Welcome to The Threat Assessment Brief—or, as I’ll usually call it, the TAB. In this new publication, I’ll curate the developments in behavioral threat assessment and management (BTAM) that I think are most worth your attention. The TAB filters emerging and overlooked research, interprets legal developments, follows significant cases, and translates it all into practical takeaways. It’s for busy professionals responsible for preventing targeted violence but who don’t have the hours to spend seeking out and reading what matters most. I’m thrilled that you’re checking it out. If you find it useful and know someone else who might, too, I’d be grateful if you’d use the Share button below. Shared issues preserve the original formatting so they’ll see it exactly as intended, and make it easier for them to subscribe if they decide the TAB is worth their time.

Every other Thursday, a new issue of the TAB will arrive with operationally useful updates for professionals in BTAM. Every issue is researched, written, and edited by me. No AI-generated articles and no recycled summaries—just my assessment of what matters and why. And it’s free to subscribe. If you like what you see and find it beneficial, I hope you’ll stay with it.

There is no shortage of information about BTAM—new stuff is constantly coming out. There is, however, a shortage of time. My goal is not to report everything that happens, but to flag what matters, explain why it matters, and help busy professionals translate research, cases, and legal developments into better practice.

I'm Molly Amman, an attorney and former prosecutor, retired FBI special agent, former FBI targeted violence/threats profiler, and a Certified Threat Manager™. During my career as a special agent, I investigated violent crime and terrorism, supervised a Joint Terrorism Task Force, taught at the FBI Academy, managed crisis response and investigation assets for major special events, and worked and taught throughout the United States and internationally.

Today, I consult on threat assessment cases, provide training, and participate in research. After years of thinking about it, I finally decided to launch The TAB.

When I was working full time at the FBI Behavioral Analysis Unit, staying current with new research and legal developments was essential. Like everyone one else, I wanted to read every important study and every big court decision. The reality was that there just weren’t enough hours in the day. Now that I control my own schedule, things are different. The TAB is a passion project that grew out of that experience. It’s built to solve the problem of not enough time.

I won’t try to report everything happening in the field. Instead, I’ll focus on the developments I believe are most likely to influence practice. I won’t speculate about ongoing investigations or comment publicly on pending investigations or prosecutions. Likewise, my goal is to explain legal developments—not to advocate for one side or another in civil litigation.

The Threat Assessment Brief is written for professionals whose work involves identifying, assessing, and managing the risk of targeted violence, including:

If your work involves recognizing risk before it escalates, this is for you.

The Threat Assessment Brief is available in both free and professional editions.

Free Edition

The free edition includes analysis of selected issues from The TAB. Every edition is researched, written, and edited to the same standards as the full publication, with a focus on practical and meaningful value for professionals working in BTAM. It is intended to stand on its own while introducing readers to the broader publication.

Professional Edition

Beginning with Issue 4, the professional edition will include an expanded version of every regular, biweekly issue along with bonus issues as developments in the field dictate. Full practical commentary will accompany each issue covered. This edition is intended for professionals who want a comprehensive, regularly updated resource to support their practice.

If you’ve made it this far, you’ve been very patient with all the “about the TAB” stuff. Let’s get to the first briefing. I’ve been noticing a lot more attention focused on patient-on-staff violence in healthcare settings lately—that’s good. Below I present a case in which chronic and often serious violence by patients in a psychiatric hospital did not get the attention it needed, and what OSHA thought of the employers’ “safety measures.”

The management aspect of BTAM is often primarily focused on the persons of concern who appear on our radar. But we never want to neglect the other three dimensions of management: victim factors, situation factors (like the grievance if it can be addressed, for example), and the physical setting. This case is about neglect of the physical setting as an obvious avenue for protective measures.

The Tenth Circuit Court of Appeals recently handed down a pair of decisions affirming OSHA’s citation of a psychiatric hospital for General Duty Clause violations when patient-on-staff violence habitually occurred and the employer didn’t take sufficient measures to abate it. According to the Occupational Safety and Health Review Commission (OSHRC) Administrative Law Judge’s (ALJ) decision, here’s what happened:

Following a whistleblower complaint from a Cedar Springs Hospital employee about unsafe working conditions, the Occupational Health and Safety Administration (OSHA), opened a multi-month investigation of the hospital. At the end of it, the agency issued two citations to the hospital and its management company—one for failures under the OSH Act’s General Duty Clause and one for failing to provide records as required by law. The General Duty Clause requires employers to provide a job and worksite free from recognized hazards—in this case the hazard of patient-on-staff workplace violence (WPV).

Background

At the time of the investigation, the worksite was a behavioral health hospital capable of treating up to 110 adult, adolescent, and child patients in acute and residential settings. Most patients were involuntary admits. Upon admission, patients’ belongings were typically brought with them, uninspected, to their care units—sometimes carried by the patients themselves. They were placed in the nurse’s station until they could be inventoried. Hours or even a day or two could pass before the inventory was done. Sometimes, hazardous items were found. One patient managed to get a large butcher knife in.

Nurses’ stations ranged from completely open to having somewhat of a barrier, but all could be accessed by a determined patient. It was not unusual for patients to find ways into the nurses stations to get weapons opportunity and to attack staff. The hospital was almost always short staffed, which resulted in workers being alone and unable to summon help in hazardous situations, among other safety implications. Some patient-facing employees, including those who were alone with patients, had no access to rapid communication in an emergency, like a radio or silent alarm. A WPV prevention plan existed on paper but was largely not followed or never implemented. Many employees didn’t know it existed and the executive responsible for it seemed unaware of its contents in multiple respects.

The hospital had no trained security employees. Though senior leadership was not supportive of doing it, staff sometimes had to call the police to keep themselves safe. For example, one staff member testified that she called the police when a patient was bashing a worker’s head onto the concrete outside of the care unit.

Doctors could order assault precautions for a patient, but there was no policy or instruction about handling them and precautions didn’t result in additional staffing. Colored armbands and door magnets were used with patients on fall, seizure, or infection control precautions, but there were no visual indicators of assault precautions and many staff were unaware of them. De-escalation and restraint training required staff to have at least two people present for hands-on techniques with a patient, but chronic short-staffing made that impossible in many instances. Staff often felt compelled to intervene with violent or aggressive patients by themselves. Following patient assaults on staff, any measures or documentation were generally if not entirely about patient safety and treatment, not about worker safety.

The hospital had a high number of staff injuries serious enough to require lengthy days away from work and restricted duty assignments. A single shift could have multiple assaults including punches, kicks, and bites, and sometimes much worse. During the year or so of OSHA’s investigation, 73% of the injuries recorded in the worksite’s OSHA logs were from workplace violence. Nearly all the injuries that required days away from work were WPV-related.

Litigation

Based on all of the above and more, OSHA cited the hospital and its management company for violating the General Duty Clause. Both contested it, which put the matter into litigation before a review body (the OSHRC) and an administrative law judge, or ALJ.

During litigation discovery, OSHA realized that the hospital and/or its management company (hereinafter “defendants”) had [a] not retained and [b] actively deleted many of the surveillance videos that would have captured assaults on workers by patients. This despite the fact that OSHA previously served the defendants both with a preservation letter, and a subpoena consistent with the letter, instructing them to “not remove, intentionally alter, destroy, rearrange, or otherwise tamper with any surveillance video footage or recordings" at the worksite. It further instructed them to "take all steps necessary to identify, retain, and preserve all potentially relevant information to OSHA's investigation” (p.31).

This is called spoliation of evidence, which is an intentional or negligent destruction, alteration, or failure to preserve material evidence. As you might guess, it’s a big deal. Needless to say, the ALJ found it “troubling” and, further, found that the evidence surrounding the deletions was sufficient to infer the hospital and its management company did it with an intent to deprive OSHA of evidence. Yikes—not a good look for any party to litigation. And yes, in case you’re wondering, even routine, scheduled distruction can be spoliation. The subpoena and preservation letter trumped any corporate policy about retention—period. The ALJ imposed sanctions on the defendants in the form of inferences that the destroyed material would have been both unfavorable to the defendants and favorable to OSHA on the issues of gravity of the hazard, need for more abatement measures, and defendants’ knowledge of the hazard at the worksite—three of the elements needed to establish a General Duty Clause violation.

Generally, there are four elements of a General Duty Clause violation (§5(a)(1) of the OSH Act), though courts often add a fifth element when serious violations are alleged by OSHA (as was the case here). They are:

There are other nuances. For example, when OSHA alleges feasible and effective abatement measures existed (item 4, above), it has to specifically identify what measure(s) it has in mind—that comes from case law rather than the OSH Act. But generally, this is the formula. So, in this case the defendants’ spoliation bought them a fast-lane ticket to over half of OSHA’s burden of proof being met.

In the end, the ALJ agreed with OSHA that all the elements were met and affirmed the citation. In the written decision, the ALJ wrote something similar to a foundational understanding of BTAM: “Not all workplace violence is unpreventable. While predicting which patient would act violently was difficult, the unpredictability necessitated more, not less, effort to implement engineering controls, assess risk, and have adequate staffing” (p.67). In BTAM, we know that it’s not about prediction, but prevention. Instead of trying to predict anything, we assess and manage now to prevent violence down the road.

The Tenth Circuit Court of Appeals

After their loss at the Commission level, the defendants separately appealed their citations up to the Tenth Circuit. Those decisions are found at Cedar Springs Hospital, Inc., v. Occupational Health and Safety Review Commission and UHS of Delaware, Inc. v. Occupational Health and Safety Review Commission.

The circuit court of appeals did a couple of interesting things for our purposes in these orders. First, it very tidily summarized OSHA’s proposed abatements. Recall above where I wrote that OSHA has to get specific about the abatement measures it thinks would have been effective and feasible? It did, and offered expert testimony to back it all up. Here they are:

The defendants don’t necessarily have to do all of these. They can do all, some, or theoretically none—as long as they solve the problem by materially reducing the hazard. (But one imagines a decent way to avoid further scrutiny is to work with the list.) Part of “feasibility” is economic—an employer doesn’t have to drive itself out of business with more abatements than it can withstand.

In Cedar Springs Hospital’s appeal, it challenged the effectiveness of the measures related to nurses stations, communication equipment, and hiring security guards by asserting the ALJ didn’t have enough evidence to agree with OSHA about them. The court flatly rejected those arguments, and recited evidence from the record that supported each measure.

The other interesting thing from the appeals (thought not unique—at least the Eleventh Circuit has also gone this way) happened in the management company’s appeal. It argued that, as merely the management company and not the actual employer of the healthcare staff, it should not have been subject to penalties.

(This part is admittedly more interesting for legal readers and BTAM-related litigation than the strict practice of BTAM.) The Tenth Circuit made quick work of the argument, too, finding the management company was sufficiently intertwined with the hospital as to also qualify as an employer. To decide that, the Commission and subsequently the appellate court looked at three factors: [1] Did the two companies share a common worksite? [2] Were they integrated in matters of operations, safety, and health? [3] Did they share responsibility through a common president, supervision, or ownership? In this case, the answers to all three questions were yes and therefore UHS of Delaware was also subject to penalties. For those interested in the details of this fact-based analysis, begin reading at page 2 of the UHS of Delaware Decision.

Takeaways

Health care employers and potentially third-party management companies must become actively aware of what’s going on inside their facilities. Willful blindness never works as a shield from responsibility. If WPV is a foreseeable hazard (in hospitals, that’s a “yes,” says the Joint Commission), take concrete steps to remediate it. And if there is a WPV prevention plan “on paper,” for goodness’ sake, make sure it’s happening in practice, too. The executive over WPV should know every requirement of the plan, how each is being met, and what the challenges are to the plan’s success.

At the end of the day, a culture of shared responsibility for safety is the ideal, but it’s up to employers to establish policies that counter aggression and violence, active programs to implement those policies, and strong signals of endorsement right from the top. And I have a sneaking suspicion it will help retention rates.

Anger rumination more predictive of insider threat behavior

A recent study of psychological predictors of insider threat activity found that anger rumination (a propensity to repetitively think about and relive the experience that caused their anger) more strongly predicted a person’s justification and willingness to engage in insider threat behavior than job dissatisfaction did. While dissatisfaction may spawn resentment, angry ruminations seem to be the energizing force that prompts someone to act.

Sentencing in the Colin Gray prosecution

A shooting attack at Apalachee High School, Georgia, in 2024, killed two students and two teachers. Those of you following the case closely know that the juvenile attacker recently pled guilty to all 55 counts against him…without having a deal in place with prosecutors. Sentencing (as an adult) to follow.

His father, Colin Gray, was found guilty by a jury in March on charges including second-degree murder and involuntary manslaughter. A primary theory of prosecution was that he committed criminal negligence and cruelty to children by allowing his minor son to access a firearm and ammunition, even after receiving warning that his son was a danger to the safety of others (Kallingal & Sayers, 2024). This theory of prosecution is being used around the country with mixed results—more on that in another issue. Evidence at Colin Gray’s trial demonstrated he knew about his son’s deteriorating mental health, had been urged to secure his guns, and after the attack instructed his daughter to lie about his awareness of his son's mental health struggles (McGee, 2026). He was just sentenced to 15 years in prison (Lavietes & Gallo, 2026).

That’s all for Issue 1. I’d love to know what you’d like to see covered in future issues. Just hit Reply—I read every email.

A quick housekeeping note: Remember to check your Promotions, Other, or Junk folder for your first issue if you don’t see it. Moving it to your primary inbox will help ensure you don’t miss future issues.