When an Employee Is Attacked at Work: Negligent Security and Your Legal Options

What Negligent Security Means If You Were Attacked at Work

Negligent security is a branch of premises liability. Premises liability is the area of law that asks whether the people who own or control a property kept it reasonably safe for those on it. Under a negligent security theory, a property owner or occupier may be liable when inadequate security measures allow a foreseeable criminal act to harm someone on the property. Our page on what a negligent security lawyer handles walks through the theory more broadly.

The central idea is foreseeability: whether a reasonable property owner in that location and context would have anticipated the risk of criminal activity. A property with a history of break-ins or assaults raises the question differently than one with no history at all. The attack alone does not prove that security was inadequate or that anyone was at fault. The law asks what the owner knew or should have known, and what it did about it.

A workplace can be the property in question. Employees on a property for work are typically treated as invitees under most states' premises-liability law. An invitee is someone on the property for a purpose connected to the owner's business, and property owners generally owe invitees the highest duty of care. Exactly how a state labels and treats visitors is part of that state's law.

For someone who was hurt, this means the question is not only whether the attack happened at work, but who controlled the place where it happened and what they knew about the risk there. Those answers decide whether a claim beyond workers' compensation is worth examining.

If what happened to you involved threats, harassment or intimidation rather than a physical assault, it may still fit how the Occupational Safety and Health Administration describes workplace violence: "any act or threat of physical violence, harassment, intimidation, or other threatening behavior that occurs at the work site." That federal definition and a civil negligent security claim come from different bodies of law and serve different purposes. The next section covers the federal side; the rest of this page covers the civil side.

The Employer's General Duty Under Federal Law

Federal law places a general safety duty on employers. Under 29 U.S.C. § 654(a), each employer the Act covers:

"(1) shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees; (2) shall comply with occupational safety and health standards promulgated under this chapter."

Two points matter in reading that text. First, the duty binds covered employers, not every business that has workers: the Act's own definition of an employer leaves some out. Second, the duty is about "recognized hazards" likely to cause death or serious physical harm. Whether a risk of violence at a particular workplace was a recognized hazard in the statute's sense is a question the facts decide.

OSHA's workplace violence page notes that there are currently no specific OSHA standards for workplace violence. The agency lists its enforcement procedures for occupational exposure to workplace violence, OSHA Directive CPL 02-01-058, along with prevention guidance for settings such as healthcare, late-night retail and taxi driving.

For someone who was hurt, this federal duty is useful context, but it is a workplace-safety obligation, not the source of a negligent security claim. A shortfall under the federal duty does not by itself establish that anyone is liable in a civil case. In practical terms, if you are wondering whether your employer "broke the rules," the answer to that question does not settle whether you have a civil claim; that rests on state law and its own elements, described below.

Why Workers' Compensation May Not Be the Only Path After an Employee Is Attacked

Workers' compensation is a state-run system that pays benefits to employees hurt on the job, generally without requiring them to prove anyone was at fault. In exchange, it is typically the exclusive remedy against the employer. Exclusive remedy means that workers' compensation is generally the only form of recovery the employee has against the employer for a work injury, so a civil lawsuit against the employer is usually barred in most circumstances. An assault during work can fall within that system.

What workers' compensation generally covers includes medical expenses, a portion of lost wages and disability benefits. The amounts, the rules for qualifying, the deadlines and any exceptions to the exclusive-remedy rule are each state's own. Because some states recognize exceptions and others do not, whether one could apply to an attack at work is a state-specific question; this page gives no state's exceptions, benefit levels or time limits.

The key limit is narrower than many people assume. The exclusive-remedy rule protects the employer. It does not generally extend to third parties, meaning a property owner, a security company or another entity that is not the employer.

That is why where the attack happened can matter so much. An employee attacked at a client's building, in a parking structure, at a hotel during work travel, or on another company's premises may face a different set of options than one attacked inside a facility the employer owns and controls. In the first group, someone other than the employer may have controlled the property and its security. If you are trying to understand your options, who owned and controlled the place where the attack happened is often the starting point.

When a Third-Party Negligent Security Claim May Be Possible

A third-party claim is a civil lawsuit against a party other than the employer. Depending on the facts, that may be a property owner, a building landlord, a parking-structure operator, a security company, or another entity whose negligence is said to have contributed to the attack. Because that party is not the employer, the exclusive-remedy rule generally does not bar the claim. Who may bring one is covered on our page about who can bring a claim.

A negligent security claim generally requires four elements:

1. A duty owed to the person on the premises.
2. A breach of that duty through inadequate or absent security measures.
3. Causation, meaning the inadequate security was a proximate cause of the attack and the harm.
4. Damages, the injuries and losses that resulted.

Our page on what an inadequate security lawsuit has to show explains these elements in more depth.

Workplace attacks raise these elements in recognizable patterns. An employee may be attacked in a shared office building's common area, which the building owner rather than the tenant employer controls. An employee may be assaulted in a parking garage the employer leases but does not own. An employee may be working at a client's site where the client controls who enters and what security is in place. A company hired to provide security may also owe an independent duty if its negligence contributed to the harm, often shaped by what its contract required it to do.

State law governs the standard. If you were attacked, your own conduct may also come up: under comparative fault, a person's own share of fault can reduce what they may recover, while a few states follow stricter contributory-fault rules. The deadline for filing suit also differs by state, and each one runs from a point that state's law defines, which is one reason the applicable state matters early.

What the Property Owner Knew and When: What Shapes a Negligent Security Case After a Workplace Attack

These cases turn on what the property owner knew, when it knew it, and what security measures were or were not in place at the time of the attack. The law looks at the property itself: the adequacy of lighting, locks, cameras, security personnel and access controls, and whether the owner had notice of prior criminal activity, including similar crimes at or near the property, crime in the surrounding area and the nature of the business. The same questions arise in assault claims involving visitors and customers.

If you were hurt, the records that usually matter include incident reports filed with the employer or the property manager, police reports, medical records, photos and video of the scene, records of prior incidents at the property, security logs, security contracts and the names of witnesses. Injured employees and families often gather what they can of these, though some, such as a property's own incident history or a security company's contract, are held by others. That matters for the reader because the records that show what the owner knew are often not in the injured person's hands.

Damages are the losses the law may allow a person to recover. The categories commonly include medical expenses, lost wages and pain and suffering, and state law may allow other categories, including wrongful-death damages for a family after a death. What any case involves depends on the facts and on the law of the state where it happened, and nothing about an injury predicts a result.

For many employees, the hardest part is that two systems are moving at once while they are still healing. A conversation with an attorney can help clarify which parties may have owed a duty at the place of the attack, how the workers' compensation claim and a possible third-party claim relate, and what the applicable state's rules require.

How Workers' Compensation and a Third-Party Claim Can Interact

In many states, an injured employee can file a workers' compensation claim with the employer's insurer and also pursue a civil negligent security claim against a third party. The two tracks run on different rules: one pays benefits without proof of fault, the other requires proof of the elements described above.

The link between them is subrogation. If you have already received workers' compensation benefits, the insurer may have a right to be reimbursed from a third-party recovery for what it paid. That means part of any settlement or judgment from the third party may go back to the insurer, which can reduce the net amount you receive. How subrogation works, how offsets are calculated, and how the two claims fit together are governed by state law, and the rules differ significantly from state to state.

That interaction can shape decisions about timing, sequencing and coordinating the two claims. An employee who has already received benefits and is weighing a third-party claim will usually want to understand how subrogation applies under their state's law before either claim is resolved. A civil claim also runs separately from any criminal case against the attacker, a difference explained on our page comparing civil and criminal cases.

If you would like help working out how the two claims could fit together in your state, you can request a case evaluation and talk through the timeline, the benefits already paid and the property involved.