# Incident report vs variance report vs occurrence report: what is the difference?

> Usually none. All three are short records of something that happened, or nearly happened, outside normal operations. The names come from habit and setting. Legally, what matters is the statute, how the record is made and routed, and who may read it, not the label.

Source: https://incidentkit.ai/blog/incident-report-vs-variance-report-vs-occurrence-report · Updated Oct 5, 2026

## Mostly, they are the same document

An incident report, a variance report and an occurrence report each record something that happened, or nearly happened, outside normal operations. The person who saw it writes it. The organization uses it to review the event and fix the system behind it.

The names come from habit and setting. A hospital quality team may say "patient safety event report." A plant says "incident report" or "near-miss report." CMS guidance for surgery centers says "adverse patient events."

**Example.** A nurse catches a wrong-strength dose before giving it. One hospital files it as a "variance," another as an "occurrence." The record holds the same facts either way.

What matters is what your state law and policy say about the record: who must report it, how fast, and who may read it afterward.

## Each name carries a flavor, not a rule

Use the table to decode what you hear. Then check how your own policy defines the word.

*How the three names are commonly used. Your policy's definition controls.*

| Name | Where you hear it | What it usually points to |
| --- | --- | --- |
| Incident report | Across settings. OSHA's Form 301 is titled "Injury and Illness Incident Report." AHRQ's PSNet uses "incident reporting" for voluntary patient safety systems. | Any unexpected event, near miss or unsafe condition. The broadest name. |
| Patient safety event or adverse event report | Hospital, accreditor and CMS language. The Joint Commission says "patient safety event." CMS says "adverse patient events" and expects near misses to be found too. | Events that reached, or nearly reached, a patient. |
| Variance report | Local usage in some hospitals and health systems. | A departure from expected care or policy, harm or not. |
| Occurrence report | Local usage in some facilities. Also in statutes, such as Pennsylvania's "event, occurrence or situation." | Something that happened. Often used loosely. |

## Every version should capture eight things

The wording of the form matters less than whether these eight things are present:

1. What happened, in time order, from what the reporter saw.
2. Date, time and exact location, such as room, bay or equipment ID.
3. Who was involved, by role or identifier.
4. What was done right away, including care given and hazards controlled.
5. The outcome for the person, on a [harm scale](https://incidentkit.ai/glossary/harm-scale) you have adopted.
6. Who was notified, and when.
7. Witnesses, equipment, lot numbers and anything else to keep.
8. Who owns the follow-up.

OSHA's Form 301 shows how short the core can be. It asks four things: what the employee was doing just before, what happened, what the injury or illness was, and what object or substance directly harmed the employee.

For wording tips, see [how to write an incident report](https://incidentkit.ai/blog/how-to-write-an-incident-report).

## The law cares about definitions, not labels

No statute we reviewed makes a "variance report" legally different from an "incident report" because of the label. The law attaches to your state's definition, how the record is made and routed, and who must report it where. Statutes as read on 2026-10-05.

Ask counsel which rules apply to you.

### Pennsylvania, MCARE Act

It covers ambulatory surgical facilities. An "incident" could have injured a patient but did not. A "serious event" caused unanticipated injury needing more care. Staff report either within 24 hours.

The facility reports serious events to the state within 24 hours of confirming them, and tells the patient in writing within 7 days.

### Florida, Statute 395.0197

Incident reports go to the risk manager and join the defense attorney's workpapers. They are subject to discovery but not admissible as evidence. Listed "adverse incidents," such as death or wrong-site surgery, go to the state within 15 calendar days.

### Federal PSQIA, 42 CFR Part 3

Patient safety work product reported to a patient safety organization is privileged, with exceptions. It excludes the medical record and other original information. Privilege depends on how information is collected and reported, not the document's name.

If you work with a [patient safety organization](https://incidentkit.ai/glossary/patient-safety-organization), how you set up the reporting path decides whether federal privilege can apply. Decide with counsel before you rename anything.

## Pick one word, define it, and map it

Pick one word and define it in policy. Map it to the words your regulators use. Staff should never wonder whether a near miss, a good catch or a caught wrong count "counts."

CMS says an ASC must track all patient adverse events and should find errors that cause near misses. The form behind your label must take both.

- Use plain questions on the form, such as "What happened?"
- Define near miss, adverse event and state categories in policy.
- Set the legal category in a separate field, assigned by a reviewer.
- Keep one record per event, so counts do not split across systems.

## The report starts the work

CMS tells surveyors to ask whether a surgery center stops at the immediate cause, such as staff error or equipment failure, or probes for root causes. Whatever your label, the follow-through is what gets reviewed.

Follow-through has four steps: route the report, investigate contributing factors, assign corrective actions with owners and dates, and check the fix worked. [Investigations](https://incidentkit.ai/product/investigations) and [corrective actions](https://incidentkit.ai/product/corrective-actions) in IncidentKit follow that path. Nothing closes until verified.

IncidentKit uses "incident" as the standard word. A pack sets the incident types and forms for a kind of site, so a surgery center's adverse events and a plant's near misses can live in one account. See [incident reporting in healthcare](https://incidentkit.ai/guides/incident-reporting-in-healthcare).

## Frequently asked questions

### Is a variance report the same as an incident report?

In most organizations, yes. Both record an event or a departure from expected care for internal review. Some facilities use "variance" for any departure from policy, including no-harm ones, but the name has no legal effect. Legal duties attach to your policy's definition and your state's rules.

### Can an incident report be used in court?

It depends on your state and how the report was created. Florida says incident reports are subject to discovery but not admissible as evidence. The federal PSQIA privilege protects patient safety work product reported to a patient safety organization. Ask counsel, and keep reports factual either way.

### What is the difference between an incident and an adverse event?

CMS surveyor guidance for surgery centers borrows Institute of Medicine definitions. An adverse event is an injury caused by medical management, not the underlying condition. A near miss is an error that did not result in an adverse event. An incident report can record either, plus unsafe conditions.

### Does OSHA require an incident report?

OSHA requires Form 301, or an equivalent, for each recordable work-related injury or illness. Complete it within 7 calendar days of learning about the case. It covers recordable cases only, so near misses need your own process.

### Which term do surveyors expect?

The guidance we reviewed requires no particular label. CMS asks whether a center tracks adverse patient events, identifies near-miss errors and analyzes causes. The Joint Commission uses "patient safety event." Use the word your staff know, and show the tracking, analysis and corrective action behind it.

## Sources

- [AHRQ PSNet primer: Reporting patient safety events](https://psnet.ahrq.gov/primer/reporting-patient-safety-events)
- [Pennsylvania MCARE Act (Act 13 of 2002), sections 302, 308 and 313](https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=PDF&SessYr=2002&ActNum=0013.&SessInd=0)
- [Florida Statutes 395.0197: Internal risk management program](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0300-0399/0395/Sections/0395.0197.html)
- [42 CFR 3.20 and 3.204: Patient safety work product and privilege](https://www.ecfr.gov/current/title-42/part-3/section-3.204)
- [CMS State Operations Manual, Appendix L: ambulatory surgical centers](https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/som107ap_l_ambulatory.pdf)
- [29 CFR 1904.29: Forms (OSHA 300, 300A and 301)](https://www.ecfr.gov/current/title-29/section-1904.29)

## Related

- [Incident report: definition and meaning](https://incidentkit.ai/glossary/incident-report)
- [Variance report: definition and meaning](https://incidentkit.ai/glossary/variance-report)
- [How to write an incident report: facts, not opinions](https://incidentkit.ai/blog/how-to-write-an-incident-report)
- [Incident reporting in healthcare: the complete guide](https://incidentkit.ai/guides/incident-reporting-in-healthcare)
- [ASC Incident Report Template for Surgery Centers](https://incidentkit.ai/templates/asc-incident-report)
- [State adverse event reporting for hospitals, ASCs and SNFs](https://incidentkit.ai/compliance/reporting-deadlines/state-reporting-overview)