The program, the documentation, and the governing-body report
The standard is NPG.02.04.01: the hospital has a workplace violence prevention program. EP 1 requires a program led by a designated individual and developed by a multidisciplinary team, with policies, incident reporting, post-incident support for victims and witnesses, and reporting of workplace violence incidents to the governing body. EP 2 requires training at hire, annually, and on program change. EP 3 requires an annual worksite analysis with action on the findings, and closes with “Documentation is required.” We use the Joint Commission’s actual words — reporting incidents to the governing body — not looser paraphrases like “executive accountability” that soften what the standard says.
This is the clearest illustration of the whole vertical’s thesis. The standard does not tell you to buy a duress system or a weapons-detection portal. It tells you to build a program, analyze your worksite, act on what you find, document all of it, and report incidents up to the board. The systems an integrator provides — duress alerting, access control on at-risk areas, the incident record itself — are how a facility executes and proves that program. They are our recommendation for meeting the accountability, not the standard’s mandate.
“The moment workplace-violence reporting became a governing-body item, it stopped being a security line item and became a board risk. That changes who returns your call.”
Sources: NPG.02.04.01 EP 1, EP 2, EP 3 (NPG Hospital Program document).
What would change this: JC mid-2026 announcements; any state workplace-violence statute change affecting the worksite-analysis obligation.
Reviewed July 2026 by the Eagle Systems healthcare practice. The systems referenced are how a facility meets the accountability the regulation creates, not a mandate; the accreditation and compliance determinations belong to the organization and its regulators. Current as of Accreditation 360 (eff. Jan 1 2026).