A federal Medicaid rule finalized in 2024 will require states to run systems that find, investigate and track serious incidents, including sexual abuse, in home and community-based services. Most of those requirements apply starting July 9, 2027. For people who get personal care at home through Medicaid, the rule sets the first nationwide minimum for how states handle these reports.
What the rule requires
The rule, known as the Ensuring Access to Medicaid Services final rule, was published in the Federal Register on May 10, 2024. The part on incidents is found at 42 CFR 441.302(a)(6), which applies to Medicaid home and community-based services waiver programs under section 1915(c) of the Social Security Act.
Under that section, each state must run an incident management system that identifies, reports, investigates, resolves, tracks and trends critical incidents. The state’s definition of a critical incident must at least include:
- Verbal, physical, sexual, psychological or emotional abuse
- Neglect
- Exploitation, including financial exploitation
- Misuse or unauthorized use of restrictive interventions or seclusion
- Certain serious medication errors
- An unexplained or unexpected death
Providers must report critical incidents to the state. States must also use Medicaid claims data, fraud control unit data and data from agencies such as Adult Protective Services to look for incidents that providers did not report. If the agency investigating an incident does not report back in time, the state must investigate on its own.
Performance standards and dates
The rule sets minimum performance levels. For at least 90 percent of critical incidents, a state must start an investigation within its own set timeframe, and complete the investigation and decide the outcome within its timeframe. For at least 90 percent of incidents that need corrective action, that action must be finished on time.
States must comply beginning three years after July 9, 2024, which is July 9, 2027. The requirement for an electronic information system to collect, track and trend incident data applies five years after that date, on July 9, 2029.
In February 2026, CMS issued an informational bulletin saying it will use enforcement discretion until December 2027 for a separate requirement in the same rule: a fee-for-service grievance system for home and community-based services. That bulletin concerns grievances. As of this writing, CBW did not find a similar announced delay for the incident management requirements, but federal timelines can change.
Why this matters for abuse at home
In a home, a caregiver is often alone with the person receiving care. A federal audit published in 2023 found that most of the sampled incidents of potential abuse or neglect identified from Medicare claims happened in the person’s own home. CMS said in response that it has limited oversight of private homes.
The new rule does not create a federal right to sue. It sets duties for states and providers. But records created under these systems, such as incident reports, investigation findings and corrective action plans, may become important evidence if a survivor later brings a civil claim. Our home health care sexual abuse page describes other records that may matter.
What this means for survivors and families
You do not need to wait for these rules to take effect to report abuse. You can contact local police, Adult Protective Services, your state Medicaid agency or the agency that provides the care. Deadlines for civil claims vary by state, and a lawyer can review the specifics. You can learn more in our sexual assault and abuse section.
This article is general information about how these cases work. It is not legal advice, it does not create an attorney-client relationship, and no two claims are alike. If something here sounds like your situation, the useful next step is a conversation about the facts.
