State adverse event and incident reporting: a verified overview
Short answer
Most states run their own adverse event reporting system. Rules differ on who reports, what counts and how fast. This page covers four verified systems, not every state: Pennsylvania, New York, Minnesota and Florida. Confirm yours with your licensing agency.
- Federal floor for nursing homes
- 2 hours or 24 hours to report, 5 working days for results. States cannot allow longer
- Pennsylvania
- Serious events reported within 24 hours of confirmation (MCARE Act)
- New York
- NYPORTS, run by the State Department of Health, for Article 28 hospitals and diagnostic and treatment centers
- Minnesota
- Listed events within 15 working days of discovery. Root cause analysis within 60 days
- Florida
- Listed adverse incidents to the state agency within 15 calendar days (hospitals, ASCs, nursing homes)
- Scope of this page
- Only systems verified on official sources. Not every state, and not every requirement
Applies to: Hospitals · Ambulatory surgical centers · Nursing homes
How do state reporting systems differ?
State systems differ on four things: which facility types report, which events count, the deadline, and who receives the report. They sit on top of federal rules. They do not replace them. For nursing homes, CMS says a state may add recipients and event types. It may not remove a federally required report or allow a longer time than the federal rule.
| State | System and governing body | Facility types | Verified timing |
|---|---|---|---|
| Pennsylvania | PA-PSRS, Patient Safety Authority with the Department of Health, under the MCARE Act (Act 13 of 2002) | Hospitals, ambulatory surgical facilities, birth centers. Nursing homes report healthcare-associated infections | Serious events: 24 hours after confirmation. Written patient notice within 7 days |
| New York | NYPORTS, State Department of Health, under Public Health Law 2805-l and 10 NYCRR 405.8 and 751.10 | Article 28 hospitals and diagnostic and treatment centers | Check the Department of Health for events and timing |
| Minnesota | Adverse Health Events Reporting Law, Minnesota Department of Health, Minn. Stat. 144.7065 | Hospitals and licensed ambulatory surgical centers | 15 working days after discovery. Root cause analysis and corrective action plan within 60 days |
| Florida | Agency for Health Care Administration, Fla. Stat. 395.0197 and 400.147 | Hospitals and ambulatory surgical centers (395). Nursing homes (400) | Listed incidents: 15 calendar days. Nursing homes: investigation begins within 1 business day of the risk manager's report |
Pennsylvania: Patient Safety Authority and PA-PSRS
The MCARE Act created the Patient Safety Authority. It defines a medical facility as an ambulatory surgical facility, birth center, hospital or abortion facility. A serious event is an event in clinical care that results in death or compromises patient safety and results in an unanticipated injury needing additional health care services. An incident could have injured the patient but did not.
A medical facility must report a serious event to the Department of Health and the Authority within 24 hours of confirming it. The patient gets written notice within 7 days of the occurrence or discovery. Health care workers who believe a serious event or incident occurred report it under the facility's patient safety plan within 24 hours of occurrence or discovery. Reports to the Authority leave out patient names and other identifiable information.
New York: NYPORTS
NYPORTS, the New York Patient Occurrence Reporting and Tracking System, is a mandatory adverse event reporting system. The State Department of Health runs it under Public Health Law 2805-l and 10 NYCRR 405.8 and 751.10. Designated staff of Article 28 hospitals and diagnostic and treatment centers report through the Health Commerce System. Check the Department of Health for current reportable events and timing.
Minnesota: Adverse Health Events Reporting Law
Minnesota Statutes 144.7065 requires hospitals and licensed ambulatory surgical centers to report listed adverse health care events to the Department of Health. Reports are due as soon as reasonably and practically possible, and no later than 15 working days after discovery. The categories are surgical, product or device, patient protection, care management, environmental, potential criminal and radiologic events.
The facility must also do a root cause analysis that considers staffing levels. It must then carry out a corrective action plan or tell the Department why it will not. If the analysis and plan are not finished when the event is reported, they are due within 60 days of the event. Reports must not identify patients, professionals or employees. Use the Department's current event list, because its publications have cited different counts over time.
Florida: adverse incident reporting
Florida licenses hospitals and ambulatory surgical centers under Chapter 395. Section 395.0197 requires each licensed facility to report certain adverse incidents to the Agency for Health Care Administration. Reports are due within 15 calendar days after the incident occurs. The list includes the death of a patient, brain or spinal damage, surgery on the wrong patient, the wrong site or the wrong procedure, medically unnecessary surgery, surgical repair of damage from a planned procedure, and removal of unplanned foreign objects. The agency may grant extensions on written request.
Section 400.147 covers nursing homes. Staff must report adverse incidents to the facility risk manager within 3 business days. The nursing home must begin an investigation within 1 business day after the risk manager receives the report. It must send a report to the agency within 15 calendar days after the incident occurred. Abuse, neglect and exploitation have their own reporting rules.
What about nursing homes in other states?
Every certified nursing home follows the federal clocks in 42 CFR 483.12. It has 2 hours or 24 hours to report an alleged violation, and 5 working days to report results. Reports go to the administrator and to other officials under state law, including the State Survey Agency. CMS notes that some states go further. For example, some require every fall to be reported. Read abuse and neglect reporting for the federal rule.
Which reporting clocks have we verified?
| Clock | Applies to | Source |
|---|---|---|
| 2 hours or 24 hours to report; 5 working days for results | Nursing home allegations of abuse, neglect, exploitation and mistreatment | 42 CFR 483.12(c) |
| 10 work days | Device-related death or serious injury at any device user facility | 21 CFR 803.30 |
| 45 business days to submit the analysis and action plan | Joint Commission sentinel events at accredited organizations | Joint Commission Sentinel Event Policy |
| 24 hours after confirmation | Serious events at Pennsylvania medical facilities | MCARE Act, section 313 |
| 15 working days | Listed events at Minnesota hospitals and ASCs | Minn. Stat. 144.7065 |
| 15 calendar days | Listed adverse incidents at Florida hospitals and ASCs, and Florida nursing homes | Fla. Stat. 395.0197 and 400.147 |
One event can start several clocks at once. A wrong-site surgery at a Minnesota surgery center, for example, is a listed state event. It is also a Joint Commission sentinel event for an accredited center. It also counts toward ASC-3 in the ASC Quality Reporting Program. See also sentinel events and device adverse event reporting.
How to confirm your own state's rules
- Find your licensing agencyUsually the state department of health. Look for the licensure rules for your facility type and any adverse event or incident reporting page.
- Read the statute and regulation, not only a summaryNote who reports, what is reportable, the deadline, the form and who receives it.
- Ask the agency about edge casesCall or email your licensing contact about cases such as falls or events found after discharge.
- Check your accreditor and insurersThey may add expectations of their own.
- Write it into policy and routing rulesOne page per facility type: the event, the clock, the recipient and the owner.
- Review once a yearRules change. Note the date you last checked.
How IncidentKit supports this requirement
| What the rule asks for | Where it lives in IncidentKit |
|---|---|
| Know which reports your state requires, to whom, and by when | You supply the rules. IncidentKit does not interpret state law. Packs set incident types, forms, regulator exports and roles for a kind of site. Routing rules name the owner and recipients. |
| Reach the right person immediately when a reportable event occurs | Routing and escalation notifies the roles you name the moment an incident is flagged. |
| Consistent facts across several reports for one event | One incident record holds the timeline, and the audit trail logs every change with who, when and what changed. |
| Root cause analysis and action plan where required, such as Minnesota's 60 days | Investigations hold contributing factors and five whys. Corrective actions carry an owner, a due date and an effectiveness check. |
| Different states and facility types in one organization | Organizations, facilities and six roles let you mix packs across sites in one account, so each site can follow its own state's routing. |
Product parts involved: Routing and escalation, Incident reporting, Investigations and RCA, Audit trail, Multi-site and roles. Capabilities marked “rolling out” are being released in stages; see the changelog.
Frequently asked questions
Do state reporting rules replace federal requirements?
No. They sit alongside them. No state can override the federal duty to report alleged violations under 42 CFR 483.12(c). States can add recipients, event types or shorter deadlines, not longer ones.
Is my state listed on this page?
Only if we verified it: Pennsylvania, New York, Minnesota and Florida. Many other states have systems. Ask your state licensing agency, and do not read a gap as an exemption.
Does reporting to the state satisfy my accreditor?
Not automatically. Joint Commission, for example, does not require sentinel event reports, but accredited organizations must analyze every sentinel event. Check both.
Do state reports include patient names?
It depends. Minnesota's statute says reports identify the facility but not professionals, employees or patients. Pennsylvania reports to the Authority exclude patient names.
What should we do when two reports are due for one event?
File each on its own clock and keep one timeline in a single record. Do not wait for one report to finish before starting another.
Sources
- Pennsylvania Patient Safety Authority, PA-PSRS reporting requirements
- Pennsylvania Act 13 of 2002, MCARE Act, sections 302, 308 and 313
- New York State Department of Health, NYPORTS
- Minnesota Statutes 144.7065, facility requirements to report, analyze and correct
- Minnesota Department of Health, Adverse Health Events fact sheet
- Florida Statutes 395.0197, internal risk management program
- Florida Statutes 400.147, internal risk management and quality assurance program (nursing homes)
- CMS State Operations Manual, Appendix PP, F609 guidance on state law and timeframes
Reviewed against the sources above on Oct 5, 2026. Rules change: confirm current requirements with the issuing body or your counsel before relying on any summary.
Map this requirement to your records.
IncidentKit connects each rule to the incident, investigation and corrective action that satisfy it.