Violence against healthcare workers stopped being treated as part of the job in Texas in 2023. Senate Bill 240 added Chapter 331 to the Health & Safety Code, and since September 1, 2024, covered facilities have been required to have a written workplace-violence prevention policy and plan in force. Most hospitals got there. But the law has kept moving — and one of its deadlines lands this September.
Who’s covered — including who’s new
Chapter 331 covers licensed hospitals, nursing facilities employing two or more RNs, ambulatory surgical centers, freestanding emergency rooms, mental hospitals, and home and community support services agencies with two or more RNs. In 2025, Senate Bill 463 extended coverage to intermediate care facilities (ICFs/IID) and state supported living centers, and broadened the home-care category — with newly covered facilities required to comply by September 1, 2026.
Physician offices and standalone clinics are generally not covered — though many adopt the same framework voluntarily, for the same reasons the covered facilities were told to.
What the plan must contain
The statute is specific about the plan’s required elements. It must be tailored to the practice setting, define workplace violence (including threats and weapon incidents), require at least annual training, establish a system for responding to and investigating incidents — and, in the words of the statute itself, “address physical security and safety.”
Three details worth knowing:
- The committee that writes the plan expects security at the table. The law requires a workplace-violence prevention committee including at least one direct-care nurse and physician — and a facility security-services employee where one exists. If your facility has no security staff, your systems integrator is often the closest thing to that expertise.
- The law anticipates the plan holds sensitive detail. Committees may redact information from public copies that would pose a security threat if released — a signal that real plans describe real measures, not generalities.
- It has teeth. Facilities must provide immediate post-incident support, may not discourage reports to law enforcement, may not retaliate against good-faith reporters — and the licensing agency can discipline violations like any other licensing failure.
The element that lives in hardware
The statute deliberately doesn’t prescribe technology — each committee decides what its setting needs. In practice, the physical-security element is commonly met with the same three systems, engineered together:
- Access control — separating public, patient, and staff zones; protecting medication rooms and records; giving credentials a schedule and an audit trail. In an incident review, the access log is the difference between reconstruction and recollection.
- Screened entry — after-hours and secondary entrances that see and hear a visitor before the lock opens, instead of a door that trusts everyone equally at 2 a.m.
- Video surveillance — coverage where incidents actually occur: reception, triage, parking, corridors — engineered for identification, with retention matched to how incidents surface. (In treatment areas, camera placement must respect patient privacy — coverage design is a judgment call, not a blanket.)
What makes these plan evidence rather than just equipment is the documentation: a design that maps each measure to the risk it addresses, verification that every device works, and staff trained on the procedure the hardware enforces. That’s the standard our engagement lifecycle was built around.
Current as of August 2026. Statutory framework: Tex. Health & Safety Code ch. 331 (SB 240, 2023; expanded by SB 463, 2025); HHSC has adopted implementing rules by facility type. This is an explainer, not legal advice — confirm your facility’s obligations with counsel and your licensing agency.