Mandatory Elder & Vulnerable Adult Abuse Reporting for Medical Practices

Every state designates licensed healthcare providers as mandatory reporters of suspected abuse, neglect, or financial exploitation of elderly or vulnerable adults. The federal Elder Justice Act (42 USC § 1397j) and the Older Americans Act establish the federal framework; state Adult Protective Services statutes carry the operative duty. HIPAA at 45 CFR § 164.512(c) permits the disclosure without patient authorization.

What triggers the duty to report

The trigger is reasonable suspicion — observed during professional duties — that a person aged 60 or 65 and older (the cutoff varies by state) or a "vulnerable adult" (an adult unable to protect themselves due to physical or mental impairment, regardless of age) has been the victim of:

• Physical abuse — assault, battery, unreasonable physical constraint, or inappropriate medication use as restraint
• Sexual abuse — non-consensual sexual contact of any kind
• Neglect — failure of a caregiver to provide goods or services necessary to avoid physical harm or mental suffering, including medical neglect
• Self-neglect — included in most state definitions where the adult cannot meet their own basic needs
• Financial exploitation — theft, fraud, misuse of power of attorney, undue influence over assets or property
• Isolation and abandonment — preventing the adult from contact with others, or abandonment by a caregiver
• Psychological/emotional abuse — verbal abuse, threats, intimidation, humiliation

The Elder Justice Act at 42 USC § 1397j(8) provides the federal definition of "exploitation" that anchors most state statutes. What clinicians most often miss is that financial exploitation — the fastest-growing category — does not require physical findings. Unexplained changes in a power of attorney, a new joint account, a "friend" suddenly managing finances, or unpaid bills with active accounts each independently support reasonable suspicion.

Who must report

Healthcare-specific mandated reporters across the states include:

• Physicians, PAs, nurse practitioners, dentists
• Registered nurses, LVNs, CNAs, home health aides
• Mental health professionals (psychologists, LCSWs, LMFTs, LPCs)
• EMS personnel
• Long-term care administrators and ombudsmen
• Adult day program staff
• Coroners and medical examiners
• Pharmacists (in some states for medication-diversion patterns)

Several states (Florida, Indiana, Kentucky, New Mexico, Wyoming) are universal-reporter states where every adult who knows or has reasonable cause to suspect elder abuse must report. In all other states the duty is profession-based and always includes the healthcare clinician roster.

State-by-state framework (top 10 by population)

| State | Reporter Class | Timeline | Statute | |---|---|---|---| | California | Care custodians + healthcare practitioners | Immediate phone + written within 2 working days | CA W&I § 15630 | | Texas | Any person; healthcare professionals named | Immediate (no later than 48 hours) | TX Human Resources Code § 48.051 | | Florida | Universal reporter state | Immediate | F.S. § 415.1034 | | New York | No general mandatory reporting of community elder abuse (facility-specific duties apply) | n/a — voluntary in the community | DOJ Elder Justice resources; NY does not have a general elder-abuse reporting statute | | Pennsylvania | Healthcare practitioners + facility staff | Immediate (24 hours) | 35 P.S. § 10225.701 | | Illinois | Healthcare professionals + LTC staff | Within 24 hours | 320 ILCS 20/4 | | Ohio | Healthcare practitioners + LTC | Immediate | ORC § 5101.61 | | Georgia | Healthcare practitioners + clergy | Immediate | OCGA § 30-5-4 | | North Carolina | Any person | Immediate | NCGS § 108A-102 | | Michigan | Healthcare practitioners + LTC | Immediate | MCL 400.11a |

Universal-reporter states impose the duty on everyone, but healthcare clinicians remain in the named-class list with sharper penalty exposure.

Timeline

The phone-report-then-written-follow-up pattern repeats across the states. California W&I § 15630(b)(1) requires the phone report "immediately, or as soon as practicably possible" and the written report on form SOC 341 within two working days. Texas requires the report no later than 48 hours under Human Resources Code § 48.051(b). Illinois requires the report within 24 hours under 320 ILCS 20/4. New York stands out as one of the few states without a general community mandatory-reporting statute for elder abuse; facility-specific duties apply (e.g., nursing-home incident reporting), but routine outpatient encounters do not trigger a state-mandated APS report.

The 2-hour and 24-hour federal Elder Justice Act § 1150B clock for covered long-term care facilities (skilled nursing, certain long-term care providers receiving Medicare or Medicaid payments) is the tightest window in the federal scheme — applicable when there is reasonable suspicion of a crime against a resident.

What to report and how

A report should contain: the adult's name, age, and address; the nature and extent of the suspected abuse, neglect, or exploitation; the suspected perpetrator if known; the reporter's name, credentials, and contact information; whether the adult has capacity to the reporter's clinical assessment; whether the adult has been informed of the report; and any immediate-safety concerns.

The chart entry should reflect the observation that triggered the suspicion, the report itself (hotline, intake worker, case number), and any safety planning. APS intake commonly requests follow-up information; respond through the documented case number.

Federal vs state framework

The federal scaffolding:

• Older Americans Act (42 USC § 3001 et seq.) — funds state APS and the Long-Term Care Ombudsman program; defines elder abuse, neglect, and exploitation.
• Elder Justice Act (42 USC § 1397j–§ 1397m-5, part of the ACA) — establishes federal Adult Protective Services coordination, the Elder Justice Coordinating Council, and § 1150B reporting for long-term care facilities.
• Nursing Home Reform Act (42 USC § 1396r) — imposes reporting and investigation obligations on skilled nursing facilities receiving Medicare/Medicaid.
• Older Americans Act Title VII Chapter 3 — funds prevention activities and the National Center on Elder Abuse.

State statutes carry the operative reporter duty. The federal framework does not create a direct duty on the individual clinician.

Penalties for failure to report

• California — Failure to report under W&I § 15630(h) is a misdemeanor with up to six months in county jail and/or a $1,000 fine, escalating to up to one year and/or $5,000 where the failure resulted in death or great bodily injury, plus civil damages.
• Texas — Failure to report under Human Resources Code § 48.052 is a Class A misdemeanor; escalates to a state jail felony for vulnerable individuals where serious bodily injury or death results.
• Florida — F.S. § 415.111(2) makes failure to report a second-degree misdemeanor; civil damages also attach.
• Illinois — 320 ILCS 20/4(b) makes failure to report a Class A misdemeanor with mandatory professional license review by IDFPR.
• New York — New York does not impose a general community mandatory-reporting duty for elder abuse, so there is no parallel failure-to-report criminal statute. Facility-specific incident-reporting failures (nursing homes, ALPs) are enforced by DOH and OPMC, and Soc. Serv. § 473-a creates protected-class status for adults receiving APS services.

License discipline through the state medical, nursing, or psychology board is the practical exposure most clinicians underestimate. State Medicaid Fraud Control Units also pursue cases involving institutional neglect.

HIPAA permissible disclosure

The HIPAA carveouts that permit the report:

• 45 CFR § 164.512(c) — disclosure about victims of abuse, neglect, or domestic violence to a government authority authorized by law. The provider must promptly inform the individual of the disclosure unless informing the individual would place them at risk of serious harm, the provider would be informing a personal representative reasonably believed to be responsible for the abuse, or the law would prohibit notifying the individual. State APS statutes are the "authorized by law" anchor.
• 45 CFR § 164.512(b)(1)(ii) — disclosure to a public health authority authorized by law to receive reports.
• 45 CFR § 164.512(j) — disclosure to avert a serious and imminent threat to the health or safety of a person, where the disclosure is to someone reasonably able to prevent the threat.

The minimum-necessary standard at 45 CFR § 164.502(b) applies. Log the disclosure in the accounting-of-disclosures register under 45 CFR § 164.528.

How d3rx fits

The d3rx compliance binder maintains the elder-abuse reporter workflow inside the disclosure module: the APS hotline directory by state, the chart-documentation template, the accounting-of-disclosures entry, the long-term care facility § 1150B 2-hour/24-hour decision tree, and the supplementary-report template. d3rx is an administrative documentation aid. It does not file the report, does not represent the practice before APS, the survey agency, or the licensing board, and does not replace counsel.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.