Mandatory reporting obligations after a session incident

Last reviewed: August 2026 · Psychedelic law changes quickly — verify current status before relying on this page.

Who this is for: Oregon and Colorado service center and healing center operators, facilitators, and staff determining what they must report after a serious incident.

The short answer

A serious incident at a service center can trigger more than one reporting duty. The licensee usually has to report certain events, such as a death, a medical emergency, or a loss of product, to the psychedelics regulator within a set deadline. Separately, if the incident involves a disclosure of child or vulnerable-adult abuse, the facilitator or staff may be mandatory reporters under general state law, which runs to a different agency. These duties are not optional, and failing to make a required report is its own violation. An operator should know the categories and the deadlines before an incident and should get legal advice on how to report accurately, not on whether to report.

Two kinds of reporting an incident can trigger

An incident can set off two distinct reporting obligations that should not be confused. The first is incident or adverse-event reporting to the psychedelics regulator, Oregon Psilocybin Services or the Colorado Department of Revenue, which licensees owe as a condition of their license. The second is general mandatory-reporter reporting, which a person in a covered role may owe when they learn of abuse of a child or a vulnerable adult, and which goes to a child-welfare or adult-protective agency rather than the psychedelics regulator. A single event can trigger one, both, or neither, and the two have different recipients, different content, and different deadlines.

What licensees report to the regulator

State rules require licensees to report defined incidents. The categories generally include the death of a participant, a serious medical emergency or hospitalization connected to services, the theft, loss, or diversion of product, and certain other events the rule lists. The exact list is set by the regulator’s rules, and an operator should work from that list rather than from memory, because what counts as a reportable incident is defined there. What to do if a client is harmed at your service center covers the broader response that the report fits into.

One category is defined with real precision in Oregon: an “adverse event” is a client’s behavioral reaction that required contacting emergency services or receiving care from a medical provider during an administration session, reportable under OAR 333-333-5120 and OAR 333-333-4700. That threshold turns on medical intervention, not on how unusual or difficult the session was — a distressing experience that did not require emergency services or medical care is not, by itself, an adverse event. Mandatory reporting obligations for licensed psilocybin facilitators and What happens when a client has a medical emergency during a session? cover this threshold, and the required sequence of mitigating a safety issue before calling emergency services, from the facilitator’s side. The other categories a licensee must report — a participant death, product theft or diversion, and the others the rule lists — do not carry the same single clean definition and should be confirmed against the current rule text rather than assumed.

Deadlines are set by rule and they are firm

Incident reports usually come due quickly, within a timeframe the rule specifies. An operator should treat the deadline as fixed and confirm it from the current rule, because a report that would have been fine on time becomes a violation when it is late. Knowing the deadline in advance, as part of an incident plan, keeps the report from being missed in the confusion after an event. Incident response for psychedelic operators: the first 72 hours covers where the report falls in the immediate timeline.

The mandatory-reporter overlay

If, during or around a session, a participant discloses abuse of a child or a vulnerable adult, or staff observe signs of it, a separate reporting duty may apply. People in many roles are mandatory reporters under state law and must report suspected abuse to the designated authority, on that law’s timeline, regardless of the psychedelics rules. Mandatory reporting obligations for licensed psilocybin facilitators covers who is a mandatory reporter and how that duty works. This reporting goes to the child-welfare or adult-protective system, not to the psychedelics regulator, and the two reports are made separately.

Data and records breaches

If an incident involves the loss or exposure of participant records or personal information, a data-breach notification duty may apply under state privacy law, separate from the incident report to the psychedelics regulator. What facilitators need to know about client confidentiality and data privacy and HIPAA, state privacy law, and psychedelic client records cover those obligations. An operator should consider whether an incident touched protected information and whether a breach notice is required.

Reporting is required even when it is uncomfortable

A required report can feel like it works against the operator, because it tells the regulator about an event that may lead to scrutiny. The duty applies anyway. An operator cannot withhold a mandatory report to avoid exposure, and doing so adds a second, independent violation and can look like concealment. The role for legal advice is in how the report is made, keeping it accurate, complete, and limited to what the rule requires, not in whether to make it. Cooperating with an OPS investigation as a licensee covers what follows if the report leads to an investigation.

How confidentiality fits

Reporting required incidents to the regulator does not breach the operator’s confidentiality obligations, because the rules that require the report also permit the disclosure. The operator should still limit what it discloses to what the report calls for, rather than volunteering unrelated participant information. The mandatory-reporter duties for abuse likewise override ordinary confidentiality for the specific purpose of the report.

When public information may be enough

The regulator publishes the incident-reporting rules, including the categories and the deadlines, and the mandatory-reporter and data-breach laws are public as well. An operator can read these and build a reporting checklist before an incident. Identifying the duties is something public sources support; applying them to a specific, serious event is where advice helps.

When you should speak with a lawyer

For a serious incident, especially a death or an allegation of abuse or misconduct, a lawyer should help with the reporting promptly. Counsel can confirm which duties apply, what each report must contain, and the deadlines, and can make sure the reports are accurate without disclosing more than required. Because failing to report is itself a violation, the advice is about getting the reporting right and on time, not about avoiding it.

You might also want to read

This article provides general legal information, not legal advice, and does not create an attorney-client relationship. Psychedelic law differs by state and changes over time. Consult a licensed attorney in your jurisdiction before acting on anything described here.