Domestic Violence Reporting for Healthcare Providers: When Reports Are Required
8 min read · Last reviewed May 23, 2026
Domestic violence is the rare reporting category where the default is patient autonomy, not mandatory disclosure. Most states do not impose a general healthcare-provider duty to report DV against a competent adult — but injury-by-weapon statutes, elder-abuse statutes, and child-witness duties commonly intersect with DV scenarios and trigger reporting on their own. HIPAA at 45 CFR § 164.512(c) permits the disclosure when state law requires or authorizes it.
What triggers the duty to report
The trigger depends entirely on the state — and on which collateral statute applies. The four common patterns:
- Injury-by-weapon reporting — many states require healthcare practitioners to report wounds from a firearm (and in some states, knives or other deadly weapons) to local law enforcement regardless of the underlying relationship. Examples: CA Penal Code § 11160 (firearm or other deadly weapon and assaultive/abusive conduct); Tex. Health & Safety Code § 161.041 (gunshot wounds, reported to local law enforcement); IL 20 ILCS 2630/3.2 (knife/gunshot wounds, second- and third-degree burns); and many parallel state statutes. The reporter's analysis is 'is this an injury from a weapon covered by the state statute,' not 'is this domestic violence.'
- Injury-from-assaultive-conduct reporting — California is the leading state extending the injury-trigger statute beyond weapons to "assaultive or abusive conduct" (CA Penal Code § 11160(a)(2)). The reporter's duty triggers on a wound or injury the practitioner reasonably believes resulted from such conduct. DV injuries fall within the trigger.
- Child-witness duty — most states treat a child's exposure to DV as a form of child emotional abuse or neglect, triggering the parallel mandatory child-abuse reporting duty regardless of any DV-specific statute.
- Elder-victim duty — every state's elder-abuse mandatory reporting statute applies when the suspected victim is an elder or vulnerable adult, including where the abuser is a spouse or domestic partner.
What clinicians most often miss is that the DV scenario typically triggers a collateral reporting duty even where no general DV-reporting statute exists. The analysis is not "do I report DV"; it is "what is reportable about this encounter under any statute."
Who must report
Where reporting is required (injury-by-weapon, injury-from-assaultive-conduct, child witness, elder victim), the reporter class includes the standard healthcare clinician roster: physicians, PAs, NPs, registered nurses, dentists, EMS personnel, mental health professionals, and (in many states) any healthcare practitioner under licensing-act definitions. CA Penal Code § 11160(a) names "any health practitioner" employed in a health facility, clinic, physician's office, or local or state public health department.
State-by-state framework
The landscape is fragmented. The most common categories:
| State | Healthcare-Provider DV Mandate | Timeline | Statute | |---|---|---|---| | California | YES — injury from weapon OR assaultive/abusive conduct | Phone immediately + form within 2 working days | CA Penal Code § 11160 | | Texas | NO general DV mandate; gunshot-wound report required | Immediate to local law enforcement | Tex. Health & Safety Code § 161.041 | | Florida | NO general DV mandate; child/elder layers apply | N/A general; immediate child/elder | F.S. § 39.201 (child); § 415.1034 (elder) | | New York | NO general DV mandate; injury-from-weapon required | Immediate to law enforcement | NY Penal Law § 265.25 | | Pennsylvania | NO general DV mandate; weapon injury required | Immediate | 18 Pa.C.S. § 5106 | | Illinois | NO general DV mandate; weapon + child-witness layer | Immediate weapon; child duty under 325 ILCS 5/4 | 325 ILCS 5; 720 ILCS 5/12-3.3 | | Ohio | YES — competent-adult DV reporting required where serious injury | "As soon as possible" | ORC § 2921.22 | | Colorado | YES — practitioners must report criminal-conduct injuries | Immediate | C.R.S. § 12-30-110 | | Kentucky | YES — universal DV reporter state | Immediate | KRS § 209.030; § 209A.030 | | Massachusetts | NO general DV mandate; weapon injury required; child layer | Immediate weapon | M.G.L. c. 112, § 12A |
A small minority of states — Kentucky most prominently — impose a general healthcare-provider duty to report DV against competent adults regardless of injury type. Most states do not. Practices operating across state lines must build a state-specific matrix; the rules are not interchangeable.
Timeline
Where a duty applies, the timeline is universally immediate (phone) with a written follow-up window of 2–5 working days. California Penal Code § 11160(b) requires the phone report "as soon as practicably possible" and the written report on form OES 920 within two working days.
What to report and how
The report — where required — should include the patient's name, age, and address; the nature and extent of the injury; the practitioner's clinical observations and the source of suspicion; the practitioner's name, credentials, and contact information; and the date and location of the encounter. In injury-by-weapon scenarios, include the weapon type if known.
Documentation in the chart should describe the injury objectively (mechanism inconsistent with history, injuries in patterned distribution, weapon-shape contusions, defensive injuries) and the report itself. Patient statements about the perpetrator's identity should be quoted, not paraphrased.
The DV safety-planning conversation — shelter resources, restraining order options, the National Domestic Violence Hotline (1-800-799-7233) — is a clinical encounter independent of any reporting duty. Most states' guidance encourages providers to offer the safety conversation even when no report is filed, and even where the patient declines to engage law enforcement.
Federal vs state framework
The federal framework is mostly supportive, not mandate-creating:
- Violence Against Women Act (VAWA), 34 USC § 12291 et seq. — funds DV services and shelters; does not impose a healthcare reporter duty.
- Family Violence Prevention and Services Act (42 USC § 10401 et seq.) — supports DV programs.
- Affordable Care Act § 2713 — requires DV screening and counseling as a preventive service under most health plans without cost sharing.
- HHS HRSA Women's Preventive Services — recommends screening but does not mandate reporting.
The federal framework treats DV primarily as a public health screening priority, not as a reportable condition. State law carries the operative reporter duty where it exists.
Penalties for failure to report
Where the state imposes a duty, the failure-to-report penalty mirrors the elder-abuse and child-abuse structures:
- California — Failure to report under Penal Code § 11160(d)(2) is a misdemeanor punishable by up to six months in county jail and/or a $1,000 fine. Civil liability also attaches.
- Texas — Failure to report a gunshot wound under Tex. Health & Safety Code § 161.041 carries the penalty stated in that chapter; the offense is a Class B misdemeanor under § 161.043.
- Kentucky — Failure to report under KRS § 209A.990 is a Class B misdemeanor for the first offense.
- Ohio — Failure to report under ORC § 2921.22 is a fourth-degree misdemeanor.
- Colorado — Failure to report under C.R.S. § 12-30-110 is a Class 3 misdemeanor.
Where no general DV-reporting duty exists, over-reporting carries its own exposure: a confidentiality breach claim by the patient, an HIPAA complaint to OCR, and (in CMIA states) a private right of action. The cleanest posture in non-mandate states is patient-led reporting supported by clinician safety planning, not unilateral disclosure.
HIPAA permissible disclosure
The HIPAA path when a state law requires or permits DV reporting:
- 45 CFR § 164.512(c)(1) — disclosure about a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive such reports. The disclosure must be required by law, or the individual must agree to the disclosure, or the disclosure must be expressly authorized by statute and the covered entity must (in its professional judgment) believe disclosure is necessary to prevent serious harm.
- 45 CFR § 164.512(c)(2) — informing the individual of the disclosure is generally required unless informing the individual would place them at risk of serious harm, or the provider would be informing a personal representative reasonably believed to be the abuser.
- 45 CFR § 164.512(f)(1)(ii) — disclosure to law enforcement in response to a state-law reporting mandate (e.g., gunshot wound reporting).
- 45 CFR § 164.512(j) — disclosure to avert a serious and imminent threat.
What clinicians most often miss is the patient-notice obligation at § 164.512(c)(2). When the disclosure is permitted (rather than required), the provider generally must promptly inform the patient. The "informing creates risk" carve-out applies to many DV scenarios — document the basis.
How d3rx fits
The d3rx compliance binder maintains the DV reporting matrix inside the disclosure module: a state-by-state map of mandates and carve-outs, the injury-by-weapon decision tree, the chart-documentation template, the child-witness and elder-victim collateral-duty checklist, the safety-planning resource list, and the accounting-of-disclosures entry. d3rx is an administrative documentation aid. It does not file the report and does not replace counsel.
D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.
Step 1 · Get the binder
Get the d3rx compliance binder for your practice
Pre-filled to address the gaps this guide covers — Domestic Violence Reporting for Healthcare Providers: When Reports Are Required. We will email you the section preview and your binder intake link.
No PHI required. We use your email to send the binder preview and intake link only.
Frequently asked
My patient was assaulted by her husband. She does not want me to report. Do I have to?
In most states, no — and the patient's autonomy is the controlling consideration. New York and Florida have no general healthcare-provider duty to report DV against a competent adult. California requires reporting under Penal Code § 11160 only where the injury results from a firearm or any assaultive or abusive conduct presenting to a healthcare practitioner — the duty is injury-triggered, not relationship-triggered. The cleaner clinical posture is to follow the patient's lead on reporting while documenting the encounter, offering DV resources, and ensuring safety planning.
Does HIPAA let me disclose to law enforcement when I do report?
Yes, when the disclosure is required or permitted by state law. HIPAA at [45 CFR § 164.512(c)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512) permits disclosure about victims of abuse, neglect, or domestic violence to a government authority authorized by law. The provider must promptly inform the individual unless doing so would place them at risk. [45 CFR § 164.512(f)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512) separately permits disclosure to law enforcement under specified state-law and federal-law triggers.
There is a child in the home when DV occurs. Does that change my duty?
Yes. Witnessing domestic violence is, in many states, a form of child emotional abuse or neglect that triggers mandatory child-abuse reporting independent of any DV-reporting analysis. California, Illinois, and several other states explicitly recognize child exposure to DV as reportable. The two duties are independent — the DV report (where required by injury-trigger statutes like CA Penal Code § 11160) and the child-abuse report (always triggered by reasonable suspicion of harm to the child) each run on their own track.
What about the older adult who is being abused by their spouse?
Elder-abuse mandatory reporting controls. Every state requires healthcare-provider reporting of suspected elder abuse to Adult Protective Services — see the parallel d3rx guide. CA W&I § 15630, TX Human Resources Code § 48.051, FL F.S. § 415.1034, and IL 320 ILCS 20/4 each impose the duty regardless of whether the abuser is a spouse, adult child, or other caregiver. The fact that the conduct is also domestic violence does not displace the elder-abuse reporter duty — it layers.
What is California Penal Code § 11160 actually requiring me to report?
CA Penal Code § 11160 requires healthcare practitioners to report to local law enforcement any person who presents with a wound or injury that the practitioner reasonably believes is the result of assaultive or abusive conduct, or any wound inflicted by a firearm. The triggering element is the injury type, not the suspected relationship. The phone report is immediate; the written report (form OES 920) is due within two working days. The statute carves out reports to law enforcement when the injury is from any assaultive or abusive conduct, defined broadly in subsection (a)(3) to include domestic violence injuries.
Can I be liable for reporting DV that the patient did not want disclosed?
Good-faith reports under a state injury-by-weapon or DV-injury statute are generally immunized. CA Penal Code § 11161.9 grants reporters immunity from civil and criminal liability for any report required or authorized by § 11160. The harder liability surface is reporting where state law does not require or permit it. In states without a general DV-reporting duty (NY, FL, MA), a provider who reports without patient consent and outside the [45 CFR § 164.512(c)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512) framework risks both HIPAA exposure and a tort claim for breach of confidence.
Turn this into a review-ready binder
The Security Risk Analysis is where this guide becomes documentation you can actually hand to a reviewer — assembled into one review-ready binder. Source-grounded, citation-linked, and explicit about what it does and does not do.
Editorial process. This guide was drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and edited by the D3rx team for restraint and source fidelity. A named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged to verify citations — see the team page for status. Until that reviewer engagement is finalized, this page does not claim credentialed review.
This article is an administrative documentation aid. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program. References cited link to primary sources at HHS, OCR, CMS, the Code of Federal Regulations, NIST, and state regulators.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
- 45 CFR § 164.512(c)https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512
- § 161.041https://statutes.capitol.texas.gov/Docs/HS/htm/HS.161.htm#161.041
Sources verified as of May 23, 2026
This guide is a plain-English summary maintained by D3rx for healthcare practice administrators. It is not legal advice, medical advice, or accounting advice. The authoritative source is the cited regulation or agency document. Always confirm with qualified counsel before acting on a specific compliance question affecting your practice.
Related Guides
Mandatory Child Abuse Reporting for Healthcare Providers (Federal + 50-State Overview)
9 min readCompliance FoundationsMandatory Elder & Vulnerable Adult Abuse Reporting for Medical Practices
8 min readState ComplianceCalifornia Healthcare Compliance: CMIA + HIPAA — Where They Diverge
9 min readRelated across the archive
- ComplianceMandatory Child Abuse Reporting for Healthcare Providers (Federal + 50-State Overview)Federal CAPTA + state mandates: who reports, what triggers the duty, timeline, penalties, and the 45 CFR § 164.512(b)/(c) HIPAA carve-outs that permit disclosure to CPS.
- ComplianceMandatory Elder & Vulnerable Adult Abuse Reporting for Medical PracticesFederal Elder Justice Act + state APS statutes: who reports, what counts as abuse or neglect, financial exploitation, timeline, and 45 CFR § 164.512(c) HIPAA permissibility.
- ComplianceHIPAA Subpoena Response: Court Order vs Administrative Subpoena (45 CFR § 164.512)Court order, civil subpoena, grand-jury subpoena, DEA administrative demand — each triggers a different HIPAA response path. Identify the type before you produce a single record.
- ComplianceNotice of Privacy Practices (NPP) Template — 2026A 2026 Notice of Privacy Practices template aligned to 45 CFR 164.520, with every required header, the post-Dobbs reproductive-health content, and CMIA/HB 300 carveouts.
- RegulationHIPAA Disclosures Required by Law and Public Health (45 CFR 164.512)Disclosures permitted without authorization or opportunity to agree, including public health, judicial proceedings, law enforcement, and serious threats to health or safety.
- SRAHIPAA Risk Analysis for a Physical Therapy PracticeWhat an outpatient physical therapy clinic owes under 45 CFR 164.308(a)(1)(ii)(A), with the ePHI workflows specific to PT, OT, and rehab settings.
- BillingWhat to Do When a Payer Says You're UnderbillingGot a letter saying you're underbilling? Here's what it actually means, whether you should worry, and what action to take.
- Glossary60-Day Overpayment RuleACA requirement that Medicare and Medicaid overpayments be reported and returned within 60 days of identification.