Hospital's own post-citation safety improvements proved OSHA's case, court rules
A federal court just made it clear: healthcare employers can't hide behind Medicare compliance when their workers face patient violence.
The warning came in a decision dated February 13, 2026, when the Tenth Circuit Court of Appeals denied Cedar Springs Hospital's attempt to overturn a workplace safety citation. The Colorado psychiatric facility had argued it was already regulated by federal healthcare agencies and didn't need to follow separate OSHA requirements for protecting staff from violent patients.
The court wasn't buying it.
The case started when someone tipped off OSHA about violence at the facility. What investigators found was troubling: employees at the psychiatric hospital faced regular physical threats and assaults from patients, yet the hospital hadn't implemented basic safety measures that experts say are standard practice in behavioral health settings.
OSHA cited the hospital for seven missing safeguards. Nurses' stations were open, allowing patients to grab pens, pencils, and paperclips to use as weapons. Staff lacked adequate communication devices to call for help during emergencies. The hospital had written a workplace violence prevention program but never actually put it into practice. Staffing levels were insufficient during high-risk times like patient admissions and behavioral emergencies. No one was assigned specifically to security. And after violent incidents occurred, there was no systematic investigation or debriefing.
The administrative law judge imposed a penalty of $13,494.
Cedar Springs fought back with an argument that might resonate with many healthcare HR leaders: we're already swimming in regulations. The hospital pointed out that the Centers for Medicare and Medicaid Services oversees safety at facilities participating in Medicare and Medicaid programs. Why should OSHA pile on?
But the court drew a critical distinction. CMS regulations focus on patient safety, not employee protection. Federal law authorizes CMS to require adequate staffing to treat patients and handle emergencies, but those rules say nothing about shielding workers from harm.
The hospital tried another angle, claiming the proposed fixes were too vague. How much staffing is adequate? What exactly counts as specialized security training? Without specifics, Cedar Springs argued, the citation violated due process.
Again, the court disagreed. While the citation used general terms, it provided detailed explanations. Adequate staffing meant enough employees to handle patient admissions safely, respond to behavioral emergencies, provide one-on-one coverage when needed, allow for breaks, and accompany patients leaving the unit. Specialized security meant staff trained specifically to monitor patients for aggression, assist during violent episodes, and respond immediately without being pulled away by other duties.
Here's where the case gets interesting for HR professionals: the hospital's own actions after receiving the citation proved everything OSHA wanted was feasible.
Cedar Springs hired additional mental health specialists to rotate among units and respond to threats. The hospital added a full-time employee in the human resources department focused on recruitment and retention. It enclosed nurses' stations with barriers and locked doors. It ordered 100 new radios for staff. Windows were tinted. Security personnel were brought on board.
The chief executive officer and director of nursing both testified that these changes improved safety. The former chief financial officer admitted the hospital could afford to hire 52 more full-time employees. Yes, the profit margin would drop from 30.3 percent to 19.1 percent, but the facility would remain profitable.
Two expert witnesses drove the point home. Dr. Howard Forman, a psychiatrist who works with violent patients, testified that trained security staff prevent injuries. He pointed to his own facility's success with these measures. Dr. Jane Lipscomb, a nurse with a doctorate in epidemiology, said security staffing in behavioral health facilities is considered a best practice in workplace violence prevention and noted that silent panic alarms are widely used throughout healthcare.
The message to HR leaders is stark: you can't wait for a citation to implement safety measures that are already standard in your industry.
The case also offers a cautionary tale about evidence preservation. Cedar Springs recorded over many subpoenaed videos of violent incidents. When OSHA asked for the footage, the hospital couldn't produce it. The Risk Management Director blamed a network outage and claimed she made extraordinary efforts to save videos, but she couldn't recall which specific incidents she had reviewed and kept no list of saved recordings.
Internal logs showed the hospital had documented violent episodes with notes indicating video existed, but when OSHA came calling, those videos were gone. In one instance after the subpoena was issued, a nurse testified that footage would have captured a violent episode, yet Cedar Springs produced nothing.
The court upheld sanctions against the hospital: adverse inferences presuming the missing videos would have shown that Cedar Springs knew about the violence, understood its severity, and needed better safety measures. While not a default judgment, these inferences shifted the burden back to the employer to prove otherwise.
For HR professionals navigating workplace violence prevention, the decision offers clear guidance. First, compliance with one regulatory scheme doesn't exempt you from others. Medicare certification doesn't satisfy OSHA obligations. Joint Commission accreditation doesn't either.
Second, written policies gathering dust accomplish nothing. Cedar Springs had a workplace violence prevention program on paper. The problem was implementation. OSHA expects employers to actually follow the programs they write.
Third, what's feasible is often what you end up doing anyway after you get cited. If you can afford the safety measures post-citation, you probably could have afforded them before. Courts will look at your own subsequent actions as proof of feasibility.
Fourth, industry standards matter enormously. Expert witnesses will testify about best practices in your sector. If other psychiatric hospitals use security staff, enclosed nurses' stations, and panic alarms, you'll have a hard time arguing those measures aren't feasible for your facility.
Finally, preserve everything once you know or should know an investigation is coming. Missing evidence creates presumptions against you, and explaining that you forgot or had technical problems won't cut it.
The court's decision reflects growing attention to workplace violence in healthcare settings. The general duty clause requires employers to protect workers from recognized hazards likely to cause serious harm. In psychiatric facilities where patient violence is a known, recurring risk, that duty demands concrete action.
The standard isn't perfection. Courts recognize that eliminating all violence in behavioral health settings is impossible. But the law requires measures that would materially reduce the hazard. Doing something isn't enough if you could reasonably do more.
As workplace violence incidents climb across healthcare, the Cedar Springs decision signals that regulators and courts will scrutinize whether employers are implementing evidence-based protections. HR leaders would be wise to audit their current programs, compare them against industry best practices, and close any gaps before OSHA comes knocking.
