ABA practice incident reporting requirements in Maryland do not live in one incident form. Child protection, vulnerable-adult protection, Developmental Disabilities Administration programs, professional licensing, payers, workplace safety, privacy and internal quality work each have their own threshold and destination. Protect the person first, then identify which routes apply. A child report generally begins orally as soon as possible and receives written follow-up within 48 hours. A covered professional's vulnerable-adult report is made as soon as possible. Program clocks can add separate duties, but they do not replace those direct reports.

Start with care, not paperwork

A serious event can make an otherwise thoughtful team rush toward whichever form is most familiar. Pause long enough to secure the scene. Call 911 when there is immediate danger, arrange appropriate medical attention, follow the client's current safety plan within each person's competence and preserve anything that may be needed to understand what happened. The legal clocks still matter, but they never justify delaying urgent care.

Once the situation is stable, open a factual chronology. Record when the practice learned each fact, who observed it, the exact words of an important disclosure, immediate safeguards and every attempted contact. A coordinator can keep parallel tasks visible, yet the practice should not imply that assigning a coordinator removes a reporter's personal obligation.

Understand who may be a Maryland child reporter

Maryland's child-protection definitions include health practitioners and human service workers. Because a Maryland licensed behavior analyst practices under a health-occupations framework, an LBA may fall within the health-practitioner category. Other ABA employees may qualify through a different role or setting, especially when employed by a public or private health or social-service agency or provider. Confirm the actual credential, duties and employment relationship rather than treating every job title alike.

The Maryland child reporting statute applies when a covered person, acting in a professional capacity, has reason to believe a child has been subjected to abuse or neglect. That is a reporting threshold, not a direction to determine guilt. A direct observation, disclosure and surrounding facts can support a report even while important details remain uncertain.

Use both parts of the child-reporting route

The child route has an oral and a written component. The reporter contacts the local department of social services or appropriate law-enforcement agency by telephone or direct communication as soon as possible. A written report then goes to the local department no later than 48 hours after the contact, examination, attention or treatment that gave the reporter reason to believe maltreatment occurred, with a copy to the local State's Attorney.

Maryland DHS's mandated-reporter guidance points reporters to the current DHR/SSA 180 process and reinforces the immediate verbal step. Keep confirmation of both submissions. A written incident note stored in the EHR is not the statutory written report, and the 48-hour outside limit is not permission to hold the oral call for a supervisor meeting.

Do not confuse leadership notice with the direct report

A staff member in a hospital, public health agency, child-care institution, juvenile detention center, school or similar institution must immediately notify the institution's head or designee. Maryland law also says that institutional notification does not substitute for the report to social services or law enforcement. The safest policy names both actions and records their completion separately.

Keep the conversation with the child narrow and supportive. Any question should serve immediate safety or make the report intelligible. Do not rehearse the account, confront the alleged actor or keep interviewing until every question is answered. Record observation as observation and attributed speech as attributed speech. The receiving authority, not the ABA practice, investigates and decides what the evidence establishes.

Map vulnerable-adult concerns by role and contact

Maryland's vulnerable-adult reporting provision covers a health practitioner, police officer or human service worker who contacts, examines, attends or treats an alleged vulnerable adult and has reason to believe abuse, neglect, self-neglect or exploitation occurred. The current adult-protection definitions matter: vulnerability is a legal concept tied to an adult's ability to meet essential needs, not a synonym for disability or ABA participation.

A covered professional reports as soon as possible to the local department by telephone, direct communication or writing, including through the statewide reporting route identified by the department. Anyone else may report. When danger is immediate, emergency action comes first. Missing details should be described as unknown rather than used as a reason to delay a good-faith threshold report.

Keep DDA reporting inside the service relationship

The Maryland Developmental Disabilities Administration maintains a current policy library that includes incident resources. Its Policy on Reportable Incidents and Investigations, often called PORII, addresses categories such as abuse, neglect, death, hospital admission, injury, medication error, choking, emergency-service involvement, theft, certain absences and restraints. Those categories apply through the defined DDA provider and service relationship, not merely because a person has an intellectual or developmental disability.

Identify the participant's program, provider agreement, service authorization and current submission method before assigning a PORII category or clock. The linked PORII document is older than some current manuals and portal instructions, so validate it against the current contract and DDA direction. Never let an older program summary override current child or vulnerable-adult law.

Treat self-directed services as their own operating context

DDA's current Self-Directed Services Manual says PORII applies to people using self-directed services and describes coordination among the participant, support broker, team and coordinator of community services. The manual also reflects current system roles, including reporting through the state's program infrastructure. An ABA organization supporting a self-directed participant should know whether it is acting as a qualified provider, employee, vendor or outside clinician.

That distinction changes who owns which program step. It does not change the need to protect the person or make any direct statutory report. Preserve the time of discovery, who notified the coordinator, the program confirmation and any later correction. If the current program contact gives different instructions from a stored playbook, retain the instruction and update the playbook after qualified review.

Separate professional complaints from protective action

Maryland's behavior-analyst licensing page identifies the state licensing structure for behavior analysts. A professional complaint can address conduct within that board's jurisdiction, while the BACB Ethics Code governs certification. Neither route provides emergency care, receives a child or vulnerable-adult report or determines whether DDA reporting applies.

The same event can legitimately create more than one lane. For example, an allegation about supervision could require a child report now and later support board, employment or certification review. Avoid sending one broad narrative everywhere. Use the shared factual chronology, then tailor each submission to the recipient's lawful purpose and minimum necessary information.

Read payer duties from the actual agreement

Maryland Medicaid programs, managed-care organizations, commercial plans and school partners may define adverse events, sentinel events, quality concerns or fraud referrals in different documents. Keep a payer appendix by product and service line, not a single row labeled Medicaid. Record the trigger, recipient, discovery rule, clock, after-hours option, required identifiers and confirmation method from the current agreement.

A payer notice can be necessary even when no protective report is required, and a protective report can be required regardless of payment source. Claims status does not determine safety jurisdiction. When a payer term is unclear, escalate promptly to the contract owner or qualified adviser and record the interpretation rather than inventing a universal Maryland ABA payer rule.

Give employee injuries and privacy events their own files

Maryland operates an OSHA-approved state plan. The MOSH page provides the current state route; current severe-event rules generally use eight hours for a work-related fatality and 24 hours for an inpatient hospitalization, amputation or loss of an eye. Confirm jurisdiction and definitions immediately. Workers' compensation notice and an ordinary injury log do not necessarily satisfy the severe-event report.

If an incident exposes PHI, contain access and begin a separate privacy assessment. HHS's Breach Notification Rule guidance describes the presumption and risk-assessment framework for impermissible uses or disclosures of unsecured PHI. Do not call every misdirected message a breach before the analysis, and do not treat a long outer notice period as an operational wait target.

Write a record that remains useful a week later

Good incident documentation lets someone who was not present reconstruct what the practice knew and when it knew it. Describe the service, setting and people involved; distinguish observed facts from statements; identify immediate care; log external contacts; and preserve relevant records under appropriate access controls. Use a dated amendment when later information changes the picture instead of silently rewriting the first account.

Careful language protects everyone. “The caregiver neglected the client” announces a conclusion. “The technician arrived at 3:05 p.m., found no adult present and called the listed guardian twice” records facts. The second version is more useful to an agency, counsel, a payer and the family, while leaving the ultimate determination to the proper process.

Follow a Maryland incident across the lanes

Imagine Chesapeake Lantern ABA, a fictional practice serving a child whose supports also involve DDA. During an afternoon session, the child makes a concerning statement. Later, while arranging medical evaluation, the owner learns that a staff member sent the first incident summary to the wrong family contact. The practice protects the child and the reporter uses the child-protection route without waiting for Monday's quality meeting.

Leadership separately confirms whether the DDA service and event trigger PORII, checks the payer agreement and starts a privacy assessment. The same chronology supports the work, but the outcomes remain independent. A child report does not prove abuse, DDA enrollment does not automatically make every event reportable and a misdirected email is not labeled a breach before the required analysis.

Communicate with warmth without overpromising

A family usually needs three things early: what is known, what has been done to protect the person and when the next update will come. Offer those facts in plain language, provide accessible communication and acknowledge that the situation may be frightening or frustrating. Do not fill uncertainty with speculation or disclose another person's private information to make the explanation sound complete.

Staff also need a nonretaliatory way to raise concerns and make good-faith reports. Temporary schedule or supervision changes may be sensible while facts are reviewed, but explain them as protective measures rather than discipline already decided. If an outside investigator limits contact or preservation practices, document the instruction, who received it and how the team will comply.

Build an after-hours Maryland reporting map

A usable map connects each site, staff role, age group, DDA relationship, payer and credential to emergency, child, adult, program, professional, workplace and privacy routes. Include backup contacts, the evidence of submission and a clear owner for follow-up. Test the map with an event that triggers two clocks, because real incidents rarely stay inside one department.

Review what the event exposed after urgent work is complete. Look for stale contact lists, unclear self-directed roles, inaccessible records, unnecessary PHI or a supervisor bottleneck. For a voluntary federal reference, the OIG General Compliance Program Guidance offers a useful structure for reporting, investigation and corrective action, but it is not Maryland law. Obtain current Maryland legal, program, payer, privacy and clinical review before relying on the map.

Related resources

Sources