30 October: Is Your Harassment Policy Ready for "All Reasonable Steps"?

On 30 October, two changes to harassment law take effect under the Employment Rights Act 2025. For healthcare providers, the second one matters most: employers become liable when staff are harassed by patients, relatives and visitors, unless they've taken all reasonable steps to prevent it.

There's not much time. And an Acas survey of senior decision makers, carried out in the spring, found that 41% of employers weren't aware the changes were coming.

What changes on 30 October?

The sexual harassment duty gets tougher. Since October 2024, employers have had to take "reasonable steps" to prevent sexual harassment of their workers. From 30 October, that becomes "all reasonable steps". Acas puts it plainly: employers will be expected to take them all, with no exceptions. What counts as reasonable still depends on your size, sector and the work you do.

Employers become liable for third-party harassment. If a worker is harassed in the course of their work by someone outside the organisation, the employer can be liable, unless it took all reasonable steps to prevent it. This isn't limited to sexual harassment. It covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation - all of the protected characteristics.

Two existing rules sit alongside these. Tribunals can already increase compensation by up to 25% where an employer has failed in its duty to prevent sexual harassment. And since April 2026, disclosures about sexual harassment can count as protected whistleblowing disclosures.

Why this lands harder in healthcare

Most employers think of third parties as customers or contractors. In healthcare, they're patients, relatives and visitors, and staff deal with them in some of the most intimate and pressured settings there are. Personal care, home visits, lone working, night shifts, distressed families: each of these is a risk the new law expects you to have thought about.

There's a tension here too. A patient's behaviour may be linked to their condition, and good care means responding with compassion, not just enforcement. The law doesn't ask you to stop caring for people. It asks you to show you've assessed the risk to staff and taken reasonable steps to reduce it.

A practical checklist before 30 October

1.     Update your policy. Make sure it covers third-party harassment as well as harassment between colleagues, names the protected characteristics, and explains how patient and visitor behaviour will be handled.

2.     Do a risk assessment. Identify where staff are most exposed: lone working, community visits, personal care, night shifts, high-acuity settings. Record what you're doing about each one.

3.     Give people more than one way to report. Not everyone will go to their line manager. Include an anonymous route and your Freedom to Speak Up guardian.

4.     Train staff and managers. Staff need to know what to report and how. Managers need to know how to respond, investigate and support the person who raised it.

5.     Tell patients and visitors what you expect. Signage, patient information and admission agreements can set out the standard of behaviour and what happens if it isn't met.

6.     Plan your response to incidents. Decide in advance what options you have when a patient or relative harasses staff, from a conversation to changing the care arrangements, so decisions aren't made from scratch under pressure.

7.     Keep records. If you're ever challenged, you'll need to show what steps you took. A log of incidents and actions, and evidence of training and review, is the evidence you'll need.

8.     Give it board-level ownership. Name a board lead, and add staff safety from harassment to the risks your board actually discusses.

The governance angle

This is a good example of a duty that's easy to meet on paper and hard to meet in practice. A refreshed policy and a training module will tick a box. "All reasonable steps" asks something different: whether you know where your staff are at risk, and whether what you've done is actually working.

The Harbour Governance team will be covering what good looks like as guidance develops. In the meantime, if your policy hasn't been reviewed since 2024, this fortnight is the time.