Compliance incident management: Why a rise in reports is usually a good sign.

TLDR

• Low incident volume rarely means few incidents. It usually means reporting is too hard, too slow or too unclear.
• A 2025 OIG review found that hospitals failed to capture roughly half of patient harm events, most often because staff did not consider the event reportable.
• When reports go up after a change to your process, that is normally the process working.
• What matters is not how many reports you receive, but how fast they get to the right person and whether anything changes as a result.

The number that looks good and isn't.

If your organization logged 40 incidents last quarter and 90 this quarter, the instinct is to worry that something got worse.

But when we’re talking about incident reporting, that change usually indicates something got easier.

Incident volume measures reporting behavior first and events second. An organization with a two-page paper form and an unclear submission process will always look safer on paper than one where reporting takes 30 seconds on a phone. The events are the same. Only the capture rate changed.

That makes low volume one of the least reliable signals in compliance, and one of the most comforting, which is a bad combination.

What the research really shows.

A 2025 OIG review found that 49% of Medicare patient harm events were absent from hospitals' incident reporting and surveillance systems, with another 16% where OIG could not determine whether the event had been captured.*

The reasons are the useful part. Among missed events, 46% went unrecorded because staff did not consider the event to be harm, and 18% because capturing that type of event was not standard practice at the hospital, which OIG attributed largely to hospitals applying narrow definitions of harm.*

That is not a workforce problem. It is a definitions and process problem.

For context on the trend, OIG's 2012 review found hospital incident reporting systems captured only an estimated 14% of patient harm events, with 61% of the gap attributed to staff not perceiving events as reportable.** Capture has improved substantially. The dominant reason for the remaining gap has not changed at all.

Why people do not report.

Four things account for most of it.

1. They do not know it counts. This is the largest category in both OIG reviews. Someone sees a near miss, a medication delay or a minor fall with no apparent injury and files it mentally under "not a real incident."
2. It takes too long. An incident that takes 30 minutes to report does not get reported. A nurse finishing a shift will choose the patient in front of them over a form every time, and they are right to.
3. They’re not sure where it goes. If staff cannot say what happens after they hit submit, submitting feels like handing something to nobody.
4. Nothing came of the last one. This is the quietest and most damaging. In the 2025 OIG review, among captured harm events where sufficient information was available, only a minority were investigated, and fewer still led to patient safety improvements or process changes.* Staff notice that pattern faster than any dashboard does.

What to watch instead of volume.

Volume tells you about your process. These tell you about your risk.

• Time to route. How long between submission and the right person seeing it.
• Mix of severity. A system receiving only serious events is missing the near misses that predict them.
• Reporter diversity. If every report comes from nursing, other roles have opted out. Physician underreporting is well documented.
• Repeat categories. The same event type recurring in the same department is the signal worth acting on.
• Closure rate. How many reports reach a documented resolution.
• Whether anything changed. The only measure that ultimately matters.

A rise in volume alongside a stable or falling severity mix is close to the ideal picture. It means people are reporting the small things.

Lowering the friction.

Most of the gap closes with unglamorous changes.

Define what counts, in writing. OIG specifically noted that hospitals applying narrow definitions of harm missed more events.* A short, concrete list of reportable event types does more than a training module.

Make submission take seconds, from any device. Reporting has to be possible from wherever the incident happened.

Route automatically. Manual triage adds delay at the exact moment delay matters, and it makes reporting feel like it disappears into an inbox.

Give people a way to report confidentially. Some concerns will not come through a named channel, and that includes concerns from patients and community members, not only staff.

Close the loop. Even a brief acknowledgment that a report was reviewed changes reporting behavior more than any campaign.

Where incidents connect to everything else.

An incident is rarely just an incident. It usually points at a policy that needs revision, a vendor whose performance should be reconsidered at renewal, or a training gap that shows up in more than one department.

When incident data sits in its own place, those connections depend on someone remembering to make them. When it sits alongside policy management, contracts and compliance, the incident points back at the policy that governs it, and a pattern involving a vendor is visible when that agreement comes up for renewal.

How we approach it.

We built incident reporting around the two things that determine whether it works: how little effort it takes to file a report, and how quickly that report reaches someone who can act on it.

Everything else follows from those two. What counts as reportable, where a report goes, who gets notified and how fast are all decisions your organization makes rather than ones the software makes for you.

Want to see what your reporting picture looks like?

We can walk you through how incidents are captured, routed and resolved, and what the data looks like once it is connected to your policies.

Sources

* U.S. Department of Health and Human Services, Office of Inspector General. Hospitals Did Not Capture Half of Patient Harm Events, Limiting Information Needed to Make Care Safer. Report No. OEI-06-18-00401, 2025.

** U.S. Department of Health and Human Services, Office of Inspector General. Hospital Incident Reporting Systems Do Not Capture Most Patient Harm. Report No. OEI-06-09-00091, January 2012.