Incident reporting in behavioral health: who to tell, and by when (Texas)

Every reporting clock, in one table

Print this and put it next to the incident forms. Where two rules apply to one event, both clocks run.

Event	Who you tell	Deadline	Rule
Any reportable incident (list below)	Internal incident report, signed with date and time, filed in a separate incident file	Within 24 hours	26 TAC 564.509
Abuse, neglect or exploitation (ANE) allegation involving a client	HHSC's investigations and your CEO (the governing body if the CEO is the subject)	Immediately; written report to the CEO within 24 hours; the CEO's written report to HHSC within 2 business days	26 TAC 564.703; HHSC Form 6108
Suspected abuse or neglect of a child	DFPS (Texas Abuse Hotline 1-800-252-5400 or txabusehotline.org); 911 first in an emergency	Professionals: within 48 hours of first suspecting it; the duty can't be delegated	Tex. Fam. Code 261.101; 564.703
Suspected abuse, neglect or exploitation of an adult 65 or older or with a disability	DFPS	Immediately	Tex. Hum. Res. Code 48.051
A court-committed client leaves without authorization	The court	Immediately, with written confirmation within 24 hours	26 TAC 564.1301
A client grievance	The client, in writing; the central grievance file	Within 7 days of receiving it	26 TAC 564.702(e)
Breach of unsecured health information (HIPAA, and Part 2 records)	Each affected client	Without unreasonable delay, no later than 60 days after discovery	45 CFR 164.404
Breach affecting 500 or more people	HHS, and prominent media where 500+ residents of a state are affected	Within 60 days of discovery	45 CFR 164.406, 164.408
Breach affecting fewer than 500	HHS (breach portal)	Within 60 days after the end of the calendar year	45 CFR 164.408
Breach of sensitive personal information of 250 or more Texans	The Texas attorney general, on its online form	Within 30 days of determining the breach (individuals within 60)	Tex. Bus. & Com. Code 521.053
Work-related death of an employee	OSHA	Within 8 hours	29 CFR 1904.39
Work-related inpatient hospitalization, amputation or eye loss of an employee	OSHA	Within 24 hours	29 CFR 1904.39
Sentinel event (Joint Commission-accredited programs)	Your own comprehensive systematic analysis (root cause analysis) and action plan; reporting to the Joint Commission is encouraged	Within 45 business days of becoming aware of it	Sentinel Event Policy

Texas mental health programs licensed or contracted under other HHSC rules (a community mental health center, a crisis unit, a psychiatric hospital) have their own incident rules and forms. This table is built for licensed chemical dependency treatment facilities under 26 TAC 564. Cima Consulting and Comply aren't law firms; for a death, a serious injury or a possible crime, call a Texas health care attorney the same day.

What counts as an incident

26 TAC 564.509 names the events a licensed Texas chemical dependency program writes an internal incident report for, including:

• Accidents and injuries
• Medical and psychiatric emergencies, including an emergency room visit or inpatient admission
• A suicide attempt by an active client, on or off site
• The death of an active client
• Medication errors and adverse reactions (564.1004(g) also asks you to notify the prescriber and record the date and time)
• Illegal or violent behavior
• Rights violations and allegations of abuse, neglect or exploitation
• Loss of a client record
• Release of confidential information without consent

Read the full list in the current rule and copy it into your incident policy. When in doubt, write the report; an extra report costs ten minutes, a missing one is a citation.

How to write the incident report

The report goes in the incident file, not the client's chart (564.509(e)). The chart gets its own factual clinical note about what happened and the care given. A surveyor reads both, and they should match. A good report:

• Identifies the client by chart number or initials on anything that leaves the file (emails, the quarterly summary), never by full name.
• States the date, time and place of the event and of the report.
• Describes what happened in observable terms: what staff saw and heard, what the client said in quotes, not conclusions ("client was found on the restroom floor, responsive, said 'I took something before group'," not "client was high").
• Lists what was done: first aid, naloxone, 911, who stayed with the client, where they went.
• Lists every notification with the name, the time and how: supervisor, CEO, prescriber, family or consenter, HHSC, DFPS, OSHA.
• Names witnesses by role and initials.
• Is signed by the writer with the date and time (564.509(d)) and reviewed by a supervisor the same day.
• Is never rewritten. Add a dated addendum when you learn more.

An abuse, neglect or exploitation allegation, step by step

Allegations of ANE involving a client have the shortest clocks in the chapter. Under 26 TAC 564.703 and HHSC's Form 6108 instructions:

1. Protect the client first. Separate them from the person accused; get medical care if needed.
2. Report immediately to HHSC's investigations and to the CEO or designee. If the CEO is the subject, report to the governing body. HHSC's Complaint and Incident Intake line is 1-800-458-9858; Form 6108 lists the current email, fax and mail routes. If the client is a child, report to DFPS too.
3. Within 24 hours, the staff member gives the CEO a written incident report.
4. Within 2 business days, the CEO sends HHSC the written report on Form 6108 (one form per incident, with your facility name and license number exactly as on the license, and every attachment HHSC asks for).
5. Notify the consenter, within the limits the rule sets.
6. Investigate and document in a segregated ANE file, not the chart. Your policy says what happens to the accused staff member during the investigation; follow it every time.
7. Close the loop: what you found, what you changed, and the training that followed.

42 CFR Part 2 doesn't block the initial report of suspected child abuse or neglect that state law requires (42 CFR 2.12(c)(6)). Follow-up disclosures, such as records requested for a later investigation, still need consent or a court order under Part 2.

Privacy incidents and breaches

A release of information without consent is a reportable incident under 564.509, and it may also be a breach. Run every privacy incident through the HIPAA breach risk assessment (the nature of the information, who received it, whether it was actually viewed, and how far the risk was reduced), and document the outcome even when you decide it isn't a breach. The 2024 Part 2 rule applies the HIPAA breach notification rules to substance use disorder records too, so notices to clients, HHS and the media follow the same clocks. For a breach of computerized sensitive personal information of 250 or more Texas residents, the attorney general's 30-day clock is shorter than the 60 days for individuals.

The best time to learn these deadlines is before you need them. Comply schedules a privacy breach tabletop every six months that walks the team through a made-up breach, the decisions, the notice deadlines and the Part 2 rules. Cima EHR's security page describes how chart views are logged, which is what you'll need to reconstruct who saw what.

Sentinel events and accreditors

• The Joint Commission: a sentinel event (for example, a client's suicide or a severe harm event) calls for a comprehensive systematic analysis, usually a root cause analysis, and a corrective action plan within 45 business days of becoming aware of it. Self-reporting to the Joint Commission is encouraged, not required; if it learns of the event another way, it expects the same analysis. See the Sentinel Event Policy and Procedures.
• CARF: the health and safety section asks for a critical incident process, and surveyors look for written analysis of incidents with follow-through on the action items. Check your current manual for the exact standard and categories.

Reviewing incidents for trends

Each quarter, leadership reviews incidents, grievances and complaints together (Joint Commission PI.02.01.01, RI.01.07.01, LD.03.09.01). The minutes should show:

• How many incidents and grievances there were this quarter.
• That every incident was reported the same day and reviewed by a supervisor.
• That every grievance was answered in writing on time (7 days in Texas).
• That reportable incidents went to the state on time.
• That any sentinel event had a root cause analysis and action plan.
• The trends you saw (time of day, location, a group, a shift) and what you changed.

Trends feed the rest of the safety program: a cluster of restroom incidents goes into the ligature risk assessment, a run of falls into environment of care rounds, an overdose on site into the next emergency exercise and the hazard vulnerability analysis.

Where Comply fits

Comply isn't an incident reporting system, and no client information goes into it; write incident reports in your own records system or on paper. What Comply does is make sure the review happens: the quarterly incident, grievance and complaint review is a scheduled task for leadership with the checks above (counts, same-day reporting, grievances answered on time, state reports on time, root cause analyses, trends and changes), and anything marked "no" becomes a fix with an owner. The privacy breach tabletop runs every six months. Both are filed in the survey binder, next to the drills and safety checks a surveyor will ask about. The full schedule is in the compliance calendar.

Questions

How soon must an incident report be written at a Texas chemical dependency treatment facility?

Within 24 hours of the incident, signed with the date and time, and kept in a separate incident file rather than the client's record (26 TAC 564.509).

How fast must abuse, neglect or exploitation be reported to HHSC?

Immediately, to HHSC's investigations and the CEO or designee. The staff member gives the CEO a written report within 24 hours, and the CEO sends HHSC a written report within 2 business days. HHSC's Form 6108 instructions say "as soon as possible or within two business days."

What's the deadline to report child abuse in Texas?

Professionals must report to DFPS within 48 hours of first suspecting abuse or neglect, and can't hand the duty to someone else (Texas Family Code 261.101). In an emergency, call 911 first.

Does a client's death have to be reported?

At a Texas chemical dependency program, the death of an active client is an incident that needs an internal report within 24 hours. Whether HHSC also needs a report depends on the circumstances (an ANE allegation, for example); check Form 6108's current instructions and call HHSC if unsure. A Joint Commission-accredited program should also decide whether it's a sentinel event.

Does 42 CFR Part 2 stop us from reporting child abuse?

No. Part 2 permits the initial report of suspected child abuse or neglect that state law requires. Disclosing records for a later investigation still needs consent or a court order.

More in this set: the Texas HHSC inspection checklist, environment of care rounds, the hazard vulnerability analysis, the emergency operations plan and the ligature risk assessment. For the record side, see the chart audit checklist, and our sister site's 26 TAC 564 requirements guide. Want your incident and grievance process checked by a person? Cima Consulting's mock survey ($3,500) includes it.

Sources

• 26 Tex. Admin. Code chapter 564 (Cornell LII): 564.509 (incidents), 564.703 (abuse, neglect and exploitation), 564.702 (grievances), 564.1004 (medications), 564.1301 (court-committed clients).
• HHSC, Form 6108, Chemical Dependency Treatment Facility and Narcotic Treatment Program Incident Report (effective 1/2025) and complaint and incident intake contacts.
• Texas Family Code 261.101; DSHS, Child abuse reporting requirements; Human Resources Code 48.051; Business and Commerce Code 521.053 (as amended by SB 768, 2023).
• HHS, HIPAA Breach Notification Rule (45 CFR 164.400–414); 42 CFR Part 2 (2.12(c)(6), child abuse reporting).
• OSHA, 29 CFR 1904.39 and how to report a severe injury.
• The Joint Commission, Sentinel Event Policy and Procedures; UDSMR, CARF accreditation: a facility perspective (2025) (critical incident analysis).

This guide is general information, not legal advice; the official text of each rule controls. Comply isn't affiliated with or endorsed by HHSC, DFPS, OSHA, HHS, The Joint Commission or CARF.