# Nursing home abuse and neglect reporting requirements

> Federal rules give nursing homes two clocks. Report alleged abuse, or any allegation that causes serious bodily injury, immediately and within 2 hours. Report other alleged violations within 24 hours. Send investigation results within 5 working days of the incident.

Source: https://incidentkit.ai/compliance/reporting-deadlines/abuse-and-neglect-reporting · Updated Oct 5, 2026

## Key facts

- **Abuse or serious bodily injury:** Immediately, and no later than 2 hours after the allegation is made
- **Other alleged violations:** No later than 24 hours (for example neglect, exploitation, mistreatment, misappropriation of property)
- **Investigation results:** To the administrator and the State Survey Agency within 5 working days of the incident
- **Suspected crime:** Each covered individual reports to the State Survey Agency and local law enforcement, on the same clocks
- **Who is a covered individual:** Any owner, operator, employee, manager, agent or contractor
- **Clock type:** Real clock time. The 5-day results deadline counts working days
- **Annual duty:** Tell covered individuals of the duty every year; keep proof
- **Surveyor tags:** F609 (reporting and annual notice), F610 (investigation and protection), F607 (written policies)

- **Citation:** 42 CFR 483.12(b)(5) and (c); section 1150B of the Social Security Act; F607, F609, F610
- **Authority:** CMS
- **Applies to:** Medicare-certified skilled nursing facilities, Medicaid-certified nursing facilities, Owners, operators, employees, managers, agents and contractors of those facilities

## What do federal rules require?

Two federal duties apply, and both run on short clocks. Under 42 CFR 483.12(c), the **facility** must report every alleged violation involving abuse, neglect, exploitation or mistreatment. That includes injuries of unknown source and misappropriation of resident property. Under 42 CFR 483.12(b)(5), every **covered individual** must report a reasonable suspicion of a crime against a resident. This rule carries out section 1150B of the Social Security Act.

Surveyors cite reporting duties, including the annual notice to covered individuals, at [F609](https://incidentkit.ai/compliance/f-tags/f609). They cite investigation and protection duties at [F610](https://incidentkit.ai/compliance/f-tags/f610). F607 covers the written policies behind both.

## What are the 2-hour and 24-hour clocks?

The clock depends on what happened, not on what the report is called. Alleged abuse and any event that causes serious bodily injury get 2 hours. Everything else gets 24 hours.

*Federal timing under 42 CFR 483.12. Where a state sets a shorter time, the shorter time applies.*

| What happened | Deadline | Clock starts | Rule |
| --- | --- | --- | --- |
| Alleged violation involves abuse, or results in serious bodily injury | Immediately, no later than 2 hours | When the allegation is made | 483.12(c)(1) |
| Alleged violation does not involve abuse and does not result in serious bodily injury | No later than 24 hours | When the allegation is made | 483.12(c)(1) |
| Reasonable suspicion of a crime, with serious bodily injury | Immediately, no later than 2 hours | When the individual forms the suspicion | 483.12(b)(5)(i)(B) |
| Reasonable suspicion of a crime, without serious bodily injury | No later than 24 hours | When the individual forms the suspicion | 483.12(b)(5)(i)(B) |
| Results of the investigation | Within 5 working days | Of the incident | 483.12(c)(4) |

> **Clock time, not business hours** CMS says the 2-hour and 24-hour limits run on real clock time. The 5 working days for results count from the incident, not from the day you filed the first report.

## Who must report, and to whom?

The facility and each covered individual have separate duties. A covered individual is anyone who is an owner, operator, employee, manager, agent or contractor of the facility.

| Duty | Who reports | Reports to |
| --- | --- | --- |
| Suspected crime against a resident | Each covered individual | The State Survey Agency and one or more law enforcement entities where the facility is located |
| Alleged abuse, neglect, exploitation or mistreatment | The facility | The administrator and other officials under state law, including the State Survey Agency and adult protective services where state law gives them jurisdiction |
| Investigation results | The facility | The administrator or designee and other officials under state law, including the State Survey Agency |

An administrator may coordinate one report for staff who ask, as long as it goes out on time. Each covered individual still owns their own duty. A facility cannot stop anyone from reporting directly to law enforcement.

## What counts as an alleged violation?

An alleged violation is something staff, a resident, a relative, a visitor or another provider sees or reports that has not yet been investigated. The reporter does not need to say the word abuse. If staff could reasonably conclude abuse, neglect, exploitation or mistreatment might exist, it is reportable.

- **Injury of unknown source:** nobody saw the cause, the resident cannot explain it, and the injury looks suspicious from its extent, location or frequency.
- **Serious bodily injury:** extreme physical pain, substantial risk of death, protracted loss or impairment of a body part or function, or an injury that needs surgery, hospitalization or physical rehabilitation. Injury from criminal sexual abuse counts.
- **Resident-to-resident incidents:** willful actions that cause physical injury, mental anguish or pain are reportable. Examples: bullying, threats of violence, unwanted sexual contact. Ordinary disagreements are not, unless they reach that level.

If an allegation meets the definition of abuse, neglect, exploitation or mistreatment, CMS says do not judge whether it is credible before reporting it.

## What must the reports say?

The first report must describe the alleged violation and show how residents are being protected. It must be accurate to the best of your knowledge at that moment. Leaving out facts or making the event look smaller can itself draw a deficiency at F609.

Keep records of what you reported and the date and time it reached the State Survey Agency. The follow-up report is due within 5 working days of the incident. It gives the investigation results and any corrective action if the allegation was verified. CMS publishes sample forms as Exhibits 358 and 359. Your state may require its own.

## What must the investigation show?

F610 asks for evidence of three things. Each allegation was thoroughly investigated. Residents were protected while the investigation was open. Corrective action followed if it was verified. CMS does not require one investigation method.

- Observations of the alleged victim, the location and staff and resident interactions.
- Interviews with the resident and representative, the alleged perpetrator, witnesses, the practitioner and outside agencies.
- Record review: progress notes, incident reports, hospital and medication records, and photographs.

A report to law enforcement does not replace your own investigation. Preserve possible evidence, such as clothing and linens, as law enforcement instructs. The QAA committee is expected to monitor reporting and investigation.

## What do surveyors check, and what is at stake?

Surveyors check that your policies name the covered individuals, the reportable crimes, what serious bodily injury means, the time limits and who receives the report. They look for proof that every covered individual was told each year, in a language they understand. They also review facility-reported incidents filed since your last survey.

A covered individual who fails to report on time faces a civil money penalty of up to $200,000, as adjusted annually. Exclusion from federal health care programs is also possible. If the failure worsens harm to the victim or harms someone else, the limit is $300,000, as adjusted annually.

## How to run it every time

1. **Protect the resident and tell the administrator** Make sure the resident is safe and examined. Separate the alleged perpetrator from residents. Tell the administrator at once.
2. **Pick the clock** Does it involve abuse? Did it cause serious bodily injury? Yes to either means 2 hours.
3. **File with each required office** The State Survey Agency, local law enforcement for a suspected crime, and adult protective services where required. Note the time of each report.
4. **Investigate and keep the evidence** Observations, interviews and record review, ending in a written conclusion.
5. **Send the results within 5 working days** Count from the incident. Include corrective action if the allegation was verified.
6. **Review it at QAA** Bring the case, the timing and the corrective action to the next meeting. See [abuse reporting deadlines](https://incidentkit.ai/use-cases/abuse-reporting-deadlines).

## What the rule asks for, and how IncidentKit supports it

| Requirement | IncidentKit |
| --- | --- |
| Report each alleged violation within 2 or 24 hours (42 CFR 483.12(c)(1)) | Staff report by text, QR code, email or web form. Lauren asks if abuse is alleged and if there was serious bodily injury. Routing alerts the administrator. Your designated person files with the State Survey Agency. IncidentKit does not file for you. |
| Keep documentation of what was reported and when | The audit trail logs who did what and when. Record the time of each outside report on the incident. |
| Thorough investigation with evidence (F610) | The investigation workspace holds interviews, record review, contributing factors and a disposition. Lauren drafts. A person signs. |
| Protect residents while the investigation is open | Protective steps are logged as corrective actions with an owner and due date. |
| Report results within 5 working days and take corrective action if verified | The investigation record supports the results report. Nothing closes until verified. |
| QAA committee monitors reporting and investigation (F610, F867) | Analytics cluster incidents by cause. Compliance packets include a QAPI summary. |
| Annual written notice to covered individuals (483.12(b)(5)(i)) | Not an IncidentKit feature. Keep the notice and proof of receipt in your training or HR records. |

## Frequently asked questions

### Does the 2-hour deadline count nights and weekends?

Yes. The 2-hour and 24-hour limits run on real clock time, not business hours. Only the 5-day results deadline counts working days.

### Can a state set a longer deadline than the federal rule?

No. A state may add recipients or event types, but it cannot allow more time than 42 CFR 483.12(c). A shorter state time applies.

### When does the 5-working-day clock for investigation results start?

At the incident, not at the first report or the start of the investigation. The rule says within 5 working days of the incident.

### Who counts as a covered individual?

Any owner, operator, employee, manager, agent or contractor of the nursing home. Each must be told of the duty every year, in a language they understand.

### Do resident-to-resident arguments have to be reported?

Not every one. Willful actions that cause physical injury, mental anguish or pain must be reported. Outbursts not aimed at anyone and ordinary disagreements are not.

## Sources

- [42 CFR 483.12, Freedom from abuse, neglect, and exploitation (eCFR)](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-483/subpart-B/section-483.12)
- [CMS State Operations Manual, Appendix PP, guidance to surveyors for long-term care facilities (F607, F609, F610)](https://www.cms.gov/medicare/provider-enrollment-and-certification/guidanceforlawsandregulations/downloads/appendix-pp-state-operations-manual.pdf)
- [CMS nursing home regulations and guidance page, including sample report Exhibits 358 and 359](https://www.cms.gov/medicare/provider-enrollment-and-certification/guidanceforlawsandregulations/nursing-homes)
- [CMS Long-Term Care Survey Process (LTCSP) Procedure Guide, effective July 14, 2026 (Survey Resources package)](https://www.cms.gov/files/zip/survey-resources-updated-09-08-2026.zip)

## Related

- [F609 reporting alleged violations: 2-hour and 24-hour rules](https://incidentkit.ai/compliance/f-tags/f609)
- [F610 investigate, prevent and correct alleged violations](https://incidentkit.ai/compliance/f-tags/f610)
- [State adverse event reporting for hospitals, ASCs and SNFs](https://incidentkit.ai/compliance/reporting-deadlines/state-reporting-overview)
- [Abuse Reporting Deadlines for Nursing Homes: 2 and 24 Hours](https://incidentkit.ai/use-cases/abuse-reporting-deadlines)
- [Nursing home QAPI requirements: 42 CFR 483.75 explained](https://incidentkit.ai/compliance/cms-qapi/skilled-nursing-facilities)
- [Nursing home recertification survey: process and prep](https://incidentkit.ai/compliance/survey-readiness/snf-recertification-survey)
- [Incident reporting software for skilled nursing facilities](https://incidentkit.ai/solutions/skilled-nursing-facilities)
- [Nursing Home Incident Report Template (Printable)](https://incidentkit.ai/templates/nursing-home-incident-report)