Sentinel events and root cause analysis in behavioral health programs

What counts as a sentinel event

The Joint Commission's Sentinel Event Policy and Procedures defines a sentinel event as a patient safety event (not primarily related to the natural course of the illness or underlying condition) that reaches the individual and results in any of three outcomes:

Outcome	What it means in the policy (paraphrased)	Behavioral health examples to test against it
Death	The event caused or contributed to the person's death.	A client dies of an overdose on site; a client dies after a fall in a residential program.
Permanent harm	Lifelong harm that changes the person's functioning, whatever its severity.	A brain injury after a prolonged overdose; an injury from an assault on site that leaves lasting loss of function.
Severe harm	Life-threatening bodily injury (including pain or disfigurement) that interferes with or results in loss of functional ability or quality of life and needs continuous physiological monitoring, surgery, an invasive procedure or treatment to resolve, however long it lasts.	A client found unresponsive and put on a ventilator; a suicide attempt on site that needs surgery.

The policy also lists events that count as sentinel events in themselves. For behavioral health the one that matters most is the suicide of an individual served in a staffed around-the-clock care setting, or within 72 hours of discharge. The current list also includes rape, sexual assault, physical assault leading to death, permanent harm or severe harm, and homicide, of an individual served or of a staff member, while on site. A suicide or serious suicide attempt in an outpatient program that isn't on the list is still tested against the general definition: did a gap in care reach the person and contribute to the harm?

Not every bad outcome is a sentinel event, and not every sentinel event involves an error. The test is whether a patient safety event reached the person and caused one of those outcomes. When it's unclear, decide in writing, with the reason, and have leadership sign off. Comply isn't affiliated with or endorsed by The Joint Commission; the policy text is the Joint Commission's, and this guide paraphrases it.

The 2027 change: the serious reportable events list

In 2026 the Joint Commission announced that it will adopt the National Quality Forum's updated 2025 list of serious reportable events (SREs) as its sentinel event list, effective January 1, 2027. According to its sentinel event FAQs and the alignment update:

• Accredited organizations should move to the new list no later than January 1, 2027.
• Three workforce safety events stay on the list from the old framework: the homicide, sexual abuse or assault, and physical assault of a staff member.
• Reporting stays voluntary.
• The Joint Commission suggests three steps now: review and update your internal sentinel event policy, line up your incident reporting system with the new list, and teach staff the new definition and list.

Practically: if your incident form has a "sentinel event?" checkbox, it needs the new categories by January. Update the policy, the incident form and the quarterly review together so they use the same words.

The first 24 hours

1. Care for the person and keep everyone safe. 911, naloxone, first aid; separate anyone at risk.
2. Preserve what happened. Leave the room as it is if you can; save the sign-in sheets, the group schedule, the door log, the medication log and any video; write down who was there.
3. Write the incident report the same day, in observable terms, and file it in the incident file, not the chart (in Texas, within 24 hours under 26 TAC 564.509; see incident reporting timelines).
4. Start the outside clocks: HHSC for abuse, neglect or exploitation allegations, DFPS for a child, OSHA for an employee's death or hospitalization, the court for a committed client, your payer contracts, and your insurer.
5. Support the staff involved. The people closest to the event are part of the analysis, not its target.
6. Tell leadership and decide, in writing, whether it's a sentinel event. The 45-business-day clock starts when the organization becomes aware of the event, not when someone decides what to call it.

A 45-business-day timeline

The policy sets the endpoint: the analysis and the action plan, done within 45 business days of becoming aware. The steps in between are ours, from running reviews at a licensed Texas outpatient program; adjust the days to your size.

Business day	Step	Output
0	Event, or the day you learn of it	Incident report; outside reports started; leadership told
1–3	Charter the team: a leader who runs it, a clinician, operations, someone who knows the process but wasn't involved, and leadership	Team named in writing, with the due date
3–15	Gather the facts: interviews (one at a time, soon), the record, logs, the room, the policies as written	A minute-by-minute timeline of what happened
15–25	Find the causes: at each step, ask what should have happened, what did, and why; keep asking why until you reach a process, a design or a resource you control	Root causes and contributing factors, each tied to the timeline
25–35	Choose actions for each cause, favoring strong ones; name an owner, a date and a measure for each	The corrective action plan
35–45	Leadership reviews, approves and resources the plan; governing body informed	Signed analysis and plan, filed
After	Do the actions; measure whether they work; report at the quality meeting until the measure holds	Results in the quarterly minutes

What the analysis has to show

The policy calls the review a comprehensive systematic analysis, and expects it to be thorough and credible. In plain terms, a surveyor reading yours should find:

• Systems, not just people. The causes are processes, designs, staffing, communication, training or equipment, not "the counselor didn't follow policy." If someone didn't follow a policy, the analysis asks why it was easy not to.
• The whole sequence. What happened before, during and after, with the policies as written next to what actually happens.
• The right people. Leadership took part, and so did the people closest to the work.
• Consistency. Every cause traces to the timeline, every action traces to a cause, and nothing in it contradicts the incident report or the record.
• Risk elsewhere. Whether the same gap exists in other rooms, tracks, shifts or locations.
• An action plan with what will change, who owns it, when, and how you'll know it worked.

Strong and weak actions

The commonest weakness we see in a root cause analysis is a plan made of reminders. Rank actions by how much they depend on people remembering:

Strength	What it does	Examples in an outpatient program
Stronger	Changes the design so the error is hard or impossible	Naloxone mounted unlocked in every hallway and next to every restroom; restroom doors staff can open from outside; the EHR won't let a note with high suicide risk be signed without a safety plan.
Intermediate	Standardizes or adds a check built into the work	A timed restroom check with a named owner each group; a checklist at intake; a second staff member on site whenever clients are present.
Weaker	Relies on memory and attention	Retraining, a new policy, a memo, a poster, "counsel the staff member."

Weaker actions have a place, usually next to a stronger one. A plan with nothing but training is a sign the analysis stopped too early.

A worked example: an overdose in the restroom

Made up, to show the method. During an afternoon IOP group, a client leaves for the restroom and is found unresponsive 20 minutes later. Staff give naloxone and call 911; the client is intubated and spends four days in the ICU. It meets the severe harm definition, so leadership treats it as a sentinel event on day 0.

What the timeline showed	Why (the cause)	Action, owner, date, measure
No one noticed the client had been gone 20 minutes.	No restroom check procedure; the facilitator was alone with 11 clients.	Restroom check at 7 minutes by the floor staff member, logged (intermediate). A second staff member on the floor during groups (stronger). Program director, 30 days. Measure: monthly spot checks of the log.
Naloxone took about 3 minutes to reach the restroom.	The only kit was in a locked office cabinet.	Unlocked kits in the hallway and group rooms (stronger). Operations lead, 7 days. Measure: monthly environment of care rounds check every kit.
The restroom door was locked from inside and took a key from the front desk.	Door hardware chosen for privacy only.	Hardware staff can open from outside without a key (stronger). Landlord request, 45 days. Measure: added to the yearly ligature and environmental assessment.
Two staff present hadn't done naloxone training in over a year.	Training due dates tracked on paper.	Due dates tracked with alerts; no client-facing work past due (intermediate). Clinical director, 14 days. Measure: training current for 100% of direct-care staff.

Our sister site's naloxone policy guide covers stocking and training; the room checks belong in environment of care rounds and the ligature risk assessment, and an on-site overdose belongs in the hazard vulnerability analysis.

Reporting to the Joint Commission

• Voluntary, and encouraged. The policy strongly encourages self-reporting; it doesn't require it, and the January 2027 change keeps it that way.
• If the Joint Commission hears another way (a complaint, the news, a family), it expects the same analysis and action plan.
• Either way, the work is the same: the analysis and plan inside 45 business days, and evidence later that the actions were done and measured.

How you protect the analysis from disclosure (peer review and quality committee privileges, attorney involvement) is a legal question for your state. Ask a health care attorney before the first one, not during it. Cima Consulting and Comply aren't law firms.

The Texas clocks that run at the same time

For a licensed Texas chemical dependency treatment facility, the sentinel event review doesn't replace any state report. The ones most likely to apply, all on the incident reporting timelines page:

• An internal incident report within 24 hours for a death, a suicide attempt, a medical or psychiatric emergency, or violent behavior (26 TAC 564.509).
• Abuse, neglect or exploitation: to HHSC immediately, with the CEO's written report within 2 business days on HHSC Form 6108 (26 TAC 564.703).
• An employee's work-related death to OSHA within 8 hours; an inpatient hospitalization within 24 hours (29 CFR 1904.39).

Where Comply fits

Comply isn't an incident reporting system, and no client information goes into it. It makes sure the review loop closes: the quarterly incident, grievance and complaint review asks leadership whether every sentinel event had a root cause analysis and action plan, and each action can become a fix in Comply with an owner, a due date and a photo of the result. When an action changes recurring work (a new restroom check, kits checked on rounds, training tracked), it goes on the schedule so it keeps happening after the review is filed. The proof lands in the survey binder, and the year's reviews are listed in the compliance calendar.

Want someone outside the team to read your process before you need it? Cima Consulting's mock survey ($6,500) traces your incident and sentinel event process, and the accreditation consultant work covers the policy itself.

Questions

What is a sentinel event in behavioral health?

Under the Joint Commission's policy, a patient safety event, not primarily related to the natural course of the person's illness, that reaches an individual served and results in death, permanent harm or severe harm. The policy also lists specific events, such as the suicide of someone in a staffed around-the-clock setting or within 72 hours of discharge.

How long do we have to complete a root cause analysis for a sentinel event?

45 business days from the day the organization becomes aware of the event, for both the comprehensive systematic analysis and the corrective action plan.

Do we have to report a sentinel event to the Joint Commission?

No. Self-reporting is voluntary and encouraged. If the Joint Commission learns of the event another way, it expects the same analysis and action plan. Reporting stays voluntary under the list that takes effect January 1, 2027.

Is a client suicide in an outpatient program a sentinel event?

The specific listed event covers staffed around-the-clock settings and the 72 hours after discharge. In an outpatient program, test the death against the general definition: did a patient safety event reach the person and contribute? Document the decision and the reason, and review the case either way.

What is the difference between an RCA and a comprehensive systematic analysis?

The policy uses "comprehensive systematic analysis" for the review; a root cause analysis is the most common way to do one. Either way it has to look at systems and processes, include leadership and the people involved, and end with an action plan with owners, dates and measures.

What changes on January 1, 2027?

The Joint Commission adopts the National Quality Forum's 2025 serious reportable events list as its sentinel event list, keeps three workforce safety events (homicide, sexual abuse or assault, and physical assault of a staff member), and keeps reporting voluntary. Update your policy, incident form and staff training to the new list.

More in this set: NPSG.15.01.01 suicide risk reduction, incident reporting timelines, the emergency operations plan and the Joint Commission checklist.

Sources

• The Joint Commission, Sentinel Event Policy and Procedures and the Sentinel Event Policy (SE) chapter (definitions, the 45-business-day analysis and action plan, self-reporting).
• The Joint Commission, Sentinel event FAQs and Alignment of patient safety event reporting update (the NQF serious reportable events list from January 1, 2027).
• 26 Tex. Admin. Code 564.509 (incidents) and 564.703 (abuse, neglect and exploitation); HHSC Form 6108.
• OSHA, 29 CFR 1904.39, reporting fatalities and severe injuries.

The example is made up. This guide is general information, not legal advice; the official policy text controls. Comply isn't affiliated with or endorsed by The Joint Commission, the National Quality Forum, HHSC or OSHA.