Critical incident: the events brokers and waiver programs make you report fast
Overview
A critical incident is a serious event, such as abuse, neglect, exploitation, misuse of restraints, a dangerous medication error, or an unexplained death, that a Medicaid waiver program or broker requires providers to report right away and then in writing. Starting July 9, 2027, a federal rule makes each state define, track, and investigate these events in its 1915(c) home and community-based services waivers.
On this page
What makes an incident critical
A critical incident is a category, not just a bad day, and it starts a faster track than the usual incident investigation. Programs sort events into routine incidents, which get a written report on a normal deadline, and critical ones, which trigger an immediate call, a faster written report, and often a formal investigation. The label comes from the program you are working under, so the same event can be critical for one rider and routine for another.
Brokers write their own definitions. Modivcare’s yearly provider training, in its 2025 version, says a critical incident involves health, safety, abuse, or a possible violation of the law, or a member’s written complaint, and that abuse, neglect, and exploitation are always critical. Its examples go well beyond injuries:
- Behavior. A missing member, a member illegally carrying a weapon, aggressive behavior, a suicide attempt or threat.
- Criminal acts. A member or provider arrested or charged, fraud by a member, provider, or caregiver, theft.
- Sexual misconduct. Sexual harassment and sexually problematic behavior.
- Medical events. A medical or psychiatric emergency, a self-inflicted injury.
- Other events. Falsified credentials or records, bribery or attempted bribery, a media inquiry, and restraint or seclusion.
The same training says every critical incident must be reported immediately. By contrast, Modivcare’s routine incident form covers every transportation event, injury or not, such as harsh braking, a securement problem, or member conduct, and is due within 24 hours.
The federal rule for waiver programs
For riders on 1915(c) home and community-based services waivers, the Ensuring Access to Medicaid Services final rule of May 10, 2024 (89 FR 40542) sets a national floor. Starting July 9, 2027, each state’s definition must cover at least six kinds of events, from abuse and neglect to unexplained deaths. The IDD transportation guide lists all six with Ohio’s deadlines.
The rule also changes what the state does once a report is in:
- Providers report on the state’s clock. That covers incidents during waiver services and incidents caused by a service in the person’s plan not being delivered.
- The state looks for what was not reported. It must use claims data, Medicaid Fraud Control Unit data, and data from agencies such as adult and child protective services to find incidents providers missed.
- The state is graded. It must start an investigation on time for at least 90 percent of critical incidents, finish one on time for at least 90 percent, and complete required corrective action on time for at least 90 percent.
- An electronic system follows. States must track and trend incidents in an information system, a piece that applies five years after July 9, 2024.
Where waiver services run through managed care plans, the dates apply from each plan’s first rating period that begins once they have passed.
A state example: Pennsylvania
Pennsylvania’s rules for waiver providers in its intellectual disability and autism programs (55 Pa. Code chapter 6100) show what the timelines look like in practice:
- Within 24 hours of discovery, report death, a suicide attempt, an inpatient hospital admission, abuse, neglect, exploitation, a person missing more than 24 hours or at risk when missing for any time, law enforcement activity, an injury treated beyond first aid, a fire needing the fire department, an emergency closure, theft or misuse of the person’s funds, and a rights violation.
- Within 72 hours, report a restraint and certain medication errors.
- Within 24 hours, tell the person and anyone they designated, and start the investigation.
- Within 30 days, file the final report with the investigation results, the corrective action, who is responsible for it, and the date it was or will be put in place.
- At least every 3 months, review incidents for trends.
Vendors that sell to the general public as well as to the waiver program are exempt from most of the chapter, including these incident rules. Ask the program office which category your company falls in.
When one happens on your trip
- Make the rider safe, calling 911 when anyone’s life or safety is at risk.
- Call the broker or waiver contact right away, using the number in your contract or provider manual.
- Make any report the law requires to adult or child protective services or the police. The mandated reporter entry covers who has that duty.
- Write the report inside the program’s deadline, using plain facts. The incident report template has the fields.
- Keep the evidence. A serious incident is a likely lawsuit, so put a litigation hold on the trip records, messages, and video.
- Cooperate and fix the cause. The incident investigation guide covers interviews, root cause, and corrective action.
The timeline in a critical incident report starts with the trip itself. HealthRide’s trip log records each leg’s scheduled and actual times, driver, vehicle, and GPS-verified miles, which gives you the facts for the first page of the report.
Frequently asked questions
- Can a missed ride be a critical incident?
- It can for waiver riders. The federal rule requires providers to report critical incidents that happen while delivering waiver services and those that happen because a service in the person's plan was not delivered. If a rider is harmed because a scheduled waiver trip never came, the state's definition decides whether that is reportable, so ask the waiver agency or case manager.
- What happens if a provider does not report one?
- The state is expected to find it anyway. From July 9, 2027, states must use claims data, Medicaid Fraud Control Unit data, and data from agencies such as adult and child protective services to identify critical incidents providers did not report. Staying silent can also break a state abuse reporting law: in Virginia, a mandated reporter who fails to report suspected adult abuse faces a civil penalty of up to $500 the first time.
- Is a written complaint from a rider a critical incident?
- Under Modivcare's definition, it can be. Its 2025 provider training describes a critical incident as one involving health, safety, abuse, or a possible violation of the law, or a member's written complaint, and says every critical incident must be reported immediately. Your own broker contract may route complaints through a grievance process instead, so check it.