In the one study that followed Oregon’s psilocybin clients for three months, four people had a serious adverse reaction. Facilitators had recorded one of them as serious.
That finding does not show the program is unsafe. Most clients in the same study improved, and events recorded during sessions were rare in every dataset published this year. It shows something narrower. A program cannot measure a harm that nobody is assigned to ask about.
We think states that license psychedelic services should require that clients be asked directly what happened to them, at fixed points after the session, by someone other than the provider who served them. What follows is the evidence, the rules as they are written today, and the strongest reasons a state might decline.
What the evidence shows
We compared three datasets on state-regulated psilocybin services last week. All three found few serious events around the dosing session. They diverged afterward, and the divergence followed the method.
Oregon’s own dashboard and a facilitator-software dataset both rely on what providers record. The third, a research cohort led by Todd Korthuis at Oregon Health and Science University, surveyed 346 clients themselves at one week, one month and three months. Three of its four serious reactions came from those surveys, and at least two of the three involved an emergency visit the client reported at one month or later. At three months, 14 of 312 respondents reported persistent, worsening depression and six reported new thoughts of dying or suicide. Both counts were higher at three months than at one week.
The cohort has no comparison group, and four events is a small number. It cannot say how often harm follows a session, or that psilocybin caused what clients reported. It can say that the client’s account and the provider’s record of the same session were different.
What the rules require today
Oregon’s rules do ask one question after the session. A facilitator must try to contact every client within 72 hours and, on reaching them, ask whether they had a “post-session reaction.” The definition is narrow: a reaction within 72 hours of release that was likely related to psilocybin and led to emergency services or care from a medical provider. Reactions during the session are defined the same way, by the need for emergency or medical care.
The facilitator records “any known” post-session reactions, and service centers send the state a quarterly count. The rules also say a facilitator “shall offer” an integration session, which the client is free to decline. After 72 hours, nothing requires anyone to ask anything.
So worsening depression at six weeks is outside the definition. An emergency visit on day five is outside it. Distress on day two that did not lead to medical care is outside it. And the one question the rules require is put by the person who ran the session.
Colorado’s rules ask facilitators for more. A healing center must report an adverse health event within two business days of being notified of it, and a facilitator must report a serious or life-threatening one within 24 hours. For each participant, a facilitator must also collect de-identified data that includes whether the person “self-identified a benefit” and, “if known to the facilitator,” whether an adverse health event occurred. No rule sets a time after the session for asking.
The legislature went further in 2025. Senate Bill 25-297 says that from July 1, 2026, a facilitator shall give the state health department de-identified data, including individual-level outcome data and “information provided by a participant prior to and following” the session. That is closer to asking the client than anything in Oregon’s rules.
Three limits apply. The duty holds only if the department has enough money for its database, and the law funds the database through gifts, grants and donations; we could not establish from public records whether that condition has been met. The data still travel through the facilitator. And the law leaves the form and timing of reporting to the department, while the licensing agency was still taking stakeholder input on its implementing rule in September. The database section repeals in 2030.
Colorado is ahead of Oregon. In both states the person who asks the client is still the provider, and neither sets a later point at which the question must be asked.
What we recommend
Three requirements, each modest.
First, ask the client. Every person who receives services should be offered a short questionnaire at fixed points after the session. It should cover a handful of things: emergency care or hospitalization, new medication or clinical care, worsening mood or anxiety, thoughts of suicide or self-harm, persisting perceptual changes, and whether the person judges the experience to have helped or harmed. States do not need to invent the instrument. The Oregon research network published a consensus set of measures for supervised psilocybin services in 2024.
Second, do not route the answers through the provider. The questionnaire should go to the state health agency or to a registry or university working under contract to it. This is the part current rules lack. A client may tell a third party what they would not tell the person who sat with them, and may only recognize a problem weeks after the last contact. The provider’s own reporting duties would stay as they are.
Third, publish the results in aggregate: how many clients were asked, how many answered, and how many reported each category of event, statewide. We would not publish results by service center. Oregon served about 6,000 clients last year across roughly two dozen centers. At that scale a single event would swing a center’s rate, and small numbers can identify people.
How long to follow is the question the evidence answers least well. Three months is the longest window any of the datasets has tested, and in that dataset some counts were still rising between the first month and the third. That supports asking at least once after the first month. It does not establish three months as the right endpoint, and none of the datasets looks further out. A state could reasonably adopt the one-week, one-month and three-month schedule already in use, say plainly that it is provisional, and revise it once its own data show when reports stop arriving.
The case against, taken seriously
Privacy is the strongest objection. These clients did not enroll in a clinical trial. They paid for a legal service involving a substance that remains in Schedule I under federal law, and they have reason to be wary of any record held by a state.
The answer has to be structural. Participation by the individual should be voluntary: the program must offer follow-up and report how many accept, and the client may refuse. Oregon already works this way for demographic data. Clients can ask that theirs be withheld from the state, and from this year centers must report how many did.
Voluntary follow-up has a cost in evidence. People who answer may differ from people who do not, which is why the response rate has to be published beside the counts.
Colorado’s law shows what statutory protection can look like, and where it stops. It makes the health department’s database confidential, exempts it from the open records act, and says its contents are not subject to subpoena or discovery and are not admissible in any private civil action. It says nothing comparable about criminal or government proceedings.
Follow-up cannot be anonymous, because someone has to hold a phone number or an email address. It can be confidential, and here we would go beyond current law in either state: contact details kept apart from answers and destroyed when the window closes. A state statute cannot change the federal status of the drug, and states should not promise clients more protection than their law provides.
Cost is the second objection, and it is immediate. Oregon’s licensees pay $10,000 a year per service center and $2,000 per facilitator. On September 22 the Oregon Health Authority withdrew a proposal to double those fees, citing feedback from its advisory board, its rule committees and public comment. In the Korthuis study, a third of clients said the cost of services was a financial strain.
We do not know what follow-up would cost per client, and we will not guess. The research network that produced the three-month data is paid for by federal and university research funds. A current federal grant to its lead investigator carries a first-year award of $736,713, and that covers research a surveillance system would not need.
What we can say is where the cost should not land. License fees are the obvious alternative, and Oregon shows their limit. The proposal to raise them was withdrawn, and a state budget document reported by Oregon Public Broadcasting projects a shortfall of several million dollars in the program’s current two-year budget without an increase. A cost added to licensees also reaches clients through the price of a session. Colorado tied its database to gifts, grants and donations, which is not a durable model. And a federal research grant covering about 5 percent of Oregon’s clients is not a surveillance system.
Knowing whether a state-licensed program harms the people who use it is a public function, and the benefit goes to the public and to future clients, not to the licensee. That is why we would fund it by appropriation. A legislature that prefers a dedicated share of program revenue would still meet the test that matters: stable public funding that does not depend on donors or on a research grant being renewed.
The third objection is proportionality. These are not hospitals, and facilitators are not clinicians. A state that keeps adding clinical requirements could turn a service model into a medical one by increments.
That concern is the reason the questionnaire should not go through facilitators at all. Nothing in this proposal asks a facilitator to assess, diagnose or treat. It asks the state to send a short set of questions and count the answers.
The last objection is that four events in one cohort is thin ground for a mandate. It is thin ground for a conclusion about risk. It is adequate ground for measurement. The mandate we are proposing is to count, not to declare the services dangerous. If follow-up finds that serious harm after a session is as rare as the session-day records suggest, the programs will have evidence of safety they do not have now.
Why this matters before the next program opens
Other parts of the health system assume that consequences can appear after an intervention. The FDA’s preliminary thinking on a first U.S. ibogaine trial contemplates cognitive testing through 12 months after a single dose. Medicare’s new behavioral health payment model reconciles payment against symptom scores over a year of care. Those are different systems with different purposes, and state service programs should not copy them. The principle carries over: someone is responsible for finding out what happened next.
Rules are being written now. New Mexico’s medical psilocybin law directs its health department to write rules for collecting data from producers, clinicians and patients, and to implement the program by December 31, 2027. The department’s proposed rule, set for a public hearing on October 2, takes treatment records and adverse-event reports from practitioners, facilitators and healing centers. It contains no patient questionnaire and no scheduled follow-up. The statute’s wording leaves room for both.
Oregon said on September 22 that it would open a new rulemaking on changes unrelated to fees, planned to take effect on January 15, 2027.
Building follow-up into a program before it opens is cheaper than adding it to one with thousands of past clients and no record of how they fared. Oregon has that problem already. The states writing rules this year do not have to.