Duty of Care and Business Continuity: What Employers Owe Their People in a Crisis

Ask a group of continuity practitioners what holds back their duty-of-care work and the answers arrive in a predictable order. Senior management pays attention only after something has gone wrong. There is no money for the tools: traveler tracking, a two-way notification platform, an employee assistance contract with real surge capacity. And nobody can say who owns the problem, because it touches HR, security, legal, facilities, communications and the continuity team all at once.

The three complaints share a root. Duty of care lives between functions, and such work tends to get done the week after an incident. This briefing covers what employers actually owe their people, where programs usually leak, and how to split the work so the first hour of a crisis is not spent arguing over who should be calling whom.

Nothing here is legal advice. Safety and employment law vary by state and by country, and counsel should review any policy you build on it.

The legal floor

The OSHA General Duty Clause

Section 5(a)(1) of the Occupational Safety and Health Act requires covered employers to keep the workplace free of recognized hazards that are causing, or are likely to cause, death or serious physical harm. OSHA reaches for it when no specific standard fits, which makes it the closest thing US federal law has to a general duty of care at work.

To make a General Duty Clause citation stick, OSHA generally has to show four things: a hazard existed and employees were exposed to it, the employer or its industry recognized the hazard, it was causing or likely to cause death or serious harm, and a feasible way to reduce it was available. The continuity angle is the word "recognized." Once a hazard appears in your own risk register, your business impact analysis or a near-miss report, arguing that the organization did not recognize it becomes difficult. The answer is not a thinner risk register. It is an owner and a documented response for every hazard on it.

Emergency action plans under 29 CFR 1910.38

Where an OSHA standard calls for an emergency action plan, 29 CFR 1910.38 sets the minimum contents:

• procedures for reporting fires and other emergencies
• evacuation procedures and exit route assignments
• procedures for employees who stay behind to run critical operations before they evacuate
• procedures to account for all employees after evacuation
• procedures for employees who perform rescue or medical duties
• the names or job titles of people who can explain the plan

Employers with ten or fewer employees may communicate the plan orally. The plan must be reviewed with each covered employee when it is first developed or the employee is first assigned, when that person's responsibilities under it change, and whenever the plan itself changes. Most employers write one regardless, since it is the first document an investigator or plaintiff's lawyer will request.

Look again at the fourth bullet. "Account for all employees after evacuation" is where workplace safety and business continuity meet. Most plans satisfy it with a headcount at the assembly point, which works for a fire drill at 10 a.m. and fails for an incident at 2 a.m. with half the workforce at home.

State law, negligence and workers' compensation

Beyond federal OSHA, many states run their own OSHA-approved plans, and some add specific obligations. California's workplace violence prevention law (SB 553) required most California employers to have a written workplace violence prevention plan in place from July 1, 2024, for example.

Then there is ordinary negligence. Workers' compensation is generally the exclusive remedy for employees injured on the job, with exceptions that vary by state, but it does not cover everyone your incident touches. Contractors, visitors and family members can bring claims, and courts tend to ask what a reasonable organization would have done with the information it had. Foreseeability and documentation decide a lot of those arguments.

The moral floor sits higher

Employees will not judge you against 1910.38. They will remember whether anyone called, whether the company knew where they were, and whether someone checked on their family. After regional disasters such as Hurricane Katrina in 2005 and Superstorm Sandy in 2012, the needs that surfaced were mostly practical: pay that kept arriving, flexible leave, help with temporary housing. None of that is legally required. All of it shapes whether people come back.

Who is actually in scope

The weakest point in most programs is the population list. The HR system knows who is employed. It rarely knows where they are today.

Travelers. Trips booked through the corporate travel tool are visible. Trips booked direct and personal days tacked onto business travel usually are not. Decide in advance who can authorize an evacuation and who pays for it, and make sure the assistance provider's number is on every traveler's phone, not in a policy PDF.

Remote and hybrid workers. OSHA has said since 2000 that it will not inspect home offices, and that position is sometimes read as "remote staff are out of scope." They are not out of scope when a hurricane is heading for their county. Location-based alerting depends on home addresses that are current, which means an annual data check rather than the address on file from onboarding. Our article on continuity planning for hybrid work covers the wider implications of losing the office as the default gathering point.

Contractors, temps and visitors. OSHA's multi-employer worksite policy means more than one employer can be cited for the same hazard, depending on who created it, who exposed workers to it, who was responsible for fixing it and who controlled the site. In practice, contractors are often absent from the notification platform because they are not in the HR feed. Fix it at the source: contractor rosters and the visitor management log should feed the same accountability list, and contracts should state who accounts for whom.

Accountability: the first hour

Leadership's first three questions never change: who was in the affected area, are they safe, and who needs help? A workable sequence:

1. Define the affected population. Building occupants, plus travelers in the area, plus remote staff within a radius. Pre-build the queries so nobody is writing them during the incident.
2. Send a check-in poll. Two or three response options ("I'm safe," "I need help," "I'm not in the area"). Long free-text replies cannot be counted.
3. Escalate non-responders on a clock. A second message, then a call from the manager, then the emergency contact, then local authorities if the situation warrants. Write down the intervals before you need them.
4. Close the loop. Report numbers, not adjectives: accounted for, needing help, not yet reached. Repeat on a fixed cadence until the last number is zero.

None of this works without a notification system people actually receive. Personal mobile numbers, opt-in for texts, multiple channels, pre-approved templates and a short list of who may send. Our guide to mass notification systems and what to test goes through the failure points, most of which are data problems rather than software problems.

If your organization runs a crisis room, give accountability a standing line on the status board. The way public emergency operations centers organize information is a good model: one source of truth, a time stamp on every figure.

Aftercare

Physical safety is the first obligation, not the last. Psychological first aid (PFA), widely used by disaster-response organizations in the early days, is simple in outline: make people safe and comfortable, meet practical needs, give clear information, connect them to family and support, and avoid pressing anyone to relive the event. It is not therapy, and managers can be trained to deliver the basics.

Several clinical guidelines advise against routine single-session "debriefings" that push everyone to recount the incident in detail. Offer support, make it easy to accept, and do not make it mandatory. Confirm your employee assistance program can handle a surge and put counselors on site. Reactions sometimes surface weeks later, on return to the site or on anniversaries.

Documentation

If the incident is ever reviewed by a regulator, an insurer or a court, the record will matter as much as the response. Keep:

• the decision log, with times and who decided
• notifications sent, delivery data and responses
• the accountability roster at each reporting interval
• support offered and accepted (aggregate figures only; health details stay with HR or the provider)
• the plan versions in force, training records and exercise reports

Ask counsel, before any incident, how after-action reviews should be framed and who should commission them.

Who owns what

Add facilities and corporate communications if they are separate functions. Every cell needs a name next to it.

Duty-of-care checklist

• A written emergency action plan for every site, reviewed with each employee as 1910.38 requires
• A single accountability list combining employees, contractors, visitors and travelers
• Home addresses and mobile numbers verified within the last year
• Pre-built notification audiences for each site and region
• Written escalation intervals for non-responders
• Named authority to approve evacuation, emergency travel and emergency spending
• An EAP contract with confirmed surge and on-site capacity
• Managers trained in the basics of psychological first aid
• A decision log template and someone assigned to keep it
• Contract language stating who accounts for contractor staff
• An accountability exercise at least once a year, timed and measured

Frequently asked questions

Is duty of care a legal requirement in the United States?

Not as a single statute. The obligation comes from several sources: the OSHA General Duty Clause, specific standards such as the emergency action plan rule, state safety and workplace violence laws, and general negligence principles. Together they amount to a duty to address foreseeable hazards with reasonable measures, and counsel should map which ones apply to you.

Do we have to track where employees are at all times?

No, and most organizations should not try. Travel itineraries, office badge data and a current home address cover most incident scenarios without continuous location tracking. Collect the minimum you need, tell employees what you hold and why, and check state privacy rules with counsel before adding anything more intrusive.

Are we responsible for contractors during an emergency?

Often, at least in part. Under OSHA's multi-employer worksite policy more than one employer can be responsible for the same hazard, and negligence claims do not depend on employment status. The practical answer is to include contractors in your accountability list and settle in the contract who checks on whom.

How fast should we be able to account for everyone?

There is no regulatory clock for most organizations, so set your own target and measure it. Run a timed accountability exercise, record how long it takes to reach most of the affected population and how long the last few take, then fix whatever slowed you down. The tail of non-responders, not the average, is usually where the real problems are.