Elder abuse and financial exploitation: the medical records that prove or disprove it

There is no single legal definition. A case can run under a state elder abuse statute, a criminal code, a guardianship or probate proceeding, or a nursing home negligence claim, often several at once. Pin down which definition governs, because the records you need follow from its elements.

4 federal sources show up in almost every file. The nursing home rules at 42 CFR 483.5 define the terms a surveyor and a facility work from. The Elder Justice Act at 42 USC 1397j defines abuse, exploitation, fiduciary and self-neglect for federal grant programs, and many state statutes borrow its wording. The 2024 APS rule at 45 CFR 1324 subpart D sets minimum standards for state Adult Protective Services programs. And FinCEN's 2022 advisory defines elder financial exploitation for banks as "the illegal or improper use of an older adult's funds, property, or assets."

Abuse (42 CFR 483.5)

The willful infliction of injury, unreasonable confinement, intimidation or punishment with resulting physical harm, pain or mental anguish. "Willful" means the person acted deliberately. It does not require an intent to injure.

Neglect (42 CFR 483.5)

The failure of the facility, its employees or service providers to provide goods and services a resident needs to avoid physical harm, pain, mental anguish or emotional distress.

Exploitation (42 CFR 483.5)

Taking advantage of a resident for personal gain through manipulation, intimidation, threats or coercion.

Misappropriation of resident property (42 CFR 483.5)

The deliberate misplacement, exploitation, or wrongful temporary or permanent use of a resident's belongings or money without the resident's consent.

Exploitation (42 USC 1397j)

A fraudulent, illegal, unauthorized or improper act by anyone, including a caregiver or fiduciary, that uses an elder's resources for monetary or personal benefit, or that deprives the elder of rightful access to benefits, resources, belongings or assets.

Fiduciary (42 USC 1397j)

Includes an agent under a financial or health care power of attorney, a guardian, a conservator and a representative payee. This is why a POA agent sits at the center of so many exploitation files.

The age line differs too. The Elder Justice Act and FinCEN both use 60. Many state statutes use 60 or 65, and others protect "vulnerable adults" of any age based on impairment. The APS rule does not make states adopt its definitions, but state definitions may not narrow the scope of adults eligible for APS or the services provided (45 CFR 1324.402(a)(5)).

How common it is, and why the numbers are soft

The best known pooled estimate comes from a 2017 meta-analysis by Yon and colleagues in Lancet Global Health: about 15.7% of people 60 and older living in the community reported some form of abuse in the past year. Financial abuse was the second most common type.

Treat these figures as background. Definitions and methods varied, and self-report misses people with dementia. Institutional numbers are harder still: a 2019 follow-up by the same group found 64.2% of staff in the pooled institutional care studies admitted to some form of abuse in the past year (Eur J Public Health), and residents in the pooled studies most often reported psychological abuse. No prevalence number proves anything about a specific resident. It can support a claim that a facility should have had screening, training and reporting systems in place.

On the banking side, FinCEN counted more than 72,000 elder financial exploitation Suspicious Activity Reports in 2021, and a family member was involved in 46% of the elder theft cases in its 2013 to 2019 sample. Its April 2024 analysis of 155,415 filings from June 2022 to June 2023 found about $27 billion in suspicious activity. Those filings are bank allegations, not findings.

Every Medicare or Medicaid certified nursing home must meet 42 CFR 483.12, which gives each resident the right to be free from abuse, neglect, misappropriation of property and exploitation. Surveyors cite violations under F-tags defined in Appendix PP of the State Operations Manual. The F-tag on a CMS-2567 statement of deficiencies tells you which duty the state found broken, and the interpretive guidance under that tag tells you what the surveyor expected to see in the chart.

Injury of unknown source

A large share of facility cases start with a bruise or fracture no one saw happen. Appendix PP treats an injury as "of unknown source," and so reportable under 483.12(c)(1), when all 3 of these are true:

1. No one observed it. No staff member saw the injury occur.
2. The resident can't explain it. The resident could not tell staff how it happened.
3. It is suspicious. Because of its extent, its location (an area not generally vulnerable to trauma), the number of injuries at 1 time, or how often injuries have occurred over time.

Use the test as a checklist. For each unexplained injury, find the first note, a witness entry, the resident's account, and the size, shape and location. A chart that says only "bruise noted to arm" cannot show the test was applied.

Serious bodily injury, which triggers the 2-hour clock, is defined in section 2011(19) of the Social Security Act and quoted in Appendix PP: an injury involving extreme physical pain, a substantial risk of death, protracted loss or impairment of a bodily member, organ or mental faculty, or one that requires medical intervention such as surgery, hospitalization or physical rehabilitation. A hip fracture that sends a resident to surgery meets it on its face.

Consent does not end the inquiry

Defense teams in exploitation cases often point to the resident's own words: she said she wanted to help the aide, he agreed to the loan. Appendix PP addresses this directly under F602.

"A resident's apparent consent is not valid if it is obtained from a resident lacking the capacity to consent, or consent is obtained through intimidation, coercion or fear, whether it is expressed by the resident or suspected by staff."

F602 examples in the guidance include identity theft, theft from a bank account, coerced credit card purchases, a gift to staff in order to receive care, and money given to a staff member who claimed a crisis. Diversion of a resident's medication is misappropriation too, so a drug diversion case and a stolen ring case sit under the same tag.

2 federal reporting duties overlap in nursing homes. The facility's duty under 42 CFR 483.12(c) covers every allegation. The individual duty under section 1150B of the Social Security Act (42 USC 1320b-25) falls on each person who works there and covers reasonable suspicion of a crime; 483.12(b)(5) folds it into facility policy. State APS and mandated reporter laws add a third layer.

Section 1150B also protects the person who reports. A facility that retaliates faces a civil money penalty up to $200,000 (a statutory figure, adjusted to $288,655 for 2025), classification as an excluded entity for 2 years, or both, and it must post a notice of employee rights. Appendix PP notes that "law enforcement" for this purpose includes medical examiners and coroners, which matters after a death.

Late and missing reports are common

HHS OIG sampled high-risk emergency room claims for Medicare beneficiaries who lived in skilled nursing facilities in 2016. In report A-01-16-00509, it found that 51 of 256 sampled claims showed potential abuse or neglect: 24 neglect, 24 injuries of unknown source and 3 abuse. Projected to the full set, that is about 7,831 claims, or 21% of 37,607. The facilities did not report an estimated 84% of them to State Survey Agencies.

For a plaintiff, the study supports a request for the facility's report log and transmission confirmations. For the defense, the Survey Agencies labeled a claim "potential" abuse or neglect from the hospital and SNF documents provided, with no investigation or finding, and OIG noted that some calls might have differed with more records. An ER note that says "fall at nursing home" is not an admission.

When you review timing, build 3 times for every allegation: when staff first charted the finding, when anyone called it an allegation or suspicion, and when the report went out. Put them side by side. A long gap after a charted facial bruise needs an explanation. A gap after a vague "discoloration" note that a later nurse recognized as a grip pattern may have one.

Physical abuse cases in older adults often come down to bruises, and the research on bruises in older adults is thinner and more specific than most people assume. 2 studies carry most of the weight.

Mosqueda, Burnight and Liao examined 101 adults 65 and older daily for up to 6 weeks and recorded accidental bruises (J Am Geriatr Soc, 2005). Nearly 90% of the accidental bruises were on the arms and legs. None appeared on the neck, ears, genitalia, buttocks or soles of the feet. People taking medications that affect clotting, and people with poorer physical function, were more likely to have several bruises. 16 bruises were already mostly yellow within the first 24 hours, and the authors concluded that the age of a bruise cannot be reliably predicted from its color.

Wiglesworth and colleagues compared 67 older adults reported to APS for suspected physical abuse with a comparison group from the earlier accidental bruising study (J Am Geriatr Soc, 2009). 72% of those abused within the prior 30 days had bruises, so more than a quarter had none. Abuse bruises were often large (over 5 cm) and on the face, lateral right arm or back of the torso, and 89.6% of the abused people with bruises could say how they got them, against 23.5% of the comparison group.

Appendix PP lists physical signs that surveyors look for: bruises in unusual locations such as the head, neck, lateral arms, back of the torso and trunk; bruises shaped like finger imprints; fractures; burns; bite marks; and facial injuries. It also names the ways evidence gets lost. An investigation is impeded when staff wash linens or clothing, destroy documentation, bathe the resident before an exam, or fail to send the resident to the emergency room when needed. If the chart shows a bath and a linen change between the discovery and the exam, that sequence belongs on your timeline.

The codes on the hospital side

When a resident goes to the emergency room, the hospital claim may carry ICD-10-CM codes that separate confirmed from suspected maltreatment. The OIG resource guide for Medicaid Fraud Control Units lists them: T74.11XA for adult physical abuse, confirmed, and T76.11XA for suspected; T74.01XA and T76.01XA for neglect; T74.21XA and T76.21XA for sexual abuse; and Z04.71 for an exam after alleged adult physical abuse. A T76 code records a clinician's suspicion. It is not a finding, and the defense should say so. Its absence proves little either way, because many ER visits for these injuries are coded only for the fracture or laceration.

For a deeper treatment of injury patterns, bruise documentation and photography, see the sibling guide on blunt force trauma in medical records.

Not every abuse file involves a bruise. 3 patterns show up often and each has its own record trail.

Neglect

Neglect under 42 CFR 483.5 is a failure to provide needed goods and services. It shows in what the chart does not say: repositioning boxes left blank, meals marked "refused" for days with no weight check, a change in condition noted by an aide and never passed to a nurse. Pressure injuries, falls, dehydration and missed changes in condition each have a sibling guide with the full record set: pressure injury records, nursing home fall records and change in condition records. For the MDS, care plan and survey documents that frame all of them, start with the pillar guide on nursing home records, the MDS and the CMS-2567.

Chemical restraint

Appendix PP defines a chemical restraint as a drug used for discipline or staff convenience and not required to treat the resident's medical symptoms. The records that test it are the order and its indication, the MAR, behavior monitoring, psychotropic consent and the pharmacist's drug regimen review; 42 CFR 483.45(d) adds dose, duration and monitoring questions. Look for a psychotropic started right after a behavior complaint, with no prior behavior charting and no non-drug approach tried.

Drug diversion

Appendix PP treats diversion of a resident's medication as misappropriation under F602. Diversion cases are built by comparing records that should agree: the controlled substance count sheet, the MAR, the pharmacy dispensing record, pain assessments and, where the facility uses an electronic MAR or dispensing cabinet, the system's own access log. Many facilities still keep paper count sheets written by hand.

The resident is the one harmed twice here: the drug is gone, and the pain it was ordered for goes untreated. That is why diversion cases often pair F602 with a neglect or pain management theory. For the MAR itself, see the guide on reading a medication administration record.

Most financial exploitation cases with a signed document turn on capacity, undue influence or both. The medical record is the main evidence of what the person could do on the day of the transaction, and it is often misread in both directions.

Start with the presumption. The DOJ Elder Justice Initiative's decision-making capacity resource guide puts it plainly: "The law presumes that adults have decisional capacity, although this presumption can be rebutted." The same guide stresses that a capacity assessment asks about the ability to perform a certain task or make a certain decision. Capacity is not a global label. A person can lack the capacity to manage an investment account and still have the capacity to name a health care agent.

The legal test also changes with the transaction. States set different standards for contracts, gifts, wills, powers of attorney and trusts. Undue influence is a separate doctrine: a person with capacity can still be unduly influenced, and courts often look at dependency, isolation, secrecy and who arranged the transaction. Get the standard for your state and document first, because it tells you which abilities the record must speak to.

The instruments you will see in the record

The MoCA validation study by Nasreddine and colleagues (J Am Geriatr Soc, 2005) shows why you should check which test an old chart used. At the cutoff the authors used, the MMSE caught 18% of people with mild cognitive impairment. The MoCA caught 90%.

Delirium is the other trap. The Confusion Assessment Method (Inouye and colleagues, Ann Intern Med, 1990) requires an acute onset and fluctuating course plus inattention, plus either disorganized thinking or an altered level of consciousness. Fluctuation is built into the definition. An older adult admitted with a urinary tract infection may be delirious at 06:00, lucid at 14:00 when a notary arrives, and confused again at 22:00. The nursing flowsheet for that day, hour by hour, is worth more than any single diagnosis.

What else in the chart speaks to capacity

• Orientation entries. "A&O x1" or "oriented to self only" on the day of signing, from the nurse who was in the room.
• Medications. New sedatives, opioids, anticholinergic drugs or anesthesia within hours of the transaction. The MAR shows what was actually given and when.
• Clinician statements about finances. A neurology note that says "recommend family assist with finances" or a social work note about unpaid bills is direct evidence of the task at issue.
• Who was present. Visitor logs, nursing notes naming who accompanied the patient, and who gave the history at intake. Isolation and control of access are classic undue influence facts.

The strongest cases on either side line up these entries with the transaction record by date: signing time and place, drafter, account activity, and unpaid care bills. For the facility and guardianship side of this work, see guardianship and capacity record review.

The file runs about 1,400 pages: primary care, neurology, the hospital chart, the nursing facility chart, subpoenaed bank statements and the notary's journal. The first job is 1 timeline of every entry on D.K.'s abilities and every transaction, each cited to its page.

What the money did

The bank production shows where the funds went. A money flow puts the medical timeline in context and separates spending that benefited D.K. from spending that did not.

How each side reads the same pages

For the daughter: a documented neurocognitive disorder, written advice to supervise finances, a positive delirium screen 2 days earlier, a sedative that morning, and a new agent who gave the history and arranged a bedside notary. FinCEN lists a POA changed to a new person during diminished cognition, a caregiver's excessive interest in finances, and uncharacteristic nonpayment for services as red flags. All 3 appear.

For J.P.: capacity is presumed and task-specific, and no one charted her mental state at 14:10, the hour that counts. A MoCA of 24 fits mild impairment, not incapacity. The neurologist "discussed with patient," so she took part in decisions. The daughter lived away, and some money paid for care. The defense will want the notary's testimony and the drafting file.

The timeline does not say D.K. lacked capacity. It shows where the capacity evidence is, when it was recorded and where it is missing. The neurology follow-up and the full MAR for 08/20 and 08/21 are the first records to request.

Elder abuse files are unusual because the same records may be used in 3 or 4 proceedings at once: a criminal case, an APS or licensing matter, a civil claim against the accused person or the facility, and a guardianship or probate dispute. Each side reads the same entries for different things.

Some defense points are strong and deserve a straight hearing. Older adults on anticoagulants bruise more, and a resident with a documented history of falls and fragile skin will have injuries no one caused on purpose. A resident may refuse care, and a well-documented refusal with repeated offers is not neglect. Resident-to-resident altercations are a real category, and the facility's duty there is about supervision and care planning, not intent. And many older adults give money to people who help them, by choice and with full understanding.

Some plaintiff points are stronger than they look. A chart that says "bruise noted" with no size, shape or photo makes abuse hard to rule out. An unreported injury of unknown source is a violation whatever caused it. And in many states an agent who can't account for the money has a problem of their own.

Standards of proof and discovery rules differ across these proceedings, and whether an APS finding, a CMS-2567 citation or a criminal plea is admissible depends on the forum and the state.

The chart is the start. A request for "the complete medical record" will not produce the investigation file, the resident trust fund ledger or the controlled substance count sheets, because most facilities keep them outside the chart. Ask for each by name.

Residents and their representatives have a fast access right under 42 CFR 483.10(g)(2): the facility must let them inspect records within 24 hours, excluding weekends and holidays, and provide copies within 2 working days of the request. That is much faster than the general HIPAA access period. Whether a family member counts as a representative depends on the facts and on state law, and it becomes a real question when the person holding the POA is the one accused. After death, the facility must convey the resident's funds with a final accounting to the estate within 30 days (483.10(f)(10)).

For the general request process, see how to get medical records for a lawsuit. For electronic metadata and late entries, see EHR audit trails in medical malpractice and altered medical records.

• Full facility chart for the whole stayNursing, MDS, care plans, orders, MAR
• Incident reports and investigation fileInterviews, photos, conclusions
• Initial and 5-day reports with transmission timesTests the 2-hour and 24-hour limits
• CMS-2567 and complaint survey fileWhat the state found and why
• Controlled substance count sheets and waste logsDiversion and sedation questions
• Resident trust fund ledger and quarterly statementsMisappropriation by staff
• Staffing schedules for the relevant shiftsWho had access
• ED and hospital records with codesIndependent injury description
• Primary care and neurology notes for 2 years beforeCognitive baseline and trend
• MAR for the 48 hours around any signingSedating drugs given
• Bank records for 12 months before and afterBaseline spending pattern
• POA, will, trust and notary journalDates, witnesses, drafter

0 of 12 checked

AI medical record review fits the cross-referencing in an elder abuse file: a nursing note on page 97, a MAR entry on page 104 and a neurology plan on page 43 all have to land on 1 timeline. It fits poorly where pages are handwritten and where the answer is a judgment for a clinician or a court.

What general AI tools get wrong here

• Handwriting and OCR. Nursing home count sheets, bedside flowsheets and incident forms are often handwritten, faxed and scanned. OCR errors turn "27 remain" into "22 remain," and handwritten notes with abbreviations like "A&O x1" can be misread. Any tool you use should flag low-confidence pages for a person to read.
• Hallucination. A large language model asked to "summarize the capacity evidence" may produce a fluent paragraph with a MoCA score that is not in the file or a date that is off by a day. On a capacity timeline, a 1-day error changes the answer. Every line needs a page-level citation you can click and check.
• Copy-forward text. Facility EHRs carry forward "skin intact" and "no new concerns" entries, and a tool will repeat them as findings. A person has to notice that 10 identical notes in a row mean little.
• Ambient AI scribe notes. Some physician notes are now drafted by ambient AI scribes and signed by the clinician. It is fair to ask how an orientation statement in such a note was produced.
• Judgment calls. Whether a bruise pattern suggests abuse, whether a person had capacity, whether a drug was a chemical restraint: these are expert and legal questions. Generative AI can organize the evidence on them. It cannot answer them.

Lawyers have already been sanctioned for filing AI output they did not check. In Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023), the court imposed Rule 11 sanctions for a brief that cited cases a chatbot invented. The same risk applies to a medical chronology an expert relies on. Human-in-the-loop review, with a person checking each cited line against its page, is the standard to hold any tool to.

What to require from any tool before you upload

For more on security questions, see the guide on HIPAA compliant AI medical record review, and on accuracy, whether AI is accurate enough for court and whether AI can read handwritten medical records.

Adapt each template to your jurisdiction and your role. Bracketed fields are yours to fill. None of these is a legal form.

RE: [RESIDENT], date of birth [DOB]. Period: [START] to [END].

Please produce, in native electronic format where it exists:

1. The complete clinical record: nursing notes, flowsheets, skin
   assessments, practitioner notes and orders.
2. Every MDS assessment and every care plan version in the period.
3. The MAR, controlled substance count sheets, waste logs and pharmacy
   dispensing records.
4. All incident reports and the full investigation file for each:
   interviews, statements, photographs, conclusions.
5. Every report to the State Survey Agency, APS or law enforcement, the
   5-day report, and proof of the time each was sent.
6. The resident trust fund ledger, quarterly statements, withdrawal
   authorizations and surety bond.
7. The admission agreement and belongings inventory.
8. Staffing and assignment sheets for [UNITS, DATES, SHIFTS].
9. Visitor logs for [DATES].
10. Abuse prevention and reporting policies in effect on [DATE], with
    training records for [STAFF ROLES].

Please preserve all electronic data, access logs and video from [DATE].

TRANSACTION
Document or transfer: [POA / will / deed / gift / wire]
Date and time signed or executed: [DATE, TIME]   Source: [p. __]
Place: [hospital room / facility / office / home]
Present: [names or roles]   Source: [p. __]
Drafted by: [role]   Paid by: [role]
Legal standard that applies (per counsel): [STANDARD, STATE]

BASELINE (before the date)
Latest cognitive screen: [TEST, SCORE, DATE]   Source: [p. __]
Clinician statements about finances: [QUOTE]   Source: [p. __]

THE DAY ITSELF
Orientation entries with times: [TIME: ENTRY]   Source: [p. __]
Delirium screen results: [CAM +/-, TIME]   Source: [p. __]
Medications given in prior 24 hours: [DRUG, DOSE, TIME]   Source: [MAR p. __]
Who gave the history, who visited: [ENTRY]   Source: [p. __]

AFTER
Next cognitive screen: [TEST, SCORE, DATE]   Source: [p. __]
Change in bills paid, payees, contacts: [ENTRY]   Source: [p. __]

MISSING
Records that should exist but were not produced: [LIST, WITH THE
ENTRY THAT IMPLIES EACH]

You are organizing medical records for a legal review. Do not give opinions
on capacity, abuse or neglect.

Build a chronological table of every entry from [START DATE] to [END DATE]
that mentions any of the following: cognitive screening scores (MMSE, MoCA,
BIMS or other), delirium or CAM results, orientation, confusion, sedating
or psychoactive medications given, statements about managing money or
bills, who accompanied or spoke for the patient, visitors, and any mention
of a power of attorney, will, notary or bank.

For each row give: date, time if recorded, source page number, author role,
and the exact words from the record in quotation marks.

Then list separately:
1. Any date where entries conflict with each other.
2. Any follow-up, test or visit a record says was planned but is not in the
   file.
3. Any page you could not read with confidence.

Do not fill gaps with assumptions. If a fact is not in the records, say so.

Medrecords AI organizes, cites and flags what is in the files you upload: on an abuse or exploitation matter, the hospital, facility, neurology and primary care records, read together.

• A cited chronology. The medical chronology puts orientation entries, cognitive screens, injury descriptions and medications on 1 timeline, and every line links to its source page.
• Handwritten and scanned pages. OCR routes each page to the right engine for typed text, handwriting or tables and flags low-confidence pages for you to read. See also handwritten record extraction.
• Records that should exist. Missing records identification flags visits, providers and date ranges the file implies but does not contain, such as a planned neurology follow-up, each flag cited to the entry that implies it.
• Pages that differ. Record alteration detection shows near-duplicate pages side by side when an incident note or skin assessment appears in 2 versions. It is a signal for you to review, not a verdict.
• Questions you can check. Ask the record "what was charted about orientation on 08/21" and get cited answers, or search every mention of a drug or visitor.
• Later productions. Supplemental record review shows what a new production agrees with, conflicts with or adds.

Here is what it does not do. It does not retrieve records from facilities, hospitals or banks. It does not decide whether abuse happened, whether a person had capacity or whether a claim has merit, and it does not sign opinions or give legal advice. It is built for medical records, so the analysis of bank statements stays with you or a forensic accountant. Every flag is a signal for a person to check.

Security is SOC 2 and HIPAA with a signed BAA; see HIPAA and security. Self-Service bills 10 cents a deduplicated page, down to 5 cents at volume, duplicates free; Enterprise On-Prem is an annual license. Details are on the pricing page.

What is elder financial exploitation?

FinCEN defines it as the illegal or improper use of an older adult's funds, property or assets. The Elder Justice Act also covers depriving an elder of access to their own assets and names fiduciaries, including POA agents. State definitions vary.

How fast must a nursing home report suspected abuse?

Under 42 CFR 483.12(c)(1), immediately and no later than 2 hours if the allegation involves abuse or serious bodily injury, and no later than 24 hours otherwise. Investigation results go to the State Survey Agency within 5 working days. State law may add duties.

What is an injury of unknown source?

Under Appendix PP, an injury no one saw happen, that the resident cannot explain, and that is suspicious because of its extent, location, number or how often such injuries occur. All 3 conditions must be met, and the facility must then report it.

Can you tell how old a bruise is from its color?

No. A 2005 study of older adults found some bruises already yellow within 24 hours and concluded that color cannot reliably date a bruise. Timing arguments should rest on documented skin checks and access, not color.

Does a dementia diagnosis mean a person could not sign a power of attorney?

Not by itself. The law presumes capacity, and capacity is judged for a specific task at a specific time. The records from the hours around the signing, plus the legal standard your state applies to that document, decide the question.

Can AI tell whether an elder had capacity?

No. AI medical record review can find and cite every cognitive screen, orientation entry and sedating medication around a transaction date. Whether those facts meet a legal capacity standard is a question for clinicians, lawyers and the court.

Is it HIPAA compliant to upload nursing home records to an AI tool?

It can be, with a vendor that signs a business associate agreement, holds SOC 2, does not train on your data and logs access. A consumer chatbot without a BAA is the wrong place for a vulnerable adult's PHI.

Can ChatGPT summarize an elder abuse file?

A general chatbot can summarize text you paste, but it gives no page citations and can invent dates or scores. In a case that may go to court or to a criminal proceeding, use a tool that cites every line and check each cite yourself.

Can software detect financial exploitation?

Banks use software to flag suspicious transactions for review, and medical record software can flag records that bear on capacity or that are missing. Neither decides that exploitation happened. That finding belongs to APS, a court or a jury.

Rules and the CMS manual were read in full text in September 2026. Quotes are verbatim; study figures are from published abstracts. The incident report, count sheet, timeline and account flow are hypothetical and invented to show method. State law was not surveyed, and many rules in this guide have state counterparts that add to or differ from the federal floor. Nothing here is legal or medical advice.

• 42 CFR 483.5: definitions of abuse, neglect, exploitation, misappropriation, mistreatment and sexual abuse.
• 42 CFR 483.12: freedom from abuse, neglect and exploitation; reporting at (b)(5) and (c)(1); investigation and 5-day report at (c)(2) to (c)(4).
• 42 CFR 483.10: resident funds at (f)(10); record access at (g)(2).
• CMS State Operations Manual, Appendix PP, Rev. 232 (July 2025): F600 to F610 guidance, injury of unknown source, serious bodily injury, F602 examples and consent, chemical restraint, evidence preservation.
• 42 USC 1320b-25 (Social Security Act section 1150B): reporting to law enforcement of crimes in federally funded long-term care facilities, penalties and retaliation.
• 45 CFR 102.3: inflation-adjusted maximums for the section 1150B civil money penalties ($288,655 and $432,981 for 2025).
• 42 USC 1397j: Elder Justice Act definitions.
• 45 CFR 1324 subpart D: Adult Protective Services rule, 89 FR 39528 (May 8, 2024); response times at 1324.402(b)(2)(i).
• FinCEN advisory FIN-2022-A002 (June 15, 2022): definition, red flags, 2021 SAR count, family member share.
• FinCEN analysis of elder financial exploitation (April 18, 2024): 155,415 filings, about $27 billion.
• HHS OIG A-01-16-00509 (June 2019): potential abuse or neglect in SNF residents' ER claims, and reporting rates.
• HHS OIG resource guide A-01-19-00502 (July 2019): ICD-10-CM maltreatment codes.
• DOJ Elder Justice Initiative, decision-making capacity resource guide: presumption of capacity, task-specific assessment.
• Mosqueda, Burnight and Liao, J Am Geriatr Soc 2005;53(8):1339, accidental bruising in older adults.
• Wiglesworth and colleagues, J Am Geriatr Soc 2009;57(7):1191, bruising in physically abused older adults.
• Nasreddine and colleagues, J Am Geriatr Soc 2005;53(4):695, MoCA validation.
• Inouye and colleagues, Ann Intern Med 1990, the Confusion Assessment Method.
• Yon and colleagues, Lancet Glob Health 2017, community prevalence; Yon and colleagues, Eur J Public Health 2019, institutional settings.
• Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023): Rule 11 sanctions for fabricated AI-generated citations.

Related guides: nursing home records, the MDS and the CMS-2567, blunt force trauma in medical records, change in condition records, nursing home neglect record review, and record review for legal nurse consultants.