The Minnesota 245D Individual Abuse Prevention Plan: what has to be in it

1. What it is, and what it isn't

Minnesota Statutes § 245A.65, subd. 2 requires every DHS license holder to maintain two separate written documents: a program abuse prevention plan covering the population, physical plant and environment the license holder controls, and an individual abuse prevention plan (IAPP) for each person receiving services. For providers of intensive support services — group homes, adult foster care, integrated community supports — § 245D.071, subd. 2 names the same obligation directly, rooted in the Vulnerable Adults Act's abuse-prevention-plan requirement at § 626.557, subd. 14.

The distinction matters because the two documents answer different questions. The program plan asks: given who we serve and where, what could go wrong here in general? The IAPP asks a narrower question about one specific person: given this person's history, cognition, mobility, and living situation, what is their specific risk, and what will staff specifically do about it? A licensor who finds a strong program plan and an empty or copy-pasted individual file has found exactly nothing about the population plan is protecting against.

2. Timing: before services start, then at least annually

Before or upon initiating services — the plan is developed as part of the person's initial service planning, not added later once someone gets around to it.

At least annually after that, using the person's individual assessment and any reports of abuse that occurred, with the plan revised to reflect what that review finds. And sooner than annually whenever something changes the person's actual risk: a move, a new diagnosis, a change in mobility or cognition, or after an incident involving that person specifically. An IAPP that was accurate a year ago and hasn't been touched since a fall, a hospitalization, or a new roommate is not current, and "current" is the standard § 245A.65 sets.

3. What the plan has to actually say

DHS's own sample IAPP document (the form most agencies start from) organizes the individual risk assessment into five categories. A complete plan addresses each one for the specific person, not as a checklist of boxes but as short, specific findings:

Sexual abuse — does the person understand sexuality and consent well enough to protect themselves; are they likely to seek out or go along with an abusive situation; can they assert a refusal.
Physical abuse — can they recognize a dangerous situation and remove themselves from it; do they have a documented history as a victim; how do they interact with unfamiliar people and handle aggression directed at them.
Self-abuse and self-neglect — safety awareness, self-injurious behavior, medication compliance, basic self-care, appropriate dress for conditions.
Financial exploitation — the person's actual ability to handle money and recognize when someone is taking advantage of them.
Risk the person may pose to others — any known history of violence or physical aggression, and what staff do to protect visitors, roommates, and the public if the person is unsupervised.

For every risk actually identified, the plan documents a specific protective measure — what staff do about it, in this program, for this person. Where a risk falls outside what the licensed service can address, the plan documents a referral instead of leaving the risk unaddressed. And where an assessment finds no elevated risk in a category, the plan says that too, rather than leaving the section blank.

4. Who has to be in the room

The person receiving services participates in developing their own plan to the full extent of their abilities — this is a participation right, not paperwork the program fills out about someone. Where the person has a legal representative, that representative must be given the opportunity to participate with or for them. DHS's sample document also carries a case manager signature line and a program representative signature line alongside the person's and legal representative's.

A plan with only a staff signature, developed without documented participation from the person or their representative, is missing the element regulators look for first — not because the signature itself matters, but because its absence is evidence the plan was written about someone rather than with them.

The one mistake that gets flagged every time

It isn't a missing signature or a late annual review — those are real findings, but they're visible and usually get fixed once. The recurring one is a plan that reads like a template: every category filled in with the same generic sentence regardless of who the person actually is, or a protective measure that doesn't connect to any risk named above it. That pattern is the fastest way to signal that thirty individual files were produced by copying one document thirty times, which is the opposite of what an individual abuse prevention plan is supposed to prove.

A note on what software can and cannot do

Software does not write the risk assessment for you, and it shouldn't try to. That judgment belongs to the person, their team, and whoever knows them best.

What a system can reasonably do is make sure the plan exists before services start, flag it the moment the annual review window is closing, and tie the review date to the person's actual assessment record instead of a spreadsheet nobody remembers to open. That is a narrower, more honest claim than "compliance software" usually makes — and it is the part that is genuinely easy to lose track of across a caseload with different admission dates and different review anniversaries for every person.