Abuse, Neglect & Exploitation Reporting: Training DSPs

Every direct support professional (DSP) is expected to notice and report abuse, neglect and exploitation. Federal Medicaid rules do not give one national training curriculum for it, but they do set the frame that your state and your agency fill in. For ICF/IID providers, the rule is specific about policies, immediate reporting, investigations and five-working-day results. For home and community-based services (HCBS) waivers, a newer federal rule will require every state to run a critical incident system that includes abuse, neglect and exploitation.

This guide explains what those federal rules say, what a recent federal audit found when reports were missed, and how to turn the rules into training that your staff can actually use. It is not a substitute for your state's mandated reporter law, which may add duties, deadlines and penalties that are not covered here.

What the ICF/IID rule requires

For intermediate care facilities for individuals with intellectual disabilities, 42 CFR 483.420(d) covers staff treatment of clients. In plain terms, the facility must:

• Develop and implement written policies and procedures that prohibit mistreatment, neglect or abuse of the client.
• Make sure staff do not use physical, verbal, sexual or psychological abuse or punishment, and do not punish a client by withholding food or hydration that contributes to a nutritionally adequate diet.
• Prohibit employment of people with a conviction or prior employment history of child or client abuse, neglect or mistreatment.
• Report all allegations of mistreatment, neglect or abuse, and all injuries of unknown source, immediately to the administrator or to other officials in accordance with state law, through established procedures.
• Have evidence that all alleged violations are thoroughly investigated, and prevent further potential abuse while the investigation is in progress.
• Report the results of all investigations to the administrator or designated representative, or to other officials in accordance with state law, within five working days of the incident, and take appropriate corrective action if the allegation is verified.

The ICF/IID staffing condition adds a training standard. Under 42 CFR 483.430(e), a facility must give each employee initial and continuing training that lets the employee do the job effectively, efficiently and competently. For employees who work with clients, training must focus on skills and competencies directed toward clients' developmental, behavioral and health needs, and staff must be able to demonstrate the skills and techniques needed to manage inappropriate behavior and to implement each client's individual program plan.

That rule does not name a number of hours for abuse and neglect training. What it does set is an outcome: staff who can recognize a problem, report it right away and follow the established procedure.

What the HCBS waiver rule adds

Most DSPs work in HCBS settings, not ICF/IIDs. For waiver services, 42 CFR 441.302(a)(6) requires the state to assure that it operates and maintains an incident management system that identifies, reports, triages, investigates, resolves, tracks and trends critical incidents. The state must define a critical incident to include at least:

1. Verbal, physical, sexual, psychological or emotional abuse.
2. Neglect.
3. Exploitation, including financial exploitation.
4. Misuse or unauthorized use of restrictive interventions or seclusion.
5. A medication error that results in a call to or consultation with a poison control center, an emergency department visit, an urgent care visit, a hospitalization or death.
6. An unexplained or unanticipated death, including a death caused by abuse or neglect.

The rule also requires the state to make providers report critical incidents that occur during the delivery of waiver services, or that result from a failure to deliver them, within state-established timeframes and procedures. States must use claims data, Medicaid fraud control unit data and data from agencies such as Adult Protective Services to look for incidents that providers did not report.

On timing, the regulation says states must comply beginning three years after July 9, 2024, which is July 9, 2027. The requirement for an electronic information system that supports data collection, tracking and trending comes five years after July 9, 2024, which is July 9, 2029. For states that deliver HCBS through managed care, the dates apply from the first contract rating period starting on or after those anniversaries. Your state may adopt its definitions and deadlines before then, so follow its current provider manual or regulations.

Why reporting training matters: one federal audit

The U.S. Department of Health and Human Services Office of Inspector General (OIG) has reviewed critical incident reporting for people with developmental disabilities in several states. Its June 2019 audit of Alaska looked at July 2014 through June 2016. OIG judgmentally selected 303 Medicaid claims for people in community-based settings whose diagnosis codes suggested a critical incident had likely occurred. Of those claims, 68 percent (205 claims) had not been reported to the state as critical incidents.

Alaska officials gave several reasons a provider may not report: the provider is unaware of the incident, fears retaliation by the employer, or has a general misunderstanding of the reporting requirements. OIG recommended that the state work with providers on how to identify and report all critical incidents, and Alaska said it had started additional training to improve providers' ability to identify and report incidents that meet reporting requirements.

This was one state and a targeted sample, so it does not describe every agency. It does show that the gap is often practical: staff who do not recognize an incident, do not know the procedure or worry about what happens when they speak up.

Turning the rules into training

Use the requirements above to build a training plan that goes beyond a one-time slide deck.

A few habits help in any state:

• Start with the reporting chain, not the definitions. A new hire should know on day one who to call at 2 a.m., and what to do if that person is the one involved.
• Use real scenarios. An unexplained bruise, a missing paycheck, a medication given late or a restraint that went too long are easier to remember than a list of terms.
• Train supervisors separately. They receive the report, protect the person and make the next calls, so they need the investigation, documentation and no-retaliation steps as well.
• Tie it to your records. If an auditor asks who was trained on reporting and when, you should be able to answer in minutes. See our guide on how to track employee training in a care agency.

How TES helps

Our catalog includes general courses that support this training. They do not replace your state's required curriculum, your agency's reporting policy or any in-person instruction your regulator requires, so confirm what your state accepts before assigning a course to meet a specific rule.

• Abuse, Neglect, and Exploitation for Direct Support Professionals
• Human Rights and Recognizing Abuse, Neglect, and Exploitation
• Fundamental Rights for Direct Support Professionals

Training & eTracking Solutions is an NADSP Accredited Education provider whose courses count toward DSP-I and DSP-II. We have trained more than 200,000 professionals since 2010, and our catalog includes 400+ courses and programs. To pair reporting training with respectful, person-directed support, read our guide to person-centered planning rules for HCBS, or contact us to set up training for your team.

This article summarizes 42 CFR 483.420, 483.430 and 441.302 as published in the Electronic Code of Federal Regulations (current through November 9, 2026) and a 2019 HHS OIG audit report. It is not legal advice. State mandated reporter laws and provider rules differ, change often and may add requirements, so check the current text and confirm with your state agency before making compliance decisions.