Adverse Incident Reporting in Florida: 15-Day Deadline and Penalties

Florida hospitals and ambulatory surgical centers must file an adverse incident report with the Agency for Health Care Administration (AHCA) within 15 calendar days of a qualifying event. The rules sit in Florida Statute 395.0197, and they cover a defined list of serious patient harm events, not every bad outcome. Facilities that ignore the rules face administrative fines that climb to $250,000 for intentional violations, on top of possible license action. Adverse incident reporting in Florida is best understood as one piece of a larger internal risk management program the same statute requires every licensed facility to run.

Who Has to Report

Chapter 395 defines a “licensed facility” as a hospital or ambulatory surgical center licensed under the chapter.¹ Those two facility types are the ones bound by 395.0197. Nursing homes and assisted living facilities have their own separate reporting regimes under Chapters 400 and 429, with different definitions, timelines, and penalties. If you work in one of those settings, this statute is not the one that governs your reports.

What Counts as a Reportable Adverse Incident

An “adverse incident” under 395.0197 is an event tied to medical intervention rather than the patient’s underlying condition, where healthcare personnel had some degree of control over what happened. A poor outcome by itself is not enough. The event must produce one of the specific results the statute lists.²

Reportable injuries include:

Death associated with medical intervention.
Brain or spinal damage, regardless of severity.
Permanent disfigurement.
Fracture or dislocation of bones or joints.
Neurological, physical, or sensory impairment that continues after the patient is discharged.
A condition requiring specialized medical attention or surgery arising from a nonemergency procedure the patient did not consent to.
A condition requiring transfer to a higher level of care because of the adverse incident itself, not the patient’s pre-existing condition.

Separately, the statute lists surgical events that are reportable no matter the outcome:

Surgery on the wrong patient, wrong site, or wrong procedure.
Surgery unrelated to the patient’s diagnosis.
Surgical repair of damage from a planned procedure where that damage was not disclosed as a known risk during informed consent.
Removal of foreign objects left behind after surgery.

The list is closed. A medication mistake or an equipment failure is not independently reportable under 395.0197 unless it produces one of the listed injuries or falls within the surgical-event categories.²

The 15-Day Deadline

Each qualifying incident must reach AHCA within 15 calendar days of when it occurred. The clock runs the same way whether the incident happened during the current admission or arose from care provided before the patient was admitted to the facility.²

Extensions are possible. The facility administrator can submit a written justification, and AHCA can grant more time. AHCA can also require a follow-up final report after the initial filing. The statute does not fix a deadline for that follow-up, so the timeline AHCA sets in the request is the one that controls.

Once a report is in, AHCA reviews the facts and decides whether the healthcare professional’s conduct warrants a disciplinary referral. Referrals move under Section 456.073, the professional discipline procedure run through the Department of Health.

The Risk Manager Who Files the Report

The reporting duty runs through the facility’s internal risk management program, which every licensed facility must operate under the oversight of its governing board. At the center of that program is a designated risk manager. The statute expects a person with demonstrated competence in healthcare risk management standards, federal and state health law, patient care, accident prevention, and medical terminology. It is not a title bolted onto someone’s existing job.²

The risk manager has unrestricted access to all medical records in the facility and receives internal incident reports. The role also carries specific duties around sexual misconduct allegations: investigating every claim against facility personnel who have direct patient contact, notifying the administrator, reporting licensed practitioners to the Department of Health, and notifying the family or guardian if the victim is a minor. Anyone who witnesses or has direct knowledge of sexual abuse must notify both local police and the risk manager.

Interfering with the risk manager’s reporting work is itself a violation. Coercing, intimidating, or preventing a risk manager from carrying out reporting obligations carries civil monetary penalties up to $10,000 per violation.²

The Annual Summary Report

Alongside the 15-day incident reports, each facility files an annual summary with AHCA that aggregates the year’s data. The report must include:

The total number of adverse incidents.
A breakdown by category of the procedures or actions that caused injuries, with counts for each.
A breakdown by category of injury types, with counts.
Code numbers tied to each involved healthcare professional’s license number, and a separate code for other individuals involved, with the number of incidents each was directly involved in. The facility keeps the names behind the codes internally.
A description of every malpractice claim filed against the facility, pending and closed, with the nature of the incident, the people involved, and the claim’s status and disposition. Each year’s report updates prior-year claims.

The annual report also identifies the risk manager by name and attaches the policies and procedures used to reduce risk, along with the results of those measures.²

Penalties for Missing or Refusing to Report

The statute uses a tiered structure that separates unintentional lapses from deliberate ones. AHCA does not go straight to a fine for a first slip. For a single nonwillful violation or a series of isolated nonwillful violations, AHCA must first seek corrective action, typically through a written plan of correction. Fines follow only when the facility fails to fix the problem within AHCA’s timeframe, or when nonwillful violations form a pattern:

First nonwillful violation, uncorrected or part of a pattern: administrative fine up to $5,000 per violation.
Repeated nonwillful violations: up to $10,000 per violation.
Intentional and willful violations: up to $25,000 per violation, per day, with an aggregate cap of $250,000.

Interference with a risk manager’s reporting obligations carries its own separate $10,000-per-violation exposure.²

These fines stack on top of anything imposed under Part II of Chapter 408, which governs healthcare facility licensing more broadly. Under Section 408.813, AHCA classifies violations into four tiers (Class I through Class IV) with their own fine schedules. Unclassified violations carry fines up to $500 each, and each day of a continuing violation is treated as a separate offense.³ Beyond fines, AHCA can require corrective action plans, run follow-up investigations, and in serious cases refer matters for licensure action.

Who Can See What You Report

Florida treats different reports differently. The distinctions matter, both for facilities weighing what to say in a report and for patients wondering what will surface later.

The 15-Day Reports to AHCA

These reports are not public records. They are not discoverable or admissible in any civil or administrative proceeding, with one exception: AHCA and the appropriate regulatory board can use them in disciplinary proceedings against a healthcare professional. Once probable cause has been found against a practitioner, that individual can request access to the records forming the basis of the probable cause determination.²

Internal Incident Reports

The reports facilities generate internally as part of their risk management program get a different form of protection. They are treated as workpapers of the attorney defending the facility in related litigation. In practical terms, a plaintiff’s attorney can obtain them in discovery, but they cannot be introduced as exhibits at trial.²

Annual Reports and AHCA-Collected Records

Annual summaries carry the same protection as the 15-day reports: confidential, not public, not discoverable or admissible outside disciplinary proceedings. Records AHCA gathers under its investigative authority in subsections 6, 7, and 9 are shielded the same way. Medical review committee records are governed by Section 766.101 rather than by 395.0197.

Federal Patient Safety Work Product

Facilities that work with a federally listed Patient Safety Organization can gain a separate federal privilege under the Patient Safety and Quality Improvement Act of 2005 for information qualifying as “patient safety work product.”⁴ There is a real trap here. If the same information was collected to meet Florida’s mandatory reporting requirements, the federal privilege does not attach to that data. Facilities that want the federal shield generally keep two parallel tracks, one for state-mandated AHCA reporting and a separate voluntary channel to the PSO, because conflating them can strip the protection.⁵

Federal Reports the Same Event Can Trigger

Filing the 15-day AHCA report does not end the reporting work. Several federal duties can attach to the same event.

The National Practitioner Data Bank takes mandatory reports from hospitals whenever a professional review action adversely affects a physician’s or dentist’s clinical privileges for more than 30 days. The same duty applies when a physician or dentist surrenders or restricts privileges while under investigation for incompetence or professional misconduct, or in exchange for the facility not opening such an investigation. These reports are due within 30 days of the action.⁶ Malpractice payments made on behalf of a practitioner also trigger NPDB reporting, and facilities can voluntarily report adverse actions involving other practitioners beyond physicians and dentists.⁷

Facilities accredited by The Joint Commission also handle “sentinel events,” defined as patient safety events that reach a patient and result in death, severe harm, or permanent harm. The Joint Commission list overlaps with Florida’s categories on wrong-site surgery, retained foreign objects, and patient death, but reaches events Florida’s statute does not, including infant discharge to the wrong family, patient abduction, and sexual assault of patients or staff on facility grounds.⁸

A single event can hit several tracks at once. A wrong-site surgery, for example, generates a 15-day AHCA report, a Joint Commission sentinel event review, and possibly an NPDB report if the surgeon’s privileges are restricted as a result. Each track has its own deadline and its own consequence for missing it.

1
Florida Legislature. Florida Code 395.002 – Definitions
2
Florida Senate. Florida Code 395.0197 – Internal Risk Management Program
3
Florida Legislature. Florida Code 408.813 – Administrative Fines
4
U.S. Department of Health & Human Services. Understanding Confidentiality of Patient Safety Work Product
5
Agency for Healthcare Research and Quality. Work With a Patient Safety Organization
6
eCFR. Part 60 – National Practitioner Data Bank
7
U.S. Department of Health & Human Services. What Is an NPDB Report?
8
The Joint Commission. Sentinel Event Policy (SE)