# F609: reporting of alleged violations

> F609 covers reporting of alleged abuse, neglect, exploitation, mistreatment, injuries of unknown source and misappropriation. Allegations of abuse, or that result in serious bodily injury, must be reported within 2 hours. Others must be reported within 24 hours, and investigation results within 5 working days. Covered individuals must also report suspected crimes to the state agency and law enforcement.

Source: https://incidentkit.ai/compliance/f-tags/f609 · Updated Oct 5, 2026

## Key facts

- **Tag title:** Reporting of Alleged Violations
- **Regulation:** 42 CFR 483.12(b)(5), (c)(1) and (c)(4), with section 1150B of the Social Security Act
- **Guidance relied on:** Appendix PP Rev. 232 (issued 07-23-25, in use since 04-28-25). F609 section Rev. 211 (02-03-23)
- **Initial report:** Immediately, no later than 2 hours for abuse or serious bodily injury. No later than 24 hours otherwise
- **Results report:** Within 5 working days of the incident
- **Clock type:** Real clock time, not business hours
- **Severity note:** Level 1 does not apply. CMS gives examples at levels 2, 3 and 4
- **How often cited:** 385 citations in CMS Region 5 (IL, IN, MI, MN, OH, WI) in the first half of 2026 (Wisconsin DHS summary)

- **Citation:** F609 · 42 CFR 483.12(b)(5), (c)(1) and (c)(4)
- **Authority:** CMS
- **Applies to:** Medicare-certified skilled nursing facilities, Medicaid-certified nursing facilities

## What F609 covers

F609 holds two reporting duties in 42 CFR 483.12. The facility reports every alleged violation and its investigation results ((c)(1) and (c)(4)). Each covered individual also reports a reasonable suspicion of a crime against a resident. That duty comes from section 1150B of the Social Security Act ((b)(5)). A covered individual is any owner, operator, employee, manager, agent or contractor.

An alleged violation is a situation anyone observes or reports, before it is investigated. It could be abuse, neglect, exploitation, mistreatment, an injury of unknown source or misappropriation. The reporter need not say the word abuse. The duty applies if staff could reasonably conclude noncompliance might exist.

An injury of unknown source meets all three tests. Nobody saw the cause. The resident cannot explain it. It is suspicious because of its extent, location, number or recurrence. For abuse, the facility should not judge credibility before it reports.

## The reporting clocks

*F609 reporting requirements*

| What is reported | Who reports | To whom | Deadline |
| --- | --- | --- | --- |
| Alleged abuse. Or any alleged violation that results in serious bodily injury. | The facility | Administrator, State Survey Agency, adult protective services (where state law gives it jurisdiction) and other officials under state law | Immediately, no later than 2 hours after the allegation is made |
| Alleged neglect, exploitation, mistreatment or misappropriation. No abuse and no serious bodily injury. | The facility | Same recipients | No later than 24 hours |
| Investigation results. Corrective action if verified. | The facility | Administrator and officials, including the State Survey Agency | Within 5 working days of the incident |
| Reasonable suspicion of a crime. With serious bodily injury. | Each covered individual | State Survey Agency and local law enforcement | Immediately, no later than 2 hours after forming the suspicion |
| Reasonable suspicion of a crime. Without serious bodily injury. | Each covered individual | State Survey Agency and local law enforcement | No later than 24 hours |

A state may add recipients or shorter clocks. It may not drop a reportable category or lengthen a federal clock.

> **Personal duty** Under 42 U.S.C. 1320b-25, a late report can bring a civil money penalty of up to $200,000, or $300,000 if the delay worsens harm. Both are adjusted annually. Exclusion from federal health programs is also possible. The facility cannot stop anyone reporting directly to law enforcement.

## What surveyors check and ask for

*What surveyors ask for and what to have ready*

| Surveyors ask for | Have ready |
| --- | --- |
| The initial report to the State Survey Agency | What was reported and when, accurate to the best of the facility's knowledge. Also how residents are protected. |
| The sequence of times | Clock times: when staff first knew, when the administrator was told, when each report was sent |
| The follow-up report | Investigation results and corrective action within 5 working days, plus updates to the first report |
| Annual notice to covered individuals | A notice or sign-in for every covered individual, contractors included. In a language each understands. |
| Policies | Who is a covered individual. Which crimes. Serious bodily injury. The clocks and the recipients. |
| Staff answers | Staff can say who they report to, how fast, and that they will not be punished. The employee rights notice is posted. |

CMS publishes sample initial and five-day report forms (Exhibits 358 and 359 in the State Operations Manual). A deliberately misleading report can itself be cited, such as one that omits facts or downplays an event.

## What makes an F609 deficiency more severe

Severity follows what the failure to report allowed to happen. CMS says level 1 does not apply to F609.

*CMS examples of F609 severity (crime reporting)*

| Level | Example from CMS guidance |
| --- | --- |
| 4: immediate jeopardy | A cognitively impaired resident said she was touched and named the person. Staff judged her confused. Nobody reported, the person kept access, and the resident developed a sexually transmitted infection. |
| 3: actual harm | A nurse aide saw a nurse take a resident's opioid dose. The aide did not report, out of fear of causing trouble. Other staff did not know their duty to report suspected drug diversion. |
| 2: potential for more than minimal harm | No annual notice of reporting duties and no employee rights sign. Five staff had no notice. Two new hires did not know their duties. |

## Documentation gaps that lead to citations

- The record has dates but no clock times, so the 2-hour clock cannot be shown.
- A supervisor decides an event does not qualify. CMS says not to pre-judge whether an abuse allegation is credible.
- An injury found at shift change is logged as a fall. Nobody asks if it fits the unknown-source test.
- The initial report is filed. The 5-working-day results report is missing or has no corrective action.
- The annual crime-reporting notice reaches employees, not contractors or agency staff.
- The facility assumes the administrator told law enforcement. Surveyors verify a report was made.

## Show good reporting and follow-through

1. **Time-stamp discovery** Record the clock time staff first learned of the event and who they told.
2. **Escalate at once** Get it to the administrator at once. Never spend the 2-hour clock waiting.
3. **File and keep proof** Report to the State Survey Agency and others required. Keep what was sent, the time and the confirmation.
4. **Finish by day 5** Send investigation results and corrective action within 5 working days. See [F610](https://incidentkit.ai/compliance/f-tags/f610).
5. **Notify every year** Tell every covered individual each year, contractors and agency staff included. Keep the proof.

## How IncidentKit supports F609

IncidentKit helps you prove timing. The State Survey Agency report still goes through your state's channel. [Routing and escalation](https://incidentkit.ai/product/routing-and-escalation) alerts the roles you set. The [audit trail](https://incidentkit.ai/product/audit-trail) logs who did what and when. [Lauren](https://incidentkit.ai/product/lauren) drafts the narrative from staff answers, marked "Lauren · draft" until a person reviews, edits and signs. Reporting in Spanish and other languages is rolling out.

## What the rule asks for, and how IncidentKit supports it

| Requirement | IncidentKit |
| --- | --- |
| Report abuse or serious bodily injury within 2 hours; other allegations within 24 hours | Routing and escalation alerts the administrator and other roles you set. The audit trail logs each hand-off. |
| Keep proof of what was reported and when | Keep the state report confirmation and any law enforcement case number on the incident record. |
| Send investigation results within 5 working days | The investigation record holds findings and disposition. Corrective actions carry an owner, due date and evidence. |
| Reports that are accurate and complete | Lauren asks the follow-up questions a risk manager would ask. A person reviews, edits and signs. Drafted fields read "Lauren · draft" until approved. |
| Annual notice to covered individuals | IncidentKit runs alongside your HR and training systems and does not run the annual notice. Spanish and other-language reporting is rolling out. |

## Frequently asked questions

### What are the F609 reporting deadlines for a nursing home?

Alleged abuse, or any allegation that results in serious bodily injury: no later than 2 hours after the allegation is made. Other alleged violations: no later than 24 hours. Investigation results: within 5 working days of the incident. The clocks use real time.

### Who must the nursing home report to?

The facility reports to its administrator and other officials under state law. These include the State Survey Agency and, where state law gives it jurisdiction, adult protective services. Each covered individual also reports a reasonable suspicion of a crime. They report it to the State Survey Agency and local law enforcement.

### What is an injury of unknown source?

An injury nobody saw happen. The resident cannot explain it. It is suspicious because of its extent, location, number or recurrence. CMS examples include unexplained fractures, patterned bruises, unexplained genital-area injuries and injuries needing a hospital visit. Report these as alleged violations.

### Does a resident-to-resident altercation have to be reported?

Yes, if a willful action caused physical injury, pain or mental anguish. Also yes for unwanted or non-consensual sexual contact, bullying, threats or similar conduct. Cognitive impairment does not rule out a deliberate act. Non-targeted outbursts and light taps with no injury, pain or distress generally need no report.

## Sources

- [eCFR, 42 CFR 483.12 (freedom from abuse, neglect, and exploitation), current through 2026-10-01](https://www.ecfr.gov/current/title-42/section-483.12)
- [CMS State Operations Manual, Appendix PP, Guidance to Surveyors for Long Term Care Facilities (Rev. 232, issued 07-23-25; revised guidance used on surveys since 04-28-25): F609 section (Rev. 211, issued 02-03-23, effective 10-21-22, implementation 10-24-22)](https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/som107ap_pp_guidelines_ltcf.pdf)
- [42 U.S.C. 1320b-25 (Social Security Act section 1150B): reporting of crimes in federally funded long-term care facilities](https://www.law.cornell.edu/uscode/text/42/1320b-25)
- [Example CMS-2567 (Indiana Department of Health, 2024) printing the F609 title and citation as 483.12(b)(5)(i)(A)(B)(c)(1)(4)](https://www.in.gov/health/reports/QAMIS/ltccr/ow8911_2567.pdf)
- [CMS State Operations Manual, Chapter 7, Survey and Enforcement Process for Skilled Nursing Facilities and Nursing Facilities (Rev. 244, issued 06-26-26): scope and severity matrix, immediate jeopardy, substandard quality of care](https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/som107c07pdf.pdf)
- [CMS memo QSO-25-14-NH (revised 2025-03-10): Revised Long-Term Care Surveyor Guidance, effective April 28, 2025](https://www.cms.gov/files/document/qso-25-14-nh-revised-2025-03-10.pdf)
- [Wisconsin Department of Health Services, Top Ten Federal Health Citations, First Half 2026 (national, state and CMS Region 5 citation counts)](https://www.dhs.wisconsin.gov/regulations/nh/2026-h1-dqa-bnhrc-top-citations-region.pdf)

## Related

- [F600 free from abuse and neglect: what surveyors cite](https://incidentkit.ai/compliance/f-tags/f600)
- [F610 investigate, prevent and correct alleged violations](https://incidentkit.ai/compliance/f-tags/f610)
- [Nursing home abuse reporting: 2-hour and 24-hour rules](https://incidentkit.ai/compliance/reporting-deadlines/abuse-and-neglect-reporting)
- [State adverse event reporting for hospitals, ASCs and SNFs](https://incidentkit.ai/compliance/reporting-deadlines/state-reporting-overview)
- [Abuse Reporting Deadlines for Nursing Homes: 2 and 24 Hours](https://incidentkit.ai/use-cases/abuse-reporting-deadlines)
- [Incident reporting software for skilled nursing facilities](https://incidentkit.ai/solutions/skilled-nursing-facilities)
- [Adverse event: definition and meaning](https://incidentkit.ai/glossary/adverse-event)