Skip to main content

Just the Facts: Collecting Evidence and Interviewing Witnesses During an Internal Investigation at Your Facility

Ann Longterm Care. 2019;27(10):10-13. doi:10.25270/altc.2019.10.00087

To contact ECRI Institute directly for more information about their tools and services, please email ECRI’s Continuing Care Risk Management at


Victor Lane Rose, MBA, NHA, FCPP, CPASRM—Column Editor


The author reports no relevant financial relationships.


Patient Safety, Risk, and Quality—Aging Services, ECRI Institute, Plymouth Meeting, PA

ECRI Institute and Annals of Long-Term Care: Clinical Care and Aging (ALTC) have joined in collaboration to bring ALTC readers periodic articles on topics in risk management, quality assurance and performance improvement (QAPI), and safety for persons served throughout the aging services continuum. ECRI Institute is an independent, trusted authority on the medical practices and products that provide the safest, most cost-effective care.

Effective postincident response is a critical element of an aging services organization’s resident and patient safety program and an important part of improving risk management, quality, and safety practices. Decisions made and actions taken in the first minutes and hours after an incident set the stage for everything that follows. Incidents can encompass any unanticipated or undesired outcome including falls, medication errors, elopement, and allegations of abuse, and even nonclinical events such as equipment malfunctions or environmental hazards. Consider the following hypothetical scenarios at Box 1.

box 1

The primary purpose of an internal investigation of an incident or near miss is to collect facts, which the organization will later analyze with the ultimate goal of improving care and services. Thus, thorough investigations are the foundation of efforts to learn from incidents and near misses.

However, providers may have concerns about discovery of the results of quality improvement processes in the event of a lawsuit. This can lead providers to avoid conducting investigations at times, to perform only cursory investigations, or to avoid delving deeply into the findings. Other barriers to effective investigation (eg, insufficient resources or skills, inadequate guidance in policies and procedures) are unintentional.

Whatever the cause, ineffective investigations represent a lost opportunity to improve and prevent harm. They may also be perceived or portrayed as a lack of concern for persons served, an attempt to hide facts about an incident, or an attempt to cover-up the incident altogether. This can undermine trust between the organization and the residents and families it serves, increasing the possibility of a claim or litigation. Ineffective investigations may also heighten the risk of regulatory citations or allegations of spoliation of evidence.

It is increasingly important to recognize the scope and boundaries of a proper internal investigation. Although exceptions exist, fact-finding documents (eg, incident reports, witness statements) often are not protected from discovery. Analytical tasks, like hypothesizing about the cause of an incident, analyzing evidence, and developing performance improvement recommendations, were once part of the internal investigation. Today, these tasks must be conducted under the auspices of the organization’s quality assurance and performance improvement (QAPI) program to be considered quality improvement work product and thus potentially qualify for protection from discovery in a lawsuit. The internal investigation, by contrast, must be limited to fact-finding. The investigation’s findings then become a source of QAPI information to drive improvement.

Internal Investigations in Context

The investigation must begin directly after initial notification of the incident because time is a significant factor. The longer it takes to conduct fact-finding after an incident occurs, the greater the possibility that evidence will be lost, memories will dim, and speculation and self-justification will cloud the process.1 Figure 1 illustrates the many elements of postincident response in three phases. The internal investigation occurs in Phase I.

fig 1

Postincident response is both ongoing and complex. Depending on the incident, the total process can occur over a long period. It comprises a series of identifications, valuations, decisions, internal and external notifications and reports, communications, evaluations and monitoring, analyses, and ultimately changes to care, delivery, and systems. In addition, postincident response activities do not always occur sequentially—one step might not be completed before the next begins—and several tasks and activities can occur at the same time.


One of the primary purposes of an investigation is to identify, catalog, collect, and preserve evidence pertinent to the incident. The quality of evidence collected during the investigatory process is an important consideration. The following characteristics of collected evidence can be used to evaluate the quality of that evidence2:

  • Relevance to the central issues of the investigation and connection to the incident
  • Validity and authenticity of the evidence
  • Reliability of evidence collection and chain of custody
  • Timeliness of evidence collection and presence of time indicators (eg, time stamps)
  • Credibility of the evidence (or if testimonial, the witness) and ability to corroborate with other evidence

A working definition of “evidence” may be “anything that can be used to gain knowledge or facts” about an incident. Four types of evidence are commonly recognized in investigatory practice: physical (eg, resident lift, syringe, liquid on floor); paper or electronically stored written evidence (eg, clinical records, staff schedule rosters, personnel files); people (eg, written witness statements, interviews); and photographic (eg, photos, videos, diagrams).3 

Maintain an Evidence Log

An evidence log is a form used to document all evidence collected during an investigation. It also facilitates management of the evidence, including production of evidence in response to requests. An evidence log may include the following:

  • A numbered list of each piece of evidence 
  • A written description of each piece of evidence 
  • The location of each piece of evidence at the time it was collected 
  • The time and date the evidence was collected
  • The person who collected the evidence 
  • The method of collection and preservation of the evidence
  • The storage location of the evidence

Sequester Equipment, Medical Devices, and Supplies

Equipment, medical devices, and supplies involved in an incident should be treated as evidence. If equipment failure was a contributing factor, the equipment should be taken out of service, tagged “locked out” to prevent accidental use, and stored in a secure area to protect others from experiencing harm from the same piece of equipment. 

Also, if the incident involved any equipment, supplies, or medical devices (eg, syringe), it would be prudent to remove identical items from inventory to serve as examples (ie, devices that were manufactured in the same “lots” as those involved in the incident). An example from the same manufacturing lot can be tested to help determine if manufacturing defects or other factors contributed to device failure.

All postincident tests and determinations regarding the functioning of equipment should be conducted by authorized service dealers. The tests conducted, along with their findings, should be witnessed, documented, and signed. The organization’s postincident practices should also outline the steps to be followed and who has decision-making authority to put a piece of equipment back into service.

Establish Chain of Custody

As evidence is collected, it should be placed in appropriate storage containers for preservation. Devices should not be cleaned, linens should not be washed, and documentation should not be altered. Chain-of-custody protocols should outline evidence collection and securing (Box 2).4

Manage evidence with great care. If litigation arises, mishandling of or the inability to produce evidence when necessary can lead to claims of spoliation of evidence. In some jurisdictions, the court may instruct the jury that it can draw a negative inference about the missing evidence or impose other consequences.

box 2

Written Witness Statements and Interviews

Witness statements (documentary evidence) and interviews (testimonial evidence) are forms of evidence that warrant special attention because of both their potential benefits and distinct risks they can pose regarding discovery and admissibility.

With witness statements, it is important to encourage the person who takes down the statement to give factual information only and to avoid speculation or subjective descriptions. Similarly, interviews should seek and record only factual information, not judgments or speculation. Interviews should take place as soon as possible after the incident, while memories of the details are still fresh. It may be useful to conduct a second round of interviews one or two weeks later to identify any new information or to answer questions that may have arisen during the investigation.

When conducting the interview, be cognizant of body language. Avoid sitting across a desk or table from the interviewee; sitting to one side, without any physical barriers, is more likely to put the interviewee at ease. Begin the interview with assurances that all those present during or involved in the incident are being interviewed in order to gather facts, not to place blame.

Experienced interviewers often use a “tell me about this shift” technique in which they prompt the interviewee to narrate the sequence of events leading up to and throughout the incident. The interviewer listens quietly and saves questions until the end.

Many factors can influence the reliability and credibility of interviews. Because interviewees are likely to act in what they perceive to be their own interests, be mindful of a witness’s perspective. Does he or she have a reason for hiding or not emphasizing certain information? Does he or she seem to note and remember events accurately? Does the potential for disciplinary action, criminal or civil liability, or discharge from employment exist for either the witness or his or her coworkers? Have others spoken to the witness and influenced his or her recollection of events? There are no easy ways to detect this information, but experience in interviewing will increase the ability to pick up subtle clues to discern the witness’s motivations behind the information provided. Effective interviewing technique requires listening for both what is said and what is not said.5

There are several issues to consider regarding whether to take notes or record interviews, including how such recordings are treated under state or federal court rules and rules of evidence.5 Work with legal counsel to develop practices for taking written statements and conducting interviews.

Investigation Findings Report: A Collection of Facts

Finally, the investigator concludes the process with a findings report. The report is meant to provide facts in a clear and concise manner. Organizations may want to adopt an investigation findings report form as part of their postincident practices. This helps guide the investigator in developing the report and not going beyond the scope of the internal investigation.


In the past, many investigation methods taught investigators to hypothesize about causation. Today, to maximize the possibility of protecting analytical work and conclusions from discovery, many internal investigations stop with the purpose of fact-finding. This leaves analysis, identification of root causes and contributing factors, and performance improvement recommendations to fall under the organization’s QAPI program.

To read more practical aging services risk management suggestions to help your organization improve its reporting and investigation of incidents, download “Incident Investigation in Aging Services” at This white paper includes additional guidance on internal incident reporting and investigation. 


1. ECRI Institute. Healthcare device adverse event recognition and investigation. Contin Care Risk Manage. July 2004. Accessed September 23, 2019. 

2. Rowe NL, Amo M. Investigations in long-term care facilities: implementing a standardized model. New York, NY: Vendome Group, LLC; 2006.

3. Oakley JS. Accident investigation techniques. Des Plaines, IL: American Society of Safety Engineers; 2003.

4. ECRI Institute. Risk management tips for device-related events. Contin Care Risk Manage. July 2004. Accessed September 23, 2019.

5. ECRI Institute. Event report interviews. Contin Care Risk Manage. February 2013. Accessed September 23, 2019.

6. ECRI Institute. Incident investigation in aging services: a systems thinking approach. Contin Care Risk Manage. September 2019.  . Accessed September 23, 2019.

Back to Top