North Carolina ABA Practice Incident Reporting Guide

ABA practice incident reporting requirements in North Carolina begin with the person and setting, not a universal ABA incident clock. Any person or institution with cause to suspect that a juvenile is abused, neglected or dependent, or died because of maltreatment, reports to the appropriate county DSS. The child statute does not give the original reporter a 24- or 48-hour filing period. Disabled-adult protective services uses a separate reasonable-cause threshold, while IRIS applies conditionally to providers and Level II or III incidents. Workplace, privacy, professional and payer work remain separate.

Let care lead the response

A serious incident does not begin as a compliance exercise. Remove a continuing hazard, call 911 when someone faces immediate danger, arrange appropriate medical attention and follow the client's current safety plan within staff competence. Preserve evidence without getting in the way of care. Reporting clocks still matter, but they should never displace the person in front of the team.

As soon as the scene is stable, start a chronology. Note when the practice learned each fact, who observed it, the exact words of a significant disclosure, immediate safeguards and all contact attempts. A response coordinator can track several outside routes, while making clear that coordination does not cancel a person's own reporting duty.

North Carolina's child duty reaches everyone

North Carolina G.S. 7B-301 says any person or institution with cause to suspect that a juvenile is abused, neglected or dependent, or has died as a result of maltreatment, must report to the director of social services in the county where the juvenile resides or is found. An ABA employee does not need a particular license or job title for that broad duty to apply.

Cause to suspect is not a finding. A technician can report an observation or disclosure while important facts are disputed or unknown. The practice should not create an internal proof requirement, wait for a BCBA to agree or condition the report on caregiver consent. DSS decides whether the information meets intake and assessment standards.

Do not invent a child-reporting hour count

The reporter provision allows the child report to be made orally, by telephone or in writing. It does not specify a 24-hour or 48-hour deadline for the original reporter. Report promptly when cause to suspect arises, particularly when a child's safety may depend on timely information, but do not present another section's agency-response period as the reporter's legal clock.

North Carolina DHHS's Child Protective Services page directs people with concerns to the local county DSS. The local DSS directory supplies county and emergency contacts. Store the correct county route for each service area before an incident; a general email expected to receive a routine business response is not a safe substitute for a CPS intake contact.

Give DSS facts without running a private investigation

A useful report identifies the child, caregiver if known, location, nature and extent of the concern and other information that may help DSS. Preserve the child's own words when relevant. Any follow-up question should serve immediate safety or make the report coherent. Repeated interviews, leading questions or confronting an alleged actor can distress the child and complicate the public agency's work.

An internal supervisor may help a reporter reach the right county or obtain client identifiers, but should not decide whether the person is allowed to report. Record the contact, confirmation and any instructions. The filing itself does not prove maltreatment, determine custody, establish employment misconduct or answer a professional complaint.

Apply the disabled-adult threshold carefully

North Carolina's disabled-adult protection article requires any person with reasonable cause to believe that a disabled adult is in need of protective services to report that information to the county DSS director. A disabled adult includes a person 18 or older, or a lawfully emancipated minor, whose physical or mental incapacity falls within the definition. Autism is listed, but diagnosis alone is not the whole test.

The person must also be unable, because of incapacity, to perform or obtain essential services and lack an able, responsible and willing person to provide or obtain them. Abuse, neglect or exploitation is evaluated within that framework. Avoid treating every adult receiving ABA as an APS case, while also avoiding assumptions that family involvement makes protective services unnecessary.

Use the adult route without borrowing agency clocks

A disabled-adult report may be oral or written and should provide the adult's and caretaker's identifying information, age, nature and extent of the condition or injury and other pertinent facts when known. The reporter section does not assign the reporter a fixed 24- or 72-hour period. Make the report promptly once reasonable cause exists, especially when conditions are urgent.

The NCDHHS Adult Protective Services page explains the county-administered program. Response classifications in an APS manual generally govern the agency's evaluation, not the original reporter's filing deadline. Keep emergency action, APS notice and any law-enforcement contact separate, and record why each route was used.

Know what IRIS actually covers

North Carolina's Incident Response Improvement System page describes IRIS as the web system for Level II and Level III incidents involving people receiving mental-health, developmental-disability or substance-use services. Coverage is tied to defined Category A or Category B providers and service arrangements under 10A NCAC 27G, not to every ABA practice or every person with an autism diagnosis.

Confirm the provider's licensure, public funding, Tailored Plan or prepaid-health-plan relationship, service and event level before assigning an IRIS duty. If the organization is outside the rule, preserve that scope decision. If it is inside, the incident level and current manual control. An IRIS entry never replaces a child or disabled-adult report.

Use the current IRIS clock and fallback

The live IRIS provider portal currently states that Level II and III reports are due within 72 clock hours. It also says printed reports are accepted only when IRIS is unavailable and that providers must enter the information after service returns. Because portal instructions and system requirements can change, verify the current page and provider manual at the time of an event.

The linked 10A NCAC 27G incident materials explain response, reporting and documentation duties for covered providers. Do not mistake the 72-hour submission period for permission to wait on urgent safety or protective reports. Record when the provider learned of the event, the level decision, submission, outage evidence, backup contact and later system entry.

Keep payer and plan notices product-specific

North Carolina Medicaid managed-care arrangements, Tailored Plans, commercial insurers and school partners may define adverse events, quality concerns, restraint reports, fraud referrals or record requests in their current contracts and manuals. An IRIS field asking for a plan identifier does not mean every payer notice is completed automatically. Maintain an appendix for each product and service line.

The appendix should preserve the trigger, recipient, discovery rule, clock, after-hours path, minimum identifiers and confirmation. A payer report may be required when APS is not, while an APS report may be necessary regardless of payment. Avoid turning “North Carolina Medicaid” into a single invented set of rules.

Separate professional review from protection

The North Carolina Behavior Analyst Licensure Board licenses the profession, and its complaint page explains how a person with personal knowledge may submit a complaint under the board's rules. The BACB Ethics Code provides another, separate certification framework. Neither route receives a child or APS report or supplies emergency response.

An event may support several reviews, but their conclusions should remain distinct. A good-faith protection report is not proof of a licensing violation. Temporary access, assignment or supervision changes may be prudent during review; explain them as interim safeguards rather than final discipline, and preserve a fair process for everyone involved.

Give employee injuries and privacy their own attention

North Carolina operates an OSHA-approved state plan. The NCDOL reporting material reflects the current severe-event framework: a work-related fatality is generally reported within eight hours, and an inpatient hospitalization, amputation or loss of an eye within 24 hours. Confirm the definition and route immediately. Workers' compensation notice and routine recordkeeping are different tasks.

When an incident note, device or email exposes PHI, contain access and start a separate privacy analysis. The HHS Breach Notification Rule page explains the federal presumption and risk assessment for unsecured PHI. A lost device is not automatically a reportable breach, and the privacy conclusion does not decide child, APS, IRIS, payer or professional jurisdiction.

Write facts that survive handoffs

Useful documentation identifies the person, service, site and time; separates observation from attributed speech; describes care and risk without speculation; and logs every external contact. Preserve relevant messages, device logs and records with restricted access. If later information changes the account, add a dated supplement rather than silently rewriting what staff recorded at the time.

Avoid conclusions such as “the caregiver exploited the client” unless the responsible process has made that finding. Record the transaction, statement, missing funds or unmet need that created concern. Precise language helps DSS, a plan, the board and the family understand the event while reducing unnecessary harm.

Follow a North Carolina event through the routes

Imagine Blue Ridge Harbor ABA, a fictional practice. During an in-home session, a technician sees conditions that create cause to suspect child neglect. That evening, the owner learns that a separate adult client may be unable to obtain essential medication and has no willing caretaker. The child report goes promptly to the correct county DSS, while the adult concern is evaluated and reported under the separate disabled-adult standard.

Leadership then confirms whether either service is delivered by an IRIS-covered provider, checks the applicable plan agreements and secures the records. One chronology keeps time clear, but no route decides another. DSS intake does not establish neglect, an autism diagnosis does not establish APS need and public funding does not automatically make every event Level II or III.

Communicate in plain, considerate language

A family facing a serious incident needs verified information and a reliable next contact. Explain what is known, what immediate protection occurred and when another update is expected. Offer language access and other accommodations. Acknowledge emotion without speculating about what DSS, a plan, IRIS, the board or an investigator will conclude.

Create the same psychological safety for staff. Good-faith concerns should not invite retaliation, and uncertainty should not be treated as disloyalty. If an outside authority asks the practice to preserve evidence or limit contact, document the instruction and assign an owner. Respectful communication can be candid without outrunning the evidence.

Keep an after-hours North Carolina map

Connect every county, site, staff role, adult-service context, IRIS relationship, plan and credential to emergency, child, APS, program, payer, professional, workplace and privacy routes. Include backup contacts and proof of submission. Rehearse a case with one direct report and one conditional program question so employees understand why a single incident ticket is not enough.

Use the later review to repair systems such as stale county contacts, inaccessible portal credentials or vague incident-level ownership. Teams may also consult the voluntary OIG General Compliance Program Guidance for a federal reporting and corrective-action framework, while remembering that it does not create North Carolina law. Obtain current North Carolina legal, agency, program, payer, privacy, workplace, clinical and owner-operator review before relying on the map.

ABA Practice Incident Reporting Requirements in North Carolina