Virginia Workplace Violence Laws — 2026 Update

In March 2025, Virginia’s workplace violence prevention legislative trajectory looked stuck. Governor Glenn Youngkin had just signed two healthcare-specific bills — HB 2269 and its Senate companion SB 1162 — establishing the Commonwealth’s first hospital workplace violence prevention requirements. The same day, March 24, 2025, he vetoed HB 1919, which would have extended a general industry mandate to all Virginia employers with 100 or more workers. HB 1620, a companion bill that would have convened a Department of Labor and Industry workgroup to study the prevalence of workplace violence in the Commonwealth, had already been tabled in House Rules in January.

The reading at the time was that Virginia’s legislative momentum on workplace violence had peaked. The general industry bill was dead. The healthcare law was modest. The workgroup that might have laid the foundation for a future expansion had been killed in committee. Multiple national legal analyses concluded that, with Youngkin in office through January 2026, no further movement was likely.

That reading was wrong.

In November 2025, former federal law enforcement officer and U.S. Representative Abigail Spanberger was elected the 75th Governor of Virginia and took office on January 11, 2026. The 2026 General Assembly produced a wide-ranging labor and employment package that the new administration largely embraced. On April 6, 2026, Governor Spanberger signed HB 1489 — legislation that materially expands the hospital workplace violence reporting framework established the prior year. A week later, on April 13, she signed an additional set of workplace reforms covering minimum wage, paid sick leave, and public sector collective bargaining.

Virginia’s workplace violence trajectory did not peak in March 2025. It paused. This article maps where the law actually stands now, what HB 1489 changes for hospital employers, and what the rest of Virginia’s employer community should be doing ahead of the 2027 General Assembly session. For the structured compliance reference, see our Virginia compliance guide.

What’s already in effect: the 2025 healthcare baseline

To understand what HB 1489 changes, it helps to see what it builds on. The 2025 baseline — HB 2269 and SB 1162, identical companion bills signed by Governor Youngkin on March 24, 2025, and effective July 1, 2025 — established the Commonwealth’s first dedicated hospital workplace violence framework. Covered hospitals were required to:

• Maintain a workplace violence incident reporting system, available to employees and capable of capturing the type, location, and circumstances of each reported incident.
• Establish a security plan based on a facility-specific risk assessment.
• Adopt anti-retaliation policies protecting any employee who reports an incident or seeks assistance after one.
• Provide workforce training on de-escalation, risk identification, and violence prevention planning.
• Report incident data to the chief medical officer and chief nursing officer at least quarterly.

The 2025 framework also included an annual reporting obligation to the Virginia Department of Health beginning July 1, 2026 — meaning that hospitals were already preparing for their first state-level submission at the moment HB 1489 was being signed.

That timing matters. HB 1489 is not a fresh framework. It is a structural expansion of a system that hospitals were operationalizing in real time, with several provisions specifically designed to address gaps that became visible during the first year of implementation.

What HB 1489 changes

HB 1489 was signed on April 6, 2026 with an effective date of July 1, 2026. It expands the 2025 framework along four specific axes — and each one increases the operational burden on covered hospitals in a meaningful way.

More detailed incident data.Where the 2025 law required hospitals to track incidents at a relatively coarse level, HB 1489 requires the collection of specific incident descriptors and the degree of physical injuries to staff. The Board of Health is directed to promulgate implementing regulations by January 1, 2027 — meaning the precise data fields will be specified in regulation, not statute. Hospitals that built their reporting systems against the 2025 statutory minimum should expect to retrofit those systems before the regulations take effect.

Expanded internal reporting.The 2025 law required quarterly reporting to the chief medical officer and chief nursing officer. HB 1489 expands the list to include the chief of staff, the chief executive officer, and the medical staff executive committee — or equivalent positions where the hospital uses different titles. The expansion has a clear governance logic: workplace violence is no longer being treated as a clinical or nursing issue but as an executive and governance issue, with visibility at the level of the body that ultimately bears responsibility for the safety of the institution.

Aggregated facility-level reporting to the state.Hospitals must submit annual, aggregated facility-level data to the Virginia Department of Health, with all personally identifiable information removed. The statute is explicit that this data is confidential and exempt from disclosure under the Virginia Freedom of Information Act — addressing a specific concern from the 2025 implementation cycle that hospitals were reluctant to report robustly without confidentiality protection. The Department is required to publish an annual public summary, organized by health planning region rather than by individual facility, with the first report due December 31, 2027.

A policy-change attestation.Each annual report must include a statement indicating whether the hospital changed any existing policies in response to workplace violence incidents during the reporting period. This is a small provision with significant operational weight. A hospital that reports incidents but never updates its policies in response is making a statement — under penalty of misrepresentation to a state agency — that none of those incidents were significant enough to warrant a policy review. The provision creates documentary evidence that will be highly relevant in any subsequent litigation involving a workplace violence incident at the facility.

The combined effect of these four provisions is a transition from the 2025 framework as a passive reporting requirement to the 2026 framework as an active feedback loop. Hospitals are no longer simply maintaining records. They are demonstrating institutional learning — or documenting its absence.

The Spanberger pivot

The political environment in which HB 1489 was signed differs fundamentally from the one in which HB 2269 was signed twelve months earlier.

Governor Youngkin’s March 2025 veto of HB 1919 reflected a specific philosophical stance: that workplace violence is primarily a criminal matter rather than a regulatory one, that existing Virginia Occupational Safety and Health authority under the General Duty Clause already covered the hazard, and that imposing a new general industry mandate would burden Virginia employers without commensurate benefit. That view was internally consistent. It was also a legitimate reading of where to draw the line between criminal law, tort law, and regulatory mandate.

Governor Spanberger’s posture is different on each of those three points. As a former federal law enforcement officer who spent her career inside investigative and counterterrorism work at the CIA and the U.S. Postal Inspection Service, she is unlikely to characterize workplace violence as something that exists primarily in the criminal domain — investigative experience tends to produce the opposite view, that the criminal law arrives only after the regulatory and prevention systems have already failed. As a former Member of Congress representing a Virginia district, her record on labor and workplace policy is broadly aligned with the structural framework that produced California’s SB-553 and New York’s Retail Worker Safety Act.

The 2026 General Assembly produced a wide-ranging package of workplace and labor reforms that Spanberger signed on April 13, 2026, including a phased increase of the state minimum wage to $15 per hour by January 1, 2028; expanded paid sick leave covering all employees, not just home healthcare workers; and a framework for public sector collective bargaining. These bills had been blocked or significantly narrowed under the prior administration. Their movement during her first session establishes the Commonwealth’s working theory of the case for the next several years: that workplace standards in Virginia will move toward the structural framework already in place in California, New York, Maryland, and Washington — and that the regulatory tools to do so are appropriate uses of state authority.

That is the political environment in which HB 1919 will likely be reintroduced in the 2027 General Assembly session.

What 2027 will probably look like

Predicting which bills will pass in any given legislative session is a hazardous exercise. But the directional indicators on a Virginia general industry workplace violence mandate are unusually clear.

Demand-side:the same delegates and senators who introduced HB 1919 in 2025 remain in office. The legislative architecture — a 100-employee threshold, a written plan requirement, a reporting mechanism, a risk assessment, anti-retaliation language, and civil penalties up to $1,000 per violation — was not the product of a single session’s work. It reflected several years of stakeholder engagement and represented the considered judgment of a coalition that has not gone away.

Supply-side:the new administration’s first-session record demonstrates that bills which were vetoed under Youngkin are signable under Spanberger if they survive the General Assembly intact. The minimum wage and paid sick leave packages are direct evidence. The HB 1489 signing demonstrates that workplace violence specifically is on the administration’s affirmative agenda, not merely something it would tolerate if forced.

Federal context:the U.S. Congress has reintroduced HR 2531, the Workplace Violence Prevention for Health Care and Social Service Workers Act, in successive sessions without passage. The federal vacuum continues to push state-level legislation. New states — Massachusetts, Pennsylvania, Oregon, Washington — have bills moving in 2026. Virginia in 2027 would be one of multiple states moving in the same direction in the same window.

Operational context:Virginia hospitals that have spent the 2025–2026 cycle building their workplace violence prevention programs under HB 2269 / SB 1162 represent an existing constituency for general industry expansion. Hospital systems with multi-state operations are already building to California and New York standards. The infrastructure for compliance — consultants, training vendors, technology providers — is already in place to serve a Virginia general industry market the moment a mandate exists.

The probability that some version of HB 1919 returns in 2027 is, in our assessment, materially higher than 50%. The probability that it survives the General Assembly is meaningful. The probability that Governor Spanberger signs it if it survives is high. None of these are certainties. The combined probability is high enough that any Virginia employer with 100 or more employees that waits until the law is signed before beginning to build a program will be operating with a compressed compliance window and limited access to qualified advisory capacity.

What hospitals must do now

The HB 1489 implementation cycle is short. The law takes effect July 1, 2026, regulations are due January 1, 2027, and the first annual aggregated submission is due July 1, 2027 with the first public regional report due December 31, 2027. For hospital compliance and risk management leadership, this implies a defined sequence of work over the next eighteen months.

The first step is auditing the existing 2025-vintage incident reporting system against the expanded data field requirements. Most hospitals built systems that satisfied the statutory minimum in 2025. Few systems were built to capture specific incident descriptors and graded injury severity at the level of granularity that the Board of Health regulations are likely to specify. Identifying the gap now — before the regulations are final — provides time for system retrofit without compressing the work into a quarter.

The second step is operationalizing the expanded internal reporting list. The 2025 framework required quarterly reporting to the CMO and CNO. The HB 1489 framework requires the same data to be reported to the chief of staff, the CEO, and the medical staff executive committee. For most hospitals, this is not a technical change — the data exists — but a governance change. Establishing the cadence, format, and review protocol for the expanded executive review cycle is itself a project that requires dedicated planning.

The third step is preparing for the policy-change attestation. Hospitals that experience workplace violence incidents during 2026 will be making a statement on the 2027 annual report about whether those incidents drove any policy revisions. The attestation creates an active documentary record. A hospital that has experienced significant incidents and made no policy changes is creating evidence that any plaintiff’s counsel in a subsequent civil action will use in discovery. The risk-management implication is that hospitals should be reviewing their incident response and policy-update protocols now, with an eye toward the documentation they will produce twelve months from now.

The fourth step is anticipating the public regional report. The first publication, due December 31, 2027, will identify health planning regions with elevated incident rates relative to other regions. Hospitals operating in those regions will face questions from boards, accrediting bodies, and the press about what they are doing differently. Having a substantive, defensible answer requires that the work be underway in 2026, not generated reactively in early 2028.

What general industry employers should do now

For Virginia employers outside the hospital sector, the question is simpler and more strategic. There is no current statutory mandate for general industry workplace violence prevention in Virginia. There is also no safe harbor — Virginia OSHA retains authority to cite under the General Duty Clause, and the tort liability framework for negligent security and workplace violence negligence applies regardless of any specific statute.

The strategic question is whether to build a program now, voluntarily, or to wait until a mandate forces the work.

The case for building now rests on three factors. First, the 2027 mandate probability is sufficiently high that organizations that wait will be doing so under time pressure when the law passes. Compressed compliance windows produce worse programs. Second, organizations that already operate in California, New York, or other mandate states have most of the work done — a Virginia program is a configuration of an existing California or New York program, not a separate build. Third, the risk-adjusted value of voluntary preparation goes beyond Virginia. A program built now to a Virginia HB 1919-style standard transfers directly to any other state mandate that follows, including the Massachusetts, Pennsylvania, and federal trajectories that are moving in parallel.

The case for waiting rests on a single factor: the 2027 mandate may not pass. That is a real possibility. It is also a wager. The expected value calculation depends on how an organization weighs the cost of voluntary preparation against the cost of post-mandate scramble. For most multi-state employers, the cost of voluntary preparation is materially lower than the cost of compressed compliance — because the work consists of adaptation, not greenfield construction. For Virginia-only employers in industries with elevated workplace violence risk profiles — retail, healthcare-adjacent services, hospitality, financial services with public-facing branches — the General Duty Clause exposure alone justifies preparation independent of any state mandate.

The organizations that built California-compliant programs in 2024 are now maintaining them as regular operations. The organizations that filed templates in 2024 are rebuilding them in 2026 against the permanent Cal/OSHA standard. The same dynamic will play out in Virginia. The difference is timing and cost, not whether the work will eventually need to be done. For the broader picture of where these obligations sit nationally, see our national healthcare compliance guide.

The strategic posture

Virginia is not California. The legislative culture is different, the regulatory enforcement posture is different, and the political timeline operates on a different cadence. A Virginia general industry mandate, if and when it passes, will likely be more measured than SB-553 — a 100-employee threshold, a $1,000 per violation civil penalty cap, and an enforcement framework anchored in VOSH rather than in a dedicated standards board.

But the directional question is no longer ambiguous. HB 1489 is now law. The 2025 healthcare framework is being expanded, not narrowed. The administration that vetoed the general industry bill is gone. The administration that has signed every workplace standards bill the General Assembly has put on its desk is in office through January 2030. The federal trajectory continues to push state-level action. The bills are written. The advocates are in place. The constituency exists.

The right question for Virginia employers is not whether to prepare. It is how to prepare in a way that produces a defensible, operationally useful program — rather than the template-and-binder posture that fails in front of an inspector and produces verdicts in front of juries. That work is the same work, regardless of which state’s deadline is on the calendar. Doing it well, ahead of the mandate, is materially less expensive than doing it under pressure once the mandate exists.