Employer Liability for an Employee Attack

Many of the attacks described on our assault and battery practice page are committed by someone who was at work: a bouncer, a security guard, a store clerk, a delivery driver, a caregiver. When that happens, the employer may be responsible as well as the employee, and the employer is usually the one with insurance and assets.

California law gives two separate routes to the employer. One does not depend on the employer's fault at all; the other depends entirely on it. This guide explains both, the evidence each needs, and when punitive damages can reach the employer.

How do you hold an employer responsible, step by step?

Confirm who employed the attacker. A bar may employ its own bouncers or hire a security company; a home care agency may employ the caregiver or only refer one. The answer decides which business is the employer.
Ask whether the attack grew out of the job. Conduct is within the scope of employment if it is reasonably related to the kinds of tasks the employee was hired to do, or reasonably foreseeable in light of the employer's business (CACI 3720).
Look for a work-related dispute. A decision the Judicial Council quotes under CACI 3722 says it is enough if the injury "resulted from a dispute arising out of the employment."
Look at the employer's own knowledge. Prior complaints, earlier incidents, a known criminal history or warnings from co-workers support a claim that the employer negligently hired, supervised or kept the employee (CACI 426).
Consider punitive damages. They reach an employer only if it had advance knowledge of the employee's unfitness and acted with conscious disregard, authorized or ratified the conduct, or was itself guilty of malice, oppression or fraud (Civil Code 3294(b)).
Calendar the deadline. A lawsuit for assault or battery generally must be filed within two years (Code of Civil Procedure 335.1), or a claim presented within six months if the employer is a public entity (Government Code 911.2).

How do the two routes compare?

	Responsibility for the employee's act (respondeat superior)	Negligent hiring, supervision or retention
What must be shown	The attack was within the scope of employment	The employer knew or should have known the employee was unfit or posed a particular risk, and its negligence was a substantial factor in the harm
Does the employer's fault matter?	No; the employer is liable because its business creates the risk	Yes; it is the employer's own negligence
Attack outside the job's duties	Can still qualify if it grew out of a work-related dispute or a risk inherent in the business	Can qualify even if the attack was outside the scope of employment
Typical evidence	Job duties, what the employee was doing, what started the confrontation	Hiring file, background checks, prior complaints, discipline records
Rule	Civil Code 2338; CACI 3720, 3722	CACI 426

When is an attack "within the scope of employment"?

The instruction on unauthorized acts tells jurors that an employee's "wrongful or criminal conduct may be within the scope of employment even if it breaks a company rule or does not benefit the employer" (CACI 3722). Civil Code 2338 makes a principal responsible for its agent's wrongful acts "committed by such agent in and as a part of the transaction of such business."

The decisions the Judicial Council quotes draw the line this way. An employer is not responsible just because the job put the employee and the victim in the same place: one quoted decision says the incident "must be an 'outgrowth' of the employment," or the risk must be inherent in the working environment or typical of the employer's business. Another says the employer's liability for an intentional tort requires a "causal nexus to the employee's work."

Applied to assaults, that means context matters. A bouncer who injures a patron while removing him is doing the job he was hired to do. A decision quoted under CACI 3722 asked whether a retail employee's "physical eruption, stemming from his interaction with a customer, is a predictable risk of retail employment," and answered that it may well be. By contrast, a quoted decision notes that courts have rarely held an employee's sexual assault of a third party to be within the scope of employment, which is where negligent hiring and supervision become important.

What is negligent hiring, supervision or retention?

It is a claim that the employer itself was careless. Under CACI 426, the injured person must prove that the employee was or became unfit or incompetent, or posed another particular risk; that the employer knew or should have known of that risk to others; that the risk harmed the plaintiff; and that the employer's negligence in hiring, supervising or keeping the employee was a substantial factor in causing the harm.

The decisions quoted there describe it as direct liability for negligence, not vicarious liability, and one says a negligent supervision claim requires that a person in a supervisory position had prior knowledge of the employee's propensity to do the bad act. Another quoted decision found that an employer had no duty to investigate and discover an applicant's juvenile delinquency record, so the claim turns on what the employer knew or should reasonably have learned, not on everything that could have been found.

The Directions for Use add that liability may also be imposed on a business that negligently selects an independent contractor, which matters when a bar or apartment complex hires an outside security company. The property owner may also have its own duty to provide reasonable security; see when a business is responsible for an assault on its property.

Can punitive damages reach the employer?

Only in limited cases. Civil Code 3294(b) says an employer is not liable for punitive damages based on an employee's acts unless it had advance knowledge of the employee's unfitness and employed the person with a conscious disregard of others' safety, authorized or ratified the wrongful conduct, or was itself guilty of oppression, fraud or malice. For a corporation, that knowledge or conduct must belong to an officer, director or managing agent. A manager who keeps a bouncer on staff after repeated complaints of violence is the kind of fact this rule looks for.

What changes the answer?

You work for the same employer. Workers' compensation rules apply, and you generally cannot sue the employer for a co-worker's attack on a respondeat superior theory; see whether workers' comp is your only option after an assault at work.

The employer is a public entity. A public entity is liable for its employees' acts within the scope of employment (Government Code 815.2), but the six-month claim rule and other limits apply; see assaults by a public employee.

The attacker was a caregiver in the home. Elder abuse laws may add remedies; see who can be held responsible for abuse by an in-home caregiver.

The employee was driving. The same scope of employment rules apply to a crash, with the commute exceptions in CACI 3725 to 3727; see holding a driver's employer responsible.

The employer approved the attack afterward. An employer that ratifies an employee's wrongful conduct can be responsible for it, and ratification is one of the routes to punitive damages under Civil Code 3294(b).

What could this look like? An example

For example, imagine a man asked to leave a Petaluma nightclub after an argument at the bar. A bouncer walks him out, then shoves him down the front steps, breaking his wrist. Two earlier customers had complained to the manager that the same bouncer used excessive force, and he was kept on without any training or discipline.

Removing patrons is the bouncer's job, so the shove may be within the scope of employment, making the club responsible for it (Civil Code 2338; CACI 3720). The earlier complaints also support a claim that the club negligently kept and supervised him (CACI 426). Because the manager knew of the complaints and kept him working, the man may also seek punitive damages against the club if he can prove conscious disregard by an officer, director or managing agent (Civil Code 3294(b)). This example is made up to show how the rules fit together; it says nothing about any real case.

What mistakes do people make when an employee attacks them?

Suing only the employee, who may have no assets or insurance that covers a deliberate act.
Assuming an employer is never responsible for an intentional act.
Not finding out whether the attacker worked for the business or for an outside contractor.
Not asking early for the employer to keep its personnel file, complaints and video.
Missing the six-month claim deadline when the employer is a public entity.

What should I do this week?

Write down the attacker's name, job title, uniform or badge, and who they said they worked for.
Write down what led to the confrontation, word for word if you can.
Send the employer a written request to keep video, incident reports, complaints and the employee's personnel records.
Report the attack to police and get the report number.
Follow the evidence checklist in our guide on what to do in the first week after an assault.
Put the two-year date on your calendar using our guide to California personal injury deadlines.

Frequently asked questions

Is an employer responsible if the employee broke company rules?

It can be. CACI 3722 says wrongful or criminal conduct may be within the scope of employment even if it breaks a company rule or does not benefit the employer.

Does it matter that the employee was angry for personal reasons?

A decision quoted under CACI 3720 says the employee's predominant motive to benefit himself does not prevent the act from being within the scope of employment. What matters is whether the incident grew out of the work.

Who decides whether the attack was within the scope of employment?

Ordinarily the jury, according to a decision the Judicial Council quotes under CACI 3720, unless the facts are undisputed.

What if the security guard worked for a security company, not the bar?

The security company is the employer for respondeat superior purposes. The bar may still be liable for negligently choosing the company or for its own duty as a business to provide reasonable security.

What if the employer and the attacker both say they cannot pay?

Restitution and the state's Victim Compensation Board may help; see who else can pay when the attacker cannot.

Where would the case be filed?

Usually in the superior court of the county where the attack happened; see what to expect at Sonoma County Superior Court in an injury case.

If you were attacked by someone who was on the job, contact Young Law Group today at (707) 343-0556 or through our contact page for a free consultation about the employer's responsibility.

Can an employer be responsible when its employee attacks someone?