Healthcare workers face higher rates of workplace violence than virtually any other industry. That has been documented across OSHA guidance, Joint Commission standards, and years of nursing surveys. What’s harder to explain is why most hospitals still lack a functioning prevention program, even where policies are written and training is conducted. The gap between those efforts and a program that actually prevents incidents comes down to data infrastructure. The Maturity Gap Is Real and Quantified The 2024 CPI Workplace Violence Prevention Training Annual Report, based on a survey of 1,200 healthcare professionals, puts specific numbers on the gap. The 2023 industry benchmark score for workplace violence preparedness was 55 out of 100, well below the 76 threshold that defines an effective program. Only 18% of organizations score in the “Leaders” category. Nearly 70% lack an established WPV committee with defined governance, and only one-third have any systemwide de-escalation training in place. Those numbers describe organizations running programs that fall short of genuine prevention, despite having policies on paper and conducting staff training. Tony Jace, then-CEO of Crisis Prevention Institute, frames the tension directly: “I’ve been at CPI for the past 15 years and I’ve been shocked at the level of violence against our care workers in the healthcare setting.” The 55% of respondents in that same report who say their WPV policies are only somewhat or not effective point to a consistent structural gap: programs that exist in policy form without the data infrastructure to sustain them. Awareness of the problem has outpaced the organizational capacity to address it. Two Problems That Make Each Other Worse The underreporting problem and the data silo problem are typically treated as separate challenges, one cultural and one technical. In practice, they compound each other in ways that make preventing workplace violence in healthcare structurally difficult to achieve. Staff underreport incidents because of fear of blame from supervisors or colleagues, distrust that reports will lead to any follow-up, or normalization of patient aggression as occupational risk. When nurses describe getting hit or verbally threatened as “just part of the job,” the reporting baseline that a prevention program depends on is already broken. The data that does get reported rarely ends up in a form that supports prevention decisions. Incident reports live in one system, security logs in another, occupational health records somewhere else, HR complaints in a fourth location. Safety teams hold pieces of the picture. Corrective actions, when they occur at all, rarely trace back to the patterns driving repeat events on specific units or shifts. These two problems reinforce each other directly. When staff report an incident and see no follow-up, they stop reporting. When reporting drops, the data becomes unreliable. When the data is unreliable, corrective actions disconnect from actual risk patterns. As the same hazards persist quarter after quarter with no coordinated response, underreporting deepens further. This can erode frontline workers’ trust in management. Breaking that cycle requires treating data infrastructure as the program’s foundation, built alongside policy and training from the start. What Breaking the Cycle Looks Like in Practice Spectrum Health’s experience illustrates what the transition from reactive to proactive safety management requires at a structural level. Before implementing Origami Risk, the health system tracked injuries and exposures through paper-based processes, with incident data feeding into multiple systems that had no consolidated view. Incidents and resolutions were not shared across the organization, and leadership had limited visibility into trends at the facility, department, or shift level. After implementation, leadership could see when an injury occurred and respond in real time. Cross-functional teams, including occupational health, HR, and disability management, were automatically engaged based on event type, with coordination built into the workflow. Dashboards gave authorized personnel a system-wide view of trends across facilities, departments, and regions. The outcome Spectrum Health pointed to was a shift from reactive responses to proactive identification of potential issues. That shift came from having incident data, near-miss reports, corrective actions, and safety trends in one connected system, visible to the right people at the right time. Building the Infrastructure for Prevention For healthcare organizations working to close the gap between policy and program, the data infrastructure question has several interconnected dimensions. Incident capture. When logging an event takes 90 seconds on a mobile device and an anonymous portal is available for sensitive submissions, the reporting barrier drops significantly. The data foundation for hospital workplace violence programs gets built incrementally through normal workflows, which means it reflects what is actually happening on the floor. Corrective action loops. Root cause analysis capabilities that let safety teams run structured investigations, identify units with repeat events, and track causal chains give the program the connective tissue between a reported incident and a visible response. For events requiring a coordinated response across clinical and administrative functions, structured investigation processes like the Joint Commission’s RCA² — which links the triggering event, root cause analysis, action planning, and outcome tracking in a single accountable workflow — keep risk, safety, HR, and occupational health working from the same record through the full response cycle. Proactive risk analysis. Healthcare Failure Mode and Effects Analysis (HFMEA) lets organizations analyze where violence risk lives in their workflows before an incident occurs, identifying the conditions that produce incidents upstream of the incident report itself. The output is operational: teams use HFMEA findings to prioritize unit-level interventions, redesign intake and triage workflows that concentrate aggression risk, and establish behavioral flagging protocols for patients with known escalation histories — addressing root conditions rather than reacting to events after they happen. Healthcare organizations that build programs around connected data are creating an advantage that compounds over time. When incident trends, root causes, corrective actions, and safety observations live in one system, the EHS program has the foundation to improve year over year and to demonstrate that improvement to leadership, accreditors, and the frontline staff whose trust it depends on. Learn how Spectrum Health shifted from reactive to proactive safety management with Origami Risk.