Occupational Violence and Aggression Policy Template

What's in this template?

This Occupational Violence and Aggression Policy gives Australian healthcare practices the operational document for managing violence and aggression from patients, family members and visitors, built from the Safe Work Australia Model Code of Practice for the Healthcare and Social Assistance Industry (July 2025).

The template includes:

1. A three-way boundary statement distinguishing this policy from the Psychosocial Hazards Policy and the Workplace Bullying and Harassment Policy
2. A risk assessment framework covering clinical, environmental and staffing factors
3. Physical, screening and behavioural controls, drawn directly from the Model Code's control examples
4. A Code Black and duress response procedure, with steps, actions and owners
5. The notifiable incident duty: what must be reported to the WHS regulator, and how
6. A training and post-incident support framework
7. Appendix A: an incident log, including near misses

Editable placeholder fields

• {{practice_name}}, {{abn}}, {{practice_address}}
• {{whs_officer}}, {{whs_officer_phone}}, {{whs_officer_email}}
• {{duress_response_lead}}
• {{effective_date}}, {{next_review_date}}

Three documents, one hazard, three boundaries

Violence and aggression against healthcare workers touches three separate policies in a mature WHS library, and getting the boundary wrong means either a gap or a document nobody reads because it repeats another one.

A patient assaulting a nurse is handled under this policy. A senior clinician belittling a junior colleague is handled under the Bullying and Harassment Policy. A ward incident that leaves staff needing a debrief afterwards draws on this policy for what happened and the Psychosocial Hazards Policy for the support and debrief process that follows. The three documents cross-link to each other so a reader who lands on the wrong one is pointed to the right one.

What the Model Code actually requires

Healthcare and social assistance workers experience acts of violence at higher rates than almost any other industry, and the Model Code is explicit that a PCBU must eliminate this risk where reasonably possible and minimise it everywhere it cannot be eliminated, even where the aggression stems from a patient's own clinical condition. A patient with a psychiatric condition or dementia who behaves violently still requires care, so the duty is not to refuse treatment, it is to control the risk through the hierarchy of controls: environment, staffing, screening, training and, as a last resort, restrictive measures.

The Code's risk assessment asks how likely violent behaviour is given the patient mix, what facilities exist for a worker to retreat to, and whether the physical environment (lighting, sightlines, noise) is itself contributing to agitation. Its control examples, reflected directly in this template, range from room layout and duress alarms to rostering, behavioural agreements and barring notices for a visitor who will not moderate their conduct.

How to customise this template

1. Download the Word document and replace every {{placeholder}} with your details.
2. Work through the risk assessment in Section 4 against your actual patient mix and premises, not a generic list. A practice with a significant mental health or drug and alcohol caseload carries a materially different risk profile to one that does not.
3. Confirm your physical controls in Section 5 match what is actually installed: duress alarms, sightlines, exits. Do not describe equipment the practice does not have.
4. Describe your real Code Black arrangement in Section 6. A solo GP practice's response looks different to a large multidisciplinary clinic's, and the template's note says explicitly not to describe a dedicated team you do not have.
5. Brief all staff on the notifiable incident duty in Section 7, since a serious incident must be reported to the WHS regulator immediately, and the site preserved.
6. Review every two years, or sooner after a serious or notifiable incident.

Related templates and tools

• Psychosocial Hazards and Workplace Wellbeing Policy: the broader hazard category this policy sits under, and the critical incident debrief process.
• Workplace Bullying and Harassment Policy: the worker-to-worker counterpart.
• WHS Incident Report Form: use it to log every incident, including near misses.
• WHS Hazard and Risk Register: the risk assessment in Section 4 feeds this register.
• CCTV and Surveillance Privacy Policy: the privacy-compliant framework for the cameras this policy's controls rely on.
• Emergency Response Plan: broader emergency procedures beyond a violence incident.

Frequently asked questions

How is this different from the Psychosocial Hazards Policy?

The Psychosocial Hazards Policy addresses violence and aggression as one of 14 hazard categories at a summary level, alongside bullying, high demand and fatigue, and it owns the critical incident debrief process that applies across all of them. This policy is the detailed, operational document for that one category: the risk assessment, physical controls, screening, training and Code Black response specific to patient and visitor aggression. Use both together, not one instead of the other.

Does this policy cover a doctor bullying a nurse?

No. Conduct between workers, including bullying, harassment and sexual harassment, is covered by the Workplace Bullying and Harassment Policy, which follows the Fair Work Act and Sex Discrimination Act complaint pathway rather than the WHS risk-control approach this policy uses.

What is a Code Black?

Code Black is the term commonly used in Australian healthcare for an activated response to violence or aggression: an alarm or call for help that brings available staff to the location, contains the situation, and, if needed, escalates to police. The Model Code does not mandate a specific team structure. A small practice's response can be "nearest available staff respond, call 000 if in doubt," which is what the template's Section 6 note tells you to describe honestly rather than overstate.

Do we have to report every incident to the WHS regulator?

No. Only a notifiable incident: a death, a serious injury or illness, or a dangerous incident that exposed someone to a serious risk, even if no one was actually hurt. Every incident, including near misses that do not meet that threshold, is still logged internally using the WHS Incident Report Form and Appendix A of this template, because that pattern of near misses is exactly what the risk assessment needs to see.

Can we refuse to treat an aggressive patient?

The Model Code's position is that you cannot simply refuse care because a patient's clinical condition contributes to aggressive behaviour, but you must still minimise the risk to workers through the controls in Section 5, up to and including behavioural agreements, restricting attendance to times with additional staff present, or, as a last resort, helping the patient transition to another provider for non-urgent care. Where there is an immediate risk to safety, involving police is always appropriate.

Do home visits need a separate risk assessment?

Yes. A pre-visit risk assessment is expected wherever a worker attends a private home, and a visit assessed as high risk should not be attended solo. The Working Alone and Lone Worker Policy covers the broader controls for work away from the practice, and this policy's Section 5 sets out the specific rule against solo attendance at a flagged high-risk address.