health regulations are promulgated. The Virginia Hospital and Healthcare Association is tracking the implementation of HB 1489 and the Board of Health rulemaking process and is the primary member resource for Virginia hospitals navigating these requirements.

The original HB 2269 analysis and the broader legislative context for Virginia’s workplace violence trajectory are covered in our companion article: Virginia’s Workplace Violence Law: What Passed, What Got Vetoed, and What’s Coming Next.