A critical incident report form is the standardized document that healthcare facilities, nursing homes, disability service providers, and other regulated organizations use to record unexpected events that harm or endanger the people in their care. Federal rules set the deadlines, the categories of events that trigger a report, and the penalties for getting it wrong. The most serious allegations, including abuse and any event causing serious bodily injury, must be reported within two hours of forming a suspicion. Less severe events run on 24-hour or five-working-day clocks. Missing a deadline can expose an individual staff member to civil penalties of up to $300,000 and a facility to exclusion from Medicare and Medicaid.
Which Events Trigger a Report
A 2024 CMS final rule on home and community-based services standardized the minimum categories that every state must treat as reportable critical incidents:
- Unexplained or unanticipated death, including any death caused or suspected to be caused by abuse or neglect.
- Physical, sexual, verbal, psychological, or emotional abuse, whether by staff, other residents, or anyone else.
- Neglect, exploitation, and financial exploitation of a person receiving services.
- Unauthorized use of physical restraints, chemical restraints, or seclusion.
- Medication errors serious enough to prompt a call to poison control, an emergency department or urgent care visit, hospitalization, or death.
States can add categories above the federal floor.1Centers for Medicare & Medicaid Services. HCBS Access Final Rule
In nursing facilities, 42 CFR 483.12 requires reports of every alleged violation involving abuse, neglect, exploitation, mistreatment, injuries of unknown source, and misappropriation of resident property.2eCFR. 42 CFR 483.12 – Freedom From Abuse, Neglect, and Exploitation The CMS State Operations Manual gives concrete examples: staff taking demeaning photographs of residents, resident-to-resident altercations causing physical injury or mental anguish, and unwanted sexual contact.3Centers for Medicare & Medicaid Services. Appendix PP – State Operations Manual
Elopement counts when the person’s absence creates a genuine safety concern. Someone returning late from an outing with no safety risk generally does not qualify.
Hospitals accredited by the Joint Commission have a separate obligation for sentinel events, meaning patient safety events not related to the natural course of illness that result in death, permanent harm, or severe temporary harm. These require an immediate root cause analysis and a corrective action plan submitted to the Joint Commission.4The Joint Commission. Sentinel Events Sentinel event reporting sits on top of the regulatory incident reports owed to state and federal agencies, not in place of them.
Reporting Deadlines
Deadlines under 42 CFR 483.12 track the severity of the allegation, and they run on clock time. Nights, weekends, and holidays do not pause them:
- Two hours: any allegation of abuse, and any event resulting in serious bodily injury, must be reported to the facility administrator and the state survey agency within two hours of forming the suspicion.
- Twenty-four hours: allegations of neglect, exploitation, mistreatment, or misappropriation of resident property that do not involve abuse and do not result in serious bodily injury must be reported within 24 hours.
- Five working days: the results of the facility’s internal investigation into the alleged violation must be submitted within five working days of the incident.2eCFR. 42 CFR 483.12 – Freedom From Abuse, Neglect, and Exploitation
The CMS State Operations Manual confirms that reporting to both the administrator and the state agency must happen within the same windows.3Centers for Medicare & Medicaid Services. Appendix PP – State Operations Manual
Section 1150B of the Social Security Act adds an overlapping duty. Any “covered individual” at a federally funded long-term care facility who forms a reasonable suspicion of a crime against a resident must report it to both the Secretary of HHS and local law enforcement inside those same two-hour and 24-hour windows.5Centers for Medicare & Medicaid Services. S&C Letter 11-30-NH – Section 1150B Reporting Requirements
What the Form Has to Contain
Forms vary by agency and state, but the sections track the same underlying information. Getting each section right the first time keeps the document from bouncing back for clarification during a time-sensitive investigation.
Identifying Information
Enter the full legal name and date of birth of the person affected, the date and time the incident happened or was discovered, and the exact location within the facility. Include any case number or client identifier your agency uses. The form will also ask for the name and role of the person completing it and the names and contact information of any witnesses.
Factual Description
The narrative is where most reports go wrong. Write only what you directly observed or what was reported to you, and attribute reported information to whoever said it. Use concrete, observable detail. Instead of “the resident became agitated,” describe the specific behavior: raised voice, standing up from a wheelchair, striking a table with an open hand. Instead of “the resident was neglected,” record that the person was found without water for a measured period.
Skip diagnostic conclusions you are not qualified to make. If a resident has a bruise, describe its location, size, and color rather than writing that the resident was beaten. Investigators draw conclusions. Your job on the form is to give them facts they can rely on.
Immediate Actions Taken
Document the facility’s response: first aid given, calls to emergency services, separation of individuals involved, notification of family or legal guardian, and steps taken to keep other residents safe. Be specific about timing. “Called 911 at 3:14 p.m.” is more useful than “emergency services were contacted.”
Medical and Financial Details
Where they apply, record the exact dosage involved in a medication error, the estimated cost of any property damage, and a description of the injury along with the medical treatment provided. These details let investigators decide whether the event crosses a reporting threshold and how serious it is.
Where to Submit It
Most regulatory agencies accept incident reports through secure online portals maintained by the state survey agency. Some still accept encrypted fax. Whichever channel you use, save the confirmation number or timestamped receipt. That receipt is your proof of timely filing if the deadline is ever disputed later.
A single incident often triggers reports to more than one entity. A nursing home reporting suspected abuse may need to notify the state survey agency, adult protective services, and local law enforcement under different but overlapping legal requirements.2eCFR. 42 CFR 483.12 – Freedom From Abuse, Neglect, and Exploitation Section 1150B adds the Secretary of HHS and law enforcement to that list for any suspected crime against a resident.5Centers for Medicare & Medicaid Services. S&C Letter 11-30-NH – Section 1150B Reporting Requirements A written checklist of every entity that needs notification for each incident type prevents the gaps that surface during audits.
What the Facility Owes After Filing
Submission starts the process. Agency officials review the report and may request additional evidence, interview staff or residents, or conduct an unannounced onsite inspection to verify that the safety measures described in the report were actually put in place.
Internal Investigation
Federal regulations require the facility to investigate every allegation of abuse, neglect, exploitation, or mistreatment and submit the results within five working days.3Centers for Medicare & Medicaid Services. Appendix PP – State Operations Manual The investigation should document interviews conducted, evidence reviewed, and the factual conclusions reached. Reports that simply restate the original allegation draw scrutiny from surveyors.
Plan of Correction
When a survey or investigation finds deficiencies, the facility must submit a Plan of Correction within 10 days of receiving the official deficiency notice on Form CMS-2567. The plan has to address four things: what the facility will do for residents already harmed, how it will identify other residents who could be affected, what systemic changes it will make to prevent a recurrence, and how it will monitor those changes going forward.6Centers for Medicare & Medicaid Services. Plan of Correction Requirements Failing to submit an acceptable plan within that window can itself trigger additional enforcement.
Penalties for Missing a Deadline
Section 1150B of the Social Security Act sets the penalties for individuals who fail to report a reasonable suspicion of a crime against a resident:
- Standard violation: a civil monetary penalty of up to $200,000, plus potential exclusion from all federal healthcare programs.
- Aggravated violation: up to $300,000, again with potential program exclusion, if the failure to report worsens the harm or causes harm to another person.
These penalties apply to the individual “covered individual” who failed to report.5Centers for Medicare & Medicaid Services. S&C Letter 11-30-NH – Section 1150B Reporting Requirements
A long-term care facility that retaliates against an employee for reporting, or otherwise violates Section 1150B, can be fined up to $200,000 or excluded from Medicare and Medicaid for two years.5Centers for Medicare & Medicaid Services. S&C Letter 11-30-NH – Section 1150B Reporting Requirements A pattern of unreported or late-reported incidents can also cost a facility its operating license or its Medicare and Medicaid certification, which for most facilities means closing.
How Long to Keep the Report
Incident reports typically contain protected health information, which brings them under HIPAA’s documentation retention rules. Under 45 CFR 164.530(j)(2), compliance documentation must be retained for at least six years from the date it was created or the date it was last in effect, whichever is later.7eCFR. 45 CFR 164.530 – Administrative Requirements The HIPAA Security Rule applies the same six-year period to security incident reports.8U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule
Some state laws require longer retention for particular record types, so six years is a floor, not a ceiling. Keep the incident report, investigation notes, corrective action plans, and confirmation receipts together in one retrievable file. When surveyors or auditors ask for documentation years later, disorganized records are nearly as damaging as missing ones.
Protection From Retaliation for the Person Filing
If you are the staff member filing the report, Section 1150B prohibits your facility from retaliating against you for reporting a suspected crime, and the facility faces penalties of up to $200,000 or two-year exclusion from federal healthcare programs for doing so.5Centers for Medicare & Medicaid Services. S&C Letter 11-30-NH – Section 1150B Reporting Requirements Employees of federal contractors, subcontractors, grantees, and personal services contractors have separate protections under the National Defense Authorization Act for Fiscal Year 2013 for disclosures that relate to a contract or grant and involve a violation of law, gross mismanagement, waste of funds, abuse of authority, or a public safety danger.9HHS Office of Inspector General. Whistleblower Protection Information If you face pushback for filing, document the timing and the specific actions taken against you; those become the basis for a retaliation complaint.