Laws and requirements for violence prevention

Ontario was one of the first jurisdictions in North America to write specific workplace violence duties into its occupational health and safety law. The provisions came into force in June 2010, after several high-profile deaths, including the killing of a nurse, Lori Dupont, by a former partner who was a physician at the same hospital in Windsor in 2005. They apply to every workplace, but hospitals, long-term care homes and home care agencies are among the workplaces where they matter most. This lesson sets out what the law requires, who has which duties, and how Northbridge turns those requirements into a working program.

The OHSA violence and harassment provisions

The provisions are in Part III.0.1 of the Act, sections 32.0.1 to 32.0.8. The core duties are:

• Policy (s. 32.0.1). The employer must prepare a policy on workplace violence and a policy on workplace harassment, and review them at least once a year. In a workplace with more than five regular workers, they must be in writing and posted in a conspicuous place.
• Risk assessment (s. 32.0.3). The employer must assess the risks of workplace violence that may arise from the nature of the workplace, the type of work or the conditions of work, considering conditions common to similar workplaces and conditions specific to this one. The assessment is repeated as often as necessary, and the results are given to the joint health and safety committee, with a copy if the assessment is in writing.
• Program (s. 32.0.2). The employer must develop and maintain a program to implement the violence policy. It must include measures and procedures to control the risks found in the assessment, to summon immediate assistance when violence occurs or is likely to occur, and for workers to report incidents or threats, and it must set out how the employer will investigate and deal with incidents, complaints and threats.
• Domestic violence (s. 32.0.4). If the employer becomes aware, or ought reasonably to be aware, that domestic violence that would likely expose a worker to physical injury may occur in the workplace, the employer must take every precaution reasonable in the circumstances to protect the worker.
• Information and instruction (s. 32.0.5). The employer must give workers information and instruction appropriate to them on the contents of the policy and program.
• Persons with a history of violent behaviour (s. 32.0.5). Employers and supervisors must provide information, including personal information, about a risk of workplace violence from a person with a history of violent behaviour, if the worker can be expected to encounter that person in the course of work and the risk is likely to expose the worker to physical injury. They may not disclose more personal information than is reasonably necessary to protect the worker. This is the legal basis for flagging, covered in Lesson 3.

The general duties in section 25 of the Act also apply. The employer must take every precaution reasonable in the circumstances for the protection of a worker, and supervisors must advise workers of any potential or actual danger they know about. Section 27 makes the supervisor responsible for ensuring workers follow the measures and procedures in the program.

Regulation 67/93 and the JHSC

Regulation 67/93, Health Care and Residential Facilities, requires the employer, in consultation with the joint health and safety committee, to develop, establish and put into effect written measures and procedures for the health and safety of workers, and to review them at least once a year. In hospitals and long-term care homes, workplace violence is one of the hazards these written measures must cover. The JHSC also has a direct role: it receives the results of the violence risk assessment, can inspect for violence hazards, can make written recommendations to which the employer must respond within 21 days, and has worker members who investigate critical injuries, including those from violence.

Ministry inspectors have run repeated inspection campaigns on workplace violence in health care. The most common orders have been for risk assessments that were missing, out of date or not shared with the JHSC; programs without a working way to summon immediate assistance; and gaps in information and training. The Ministry has also said that individual patient risk assessments are not a requirement of the Act itself, which deals with the organization's risks, but it strongly recommends them as the practical way to meet the duty to share information about people with a history of violence.

Related laws

Several other laws shape how a hospital prevents and responds to violence:

• The Criminal Code. Assaulting a health care worker is a criminal offence like any other assault. Since 2021, section 269.01 requires a court sentencing someone for assaulting a person providing health services to treat that as an aggravating circumstance, and section 423.2 makes it an offence to intimidate health care workers or obstruct access to care.
• The Ontario Human Rights Code. Harassment and discrimination by patients on grounds such as race, sex or religion are covered by the employer's duty to maintain a workplace free from discrimination, as Lesson 9 explains.
• The Personal Health Information Protection Act (PHIPA). Sharing information about a patient's history of violence involves personal health information. PHIPA allows disclosure needed to reduce a significant risk of serious bodily harm, and the OHSA duty to share is limited to what is reasonably necessary.
• The Fixing Long-Term Care Act, 2021, and its regulation. Long-term care homes must have a program for residents with responsive behaviours, with written approaches to care, screening and interventions, which overlaps with the violence program.
• Accreditation Canada. Its standards include a required organizational practice on workplace violence prevention.

Work refusals in healthcare

Under section 43 of the Act, a worker may refuse work they have reason to believe is likely to endanger them, including because workplace violence is likely to endanger them. But the right is limited for workers in hospitals, long-term care homes and other health care settings: they may not refuse when the circumstance is inherent in their work or normal working conditions, or when the refusal would directly endanger the life, health or safety of another person. A nurse cannot refuse to care for an aggressive patient simply because the patient is aggressive. What the nurse can do, and what the law expects, is insist on the measures and procedures in the program: information about the risk, a second person, security support, an alarm, and a care plan. If those are missing, the worker raises it with the supervisor and the JHSC, and an inspector can be called.

Duties of employers, supervisors and workers

Whatever the jurisdiction, the duties fall into a familiar pattern:

How Northbridge organizes it

At Northbridge, Joanne Pelletier is responsible for the workplace violence program, and the JHSC reviews it every year. The violence policy and harassment policy are posted on every unit and on the staff website. The organization-wide risk assessment is done every year and whenever a unit changes its patient population or layout; each unit also has its own assessment. Joanne keeps a simple compliance checklist so that nothing required by the Act is missed.

The checklist is a short script that Joanne updates before each committee meeting. Each item is marked done or not, with the date it was last done; anything not done, or done more than a year ago, is flagged.

from datetime import date

today = date(2026, 11, 2)
items = [  # (requirement, last done or None)
    ("written policy reviewed",            date(2026, 1, 20)),
    ("organization-wide risk assessment",  date(2025, 10, 14)),
    ("unit assessments: Emergency",        date(2026, 6, 3)),
    ("unit assessments: 4 West",           None),
    ("results shared with committee",      date(2025, 10, 28)),
    ("alarm system tested",                date(2026, 9, 30)),
    ("annual training completion report",  date(2026, 3, 31)),
    ("incident review for last year",      date(2026, 2, 17)),
]
for name, done in items:
    if done is None:
        status = "MISSING"
    elif (today - done).days > 365:
        status = f"OVERDUE ({(today - done).days} days)"
    else:
        status = "ok"
    print(f"{name:<38} {status}")

written policy reviewed                ok
organization-wide risk assessment      OVERDUE (384 days)
unit assessments: Emergency            ok
unit assessments: 4 West               MISSING
results shared with committee          OVERDUE (370 days)
alarm system tested                    ok
annual training completion report      ok
incident review for last year          ok

The output tells the committee exactly where the gaps are: the 4 West unit assessment has never been done, and the organization-wide assessment and the sharing of its results with the committee are more than a year old. Both go on the action list for the next month.

From paper to practice

Inspectors and surveyors look past the binder. A plan can tick every legal box and still fail the worker who is alone with an agitated patient at three in the morning. When the JHSC reviews the Northbridge plan each year, it asks a few practical questions that go beyond the checklist:

• Does every worker on every shift know how to call for help, and does the help actually arrive quickly? The answer comes from drills and alarm tests, not from the policy.
• Do staff learn about a patient's history of violence before they walk into the room, not after?
• Do the people who were hurt, and the people who saw it, hear what changed as a result of their report?
• Are the units with the most incidents getting the most attention, training and resources?
• Are agency staff, students, physicians, volunteers and contractors covered by the same information and training as employees?

The last question matters more than it seems. Violence often falls on the people with the least information: a float nurse who does not know the unit, an agency personal support worker on a first shift, a student, or a porter who moves patients all over the building and never attends a unit huddle. A plan that reaches only permanent staff on day shift leaves the most exposed workers unprotected.

Joanne also checks that the plan treats violence as a shared problem rather than a personal failing. The wording matters. A policy that says staff must "prevent escalation" can be read as blaming the worker who was assaulted. Northbridge's version says that the hospital is responsible for providing the controls, training and support, and that staff are responsible for using them and reporting what happens.