Critical Incident Reporting and Analysis System (CIRAS) - Version 3

CIRAS Manual- Version 3, Updated June 30, 2025

Table of Contents

1. Section 1: Purpose of CIRAS
2. Section 2: CIRAS Overview
   1. 2.1 Critical Incidents Defined
3. Section 3: CIRAS Liaison
   1. 3.1 Duties of the CIRAS Liaison
   2. 3.2 Useful applications/websites for CIRAS process
   3. 3.3 Sending a CIRAS Registration packet
4. Section 4: Enrollment in CIRAS
   1. 4.1 ISC Agencies
   2. 4.2 Model Business Associate Agreement
   3. 4.3 Data Sharing Agreement
   4. 4.4 Security and Privacy Questionnaire
5. Section 5: ISC and Community Provider Agencies (Designated Agency Reporters)
   1. 5.1 Certificate of Understanding and Acknowledgement for CIRAS
   2. 5.2 Establishment of an External User I.D.
   3. 5.3 Completion of Department of Information Technology (DoIT) forms
   4. 5.4 Community Provider/External User I.D. And System Access Request (IL444-2022)
   5. 5.5 Request for MIS Hardware, Software and Services (IL444-4144)
   6. 5.6 DoIT Unable to Verify User Identity (Use of IL444-4144)
6. Section 6: Reporting Critical Incidents Through CIRAS
   1. 6.1 Critical Incident Tracking Data Elements
   2. 6.2 Timeframe for Reporting Incidents
   3. 6.3 Entering Incidents in CIRAS
   4. 6.4 CIRAS Interim Incident Reporting
   5. 6.5 Change in FEIN impacts Incident Reporting
7. Section 7: Notification of CIRAS Incidents
   1. 7.1 ISC Agencies
   2. 7.2 DDD Staff Responsibilities for Individual Incident Review
8. Section 8: Removing Staff/User Names from CIRAS
   1. 8.1 Reasons to remove staff/user name
   2. 8.2 Steps to remove staff/user name
9. Section 9: Data Reports and Analysis
   1. 9.1 Summary Reports and Trend Analysis
   2. 9.2 Review of Trend Reports

Section 1: Purpose of CIRAS

The Division of Developmental Disabilities (DDD) has developed the Critical Incident Reporting and Analysis System (CIRAS) to capture electronic reports from providers and Independent Service Coordination (ISC) agencies for critical incidents involving individuals with developmental disabilities in the State's Medicaid Waiver programs. The types of incidents to be reported are listed and defined within this manual.

The reported information will be used to:

• Inform ISC agencies of potential issues involving the participants whose general health and well-being the ISCs are monitoring,
• Ensure incidents are addressed timely and appropriately, and
• Analyze potential systemic issues and take steps to enhance overall system quality.

CIRAS is not a reporting system for alleged incidents of abuse, neglect, or exploitation. Providers should continue to report alleged cases of abuse, neglect or exploitation to the Department of Human Services' Office of the Inspector General (OIG), Department of Children and Family Services (DCFS), Department on Aging (IDoA)/Adult Protective Services (APS), and/or Department of Public Health (IDPH) as appropriate and required in accordance with the type of service involved. In addition, providers must communicate to the ISC any serious incidents not defined in this manual where the health or safety of the individual may be impacted.

Section 2: CIRAS Overview

When a community provider is aware that an individual has experienced a critical incident(regardless to location; see Section 6.1 Critical Incident Tracking Data Elements - "Location of Critical Incident") as defined below, the community provider will use CIRAS to report the incident to the DDD. The CIRAS system will automatically notify the appropriate ISC agency identified in the report. The ISC agency will perform the appropriate follow-up, enter a summary in CIRAS of the follow-up actions taken, and if necessary, notify the Division of unresolved incidents as indicated in the Problem and Conflict Resolution Protocol. For some types of incidents, the Division may become directly involved in addressing the incident.

In addition to entering follow up for CIRAS incidents submitted by community providers, the ISC agencies are responsible for submitting CIRAS reports for incidents they become aware of that have not been reported. Unresolved issues with CIRAS incidents should be reported to the DDD per the Problem and Conflict Resolution Protocol.

CIRAS will compile data based on the CIRAS incidents reported. The DDD will have the ability to review all submitted CIRAS data while the ISC agencies will be able to review data relevant to them. Community providers will be able to review the CIRAS data relating to incidents they have reported.

2.1 Critical Incidents Defined

Critical Incidents are the alleged, suspected, or actual occurrence of an incident when there is reason to believe the health or safety of an individual may be adversely affected or an individual may be placed at a reasonable risk of harm. CIRAS reports do not include abuse, neglect, or exploitation incidents. These allegations should continue to be reported to the appropriate agency; Department of Human Services' Office of the Inspector General (OIG), Department of Children and Family Services (DCFS), Department on Aging / Adult Protective Services (APS), and/or Department of Public Health (IDPH).

Critical incidents are defined as:

911 Call: All calls to 911 for emergency personnel response that do not meet the requirements of any other category. Calls for emergency response that are initiated by persons receiving supports from the provider agency should be included here, even if they are later determined to be inappropriate.

Calls to 911 for medical assistance for a medical reason that is not to save an individual's life (or, does not result in hospitalization) should be reported as a 911 Call. Calls to 911 for medical emergencies to save an individual's life should be reported as "Medical emergency." A description of the reason for the call should be included in the narrative.

911 Call is also known as an emergency call.

Deaths: Deaths of participants who receive services while living in their own or family's home. Deaths of participants residing in residential settings are not reported in CIRAS as they are reported to OIG per Rule 50.

Known injury: A known injury is any injury from a known cause that is not considered abuse or neglect and that requires immobilization, casting, five or more sutures or the equivalent, second or third degree burns, dental injuries, eye injuries, or any injury that prohibits the individual from participating in routine daily tasks for more than two consecutive days. In some cases, an injury may not be immediately recognized as requiring reporting. A known injury becomes reportable at the point where there is recognition that it fits this definition.

Law enforcement: Any incident that results in the individual being charged, incarcerated, or arrested. If a 911 Call to law enforcement does not result in the individual being charged, incarcerated, or arrested, the incident must not be reported in this category. The selection of a more appropriate category is required.

Medical emergency: Any incident where emergency medical intervention is required to save an individual's life (e.g., Heimlich maneuver, cardiopulmonary resuscitation (CPR), intravenous (IV) therapy for dehydration).

• Calls for 911 medical assistance to save an individual's life should be reported as "Medical emergency" even if the cause is other than the examples provided above. A 911 Call is not required for an issue to be reported as a "Medical emergency" (i.e., an incident can be classified as a "Medical emergency" even if a 911 Call is not made).
• A medical emergency resulting in hospitalization should be reported as a "Medical emergency".
• Incidents that are resolved through intervention of agency staff that could have resulted in death if the action had not occurred.

Calls for 911 medical assistance for a medical reason that is not to save an individual's life should be reported as 911 Call.

Missing individual: An incident that is not attributed to neglect, as defined by Rule 50, and the individual cannot be located for a period of time longer than specified in the personal plan; the individual cannot be located after actions specified in the personal plan are taken; the individual cannot be located in a search of the immediate surrounding area; circumstances indicate that the individual may be in immediate jeopardy; or law enforcement has been called to assist in the search for the individual. (If applicable, indicate individual has been located.)

Peer-to-peer acts: Acts committed by one individual against one or more individuals when there is physical abuse with intent to harm; verbal abuse with intent to intimidate, harass, or humiliate resulting in emotional distress or maladaptive behavior; any sexual abuse; any exploitation; or intentional misappropriation of property. In some cases, such incidents may need to be reported to OIG as potential staff neglect or exploitation, rather than reported in CIRAS. If peer-to-peer actions occur due to failure of staff to intervene to prevent or stop the act, a neglect report is appropriate. In cases where one individual is clearly the aggressor, it is acceptable to make only one CIRAS entry in the name of the aggressor, listing the name(s) of the victim(s) in the narrative. However, if two or more people become involved in an altercation that meets this definition and the aggressor is identified as multiple individuals, a separate CIRAS report should be completed for each aggressor. Acts committed against staff should be reported in the "Peer-to-staff" option.

Peer-to-staff: Acts committed by one individual against one or more staff members when there is physical abuse with intent to harm or verbal abuse with intent to intimidate, harass, or humiliate. In cases where one individual is clearly the aggressor, it is acceptable to make only one CIRAS entry in the name of the aggressor, listing the name(s) of the victim(s) in the narrative. However, if two or more people become involved in an altercation that meets this definition and the aggressor is identified as multiple individuals, a separate CIRAS report should be completed for each aggressor.

Unauthorized restraint: Any use of restraint beyond the provisions outlined in Appendix G of each Waiver. Refer to Illinois Mental Health and Developmental Disabilities Code for details. (See 405 ILCS 5/1-125 and 405 ILCS 5/2-108 for details.).

Unknown injury: Any injury of an unknown cause that is not considered possible abuse or neglect and that requires treatment that only a physician, physician's assistant, or nurse practitioner can provide. If the cause of the injury is known, follow instructions in KNOWN INJURY and/or MEDICAL EMERGENCY categories.

Unscheduled hospitalization: Any hospital admission that is not scheduled in advance. Hospitalization admissions that occur as a result of a "Medical emergency" or "911 Call" should not be reported in this category but should be reported in the appropriate category.

---

NOTE: As aforementioned, CIRAS is not a reporting system for alleged OIG incidents. However, there may be instances where an incident is reported in CIRAS and also reported to OIG. For example, an individual may require an Unscheduled Hospitalization. This incident is a CIRAS entry requirement. If it is later discovered that the incident involved an allegation of abuse (either by the agency or via reports external to the agency), the allegation must be reported to OIG. Although the two reports refer to the same incident, each captures separate and specific reporting requirements.

Section 3: CIRAS Liaison

A CIRAS Liaison is an agency staff member of the ISC/community provider appointed to coordinate the agency's CIRAS incident program. Each agency must designate a staff member to serve in this role.

• The Executive Director (or an authorized representative) must identify a CIRAS Liaison by emailing specific information as shown below (email to be kept on file with DDD.
• The identified CIRAS Liaison can be a Designated Agency Reporter [refer to Section 5, ISC and Community Provider Agencies (Designated Agency Reporters)], the OIG Liaison, a Quality Assurance staff member, an Information Technology staff member, or any staff member designated by the Executive Director (or, an authorized representative).

Note: Only one CIRAS Liaison shall be identified at any given time for each ISC/community provider agency.

REQUIRED: The Executive Director (or, an authorized representative) of the ISC and community provider agency must send an email to DHS.DDD.CIRAS@illinois.gov with the following information (ensuring to use the email subject lines as shown below).

Use the below sample email to add a CIRAS Liaison.

• Email Subject:	Add CIRAS Liaison
  Email Message:	This email is to identify the CIRAS Liaison for: Provider name: Provider FEIN: Add CIRAS Liaison name (first and last name): CIRAS Liaison position title @ agency: Email address of CIRAS Liaison: Telephone number of CIRAS Liaison:

• Use the below sample email to update contact information for a CIRAS Liaison. Provide all information even if certain information is already on file.

• Email Subject:	Update Contact Information for current CIRAS Liaison
  Email message:	This email is to provide updated contact information for: Provider name: Provider FEIN: Current CIRAS Liaison name (first and last name): CIRAS Liaison position title @ agency: Email address of CIRAS Liaison: Telephone number of CIRAS Liaison:

• Use this email sample to remove a CIRAS Liaison.

  Email Subject:	Remove CIRAS Liaison
  Email message:	This email is to remove the CIRAS Liaison: Provider name: Provider FEIN: Remove CIRAS Liaison name (first and last name): CIRAS Liaison position title @ agency: (An additional, separate email is being submitted to "Add CIRAS Liaison")

3.1 Duties of the CIRAS Liaison

• Serve as the main contact staff member for DDD CIRAS unit. This staff member will be contacted by CIRAS unit staff for inquiries regarding CIRAS registrations and other CIRAS related topics;
• Review the CIRAS PowerPoint presentation developed by the CIRAS unit;
• Become familiar with the following:
  • forms to be completed by designated agency reporters;
  • how to complete and submit forms to the DDD CIRAS unit;
• Assure forms for designated agency reporters are complete and accurate prior to submission to DHS.DDD.CIRAS@illinois.gov;
• Submit the completed forms on behalf of the agency's designated agency reporters (including, but not limited to, forms for the removal of a staff member/user. See Section 8 Removing Staff/User Names from CIRAS.);
  • For each email, the CIRAS Liaison must submit registration forms that represent one staff member. Registration forms for multiple staff members shall not be included in a single email.
  • Submitted forms/documents must be unlocked and cannot be encrypted. In addition, DDD CIRAS unit must be able to electronically sign the forms/documents. (If transmitting protected health information, PHI, an encryption application compatible with software utilized by DHS, such as Entrust, must be used.)
  • The Subject of the email must reflect "CIRAS REGISTRATION REQUEST".
  • Refer to Section 3.3 Sending a CIRAS Registration packet.
• Assure each designated agency reporter becomes familiar with the CIRAS manual;
• Train designated agency reporters on how to use the CIRAS system and enter CIRAS reports that reflect accurate data/information (appropriate identification of the ISC is essential). (Maintain staff training records);
• Train and/or inform agency staff members on the requirements of CIRAS reporting;
• Maintain a list of designated agency reporters (and the associated Certificate of Understanding and Acknowledgement for CIRAS);
• Based on each agency, additional tasks and duties may be assigned to the CIRAS Liaison role.

3.2 Useful applications/websites for CIRAS process

• Click: How to Use Entrust to Encrypt Confidential Information (for DHS Providers & Partners) (Encryption must be used when transmitting PHI)
• Use of #ILEncrypt#. This feature is sometimes used by DDD staff to send encrypted emails to agencies when transmitting PHI. It utilizes a Cisco Secure Email Encryption Service. Upon receipt of an encrypted email, it will reflect "This is a secure message". Instructions will be provided to open the attachment. Click here for FAQ regarding secure messages.
• Click: How to Open PDF Forms
• Click: DoIT Identity Management Accounts for System Account Locked (Reset password). Users can reset their password by navigating to the id.illinois.gov website and following instructions to unlock their account; select "Reset your Password or Unlock your Account" option. Passwords must not be saved during use of the web browser. If saved, the user must clear the browser history to avoid a relocking of the account. (The user can do an online search for how to clear browser history)
• Agency use of DocuSign for electronic signature. When using DocuSign, forms/documents cannot be sent directly to the DHS.DDD.CIRAS@illinois.gov mailbox. An email should be sent to this email address requesting a CIRAS unit staff member to coordinate the processing of DocuSign forms/documents. For specific DocuSign requirements for IDHS use, refer to Section 5.3 Completion of Department of Information Technology (DoIT) Forms.

3.3 Sending a CIRAS Registration packet

• Prior to sending a CIRAS registration packet, the following must have occurred:
  • Per Section 5.2, designated agency reporter/user obtained an external user I.D.
  • Per Sections 5.3 - 5.5 designated agency reporter/user electronically completed forms IL444-2022 and IL444-4144
  • Per Section 3.2, agency adherence to Entrust and Docusign requirements (if applicable)
• Sending the CIRAS registration packet (unencrypted; representing one staff member):
  • Send to: DHS.DDD.CIRAS@illinois.gov
  • Subject: CIRAS REGISTRATION REQUEST
  • Attachments: Forms IL444-2022 and IL444-4144

Section 4: Enrollment in CIRAS

4.1 ISC Agencies

ISC agencies must enroll in CIRAS to be able to report CIRAS incidents, receive critical incident notifications, and review CIRAS reports. In addition, ISC agencies must select designated agency reporters who must complete the steps shown in section 5 "ISC and Community Provider Agencies (Designated Agency Reporters)" of this manual. The enrollment process consists of completing the documents below:

• Model Business Associate Agreement
• Data Sharing Agreement
• Security and Privacy Controls Questionnaire

4.2 Model Business Associate Agreement

The Model Business Associate Agreement is a standard form required by the DHS General Counsel Division to establish confidentiality standards related to the Health Insurance Portability and Accountability Act (HIPAA). The form will be provided to the ISC agency by the Division of Developmental Disabilities. The ISC agency will need to have the Executive Director or designee sign on the last page under, "Business Associate Representative." The signed form must be returned via email to DDD: DHS.DDD.CIRAS@illinois.gov.

Upon approval, the CIRAS unit will forward a copy of the agreement to the ISC for their records. The agreement is completed biennially and will be kept on file by DDD.

4.3 Data Sharing Agreement

The Illinois Department of Human Services (IDHS) and ISC agency enter into a Data Sharing Agreement (DSA) to provide the ISC with limited access to IDHS' Data for the purposes of sharing CIRAS data.

DDD has an obligation to ensure the health, safety, and welfare of the individuals served through its services. To fulfill that obligation, DDD needs to be aware of incidents where individuals may have been put at risk. Once aware of these incidents, the Division works with the ISC to address individual incidents. Thus, the Division created the CIRAS system to capture potentially harmful incidents and use the information to take appropriate action, if necessary. This Agreement allows DDD to share incident information with the ISCs so that ISCs can follow up or monitor the incident.

DDD will supply a Data Sharing Agreement to all ISC agencies. Each ISC agency will have a unique agreement number. Once completed by the Executive Director, it must be submitted to DDD by email to: DHS.DDD.CIRAS@illinois.gov.

Upon approval, a copy of the DSA will be forwarded to the ISC for their records. The agreement is completed biennially and will be kept on file by DDD.

4.4 Security and Privacy Questionnaire

The Security and Privacy Questionnaire (SPCQ) serves to outline the Agency's baseline security and privacy controls as they relate to the Data Sharing Agreement (DSA) contractual requirements to access the Illinois Department of Human Services (IDHS) data, documents and electronic media. The baseline control questions are in accordance with the Federal and State laws, policies and audit compliance regarding how IDHS provides security and privacy of our client's data and personal information. The questions are not all inclusive as each IDHS Application or System is different, however, these questions do provide a place from which to develop further discussion and ensure the Agency meets these security and privacy requirements in regard to IDHS data. This Questionnaire is an annual requirement of the DSA. The ISC will be given a copy of the final, approved SPCQ to maintain for their records. Each year, the ISC will complete the form and re-submit for approval.

Section 5: ISC and Community Provider Agencies (Designated Agency Reporters)

ISC and community provider agencies must select designated agency reporters who must complete the steps in this section.

5.1 Certificate of Understanding and Acknowledgement for CIRAS

Each ISC and community provider agency is required to have the designated agency reporter(s) complete and sign the certificate. A copy of this certificate must be maintained at the agency and is part of a security audit trail. The agency is not required to submit the completed certificate to DDD.

The certificate is available at this link: Certificate of Understanding and Acknowledgment for the Critical Incident Reporting and Analysis System

5.2 Establishment of an External User I.D.

Initially, users must request an external user I.D. by clicking on the link below. If the CIRAS user has an existing external I.D (that is, an active directory ending in @external.Illinois.gov, also known as DHS I.D.) then proceed to Section 5.3 Completion of Department of Information Technology (DoIT) forms.

• Click this site: DoIT Identity Management Accounts 
• Once at the DoIT website, select the option for "Create Illinois.gov Account" and then follow the prompts.
• The DoIT website will generate the external user I.D and email it to the work email address. The external user I.D. is the CIRAS username and will be necessary to log into CIRAS.
• For designated agency reporters registering for more than one agency, a separate external user I.D. is necessary for each agency.
• If the identity of the user is unable to be verified via the DoIT Identity Management process, refer to Section 5.6 DoIT Unable to Verify User Identity (Use of IL444-4144).

Notes:

• Passwords established for CIRAS will automatically expire 60 days without user notification. To reset the CIRAS Password, click on the following link, Links to Important CIRAS Resources. Once at the website, click External ID Password Changes. Follow steps appearing on the "External.Gov Email Password Recovery Steps" website.
• A user I.D. without login activity for 120 days will be automatically deactivated. Form "Request for MIS Hardware, Software and Services (IL444-4144)" (below) must be completed to reactivate the user I.D.

5.3 Completion of Department of Information Technology (DoIT) forms

• Community Provider/External User I.D. And System Access Request (IL444-2022)
• Request for MIS Hardware, Software and Services (IL444-4144)

IMPORTANT NOTES:

• These forms must be completed electronically, bearing an electronic signature. DoIT/DDD will not accept scanned or handwritten forms. (It is recommended to use Adobe Acrobat application for completing the forms)
• When completing the forms, for the provider name, the agency's legal, official name as reflected in the IMPACT system must be used (Illinois Medicaid Program Advanced Cloud Technology). Avoid using a "Doing Business As (DBA)" provider name that is not reflected in IMPACT.

5.4 Community Provider/External User I.D. And System Access Request (IL444-2022)

Users must complete the IL444-2022 form after being assigned an external user I.D.

The IL444-2022 is used to provide DHS system access for a variety of functions, including CIRAS. This form is available from the DHS website by clicking on the following link IL444-2022 (Community Provider / External User I.D. And System Access Request). For community provider agencies, the form is also included in the initial enrollment packets.

For examples, see:

• IL444-2022 ISC Agency Sample Template
• 
• IL444-2022 Community Provider Agency Sample Template
• 

The following steps should be taken to complete the IL444-2022 for CIRAS access (must have an active directory I.D. prior to completing this form):	Steps to follow:
Action Requested:	Check the box "System Access Only (ID Previously Assigned)"
Community Provider Information:	FEIN No.: indicate agency FEIN No. Agency Number: indicate assigned DHS number Provider Name (Required): indicate Agency/Provider Name (as reflected in the IMPACT system) IGA/DSA No. (Required): ISC - Provide the ISC CIRAS designation number provided with initial enrollment packet. Community Provider - indicate "Impact Terms and Conditions" Medicaid ID Number: leave blank
User Information:	Complete information as requested for the designated CIRAS reporter. The IDHS ID will be the external user I.D. (for example, John.Doe@external.illinois.gov). This will be the email address assigned from the Create Illinois.gov account steps. If the CIRAS reporter has an existing external.illinois.gov email address, input that existing .gov address.
User System Access Requested:	Check "CIRAS/CMA" box
To Be Completed for all Transactions Except "Delete User ID":	User indicates their printed name, sign their name and add date. (Electronic signature required using Entrust or DocuSign)
Approval Signatures (required):	The agency executive director (or, authorized representative) indicates their printed name, sign their name and add date. (Electronic signature required using Entrust or Docusign)
IDHS Program Approving Authority's Name:	Leave blank [If using DocuSign, user must identify the IDHS signature block (3 fields: printed name, digital signature, and date) as interactive/fillable fields for DHS use.]
Completion	Once completed, forward the form along with form IL444-4144 to: DHS.DDD.CIRAS@illinois.gov

5.5 Request for MIS Hardware, Software and Services (IL444-4144)

The IL444-4144 form is used to provide access to the reports, viewed through the InfoView portal, from the Reports tab on the CIRAS site. The IL444-4144 form is available from the DHS website by clicking on the following link called Request for MIS Hardware, Software and Services. For community provider agencies, the form is also included in the initial enrollment packets.

For examples, see:

• IL444-4144 ISC Agency Sample Template
  • 
• IL444-4144 Community Provider Agency Sample Template
  • 

The following steps should be taken to complete the IL444-4144 for CIRAS report access (must have an active directory I.D. prior to completing this form):	Steps to follow:
Requestor	Indicate name of staff person requesting/reporting in CIRAS (or the CIRAS Liaison). Division: indicate DDD Bureau/Facility: indicate your agency name Telephone No: indicate telephone number of requestor Contact: provide information for contact - name; agency address and city/zip code; telephone number of contact State Fiscal Year (SFY): indicate current, 2-digit State Fiscal Year. For example, for FY 2021, indicate 21. The 2-digit number changes annually Check the "New Single-Year contract" box
Recipient	Indicate name of staff person requesting/reporting in CIRAS. Division: indicate DDD Bureau/Facility: indicate agency name of recipient Address: indicate address of agency City and Zip Code: indicate city and zip code of agency Telephone No.: indicate telephone number of recipient Location Code: leave blank Active Directory ID: indicate the requestor/reporter's external.illiois.gov email address here. Remaining Fields - Leave the next four fields blank (that is, CPU Tag No. through *Required Estimated Total Cost).
ISC (to register user)	Narrative Description of Request. Indicate the following: Please register xyz@external.illinois.gov (ISC staff person's external ID information will go here in place of the xyz@external.Illinois.gov) with the roles in TAM/SAM. DHS_CIRAS_isc (CIRAS ISC) DHS_CIRAS_user (CIRAS user) DHS.G.CIRAS_ISCProviderExternalReporting DHS_DDQR_PM_user for CMA Justification. Indicate the following: To report in CIRAS & CMA databases.
Community Provider Agency (to register user)	Narrative Description of Request. Indicate the following: Please register xyz@external.illinois.gov (community provider staff person's external ID information will go here in place of the xyz@external.Illinois.gov) with the roles in TAM/SAM. DHS_CIRAS_reporter DHS_CIRAS_user DHS.G.CIRAS_ProviderExternalReporting DHS_DDQR_PM_user for CMA [For completion of new forms due to change in provider FEIN number, add a statement to reflect reason for new form, such as: "Please remove xyz@external.illinois.gov from Provider Name FEIN# ___-___________ due to merge of Provider Name FEIN # ___-___________ with Provider Name FEIN # ___-___________ . Add xyz@external.illinois.gov to Provider Name FEIN # ___-___________." Contact DHS.DDD.CIRAS@illinois.gov for questions regarding completion of this form.] Justification. Indicate the following: To report in CIRAS & CMA databases.
Division Approval and Page Two	(Agencies do not sign this form) [If using DocuSign, user must identify the following as interactive/fillable for DHS use: Page 1: Division Approval signature block (4 fields: printed name, title, digital signature, and date) Page 2: all fields shown on page 2]
Completion	Once completed, forward the form along with form IL444-2022 to: DHS.DDD.CIRAS@illinois.gov.

5.6 DoIT Unable to Verify User Identity (Use of IL444-4144)

If the identity of the user is unable to be verified via the DoIT Identity Management process (usually occurs due to a name change or out-of-state driver's license), the staff person will be required to complete the IL444-4144 form.

The completion of the form shall follow similar instructions as outlined under Section 5.5 Request for MIS Hardware, Software and Services (IL444-4144), with exceptions as shown below to the Narrative Description. The user must include their driver's license information in the narrative description.

For example, see:

• IL License Unable to Verify Template
  • 

For Section 5.6 only, refer to linked template above to complete the IL444-4144 for CIRAS report access:	Note the specific exception below when DoIT is unable to verify user identity:
ISC (unable to verify user identity)	Narrative Description of Request. Indicate the following: Please register xyz@external.illinois.gov with the roles in TAM/SAM. (use your id in place of xyz) DHS_CIRAS_isc (CIRAS ISC) DHS_CIRAS_user (CIRAS user) DHS.G.CIRAS_ISCProviderExternalReporting DHS_DDQR_PM_user for CMA ISC Reporter: Fill out this part. IL LICENSE WON'T VERIFY DL #: __________________________________________ Expiration date: ____________________________ Work email address: ________________________________________________________________________ Justification. Indicate the following: To report in CIRAS & CMA databases.
Community Provider Agency (unable to verify user identity)	Narrative Description of Request. Indicate the following: Please register xyz@external.illinois.gov with the roles in TAM/SAM. (use your id in place of xyz) DHS_CIRAS_reporter DHS_CIRAS_user DHS.G.CIRAS_ProviderExternalReporting DHS_DDQR_PM_user for CMA Provider Reporter: Fill out this part. IL LICENSE WON'T VERIFY DL #: __________________________________________ Expiration date: ____________________________ Work email address: ________________________________________________________________________ Justification. Indicate the following: To report in CIRAS & CMA databases.

Once completed, both pages of the form must be emailed to DHS.DDD.CIRAS@illinois.gov. Upon receipt of the form, the CIRAS unit will send it to DHS MIS Bureau of Innovation, Productivity and Security (BIPS) for processing. BIPS will establish an external.illinois.gov ID for the user.

Upon establishing an external.illinois.gov ID, the user will proceed with the registration process by completing the two forms as outlined in the following sections:

• Section 5.4 Community Provider/External User I.D. And System Access Request (IL444-2022)
• Section 5.5 Request for MIS Hardware, Software and Services (IL444-4144) (Note: this version will be sent to DoIT)

Forms shall be submitted per Section 3.3 Sending a CIRAS Registration packet.

Section 6: Reporting Critical Incidents Through CIRAS

The list of definitions ("Critical Incidents Defined"; refer to beginning of this user manual) and data elements shown below will aid in completing the Incident Report.

6.1 Critical Incident Tracking Data Elements

All reporters, community providers and ISC agencies will need to gather the following details to complete a CIRAS report.

DATA ITEM	DEFINITION/COMMENTS
Provider's Name	Enter the name of the provider organization reporting the critical incident.
Provider's FEIN	Enter reporting organization's FEIN.
Name of Reporter	Enter the name of the individual making the report on behalf of the provider.
Participant's Name (3 separate data fields for First, Last, Middle Initial)	Enter the name of the individual served under the Medicaid Waiver program.
Participant's Social Security Number	Enter the individual's social security number.
Participant's Date of Birth	Enter individual's date of birth.
Participant's Gender	Enter individual's gender.
Date of Critical Incident	Enter the date the incident observed or when it was reliably reported (If date of incident is unknown, check designated box). [Reliably reported means staff was aware of the date incident occurred, however, did not observe it. See below "Examples of Date/Time Entries" for additional information.]
Time of Critical Incident	Enter the time the incident was observed or when it was reliably reported (If time of incident is unknown, check designated box). [Reliably reported means staff was aware of the time incident occurred, however, did not observe it. See below "Examples of Date/Time Entries" for additional information.]
Date Reporting Agency Discovered Incident	If the box is checked, date is automatically populated to be the same as date the incident occurred as observed or reliably reported. If agency becomes aware later that an incident occurred previously, box remains unchecked and enter date the reporting agency discovered the incident. See below "Examples of Date/Time Entries" for additional information.
Time Reporting Agency Discovered Incident	If the box is checked, time is automatically populated to be the same as date the incident occurred as observed or reliably reported. If agency becomes aware later that an incident occurred previously, box remains unchecked and enter time the reporting agency discovered the incident. See below "Examples of Date/Time Entries" for additional information.
Waiver Type	Enter waiver type for which individual is enrolled.
Type of Critical Incident	Enter type of critical incident.
Location of Critical Incident	Choose one of the following from the drop-down menu: Residence, Day Program Site, School, Work Location, Community Outing, Family Visit, Other, or Unknown.
Incident City	Select the city where the incident occurred. Note: Attention should be given to providers with locations throughout the state to assure the correct city is selected. Do not include name of neighborhood.
ISC Provider for Individual	Enter the ISC providing services for the individual. An automatic email notification will be sent to the selected ISC. Due to a priority response by the ISC for specific incidents, it is imperative to select the assigned ISC. Thus, appropriate actions and timely follow up can be initiated upon receipt of the email notification.
Narrative Description of the Critical Incident	Provide a narrative of the incident including information on what happened, when (date/time) and where the incident occurred, outcome of the incident, and any staff name(s) (and their working title) or other individuals who were involved. Include other applicable dates, where circumstances occurring on those dates had impact on the reported incident. The name or initials of the individual must be included in the description. This demonstrates that the individual's name reflected in the narrative description refers to the same individual whose name is shown in the demographic information of the incident report. Assure to include any pertinent information reflecting the current status (ex.: person has been discharged from hospital; missing person has been located). The narrative should reflect sufficient details to accurately describe the incident.
Action	Provide a narrative of the provider's response to the incident. It should reflect sufficient details to accurately describe the response, including date/time of response, staff name(s) (and working titles) of persons responding, action steps taken to immediately address the incident, and the incident status at the time of the report.

Examples of Date/Time Entries	Details
Example 1: On 6/17/21 @ 3:20pm, Individual fell in his bedroom and sustained injury to his leg. Staff, who were in the kitchen when incident occurred, heard the incident and proceeded to the bedroom to assist the individual, who did not desire to participate in routine daily tasks for a few days.	Type of incident: Known injury Date observed or reliably reported: 6/17/21 (although staff did not observe the incident they can reliably report it occurred on this date) Time observed or reliably reported: 3:20pm (although staff did not observe the incident they can reliably report it occurred at this time) Date that the reporting agency discovered the incident occurred…: check designated box (same as the date the incident occurred). Entering of date is not applicable. Time that the reporting agency discovered the incident occurred…: check designated box (same as time the incident occurred). Entering of time is not applicable.
Example 2: On 7/23/22 @ 10:15am, staff discovered Individual had a bruise and cut on his right arm. Staff asked Individual, "How did you get that bruise and cut?" Individual replied, "Sometime last week. It really didn't bother me so I didn't report it. I don't remember what happened nor the exact date and time when it occurred but it was sometime last week." Due to the nature of the cut on Individual's arm treatment was sought.	Type of incident: Unknown injury Date observed or reliably reported: check designated box for Date of Incident Unknown (staff did not observe the incident and cannot reliably report date when it occurred). Entering of date is not applicable. Time observed or reliably reported: check designated box for Time of Incident Unknown (staff did not observe the incident and cannot reliably report time when it occurred). Entering of time is not applicable. Date that the reporting agency discovered the incident occurred…: leave box unchecked for Date the reporting agency discovered the incident and enter 7/23/22 Time that the reporting agency discovered the incident occurred…: leave box unchecked for Time the reporting agency discovered the incident and enter 10:15am
Other scenarios:	If an incident is not observed by staff but the staff/individual can reliably report the date and time of the incident (which can be reliably corroborated by other means) refer to Example 1 for date/time entries. If an incident is not observed by staff and the staff/individual are not able to determine the date and time of the incident (and it cannot be reliably corroborated by other means) refer to Example 2 for date/time entries.

6.2 Timeframe for Reporting Incidents

Providers must report incidents within two (2) working days of discovering or being informed of the incident. Since the incidents reported through CIRAS do not involve allegations of abuse, neglect, or exploitation, providers are given more time to compile and report information ensuring it is complete and accurate for trend analysis.

6.3 Entering Incidents in CIRAS

To enter CIRAS, the user ID will be the entire external user I.D. (for example, John.Doe@external.illinois.gov) that was received when registering for CIRAS through the IL444-2022. The password used to enter CIRAS is the same password established when the external.gov email address was requested.

Community Providers and ISC agencies (The Reporter) will access CIRAS through a web link: CIRAS Reporting Database

---

The Reporter will see the System Login screen:

---

After entering the User ID and password, the following screen will appear:

---

To report a critical incident

1. The Reporter will select the "Search" tab located in top left of the page, and the Participant Search screen will appear.
2. The Reporter will enter the individual's Social Security Number in the "Participant SSN" field and select the Search button.
   1. If an incident has not been reported for the individual, the Participant Search Results screen will appear
   2. In situations when no results are found, the agency is required to complete a ROCS case entry to register the individual in order to submit a critical incident report.
3. If an incident has been reported for the individual, the Participant Search Results screen will appear with the following information:
   1. Upon successful entry of the SSN, provider will verify the following:
      1. The individual's SSN
      2. The Provider Name
      3. Participant First Name
      4. Participant Middle Name
      5. Participant Last Name
      6. Gender
      7. Date of Birth
   2. After verifying, the provider can
      1. Select a case by clicking the SSN
      2. The Incident report will open
4. All text boxes, check boxes, and drop-down boxes must be completed on the Incident Report screen.
   1. The following information are already shown:
      1. The Provider's name
      2. The Provider's Fein number
      3. Who the report was made by
   2. The following information for the individual is already shown:
      1. First name
      2. Middle Name
      3. Last Name
      4. SSN
      5. Birth Date (mm/dd/yyyy)
      6. Gender (M/F)
         Note: The reporting agency must assure the above information for the individual is accurate. If necessary, the provider agency must update the information in the Reporting of Community Services (ROCS) system (which interfaces with the CIRAS system to update the information).
   3. The following text boxes/check boxes/drop-down boxes that need filled out:
      1. Date of Incident Unknown
      2. Date the incident occurred as observed or reliably reported (mm/dd/yyyy)
      3. Time of Incident Unknown
      4. Time of day that the Incident occurred as observed or reliably reported (hh:mm am/pm)
      5. Date that the reporting agency discovered the incident occurred is the same as the date the incident occurred
      6. Date the reporting agency discovered the incident occurred (mm/dd/yyyy)
      7. Time that the reporting agency discovered the incident occurred is the same as the time the incident occurred
      8. Time the reporting agency discovered the incident occurred (hh:mm am/pm)
      9. Waiver Type
      10. Incident Type
      11. Location Type
      12. Incident City
      13. ISC Provider for Individual
5. The description is a narrative that reflects sufficient details to accurately describe the incident.
6. The action reflects the provider's immediate response to the incident.
7. Once the mandatory fields and narrative blocks have been completed, click on the Save button.
8. The incident will be reported to:
   1. Independent Service Coordination Agency (ISC)
   2. When appropriate, the Division of Developmental Disabilities.

---

Notes:

1. Agencies must avoid using non-standard acronyms in the incident narrative that are specific to the agency. Standard, common acronyms, such as IDD (Intellectual Developmental Disabilities), are acceptable.
2. ISC entering of critical incidents (Use of provider name):
   1. If an individual does not have a provider, the ISC name must be selected for the Provider Name field. A provider name shall not be selected from the provider list. In addition, the ISC name must be selected as the "ISC Provider for Individual". For such cases, the ISC name is identified twice on the CIRAS report - for the provider name and the ISC name.
   2. If the individual has a provider, the ISC must select the provider name from the list for the Provider Name field. The ISC name must be selected as the "ISC Provider for Individual".

6.4 CIRAS Interim Incident Reporting

An individual must be registered in the ROCS system for the agency to enter incidents in CIRAS for the individual.

When an individual is transferred from one provider agency to another, the transfer must be reflected in ROCS (and then populated in CIRAS) before the receiving provider agency can enter CIRAS incidents for the individual.

If an agency is not able to access an individual's demographic information (Name, SSN, Date of Birth, Gender, etc) due to a recent transfer, in the interim the incident must be submitted via email to DHS.DDD.CIRAS@illinois.gov (with a cc: to the ISC) until such time incidents can be entered in CIRAS for the individual. The email must contain all data and information elements as defined in this section for reporting critical incidents. The purpose of the email is to assure appropriate follow-up actions occur in a timely manner, if necessary.

When the receiving provider agency has access to the individual's demographic information, the incident (previously sent via email) must be entered in the CIRAS system. It is recommended that the agency indicate in the description section of the report that an email was previously sent, and the late reporting is due to delayed accessibility to the individual's information in CIRAS.

If an agency can access an individual's demographic information via CIRAS, any CIRAS incident reported via email will be rejected and the agency will be required to enter it in the CIRAS system according to the reporting timeframe requirements.

6.5 Change in FEIN impacts Incident Reporting

Change in provider FEIN number: Impact on CIRAS Reporting for Individuals and Designated Agency Reporters

Steps to complete:

If the FEIN number for a provider agency is changed (example: due to new acquisition, merger), then the provider must complete the following steps to assure individuals served and designated agency reporters are associated with the appropriate provider agency in the CIRAS system:

Contact DDD staff in the Bureau of Community Reimbursement and Program Support to determine the appropriate documents/forms to submit to the DDD. The Bureau will provide guidance on updating the provider's information in the ROCS system. Update information of impacted individuals in the ROCS system to reflect the new provider FEIN number. Complete new forms (IL444-2022 and IL444-4144) for the designated agency reporters. For IL444-4144, add an appropriate statement to the "Narrative Description of Request" section of the form to reflect reason for submission of a new form. For information on how to complete these forms, refer to Section 5.3 Completion of Department of Information Technology (DoIT) Forms of this manual. Once completed, both forms should be forwarded to: DHS.DDD.CIRAS@illinois.gov

Section 7: Notification of CIRAS Incidents

7.1 ISC Agencies

Once a provider reports an incident through CIRAS, a report alert is sent to the default email address for each ISC agency. (The ISC must not reply to the automatic alerts.)

ISCs may change the preloaded email address or they may also add additional email addresses. Once an ISC agency receives their User ID and password, the email address changes may be made.

ISC Agency Response to Notifications

ISCs will receive notification via email of each incident reported. They will incorporate the report information into their next scheduled monitoring event or sooner. The notifications listed below will be flagged as priority for review. Upon receipt of the email, follow-up action and documentation are required. Within two (2) working days of the initial report, the ISC is required to make a follow-up entry for:

• Law Enforcement
• Missing Individual

All other CIRAS submissions require a follow-up entry by the ISC within 10 working days of the initial report. Follow-up for all CIRAS submissions should be entered in CIRAS for DDD tracking. Follow-up entries shall note specific actions taken by the ISC. The narrative shall reflect ISC actions that are unique to each CIRAS incident. The Search function in CIRAS is to be used to locate the incident and then enter the follow-up notes. Use of another reporting system does not replace a follow-up entry in CIRAS. (Note: There is a 10-day timeframe where the ISC can edit an existing follow-up note, after which the follow-up note cannot be edited.)

ISCs will follow the Problem and Conflict Resolution Protocol for all critical incidents in order to determine when incidents should be referred to the DDD for action.

7.2 DDD Staff Responsibilities for Individual Incident Review

The system will alert Quality Management Staff in the CIRAS unit of all incidents involving:

• Death (of individual who received services while living in their own or their family's home)
• Law Enforcement
• Missing Individual

If necessary, DDD staff will follow up with appropriate agency (ISC and/or the provider agency) within one working day following receipt of the e-mail to ensure necessary action is underway and continue to monitor the situation until it is resolved. If the incident is absent of risks to health and safety of the individual or others and does not contain potential threats and harm to operational functions, follow up will not be required.

The DDD will address all incidents referred to the DDD for action by ISC agencies. If necessary, Bureau of Quality Management (BQM) staff will coordinate with Regions staff to address the incident. Region staff will follow the Problem and Conflict Resolution Protocol and its time frames.

All incidents reported regarding participants selected for the annual review sample will be made available to BQM staff prior to conducting on-site visits. If necessary, staff will review follow-up of the incidents reported involving sample participants. Any unreported incidents will be identified as a finding and require a plan of correction.

Section 8: Removing Staff/User Names from CIRAS

Providers and ISC agencies have a responsibility to ensure access to CIRAS data is maintained in a confidential and protected manner. The name of staff/users no longer requiring access to the CIRAS system must be promptly removed. An agency can only remove their affiliated CIRAS registered staff member whose registration form bears the agency's FEIN number.

8.1 Reasons to remove staff/user name

• Staff/user no longer employed by the agency.
• Staff/user removed from designated agency reporter or CIRAS liaison role.
• Staff/user has change of work email address (for example, due to a name change). To re-enroll the staff member with a new work email address, the following sections must also be completed:
  • Section 5.4 Community Provider/External User I.D. And System Access Request (IL444-2022)
  • Section 5.5 Request for MIS Hardware, Software and Services (IL444-4144)

8.2 Steps to remove staff/user name

To remove staff/user name, an agency must complete form IL444-4144. The agency ensures HIPAA standards are met when staff/user name, who no longer requires access to the CIRAS system, is removed.

For example, see: 

• Removal Request Template
  • 

The following steps should be taken to complete the IL444-4144 for removal of staff/users from CIRAS:	Steps to follow:
Requestor	Indicate name of staff person needing removal from CIRAS database. (or the CIRAS Liaison) Division: indicate DDD Bureau/Facility: indicate your agency name Telephone No: indicate telephone number of requestor Contact: provide information for contact - name; agency address and city/zip code; telephone number of contact State Fiscal Year (SFY): indicate current, 2-digit State Fiscal Year. For example, for FY 2021, indicate 21. The 2-digit number changes annually. Check the "New Single-Year contract" box
Recipient	Indicate name of staff person/reporter to be removed in CIRAS. Division: indicate DDD Bureau/Facility: indicate agency name of recipient Address: indicate address of agency City and Zip Code: indicate city and zip code of agency Telephone No.: indicate telephone number of recipient Location Code: leave blank Active Directory ID: indicate the requestor/reporter's external.illiois.gov email address here. Remaining Fields - Leave the next four fields blank (that is, CPU Tag No. through *Required Estimated Total Cost).
Narrative Description of Request. Indicate the following:	Please remove xyz@external.illinois.gov from the AD shown above from the item list. Please delete the xyz@external.illinois.gov from the Active Directory shown above from the item list.
Justification. Indicate the following:	For Providers indicate: "DHS.G.CIRAS_ProviderExternalReporting" ISC agencies indicate: "DHS.G.CIRAS_ISCProviderExternalReporting" "Required reporting for CIRAS" Indicate Agency Name Indicate Agency FEIN number Indicate "Reason for removal: Employee no longer works for agency" (or indicate an appropriate reason)
Division Approval and Page Two	All fields should be left blank. (Agencies do not sign this form) [If using DocuSign, user must identify the following as interactive/fillable for DHS use: Page 1: Division Approval signature block (4 fields: printed name, title, digital signature, and date) Page 2: all fields shown on page 2]
Completion	Once completed, both pages of the form must be emailed to DHS.DDD.CIRAS@illinois.gov.

Section 9: Data Reports and Analysis

CIRAS Data Reports for ISC Agencies and Community Providers

ISC agencies and community providers are able to review standardized reports from the CIRAS system. ISC agencies will be able to review all incidents sent to them. Community providers will only be able to see the incidents they have reported.

Reports may be viewed from the Reports tab on the CIRAS site. The reports are viewed through the InfoView portal which requires an external user I.D. to log in.

Provider agencies must have a process to review CIRAS incident data (and other reported incidents) for any trends and patterns at least quarterly. It is the expectation that the outcome of the review and analysis will help to improve supports and services for individuals.

Note: Designated agency reporters have access to the CIRAS reporting templates, which capture all CIRAS incident data entered for the agency's FEIN number. The Executive Director shall contact the CIRAS Unit staff for inquiries regarding CIRAS data reports.

A list of reports is shown below.

9.1 Summary Reports and Trend Analysis

Summary reports can be generated for trend analysis as follows:

• Type of Critical Incident. This report will count and display the types of critical incidents in descending order of the most frequently reported types for the previous quarter and fiscal year-to-date.
• Time of Critical Incident. This report will count and display the number of incidents reported in each hour of the day for the previous quarter and fiscal year-to-date.
• Date of Critical Incident. This report will count and display the number of incidents reported in each month of the year for the current fiscal year.
• Location of Critical Incident. This report will count and display the number of incidents reported at each location type for the previous quarter and fiscal year-to-date.
• Participant's Age. This report will count and display the number of incidents reported by age groupings (e.g., 18 through 21, 22 through 29, 30 through 39, 40 through 49, 50 through 59, 60 through 69, 70 through 74, 75 through 79, 80 through 84, 85 through 89, 90 and above) for the previous quarter and fiscal year-to-date and compare that data to the number of participants by age groupings.
• Participant's Gender. This report will count and display the number of incidents reported for males vs. females for the previous quarter and fiscal year-to-date and compare that data to the number of male versus female participants.
• Number of Critical Incidents by Provider. This report will count and display the number of critical incidents for the previous quarter and fiscal year-to-date for each provider and compare that data to the number of participants at each provider. The report will be sorted in descending order with the providers with the highest incident rate per 100 census listed first.
• Type of Critical Incident by Provider. This report will count and display the types of critical incidents in descending order of the most frequently reported types for the previous quarter and fiscal year-to-date for each provider.

9.2 Review of Trend Reports

Reports will be prepared on a quarterly basis. They will be reviewed and discussed with Medicaid Agency staff. Additional reports may be identified and developed as needed.

BQM will perform the following review and analysis:

• Deaths. This report will be sorted by provider agency and will display all data elements, including the narrative detail. BQM staff will review this information on a quarterly basis.
• Follow up by ISCs. This data determines ISC compliance to the completion of follow up notes. Data is reviewed monthly.

• The following CIRAS reporting data shall be reviewed monthly. BQM staff will appropriately review and analyze the data for any trends and patterns. If necessary, follow up with the provider will occur to assess their actions regarding improved outcomes.
  • Number of Critical Incidents by Provider. Monthly - This report will count and display the number of critical incidents by provider.
  • Number of Critical Incidents by Individual. Monthly - This report will count and display the number of critical incidents by individual. Data anomalies can be efficiently identified, yielding in-depth review of individuals with a high rate of CIRAS incidents.
  • Category of Critical Incidents by Provider. Monthly - This report will count and display the number of critical incidents by provider and reflects the number of incidents for each category. Staff are able to assess for providers with a high rate of CIRAS incidents and the category(ies) having the most impact on the total number of provider incidents.
  • Category of Critical Incidents by Individual. Monthly - This report will count and display the number of critical incidents by individual. The report also highlights the individual(s) having the most impact on the total number of provider incidents.
• Annual Trend Analysis. On an annual basis a trend analysis report will be prepared. The report captures CIRAS incidents entered for the year and provides trend information over a period of years. The following trend information will be in the report, including but not limited to: Number of incidents by category, provider agencies with the most reported incidents, location of incidents, incidents by age range of individuals, and incidents by waiver type.

---

Forms linked in this document:

• English: IL444-2022
• Spanish: IL444-2022S
• English: IL444-4144

Forms help: The above forms may need to be downloaded to your computer and then opened with a PDF reader such as Adobe.

• To download:
  • Click the save icon and choose where the document will be saved on your computer.
  • Navigate to the location of the saved document and open with the PDF reader.
    • If the document opens in your internet browser, you will need to right click on the document and force open in your PDF reader.

---

Return to DDD Manuals

Return to DDD Home Page