Incident form: Free customizable template

Key takeaways

An incident form is the standardized record a practice completes after an accident, a near miss, an injury, or a safety concern.

Complete it within 24 hours, covering date and time, location, people involved, what happened, witnesses, injuries, actions taken, and sign-off.

England’s CQC Regulation 20 creates the duty of candour. HIPAA is separate: it governs how the record is stored and who may read it.

RIDDOR wants a specified injury reported without delay, with a written report inside 10 days. The 15-day deadline covers over-seven-day absences only.

Practice management software like Pabau replaces paper with digital forms that notify the right person and keep a searchable audit trail.

An incident form is the standardized record your practice completes after an accident, a near miss, or a patient safety concern. It turns a chaotic ten minutes into something you can investigate, act on, and show an inspector. Download the template above, then use this guide to fill it in properly.

One form protects three things at once. It protects the patient, the staff member involved, and your regulatory position. The sections below cover what belongs on the form, how to write the narrative without inviting blame, and which regulator has to be told when.

What is an incident form?

An incident form is a standardized document used to record any unexpected event in a clinical setting. That covers patient falls, medication errors, equipment failures, staff injuries, near misses, and data breaches. It also covers situations where harm could have happened but didn’t.

The purpose is twofold. It captures the facts while they are still accurate, and it builds an audit trail showing that your practice acts on safety. A formal form does several things a hallway conversation cannot:

• Creates a legal record of what happened, when, and who was involved
• Enables root-cause analysis, so the same event doesn’t repeat
• Demonstrates due diligence to inspectors, whether that is the CQC in England, HIS in Scotland, or a US state health board
• Supports insurance and claims investigations
• Shows staff that small incidents are taken as seriously as major ones

Without a form, incidents live in people’s heads and in scattered email notes. Patterns go unnoticed and root causes are never found. When an inspector asks how you handle safety, you have nothing to show them.

Why incident reporting matters

Incident reporting sits at the center of patient safety, legal protection, and regulatory compliance. Three separate rulebooks can apply to a single event, and each one asks for something different.

In the US, HIPAA compliance governs the record itself. Any form holding protected health information must be stored securely, with access limited to the staff who need it. A breach of that data is reportable. HIPAA says nothing about being open with a patient after a clinical mistake.

That obligation comes from CQC Regulation 20 in England, which creates the statutory duty of candour. Registered providers must tell the patient about a notifiable safety incident, apologize, and explain what is known so far. The two duties are separate, and they sit in separate jurisdictions.

Workplace injuries run on their own clock. Under RIDDOR (the UK’s Reporting of Injuries, Diseases and Dangerous Occurrences Regulations), a specified injury goes to the Health and Safety Executive without delay. A written report follows within 10 days. The 15-day deadline applies only to injuries that keep someone off normal duties for more than seven days.

In the US, OSHA recordkeeping applies to employers with more than 10 employees, who log recordable injuries on Form 300. Employers with 10 or fewer are exempt from that routine recordkeeping.

Beyond the rulebooks, going paperless with reporting protects you operationally. A run of near misses in one treatment room points at training, equipment, or workflow. Without tracking, you never get to fix it before someone is hurt.

Types of incidents worth documenting

Severity varies, but everything gets written down. A busy physical therapy practice logs a different mix from an IV therapy practice, so it helps to know the categories your team will meet.

• Patient incidents: falls, allergic reactions, treatment complications, and medication errors such as a mis-transcribed repeat prescription
• Near misses: events that could have caused harm but didn’t, such as a dose caught before it was given
• Staff injuries: sharps injuries, chemical exposures, manual handling strains
• Equipment failures: device malfunction, calibration drift, missed maintenance
• Data and security incidents: records accessed inappropriately, lost data, potential GDPR or HIPAA breaches
• Environmental hazards: slips and trips, poor lighting, temperature control problems

Many practices reserve the form for major events. Do the opposite. Near misses are free lessons, and they show you the weak point before anyone is hurt. A documented fall risk assessment often catches the same weakness a week earlier.

What to include on the form

A good form captures enough to understand what happened, why it happened, and what should change. These are the sections that earn their place:

• Date, time, and location. Be specific. “3 PM, treatment room 2” is useful. “Afternoon, out front” is not.
• People involved. The patient, by name or record number, plus the staff involved and their roles.
• Description. A factual, non-blame narrative of what you observed. Weak: “Staff was careless.” Strong: “Patient stepped off the treatment bed during review, and that edge has no handrail.”
• Witnesses. Names and contact details for anyone who saw the event or what led up to it.
• Injuries. None, minor, moderate, or serious. A documented pain scale keeps severity ratings consistent between staff.
• Immediate actions. First aid given, staff notified, emergency services called, equipment taken out of use.
• Corrective actions. Training, equipment replacement, a process change, or a policy clarification.
• Sign-off. Name, signature, and date, so nobody is left holding an unsigned draft.
• Follow-up. When the recommended actions get reviewed, and by whom.

Medical forms work when staff can finish them quickly and an investigator can still use them afterwards. A one-line form yields nothing. A ten-page form gets skipped.

How to write an incident report, step by step

Write the report within 24 hours, while the detail is still accurate. This sequence works for most practices.

1. Write it down straight away. Once the situation is stable, note the date, time, and what happened. That note becomes the basis for the formal form.
2. Gather witness accounts. Ask anyone who saw the event for their name, role, and what they observed. Record it in their words.
3. Stick to observable facts. Write “Patient stepped off the bed”, not “Patient was not monitored properly”. Blame language weakens the record.
4. Describe the response. What did staff do? Was first aid given, and was the clinician in charge told immediately?
5. Recommend corrective actions. Be specific. “Install a grab rail on the left side of the treatment bed” beats “Improve safety”.
6. Sign and date it. Whoever completes the form takes responsibility for what it says.
7. Store it securely. Patient data security tools matter here, because these forms hold identifiers and health data. Paper goes in a locked cabinet, digital goes in an access-controlled system.
8. Review and follow up. Book a team review one to two weeks later and confirm the actions actually happened.

Delay is the common failure. Forms written weeks later are vague, emotion has colored the memory, and the useful detail is gone. Make same-day completion the norm.

Practices that make reporting work

The form is only half of it. What surrounds the form decides whether your team ever uses it.

• No-blame culture. If reporting gets people in trouble, reporting stops. Say plainly that the goal is prevention, not a scapegoat.
• Timely completion. Set a 24-hour standard and keep blank forms where the work happens, in the treatment rooms and on whatever system your team already uses.
• Factual language only. Words like “careless” or “reckless” muddy the record and can be used against you later. Train staff to write neutrally.
• Root-cause focus. Ask why five times. “Equipment failed” becomes “it had not been serviced in 18 months”, which becomes “maintenance was never linked to the practice calendar”.
• Restricted access. Only the people who need an incident report should see it: management, the safety lead, and an inspector on request.
• Retention. UK practices typically keep incident records for at least three years. US record retention rules vary by state and often run five to seven years.

Why a generic workplace form falls short

Generic workplace forms, the kind used in offices and warehouses, miss the clinical context entirely. Four fields make the difference.

• Patient identifier. A generic form has nowhere to record who was being treated, or which service was involved.
• Treatment context. “Patient fell” is incomplete. “Patient fell during a blood draw while fasting” points the investigation somewhere useful.
• Practitioner sign-off. A clinical form needs the treating clinician to review it and give an opinion on next steps.
• Clinical harm rating. Did this cause harm, or could it have? A sharps injury triggers post-exposure protocols. A near-miss stock error does not.

Adapt the template above to your specialty and your treatment rooms. Just don’t force a warehouse form into a clinical setting and hope it holds up.

Regulatory context: HIPAA, CQC, OSHA, and RIDDOR

Incident reporting sits where several rulebooks overlap. Each has its own trigger and its own deadline, and one event can set off more than one.

• HIPAA (US): incident reports holding protected health information must be stored securely, with access limited to authorized staff. A breach of that data is itself reportable.
• CQC Regulation 20 (England): registered providers must be open with the patient after a notifiable safety incident, as soon as is reasonably practicable. This is the statutory duty of candour.
• RIDDOR (UK): a specified injury, such as a fracture, dislocation, or loss of sight, goes to the HSE without delay. A written report follows within 10 days. Injuries causing more than seven days of incapacity carry a 15-day deadline, and occupational disease must be reported as soon as practicable.
• OSHA (US): employers with more than 10 employees log recordable injuries on Form 300. Employers with 10 or fewer are exempt from routine recordkeeping.

The deadlines are what practices get wrong, because they are rarely written down in one place. The chart below lines them up, tightest first.

Incident forms are the evidence you hand these regulators. Get them right, keep them secure, and hold them for the required period.

How Pabau automates incident reporting

Most practices print the form, complete it by hand, and file it somewhere. Automated workflows in Pabau route each submission to the right person instead. The form attaches itself to the patient or staff record and leaves a searchable audit trail behind it.

Follow-up tasks are tracked too, so an outstanding corrective action stays visible until somebody closes it. Nothing depends on remembering to carry a clipboard to the office at the end of a shift.

During a CQC inspection or an OSHA audit, you can pull every incident from the past three years in seconds. You can show which ones were followed up and what changed as a result. A filing cabinet cannot do that on demand.

Storing incident data alongside patient records helps clinically as well. A history of falls, reactions, or equipment sensitivities sits next to the patient’s progress notes at their next appointment.

Replace paper incident forms with digital ones

Pabau’s digital forms and automated workflows notify the right person the moment an incident is logged. Every report stays searchable, signed, and audit-ready inside your practice management system.

Book a demo

Conclusion

An incident form only earns its keep if somebody fills it in the same day and somebody else reads it afterwards. The practices that get value from reporting are the ones treating a near miss as a warning rather than paperwork.

Download the template above and set the 24-hour standard this week. Then decide who reviews each form, and when. That second decision is what an inspector notices, and it is the one most practices never make.

Book a demo to see how Pabau’s digital forms and automated workflows keep every incident report signed, stored, and ready for inspection.

Continue your research

Preparing for an inspection? Our CQC inspection checklist covers the documentation and safety processes inspectors ask for, incident reporting included.

Need to lock down where the record lives? The HIPAA privacy policy template sets out who may open a file that holds protected health information.

Wondering what you owe the patient afterwards? The client rights policy template puts the openness that duty of candour expects into writing.

Writing up the clinical side? The PIRP note template gives you a structure for the treatment note that sits alongside an incident record.

Documenting a fall that may have broken something? The patellar pubic percussion test is a bedside check worth recording before you refer for imaging.

Frequently asked questions