7.2 CMS Conditions of Participation and Deemed Status
Key Takeaways
- The hospital Conditions of Participation live at 42 CFR Part 482 and are the federal price of Medicare and Medicaid participation, making CoP compliance an enterprise financial exposure and not merely a quality matter.
- A hospital demonstrates compliance either through a State Survey Agency survey or through an accrediting organization holding CMS deeming authority, but deemed status never blocks complaint surveys or CMS validation surveys.
- Deficiencies are cited on Form CMS-2567 as standard-level or condition-level; condition-level noncompliance places a hospital on a 90-day termination track and Immediate Jeopardy places it on a 23-day track.
- The QAPI Condition requires a data-driven, governing-body-accountable program that tracks adverse patient events and sets improvement priorities on high-risk, high-volume, or problem-prone areas.
- An acceptable plan of correction states the systemic change, how other affected patients will be identified, the monitoring that sustains compliance, the responsible title, and completion dates.
Why the CoPs Sit at the Top of the Risk Register
Domain 3 task H.1 names the Centers for Medicare and Medicaid Services (CMS) explicitly. The Conditions of Participation (CoPs) are the federal health and safety requirements a provider must satisfy in order to participate in, and be paid by, Medicare and Medicaid. Hospitals are governed by 42 CFR Part 482; critical access hospitals by Part 485; long-term care facilities by Part 483; home health agencies by Part 484; and ambulatory surgical centers, which have Conditions for Coverage, by Part 416.
These are not aspirational best practices. They are the price of admission to the largest payer in the country. For most acute care hospitals, Medicare and Medicaid represent a majority of net patient revenue, and termination from the program typically cascades: commercial contracts that require Medicare certification fall away, state licensure issues follow, medical staff and workforce departures accelerate, and lenders react to covenant breaches. That is why the risk manager, who is normally focused on claims and patient harm, must also be fluent in the CoPs. A condition-level finding is one of the few events that can threaten the going concern of the organization, and it is precisely the kind of enterprise exposure the CPHRM expects a risk professional to see coming.
Certification, Accreditation, and Deemed Status
CMS certifies providers. The certification survey is normally performed by the State Survey Agency (SA), the state health department unit working under agreement with CMS.
The alternative pathway is deemed status. A hospital accredited by an accrediting organization (AO) that holds CMS-granted deeming authority is deemed to meet the CoPs, because the AO's standards have been found to meet or exceed the federal requirements. Multiple AOs hold hospital deeming authority, including The Joint Commission, DNV Healthcare, ACHC/HFAP, and CIHQ. Deeming authority is granted for a term and must be re-approved, and an AO's standards are reviewed against the CoPs whenever the federal requirements change.
What deemed status does not do is the part exam items exploit:
- Complaint investigations are conducted by the State Survey Agency on CMS's behalf, regardless of accreditation status.
- CMS directs validation surveys on a sample of accredited hospitals, generally conducted shortly after the AO's own survey, to test whether the AO's process is catching what the CoPs require.
- CMS retains ultimate enforcement authority, including termination. An AO can withdraw accreditation; only CMS can terminate the provider agreement.
The practical translation for the risk manager: "we just passed our accreditation survey" is never a response to a CMS condition-level finding, and accreditation compliance and CoP compliance must be tracked as two related but separate obligations. Accreditation survey mechanics such as tracer methodology and accreditation decision categories belong to the accreditation topic; this topic is the federal requirement set and the federal enforcement track.
The Conditions the Risk Manager Actually Lives In
| Condition of Participation (42 CFR) | Core requirement | Risk management touchpoint |
|---|---|---|
| Governing Body, 482.12 | Legally responsible for the conduct of the hospital; appoints the medical staff and approves bylaws; accountable for the quality of contracted services | Board-level reporting of serious events, claims, and aggregate exposure; ensuring contracted services are inside the quality program |
| Patient Rights, 482.13 | Notice of rights, participation in care planning, advance directives, privacy, confidentiality, freedom from abuse and harassment, a grievance process, and restraint and seclusion limits | Grievance process design and written responses; restraint policy; consent and advance directive audits |
| Emergency Preparedness, 482.15 | Facility-based and community-based all-hazards risk assessment, policies, communication plan, training and testing program | Continuity of operations, surge and evacuation planning, downtime procedures |
| QAPI, 482.21 | Ongoing, data-driven, governing-body-accountable program that tracks adverse events and conducts improvement projects | Event report and claims data feed; analysis output; documented improvement projects |
| Medical Staff, 482.22 | Accountable to the governing body; bylaws; appointment, credentialing, privileging, and periodic appraisal; history and physical requirements | Negligent credentialing exposure; NPDB query duty; peer review structure and privilege |
| Nursing Services, 482.23 | Registered nurse supervision, an individualized nursing care plan for each patient, medication administration and verbal order rules | Staffing-related claims, medication error trends, failure-to-rescue analysis |
| Medical Record Services, 482.24 | Accurate, promptly completed, properly authenticated records, generally completed within 30 days after discharge | Defensibility of the record; late entries, addenda, and copy-forward practices |
| Pharmaceutical Services, 482.25 | Pharmacy directed by a qualified pharmacist; controls over drug distribution, storage, and adverse reaction reporting | Controlled substance diversion, high-alert medication events |
| Utilization Review, 482.30 | A UR plan and committee reviewing medical necessity and duration of stay | Medical necessity documentation, denial exposure, discharge disputes |
| Physical Environment, 482.41 | Safe, well-maintained environment; Life Safety Code compliance; maintained equipment and utility systems | Environment-of-care claims, equipment failure, security of the physical plant |
| Infection Prevention and Control and Antibiotic Stewardship, 482.42 | Facility-wide program with qualified leadership, surveillance, and a stewardship component, accountable to the governing body | Healthcare-associated infection claims, outbreak and look-back notification decisions |
| Discharge Planning, 482.43 | Discharge planning evaluation, use of post-acute quality data, and timely transfer of necessary records | Post-discharge harm, readmission and transition-of-care claims |
Three of these deserve a closer look because they generate the majority of risk management work.
Patient Rights and the Grievance Process
A patient grievance under 482.13 is a written or verbal complaint by a patient or the patient's representative regarding the patient's care, abuse or neglect, the hospital's compliance with the CoPs, or a Medicare beneficiary billing complaint related to rights and limitations, that is not resolved at the time by the staff present. Distinguish it from a complaint that staff present can and do resolve promptly, which does not trigger the formal process. Any written complaint is a grievance, including one submitted by email, and a complaint about abuse, neglect, or patient harm is a grievance regardless of how quickly it is addressed.
The governing body must approve and remain responsible for the grievance process, though it may delegate operation to a grievance committee. The hospital must provide the patient a written response identifying the hospital contact person, the steps taken to investigate, the results of the process, and the date of completion. CMS interpretive guidance treats roughly seven days as a reasonable time frame for most grievances, with written interim notice when a complex review needs longer. The risk manager's interest is direct: grievances are the earliest signal of a claim, and the written response is a document a plaintiff's attorney will read aloud.
QAPI
The Quality Assessment and Performance Improvement (QAPI) Condition at 482.21 requires an ongoing program that is data-driven and demonstrates measurable improvement in indicators linked to improved health outcomes and the reduction of medical errors. The hospital must measure, analyze, and track quality indicators, including adverse patient events; must use the data to identify opportunities and monitor effectiveness; must set improvement priorities focused on high-risk, high-volume, or problem-prone areas while considering incidence, prevalence, and severity; and must take actions and measure their success. The hospital must conduct distinct performance improvement projects, with the number and scope proportional to the scope and complexity of its services, and must document what projects are being conducted, the reasons for conducting them, and the measurable progress achieved. The Condition also requires that adverse patient events be analyzed and that preventive actions and mechanisms be implemented.
The governing body is responsible for ensuring the program is defined, implemented, and maintained, that it addresses priorities and sustains improvement, that clear expectations for safety are established, and that adequate resources are allocated. This is why "the quality department owns QAPI" is a wrong answer. The risk manager's contribution is the data no one else has: event reports, serious safety event reviews, claims and near-claim experience, and the trend analysis that identifies which high-risk area deserves the next project.
Medical Staff
Under 482.22 the medical staff is accountable to the governing body for the quality of care. Appointments are made by the governing body after a medical staff recommendation, based on individual character, competence, training, experience, and judgment. Privileges are granted individually, and there must be a periodic appraisal of each practitioner. The history and physical requirements are frequently tested detail: an H&P completed and documented no more than 30 days before or 24 hours after admission or registration, with an updated examination documented within 24 hours after admission and prior to surgery or a procedure requiring anesthesia. The credentialing and privileging process itself is developed elsewhere in this guide; here the point is that credentialing is a federal Condition, so a credentialing failure is both a negligent credentialing claim and a CoP exposure.
A hospital accredited by an accrediting organization with CMS deeming authority receives notice that State Survey Agency surveyors are arriving to investigate a patient complaint. The CEO asks the risk manager why the accreditor is not handling the matter. What is the best explanation?
Enforcement Mechanics
Survey types. Initial certification and recertification surveys, complaint surveys triggered by an allegation, CMS-directed validation surveys of accredited hospitals, and revisit or follow-up surveys verifying correction. Federal surveys are unannounced.
The document. Findings are cited on Form CMS-2567, Statement of Deficiencies and Plan of Correction. The left column contains the regulatory tag and the surveyor's factual findings; the right column is where the hospital writes its plan of correction (POC), generally due within 10 calendar days of receipt. The completed CMS-2567 is a public document.
Severity classification. A standard-level deficiency is a failure to meet a standard within a Condition where the Condition as a whole is still met. A condition-level deficiency exists when deficiencies are of such character as to substantially limit the provider's capacity to furnish adequate care or to adversely affect patient health and safety; the Condition is out of compliance and the hospital is out of compliance with the CoPs. That distinction, not the number of tags, drives everything that follows.
Immediate Jeopardy. Immediate Jeopardy (IJ) is a situation in which the provider's noncompliance has caused, or is likely to cause, serious injury, harm, impairment, or death. IJ places the hospital on a 23-calendar-day termination track. The survey team notifies leadership on site, and the hospital must produce and begin implementing a removal plan immediately; surveyors verify that the immediate jeopardy has been removed before the finding is lowered, though the underlying condition-level deficiency remains until corrected. Condition-level noncompliance that does not rise to IJ carries a 90-calendar-day termination track. Termination is preceded by public notice.
What makes a plan of correction acceptable. CMS expects the POC to state how corrective action will be accomplished for the patients found to have been affected; how the hospital will identify other patients potentially affected by the same practice and what it will do for them; what systemic measures or changes will prevent recurrence; how the corrective action will be monitored to ensure it is sustained; the title of the person responsible; and the completion dates. A POC that consists of counseling the involved staff member and recirculating the policy is the classic rejected plan, because it contains no system change, no look-back, and no sustainment monitoring.
Surveyors cite a condition-level deficiency under Patient Rights after finding restraint orders written without documented clinical justification in three records. The unit director drafts a plan of correction stating that the three physicians involved were counseled and the restraint policy was re-sent to the medical staff by email. What is the most important deficiency in this plan of correction?
The Risk Manager During a Survey
Survey response is one of the clearest illustrations of the risk manager's real authority: coordinate, document, escalate, and involve counsel, without ever speaking for the organization beyond your role.
- Before. Maintain a survey-readiness file with the documents surveyors always request: the QAPI plan and minutes, medical staff bylaws, the credentialing and privileging policy, restraint and grievance policies, contracted services lists, infection control surveillance data, staffing and competency records, and the emergency preparedness plan and exercise documentation. Rehearse the entry process.
- During. Open a command center. Assign a trained escort to each surveyor and a scribe who records every question asked, every document produced, and every observation made. Route all document requests through a single control point and keep a log with copies of exactly what was produced. Coach staff to answer the question asked, say "I do not know, let me find the person who does" when true, and not to speculate or volunteer. Hold a leadership debrief after every daily exit briefing so that a correctable finding gets corrected on the spot, which surveyors may reflect in the record.
- Counsel and privilege. Involve legal counsel immediately on any Immediate Jeopardy finding and on any request that touches material the organization treats as privileged peer review or patient safety work product. Know in advance what will and will not be produced, and remember that surveyors have broad access to the medical record itself.
- After. Own the POC's systemic content, secure governing body and QAPI visibility, and build the sustainment audit before the completion date rather than after it.
The wrong answers in survey scenarios are recognizable: argue the finding with the surveyor on the spot, promise a surveyor a specific outcome, alter or complete a record after the fact, or hand over privileged material without counsel's involvement. The right answer is nearly always to document, escalate to the appropriate leader or committee, and coordinate the response.
Exam Traps
- Accreditation is not certification. Deemed status substitutes for the routine survey only. It never blocks complaint or validation surveys and never removes CMS's authority to terminate.
- Condition-level is a different species, not more standard-level tags. It means the Condition itself is out of compliance.
- Memorize both clocks. Immediate Jeopardy runs a 23-day termination track; other condition-level noncompliance runs 90 days.
- QAPI is board-accountable. Answers that isolate quality from the governing body for objectivity invert the requirement.
- Individual remediation is not a plan of correction. CMS wants system change, identification of other affected patients, and sustained monitoring.
- Grievance versus complaint. Anything written, anything alleging abuse, neglect, or harm, and anything not resolved by staff present is a grievance and requires the formal written response.
- CoP compliance is not delegable. The hospital, not the accreditor and not the risk manager personally, holds the obligation.
The governing body asks the risk manager to confirm that the hospital's QAPI program satisfies the Condition of Participation. Which description reflects what the Condition actually requires?