Sign Up
Login
Try for Free
Login
An incident or adverse event report is an internal risk-management record of an unexpected event affecting a client, visitor, or staff member: a fall, medication error, elopement, assault, or suicide attempt. Staff file it with the practice or facility, separate from the clinical record. Facility and program rules often mandate it; for solo private practice it is convention. Most run 300 to 600 words.
The staff member who observed or discovered the event: clinicians, front-office and support staff, program managers; a supervisor or risk lead reviews
Practice leadership and risk management, quality and safety committees, malpractice carriers, and, where mandated, state agencies, accreditors, and oversight commissions
300 to 600 words · 15 to 30 minutes by hand (clinical team estimate)
Risk-management / quality-assurance record, kept outside the chart (compare: crisis note, mandated report, progress note)
As soon as practicable after a fall, medication error, elopement, assault, restraint or seclusion event, self-harm event, death, privacy event, or near miss
Mandated for facilities and funded programs (CMS, state, NDIS, aged-care rules); for solo private practice a risk-management convention, not law
An incident and adverse event report is the internal record a practice or facility creates when something unexpected happens to a client, visitor, or staff member: a fall, a medication error, an elopement, an assault, a restraint or seclusion event, a suicide attempt or death, a privacy event, or a near miss. You will also see it called an occurrence report, variance report, unusual occurrence report, critical incident report, serious incident report, or safety event report. It descends from the hospital occurrence report of the mid-century risk-management movement and was standardized by three milestones: the Joint Commission's Sentinel Event Policy (1996), the Institute of Medicine's To Err Is Human report (1999), which estimated up to 98,000 hospital deaths a year from medical error, and the Patient Safety and Quality Improvement Act of 2005, which created Patient Safety Organizations and a conditional federal privilege for patient safety work product.
What defines the document is where it lives: outside the clinical record. New York's mental health incident-management regulation states the split in black letter: incident-related documents are quality assurance records "maintained separately from the patient's clinical record," while the clinical impact of the event must be recorded in the chart (14 NYCRR 524.9). The report is an organizational account written for risk management and quality improvement; the chart keeps the client's condition, assessment, and care. That is also what separates it from its neighbors: a crisis note documents a clinical crisis contact and belongs in the chart, and mandated reporting documentation records a legal duty discharged to an outside authority, also in the chart. One event can generate several documents; this is the only one the client's record should never mention.
Facility-based and publicly funded settings use them because they must: hospitals and inpatient units under Medicare conditions of participation and state rules, community programs licensed by state behavioral health agencies, organizations accredited under Joint Commission or CARF incident-management standards, and NDIS and aged-care providers in Australia under their reportable-incident regimes. Group practices and solo clinicians use them because their malpractice carriers ask them to: a short internal form, completed the same day, is the version of events written while memory is fresh rather than two years into a claim. The trigger is any unexpected safety-relevant event, and near misses count. When the event is a clinical crisis, the chart documentation comes first (see the crisis note); the incident report is the organizational record filed alongside, never instead.
Event basics. Date, exact time, precise location, and the event type: fall, medication error, elopement, aggression, restraint or seclusion, self-harm event, death, privacy event, or near miss. Pitfall: "during the afternoon shift" instead of a clock time. Regulatory clocks run from when the organization knew, and a report that cannot establish when that was cannot prove a deadline was met.
Persons involved and witnesses. Who was affected (client, visitor, or staff member) and every person who saw any part of the event, with role and contact details. Pitfall: the unlisted witness. By the time anyone investigates, the visitor who saw the fall is unreachable and the report is the only account left.
Factual narrative. First person, in sequence, only what the reporter saw and heard, with the words people used. Pitfall: conclusions and blame. "Client was being difficult" or a guess at the cause converts a safety record into an admission drafted for the opposing attorney; describe the observable sequence instead.
Immediate actions and care provided. The assessment offered, first aid given, the EMS decision, who examined the person, and what the person chose. Pitfall: an event with no documented response. Care that was given but never recorded reads as neglect when the record is the only witness.
Injury and outcome. Apparent injury or "none observed," plus a follow-up window and who owns the reassessment. Pitfall: letting "no injury" close the file at the scene. Some injuries surface days later, and the strongest reports anticipate that with a planned check.
Notifications made. Each person and agency notified, with date, time, and by whom: supervisor or practice owner, family or guardian where appropriate, and any regulator, agency, or carrier your setting requires. Pitfall: the missed clock. CMS expects a restraint or seclusion death reported by close of the next business day, the NDIS and Australian aged-care regimes run 24-hour deadlines for the most serious categories, and Saskatchewan gives three business days.
Reporter identity and review. The person who observed the event writes and signs the report, with role and date; a supervisor reviews and dates the review. Pitfall: secondhand authorship. A report written by someone who was not there is hearsay layered on hearsay, and its evidentiary value drops with each retelling.
Routing and the chart cross-walk. Where the report is filed (risk management or practice QA files) and a reminder of what goes in the chart instead: the client's condition, assessment, and care. Pitfall: writing "incident report filed" in a progress note. The chart reference ties the protected record to the discoverable one and can waive the separation that QA privilege depends on.
INCIDENT / ADVERSE EVENT REPORT (internal QA record; file apart from the clinical record) Practice/program: ____________________ Report #: ______________ EVENT Date: __________ Time: ________ Exact location: ______________ Type: [ ] fall [ ] medication error [ ] elopement [ ] aggression or assault [ ] restraint or seclusion [ ] self-harm or suicide attempt [ ] death [ ] privacy event [ ] near miss [ ] other: _____________________________________ PERSONS INVOLVED Person affected (initials): __________ [ ] client [ ] visitor [ ] staff Witnesses (name, role, contact): ___________________ ________________________________________________________________ FACTUAL NARRATIVE (first person, in sequence; only what was seen and heard; no conclusions, blame, or speculation) ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ IMMEDIATE ACTIONS AND CARE PROVIDED Assessment offered / first aid: ________________________________ EMS called: [ ] yes [ ] no Examined by: ______________________ INJURY / OUTCOME Apparent injury: [ ] none observed [ ] described here: ________ ________________________________________________________________ Follow-up window and who reassesses: ___________________________ NOTIFICATIONS MADE (person or agency, date, time, by whom; note any mandatory deadline for your setting) Supervisor / practice owner: ___________________________________ Family or guardian (if applicable): ____________________________ Regulator, agency, or carrier (if required): ___________________ REPORTER Name and role (the person who observed): _______________________ Signature: ____________________ Date/time completed: __________ Supervisor review: ____________________ Date: _________________ ROUTING: file with risk management or practice QA files, apart from the clinical record. Chart the clinical impact (condition, assessment, care) in the clinical record; do not reference this report there.
Free to use and share, no signup. The PDF includes a one-page cheat sheet with section-by-section pitfalls and a pre-sign checklist; the DOCX is the blank template, ready to adapt.
Scenario: an adult client trips on an entry mat in a group-practice waiting room; the front-office coordinator who saw it happen writes the report the same afternoon. All details are fictional.
Incident / Adverse Event Report. Cedar Grove Counseling Associates · Report #: 2026-014 · Internal QA record, filed apart from the clinical record
Event: 07/16/2026, 2:47 PM, front waiting room near the check-in window. Type: client fall.
Persons involved: Client R.L., 58 (initials per practice policy on this form). Witness and reporter: D. Marsh, front-office coordinator. Responder: T. Okafor, LPC.
Factual narrative (D. Marsh): At approximately 2:47 PM I was at the front desk and saw R.L. walking from the check-in window toward the seating area. R.L.'s left shoe caught the corner of the entry mat. R.L. fell forward, landing on both knees and both hands. I did not see R.L.'s head contact the floor or any furniture. R.L. said "I'm fine, my shoe caught the mat." I stayed with R.L. and asked T. Okafor to come to the waiting room at 2:48 PM.
Immediate actions and care: T. Okafor helped R.L. to a chair at 2:49 PM and offered an assessment. R.L. reported mild soreness in both knees, rated 2 of 10, and no other pain. Skin intact, no swelling observed. R.L. declined emergency services when offered. Ice pack provided and accepted. R.L. chose to stay for the scheduled 3:00 PM appointment and walked to the office without apparent difficulty.
Injury / outcome: No injury observed beyond reported knee soreness. R.L. given written guidance to monitor and to contact the practice or a physician if pain increases. Front office to check in with R.L. at the 07/23/2026 visit.
Notifications: Practice owner C. Hale, PhD, notified in person by D. Marsh on 07/16/2026 at 3:35 PM. Malpractice carrier notified administratively per practice policy on 07/17/2026; no claim asserted. C. Hale confirmed no state or program reporting requirement applies to this outpatient setting for this event.
Chart cross-walk: T. Okafor documented the reported soreness, the brief assessment, and the session's clinical content in the clinical record. This report is filed with practice QA records and is not referenced in the chart.
Reporter: D. Marsh, front-office coordinator (observer). Signed 07/16/2026, 4:10 PM. Supervisor review: C. Hale, PhD, 07/17/2026.
This sample is fictional and for educational purposes. It does not describe a real client, practice, or event.
Writing these after every session? BastionGPT drafts complete notes from bullets, dictation, or a transcript.
Generate a note from bulletsWrite the report as if people you did not write it for will read it, because they may. Its protections are real but conditional: the federal Patient Safety Act privilege attaches only to material created inside a patient safety evaluation system for reporting to a listed Patient Safety Organization (42 CFR Part 3), and state quality-assurance privileges vary widely. The Kentucky Supreme Court held in Tibbs v. Bunnell (2014) that information normally contained in an incident report was not privileged under the federal act and could be discovered, while an Illinois appellate court upheld the privilege for properly channeled PSO material in 2018; Florida's constitution goes further and gives patients a right to obtain records of adverse medical incidents. Access runs differently than the chart, too: an incident report ordinarily sits outside the HIPAA designated record set (45 CFR 164.501), so the client right of access usually does not reach it, Florida again excepted. The working rules that follow: objective facts only, completed promptly, kept out of the chart, routed per policy. If you or a client needs immediate support: call or text 988 (US), 9-8-8 (Canada), or Lifeline 13 11 14 (Australia).
The reporting duties around the form are a separate layer, and for facilities and funded programs they are law with unforgiving clocks. Medicare hospitals must report a death associated with restraint or seclusion to CMS by close of business the next business day after learning of it, and must note the date and time of that report in the medical record (42 CFR 482.13(g)). NDIS providers in Australia notify the Commission within 24 hours for the most serious categories; aged-care providers report Priority 1 incidents within 24 hours under rules that commenced 1 November 2025; Saskatchewan requires written notice within three business days and a final investigation report within 60 days; Quebec makes declaring every incident or accident mandatory on the AH-223 form and requires disclosure to the user after any accident with consequences. None of this touches a claim: an incident report is not billed, has no procedure code, and has no denial codes, which is why billing-oriented template sites rarely cover it well. For a solo outpatient practice, no statute reviewed for this page requires an internal incident report at all; it is risk-management convention, and your malpractice carrier's guidance is the document to follow. When an incident involves a death, a report to an authority, or a likely claim, consult your attorney or board; state rules vary. The clinical side of the same event belongs in the chart: a crisis contact in a crisis note, a duty-to-warn action in mandated reporting documentation, and the client's condition and care in the progress note.
The dominant failure is silence. HHS Office of Inspector General work found hospital incident reporting systems captured an estimated 14 percent of patient-harm events experienced by Medicare beneficiaries (January 2012), and its follow-up study found 49 percent of sampled 2023 harm events entirely absent from hospital incident-reporting and surveillance systems, with another 16 percent indeterminate (OEI-06-18-00401). Timeliness fails almost as often: Saskatchewan's Provincial Auditor reported in 2024 that 62 percent of initial critical-incident notices reached the Ministry later than the three-business-day requirement, and 90 percent of final reports missed the 60-day deadline. The Joint Commission's 2024 sentinel event data shows behavioral health settings carry a distinct profile: suicide and self-inflicted injury led at 41 percent of reported behavioral health events, ahead of falls at 21 percent and treatment delays at 19 percent. The BastionGPT Clinical Advisory Board sees the same errors most often in incident report reviews:
BastionGPT is specifically trained, tuned, and clinically tested on incident and adverse event reports.
See how clinicians use it day to day on the AI therapy notes page.
Many BastionGPT users report saving more than 90 minutes per day on documentation.
HIPAA-compliant with a signed BAA on every plan. Your data is never used to train models. BastionGPT drafts, you review and sign.
No. It is filed with risk management or the practice's QA files, separate from the clinical record; New York's mental health regulation codifies exactly that split, and risk-management guidance across professions repeats it. The chart gets the clinical impact of the event: the client's condition, your assessment, and the care provided, documented in the progress note as usual. Do not write "incident report filed" in the chart; the clinical note should stand on its clinical content alone.
It depends on the setting, and the difference is the most misunderstood thing about these reports. Facility and program rules are law: Medicare hospitals must report restraint and seclusion deaths to CMS, New York licensed programs report through the OMH and Justice Center regimes, NDIS and aged-care providers in Australia carry 24-hour clocks for the most serious categories, and several Canadian provinces mandate critical-incident reporting. For a solo outpatient private practice, no statute reviewed for this page requires an internal incident report; it is risk-management convention backed by your malpractice carrier's guidance.
No universal list exists; each regime defines its own, and that absence is worth knowing in itself. Common categories: falls, medication errors, elopement from a program, aggression or assault, restraint or seclusion, suicide attempts and deaths, abuse or neglect allegations, privacy events, and near misses. The Joint Commission defines a sentinel event as a patient safety event resulting in death, permanent harm, or severe temporary harm, and expects accredited organizations to define and review their own list. A practical private-practice threshold: any client death, suicide attempt, serious injury, restraint use, or event likely to generate a complaint or claim.
Generally no. An incident report is an administrative quality-assurance record, ordinarily outside the HIPAA designated record set, so the right of access that covers the chart does not usually reach it. Florida is the standing exception: its constitutional Amendment 7 gives patients a right to records of adverse medical incidents. Disclosure is a separate duty from access: Quebec and Ontario law require telling the client what happened after a harmful incident, and Australia's open disclosure framework sets the same expectation, so keeping the report out of the record never means keeping the client in the dark.
Treat it as potentially discoverable. The federal Patient Safety Act privilege applies only to material created within a patient safety evaluation system for a listed Patient Safety Organization, and it expressly does not protect the medical record or information kept outside that system. Courts split: Kentucky's Supreme Court allowed discovery of incident-report information in Tibbs v. Bunnell (2014), while an Illinois appellate court upheld the privilege for properly channeled PSO material in 2018, and state QA privileges vary as much. The defensible posture: objective facts only, no conclusions, filed per policy, never referenced in the chart, and questions to your carrier or attorney before anything is produced.
Whatever your tightest applicable regime says, and they are short. Medicare hospitals: a restraint or seclusion death reported to CMS by close of the next business day. Joint Commission accredited organizations: a root cause analysis within 45 business days of becoming aware of a sentinel event. NDIS providers: 24 hours for the five most serious categories. Australian aged care: Priority 1 incidents within 24 hours. Saskatchewan: written notice in three business days and a final report in 60 days. Solo practices with no mandated regime should still complete the internal report the same day; contemporaneous is the standard that holds up.
Two records, two purposes. In the clinical record, document the facts contemporaneously: what you knew and when, your risk assessments and the reasoning behind the level of care, contacts made, and consultation sought. Never alter earlier notes; anything added later is dated as an addendum. Complete your organization's critical-incident report separately, per policy and any state program rule (some states require licensed programs to report a client death within 24 hours). If a safety plan existed, it stays in the chart as part of the record of care. Involve your malpractice carrier and attorney early, and use postvention support for yourself and your team; losing a client is one of the hardest events in clinical practice.
By where it lives and who it serves. A crisis note is chart documentation of a clinical crisis contact and the intervention delivered. Mandated reporting documentation is chart evidence that a legal reporting duty was met. The incident report is the organizational record of the event itself, kept outside the chart for risk management and quality assurance. One event can generate all three: a client's threat during a session might produce a crisis note, a duty-to-warn record, and an agency incident report, each in its own place.
Yes. Give it the facts as bullets: what you saw, times, who was present, what you did, and who you notified, and it drafts an objective, first-person report with the conclusions left out, then checks it for blame language and missing elements. It can also draft the separate progress note that records the clinical impact without referencing the report. BastionGPT is HIPAA-compliant with a signed BAA on every plan, and your data is never used to train models.
Educational content, not legal or billing advice. Sample notes are fictional. Follow your organization's policies and your board, payer, and jurisdiction requirements.