Mallow Health logo
    All resources
    Billing & Compliance
    October 27, 20266 min read

    Critical Incident Reporting in Maryland: What You Report Today, and What the Rewrite Would Add

    For program directors, clinical directors and compliance leads at any Maryland community behavioral health program licensed under COMAR 10.63.

    On this page

    A participant overdoses on a Friday evening and is taken to the emergency department. The staff handle it well. The family is called, the chart is updated, the shift lead writes a note. On Monday, nobody asks the question that matters: does this go to the state, and by when?

    Today, for most programs, the answer to that overdose question is no. Under the rewrite of COMAR 10.63 that was published for comment in the August 21, 2026 Maryland Register, the answer becomes yes, within three business days. This article lays out both rules side by side so you can see the gap before it becomes a finding.

    A note on status first. The proposal's comment period closed on September 21, 2026. No hearing was scheduled, and the Behavioral Health Administration has not posted an effective date. Treat everything under "the proposal" below as pending and subject to change, and confirm against the final text when it is adopted.

    What the rule says today

    Critical incident reporting is in COMAR 10.63.01.05G, and the definition is in 10.63.01.02B(19). A critical incident is one of seven things:

    1. A participant's death.
    2. A life-threatening injury to a participant.
    3. Non-consensual sexual activity, as prohibited under COMAR 10.01.18.
    4. Any sexual activity between a staff member and a participant.
    5. An unexpected building evacuation that threatens participants' life, health or safety.
    6. Diversion of medication from the stock of an opioid treatment services program.
    7. Any injury related to an opioid medication dispensed by an opioid treatment services program.

    You report to the Department of Health or its designee, on the form the Department requires, within 5 calendar days after the program learns of the incident. Calendar days means weekends count.

    What the proposal would change

    The proposed 10.63.02.04 replaces that list with a much longer one. Programs would report the following to the Administration, if known to the organization:

    • Death of a participant in a residential program, and unexpected death of a participant in any other program.
    • Life-threatening injuries, or injuries from interpersonal violence, that occur between participants, involve staff, volunteers or consultants, or occur at the licensed site.
    • Consensual or non-consensual sexual activity involving a participant and an associated individual, as the regulation specifies.
    • Unexpected evacuation of a site that threatens participant health or safety.
    • Fatal overdose of a participant, and non-fatal overdose that requires treatment or transport by EMS or to a hospital or emergency facility.
    • Suspected or alleged abuse, neglect or exploitation of a participant by an associated individual.
    • A reportable disease or condition diagnosed by the program, under COMAR 10.06.01.03.
    • A participant's suicide attempt.
    • A credible threat by a participant to the life, health or safety of others.
    • For programs that handle medication: theft of stored medication, and a medication error that leads to an emergency visit, urgent care visit, hospitalization or death.
    • Disappearance or elopement from a residential site of a child, or of a vulnerable or older adult for longer than 24 hours, or of an adult whose condition would become life-threatening within 72 hours if untreated.

    The report goes on the Administration's form within 3 business days of the organization's knowledge of the incident. Failure to report may result in a civil money penalty under proposed COMAR 10.63.38.

    Three differences matter most in practice.

    The clock changes unit. Five calendar days becomes three business days, and the proposal defines a business day as any day except Saturday, Sunday or a State holiday. For an incident you learn about on a Thursday, those two clocks end at very different points depending on weekends, and your staff need to know which one applies. Build the habit around the shorter one now.

    Overdoses and suicide attempts are in. Today they are not on the list unless they result in death or a life-threatening injury. Under the proposal, a non-fatal overdose that needs EMS or an emergency department, and any suicide attempt, are reportable on their own.

    Medication and elopement events are in. A medication error that sends a participant to urgent care, a theft from your medication storage, or a residential elopement that crosses the thresholds above would all become reportable.

    The proposal also says it does not require you to follow up on discharged participants or participants who have stopped maintaining contact with the program. So an overdose of a former participant that you hear about secondhand is not something you are expected to hunt down.

    What to do on Monday

    You do not need to wait for the final rule to tighten this up. Four steps cover most of it.

    1. Pick one internal clock. Treat three business days from the moment any staff member learns of an event as your standard. If today's rule is looser for a given program, you lose nothing.
    2. Widen your internal trigger list. Add overdose requiring EMS or ED transport, suicide attempt, credible threat, medication theft or error with an emergency visit, and residential elopement to whatever staff are told to escalate today.
    3. Name the person who files. The report should not depend on who happened to be on shift. One named person, one backup, and a rule that staff escalate the same day.
    4. Check your current form. BHA distributed a COMAR 10.63 critical incident report form with a 2023 provider alert. Confirm with BHA that it is still the current version, and watch for a new one when the rewrite is adopted.

    The documentation angle

    A report to the state is a summary. The record behind it is what an auditor or surveyor will actually read. For every incident, whether or not it crosses the reporting line, the internal file should show:

    • When the incident happened and when the organization first learned of it. The reporting clock starts at knowledge, so this second timestamp is the one that protects you.
    • Who was involved, who witnessed it, and what staff did immediately.
    • The judgment call: did this meet a reporting category, who decided, and when. A short note saying "reviewed, did not meet a category because..." is worth as much as a filed report.
    • If reported, the date, the form, and who sent it.
    • Follow-up actions and who closed the incident.

    The failure we see described most often is not that a program refused to report. It is that it cannot show when it found out.

    Sources