The August 26 shooting of two journalists by a former co-worker on live TV in Virginia is a stark reminder that a worker may become violent.

Violent incidents at work resulting in death or serious injury to employees have risen dramatically. Two million American workers a year report having been victims of workplace violence, with one out of every six fatal workplace injuries occurring as a result of workplace violence. Moreover, active shooter incidents have occurred more frequently in recent years — from 2000 to 2006, such incidents averaged 6.4 annually; from 2007 to 2013, such incidents jumped to an average of 16.4 a year.

The Occupational Safety and Health Administration (OSHA) defines workplace violence as an assault, intimidating act, or threatening conduct which occurs in or is related to the workplace. Examples include physical harm, verbal threats to inflict bodily harm, vague or covert threats of a violent nature, attempts to cause physical harm, bringing weapons into the workplace, and stalking.

Under the Occupational Safety and Health Act’s General Duty Clause (§ 5(a)(1)), employers are required to provide a safe and healthful work environment. Similarly, many federal and state safe workplace laws, as well as common law negligence standards, require that employers provide a workplace reasonably free from hazards and take reasonable steps to ensure the individuals they employ and do business with will not cause intentional harm to other employees. To this end, OSHA has recognized that workplace violence is an occupational hazard in some industries and environments, which may be avoided or minimized if employers take appropriate precautions. However, identifying the risk and taking appropriate steps to address those risks is often difficult, and, even with precautions, workplace violence cannot be prevented completely.

Conduct Assessment to Identify Risks

The first step in reducing workplace violence is to identify the potential signs of violence. Employers should complete a workplace violence hazard assessment and security analysis. Risk factors, such as working alone or in isolated areas, with money or valuables, or late at night or during early morning hours should be considered.

Additionally, employers should be alert to: incidents involving threatening remarks or gestures, whether direct or vague; physical harm or injury to another person, whether at or away from work; demonstrated aggressive or hostile behavior; intentional destruction of property; self-destructive behavior; and, talk of violence. While these examples may be more readily observable than other indications of risk, employers also should be mindful of: drastic changes in employee performance; expression of irrational beliefs; signs of depression, despair, or paranoia; and changes in personal habits/hygiene.

These signs are often difficult to identify. Moreover, they do not always mean that a worker will become violent, which makes decisions on how to handle employees who exhibits these signs difficult. Importantly, in identifying these risks, employers also must be mindful of employee privacy concerns. For example, if an employee’s disability records reflect treatment for mental health issues, or if an employee goes to an onsite health clinic to address stress, an employer may not be able to review or utilize this information without breaching confidentiality or violating the HIPAA. Similarly, if an employer learns about potential risks through an employee’s social media activity, it is important to analyze how such information was obtained and whether any potential legal issues may be presented by obtaining otherwise private social media content.

Tellingly, multiple news outlets have reported that the Virginia shooter exhibited many signs of risk during his employment and afterwards. Unfortunately, the risk to other employees in this case did not end when the employee was terminated.

Create Appropriate Policy

Next, employers should create an anti-violence program and policy. The written program should include an anti-violence statement that covers all workers, patients, clients, visitors, contractors, and anyone else who may come in contact with company personnel and provide specific information regarding the consequences of non-compliance. The policy should define workplace violence, which depends on the nature of the workplace. For example, should screaming, freezing someone out, and mental intimidation be included? Additionally, the policy should encourage prompt reporting of not only violent incidents, but also the risk factors identified above — employees should be encouraged to report concerns even when behavior is observed off company premises or on social media and after the employee has been terminated. Moreover, employers should keep detailed records of incidents to regularly assess risk and measure progress.

Provide Training

While a written policy is a needed initial step, training the workforce is the most effective way to achieve policy goals. For example, mandatory and annual training should be given on how to recognize the earliest stages of a possible assault or workplace violence issues and how to report these observations, as well as measures on avoiding or mitigating potentially violent encounters, including how to protect oneself.

Proactively Investigate and Respond

If employees raise complaints or concerns over any potential workplace violence issue, employers should investigate immediately. They should develop an appropriate and timely plan of action once findings are reported. Depending on the nature of the incident in question, employers may need to take steps prior to completing their investigation to prevent any possible further violence. These steps may include: separating co-workers, sending employees home pending the outcome of the investigation, assigning individuals to different shifts or departments, refusing access to the premises, and contacting local law enforcement.

Implement Appropriate Controls

In addition to policy implementation and training, employers also should implement physical and administrative controls when appropriate and feasible. Physical controls may include locks on doors, badges or key codes to limit room access, and lighting in parking lots or isolated areas. Administrative controls may include requiring visitors to sign in and present identification before entering, requiring visitors and contractors to wear badges while on the premises, or providing reliable means of communication to employees who may need to summon assistance.

Develop, Implement, and Practice Incident Response Procedures

To address onsite incidents of workplace violence, develop and implement response procedures. These should include identifying a response team that would be responsible for the immediate care of victims, reestablishment of work areas and processes after an incident, and providing debriefing sessions with victims and coworkers. Similarly, a crisis management team should be identified with responsibility for investigating complaints of violent conduct or threats of violent conduct and providing support to supervisors in managing difficult employees. As with other workplace emergency drills, employers should test their incident response procedures and teams regularly to prepare for any workplace violence.

Evaluate

The only way to determine the effectiveness of any program developed to address workplace violence is to evaluate it. Evaluation should include reviewing reports and minutes from staff meetings on safety and security issues, surveying employees before and after making job or worksite changes or installing security, and evaluating administrative and work practice changes to determine how well they work to prevent workplace violence.

Even the most thorough plan to address or prevent workplace violence, however, may not prevent an incident. This is especially true if the incident were to occur off site. Remind employees of the various avenues through which they may seek treatment to address stress, anger, or other factors that may contribute to a workplace violence incident.

Additionally, if a workplace violence incident occurs, employees should be directed to your company’s employee assistance program. An EAP can provide valuable support, and even help to deal with possible ramifications, such as post-traumatic stress.

Employers should consult with counsel to determine whether and how their particular organizations can reduce of the risks of workplace violence.