CMS Conditions of Participation — Specialized Providers

To receive Medicare and Medicaid reimbursement, healthcare facilities must meet federal Conditions of Participation (CoPs) — minimum health and safety standards set by the Centers for Medicare & Medicaid Services. While the main hospital CoPs live at 42 CFR Part 482, the regulations at 42 CFR Part 485 cover a distinct set of specialized provider types: Critical Access Hospitals (CAHs), Rural Emergency Hospitals (REHs), Comprehensive Outpatient Rehabilitation Facilities (CORFs), outpatient physical therapy and speech-language pathology providers, and Community Mental Health Centers (CMHCs). These conditions define what it means to operate each type of facility lawfully under Medicare — and their standards directly affect the quality of care rural and specialized patients receive.

Current Rule (2026)

What This Rule Does

42 CFR Part 485 is the Medicare rulebook for specialized facilities that don't fit the acute care hospital model. Each subpart defines a distinct provider type, specifies the services that type must provide to qualify for Medicare payment, and establishes the governance, staffing, quality, and safety conditions the facility must meet. CMS surveys (inspects) these facilities through State Survey Agencies under contract; failure to meet conditions can result in termination from Medicare.

Critical Access Hospitals (Subpart F — 25 sections) are a federally designated category of small rural hospitals — a designation created after the closure of hundreds of rural hospitals in the 1980s and 1990s. CAHs must meet specific criteria: located in a rural area, at least 35 miles from the nearest hospital (or 15 miles over mountainous terrain or secondary roads), and limited to 25 inpatient beds. In exchange for meeting CAH conditions, these hospitals receive cost-based Medicare reimbursement (101% of reasonable costs) rather than DRG-based payment — a critical financial lifeline for rural hospitals.

Rural Emergency Hospitals (Subpart E — 24 sections) are a new provider type created by the Consolidated Appropriations Act of 2021 and finalized in November 2023. An REH is a former CAH or rural hospital that converts by eliminating inpatient services entirely — becoming a 24/7 emergency department and outpatient facility only. REHs receive enhanced Medicare payment (5% premium above standard outpatient rates) and a monthly facility payment. The REH designation is designed to preserve emergency medical access in rural communities where full inpatient services are no longer financially viable.

Comprehensive Outpatient Rehabilitation Facilities (Subpart B — 11 sections) are free-standing facilities providing coordinated outpatient rehabilitation — physical therapy, occupational therapy, speech-language pathology, respiratory therapy, and social/psychological services — to Medicare beneficiaries. CORFs must have a physician medical director and provide at least physical therapy as a core service; other therapies may be added.

Community Mental Health Centers (Subpart J — 9 sections) must meet CMS conditions to provide day programs as a Medicare-covered partial hospitalization alternative. CMHCs must provide a core set of services including partial hospitalization, 24-hour crisis coverage, and outpatient mental health services.

Key Provisions

Critical Access Hospitals (§§ 485.600–485.645):

• § 485.600 — Basis and scope: CAH designation is made by CMS based on state nomination; the facility must maintain a rural location, bed limit, and distance criteria; a CAH may swing beds between acute care and skilled nursing facility use
• § 485.610 — Condition: location and bed size: maximum 25 acute care beds (or 10 beds if the CAH includes a distinct-part psychiatric or rehabilitation unit); location in a rural area as defined by the census bureau; distance requirements apply except for facilities in states with exceptions
• § 485.618 — Condition: emergency services: must provide emergency care 24 hours per day, 7 days per week; must have at least one physician available by phone or on call within specified response times; emergency care may be provided by nurse practitioners and physician assistants when physicians are not physically present if the state scope of practice law permits
• § 485.620 — Condition: personnel qualifications: all professional staff must be licensed under applicable state law; CAHs may employ nurse practitioners and physician assistants in expanded roles not available at acute hospitals under standard Medicare conditions
• § 485.635 — Condition: clinical records: CAHs must maintain a clinical records system including policies and a designated medical records administrator; records must be retained for a minimum period specified by state law or Medicare CoP requirements, whichever is longer
• § 485.641 — Condition: periodic evaluation and quality assurance: CAH must conduct an annual evaluation of its total program; must have an ongoing quality assurance program with documented activities and results; the CAH governing body is responsible for the quality assurance program

Rural Emergency Hospitals (§§ 485.500–485.560):

• § 485.500 — Basis and scope: REH designation requires that the facility was a CAH or rural hospital as of December 27, 2020; the facility must convert to emergency-only operations, eliminating all inpatient beds; a limited number of observation beds may be maintained
• § 485.510 — Condition: location and services: must be located in a rural area; must maintain a 24-hour emergency department staffed by qualified personnel; must have transfer agreements with hospitals to receive patients requiring inpatient care; outpatient services may include a broad range of ambulatory care
• § 485.520 — Condition: staffing: must have a physician, nurse practitioner, or physician assistant available in the emergency department at all times (not just on call); higher staffing standard than CAH because all patients are outpatients or emergency patients — no "on-call" model for the ED
• § 485.545 — Condition: quality assessment and performance improvement (QAPI): REH must maintain a comprehensive QAPI program aligned with CMS's hospital QAPI standards; must track patient outcomes and emergency readmission data

Comprehensive Outpatient Rehabilitation Facilities (§§ 485.50–485.74):

• § 485.56 — Condition: plan of treatment: each patient must have a written plan of treatment established by a physician or allowed non-physician practitioner; the plan must specify diagnosis, expected outcomes, and specific services to be provided
• § 485.58 — Condition: medical supervision: a physician must be on-site at the CORF for a sufficient number of hours to review treatments, sign orders, and be available for emergencies; the physician medical director provides oversight of all clinical services

Community Mental Health Centers (§§ 485.900–485.930):

• § 485.904 — Condition: compliance with federal requirements: CMHCs must comply with all applicable civil rights laws, fire safety codes, and HIPAA requirements
• § 485.910 — Condition: partial hospitalization: the core Medicare-covered CMHC service; must provide at least 20 hours per week of services per patient in a partial hospitalization program; services must include individual and group therapy, medication management, and case management

How It Affects You

If you live in a rural community, Critical Access Hospitals and Rural Emergency Hospitals may be the only acute care options within reasonable distance. Understanding the CAH designation helps explain why your local hospital may look different from a large urban medical center — 25-bed limit, no full-time physician in the ED at 3 AM (but one available by phone), and a mix of inpatient and nursing facility beds. The trade-off is that the cost-based Medicare reimbursement the CAH receives keeps the facility financially viable enough to stay open. Without the CAH designation, many of these hospitals would have closed.

The REH designation (new as of 2023–2024) represents a significant policy experiment: can rural communities maintain emergency access even when full inpatient services are no longer sustainable? REHs sacrifice inpatient care for financial survival. If your rural hospital converts to REH status, you will need to be transferred for any condition requiring inpatient admission — which adds time and transport costs for serious illnesses. REH emergency care for true emergencies remains available locally.

If you need outpatient rehabilitation services, Medicare covers CORF services under Part B. A referral from your physician is required. CORFs provide coordinated multi-disciplinary rehab — if you need PT and OT and speech therapy after a stroke or major surgery, a CORF can provide all services in one setting with coordinated treatment planning. This is often more efficient than visiting separate outpatient providers.

If you are a healthcare administrator converting a facility to REH status or maintaining CAH designation, the CMS conditions at Part 485 are the certification standard. State Survey Agencies conduct initial certification surveys before a facility may bill Medicare and periodic recertification surveys (typically every 3 years for CAHs). Deficiencies found during surveys must be corrected on a plan of correction timeline; repeated deficiencies or immediate jeopardy findings can trigger termination proceedings.

Statutory Authority

This rule implements:

• 42 U.S.C. § 1302 — Secretary's general authority to issue regulations for Medicare and Medicaid program administration
• 42 U.S.C. § 1395x(mm) — Definition of Critical Access Hospital for Medicare purposes; the statutory criteria that CAHs must meet

Implementing Regulations

Every provider, supplier, or practitioner that bills Medicare must first establish and maintain Medicare billing privileges under 42 CFR Part 424 — Conditions for Medicare Payment (99 sections across 9 subparts). Part 424's Subpart P (Requirements for Establishing and Maintaining Medicare Billing Privileges) is the gateway regulation: no provider may receive Medicare payment without completing the enrollment process described here. The Centers for Medicare & Medicaid Services (CMS) administers the Provider Enrollment, Chain, and Ownership System (PECOS) — the database that tracks all enrolled providers — and uses the criteria in Subpart P to screen out problematic applicants and revoke billing privileges from existing enrollees.

• § 424.505 — Basic enrollment requirement: to receive Medicare payment — whether on an assigned claim (payment directly to provider) or an unassigned claim (payment to beneficiary) — a provider or supplier must be enrolled in the Medicare program; enrollment is not optional for any entity that accepts Medicare patients; newly established providers cannot bill for services rendered before their enrollment effective date
• § 424.510 — How to enroll: providers must submit a CMS-855 series enrollment application (type varies by provider category — CMS-855A for institutions, CMS-855B for group practices, CMS-855I for individual practitioners, CMS-855S for DMEPOS suppliers); once the application is submitted, Medicare contractors must process it within specified timeframes; providers that fail to respond to requests for additional information within 30 calendar days may have their applications rejected
• § 424.514 — Application fees: prospective institutional providers (hospitals, skilled nursing facilities, home health agencies, hospices, outpatient therapy providers, ambulatory surgical centers, etc.) submitting initial applications or adding new practice locations must pay a CMS-determined application fee (adjusted annually for inflation; currently approximately $700–900 per initial application); individual practitioners, group practices, and certain supplier types are exempt from the fee; failure to pay the fee results in application rejection
• § 424.515 — Periodic revalidation: enrolled providers and suppliers must revalidate their enrollment information every 5 years (DMEPOS suppliers every 3 years); CMS notifies providers of upcoming revalidation deadlines; failure to revalidate results in deactivation of billing privileges; a deactivated provider cannot bill until it successfully revalidates — retroactive billing for the deactivated period is prohibited
• § 424.518 — Screening levels: CMS assigns every provider and supplier category a screening level based on historical fraud and abuse risk:
  • Limited screening: professional providers with strong licensure oversight (physicians, nurses, physical therapists); screening includes identity verification, state license check, and database screening against exclusion lists
  • Moderate screening: providers with meaningful fraud history in their category (community mental health centers, home health agencies, outpatient therapy providers); screening includes unannounced on-site visits in addition to database checks
  • High screening: provider types with the highest fraud rates (DMEPOS suppliers, transportation suppliers); screening includes criminal background checks and the most rigorous site visits; CMS may impose moratoria on high-risk provider types
• § 424.519 — Disclosure of affiliations: providers must disclose any current or prior affiliation (within the preceding 5 years) with a provider or supplier that has had an uncollected Medicare/Medicaid debt, been excluded from federal programs, had its billing privileges revoked, or been subject to a payment suspension; undisclosed adverse affiliations are grounds for denial or revocation; the affiliation disclosure requirement targets the practice of "fresh start" fraud — where excluded individuals restart operations through nominally new entities
• § 424.530 — Denial of enrollment: CMS may deny enrollment if the provider has unresolved Medicare debt; a current exclusion from federal health programs; an owner, officer, or managing employee with a felony conviction within the preceding 10 years related to healthcare, financial crimes, controlled substances, or violence; a false statement on the application; or failure to meet applicable enrollment requirements; denied providers face a 3-year bar on reapplication for most denial grounds
• § 424.535 — Revocation of enrollment: CMS may revoke billing privileges for an enrolled provider for noncompliance with enrollment requirements; false or misleading information; a pattern or practice of submitting claims for services not provided or not medically necessary; abusive billing; failure to maintain a physical practice location; failure to provide access to CMS's requested documentation; or an owner or managing employee's conviction of a felony offense; revoked providers face a re-enrollment bar of 1–10 years depending on the severity and basis for revocation; the bar runs from the date of revocation and prevents enrollment in any Medicare or Medicaid program during that period
• § 424.570 — Temporary moratoria: CMS may impose a moratorium on enrollment of new providers of a specific type in a specific geographic area when preliminary data suggest that the area is at high risk for fraud, waste, or abuse; moratoria freeze new applications but do not affect currently enrolled providers; CMS must publish moratorium announcements and may exempt individual applicants from a moratorium in limited circumstances; moratoria have been imposed on home health agencies and ground ambulance suppliers in markets with documented high fraud rates

Part 424's revocation and bar provisions are among the most consequential administrative actions in healthcare law. A revocation does not require proof of fraud — billing practice irregularities, failure to maintain adequate records, or changes in ownership without notifying CMS within required timeframes can all trigger revocation. The enrollment bar means a revoked provider cannot restart operations under a different name during the bar period, closing the "chameleon provider" loophole. Providers facing revocation have the right to request a CMS Informal Reconsideration (which does not extend the effective date of revocation) and then formal appeal to ALJ under 42 CFR Part 498.

When a healthcare provider is denied Medicare or Medicaid enrollment, terminated from participation, or decertified, the formal appeals process runs under 42 CFR Part 498 — Appeals Procedures for Determinations That Affect Participation. This is the administrative court system for providers and suppliers who dispute CMS's decision that they do not qualify to participate in the federal programs. Key provisions:

• § 498.3 — Scope: Part 498 covers CMS initial determinations about whether a provider or supplier is eligible to participate in Medicare and Medicaid; OIG exclusion proceedings; ICF/IID and nursing facility Medicaid participation determinations; and provider enrollment denials and revocations
• § 498.5 — Appeal rights: any prospective provider dissatisfied with a determination that it does not qualify as a provider may appeal; any currently participating provider facing termination or decertification may appeal; appeal rights do not exist for certain determinations (e.g., routine survey findings that do not trigger termination)
• § 498.20 — Initial determination notice: CMS mails a notice of initial determination specifying the basis for the action; if the determination is adverse, the notice states the effective date and explains appeal rights; for termination actions, the effective date may precede the completion of the appeal process
• § 498.22 — Reconsideration: before requesting a formal ALJ hearing, most providers must first request reconsideration by CMS or one of its contractors; the reconsideration step is waivable in some circumstances; CMS must complete the reconsideration and issue a reconsidered determination
• § 498.40 — Request for hearing: after an adverse reconsidered determination, the provider may request a formal ALJ hearing; the request must be filed with the ALJ office identified in the determination letter; there is no statutory dollar-amount threshold for provider participation hearings (unlike Medicare claims appeals)
• § 498.47 — Prehearing conference: the ALJ convenes a prehearing conference to identify disputed issues, exchange evidence lists, and set deadlines; the prehearing conference is especially important in provider termination cases because the government's administrative record may be voluminous
• § 498.74 — ALJ decision: as soon as practicable after the close of the hearing, the ALJ issues a written decision based on the record; the decision must contain findings of fact and conclusions of law; for enrollment appeals, § 498.79 requires the ALJ to issue a decision within 90 days of the request for hearing
• § 498.79 — Enrollment appeal timelines: when a request for a hearing involves a denied enrollment application (rather than a termination), the ALJ must issue a decision within 90 days — the same timeline that applies to Medicare coverage determination reviews under Part 426
• § 498.80 — Right to Departmental Appeals Board review: either party may appeal the ALJ's decision to the HHS Departmental Appeals Board (DAB); the Board reviews ALJ decisions and may affirm, modify, or reverse
• § 498.82 — DAB review request: filed within 60 days of the ALJ decision; the Board may supplement the evidentiary record in limited circumstances; Board decisions are binding unless judicial review is sought
• § 498.90 — Effect of DAB decision: the DAB's decision is the final administrative action — after DAB review, the provider may seek judicial review in federal district court; there is no automatic stay of a termination order while appeals proceed, meaning a terminated provider typically stops receiving payment during the appeal

The critical practical point for providers: a CMS termination action takes effect — and payment stops — while the administrative appeal is pending unless the provider obtains an injunction in federal court. Most providers cannot sustain a payment cutoff for the 12-18 months a full administrative appeal takes, which gives CMS significant leverage in settlement negotiations. The 90-day ALJ deadline in enrollment cases (§ 498.79) reflects Congress's recognition that enrollment delays harm access to care.

The core hospital Medicare conditions of participation live at 42 CFR Part 482 — Conditions of Participation for Hospitals (55+ sections across 9 subparts). Every acute-care hospital that accepts Medicare or Medicaid patients must satisfy Part 482's conditions; loss of Medicare certification eliminates 40–70% of a typical hospital's revenue stream overnight. CMS enforces Part 482 through state survey agencies, The Joint Commission, and DNV GL Healthcare — accreditation bodies CMS has granted "deemed status" authority, meaning accreditation by these bodies satisfies the CoP survey requirement. The 2016 final rule (81 FR 39448) substantially rewrote Part 482 for the first time in decades, adding new requirements for QAPI, discharge planning, and infection prevention. The 2020 COVID-era rule (85 FR 54820) added the antibiotic stewardship condition.

• § 482.12 — Condition: Governing body: the hospital must have a legally responsible governing body; the governing body must appoint the CEO, adopt medical staff bylaws, ensure the medical staff is accountable to it for the quality of care, adopt a conflict-of-interest policy, and set criteria for granting practitioners clinical privileges; the governing body bears ultimate legal and regulatory responsibility for all hospital functions
• § 482.13 — Condition: Patient rights: patients have the right to informed consent, to participate in care planning, to privacy and confidentiality, to access their medical records, and to be free from unnecessary restraints and seclusion; the restraint and seclusion standards (§ 482.13(e)–(f)) are among the most detailed provisions in Part 482 — physical restraint requires physician/licensed practitioner order, must be the least restrictive intervention, and must be discontinued at the earliest possible time; deaths in restraint or seclusion must be reported to CMS within 24 hours
• § 482.15 — Condition: Emergency preparedness: the hospital must develop and maintain a comprehensive emergency preparedness program built around four elements — a risk-based, all-hazards hazard vulnerability analysis; a written emergency plan updated annually; communications plan (including backup systems if primary communications fail); and a training and testing program including an annual full-scale exercise; the hospital must coordinate its plan with community emergency management systems and update it annually
• § 482.21 — Condition: Quality assessment and performance improvement (QAPI): the hospital must develop, implement, and maintain an effective, ongoing, hospital-wide, data-driven QAPI program; the governing body must ensure that the program reflects the complexity of the hospital's organization and services; the program must include measuring, analyzing, and tracking quality indicators including adverse patient events; the QAPI program must identify opportunities for improvement and implement changes that result in improvement
• § 482.22 — Condition: Medical staff: the hospital must have an organized medical staff that operates under bylaws approved by the governing body; the medical staff is responsible for the quality of medical care provided by all practitioners who are granted privileges; the medical staff must conduct peer review and credentialing (verification of education, training, licensure, and competency for each privilege granted); all practitioners must be evaluated at least every 2 years for renewal of privileges; peer review activities are protected from discovery in litigation by state peer review statutes
• § 482.23 — Condition: Nursing services: the hospital must have an organized nursing service providing 24-hour nursing services; a registered nurse must supervise the nursing service and be on duty at all times; nursing services must be provided only by licensed nurses (RNs, LPNs/LVNs) or qualified nursing students under RN supervision; the hospital must have a sufficient number of qualified nurses to care for patients safely
• § 482.24 — Condition: Medical record services: the hospital must maintain a medical record system that meets the needs of the patient, the hospital, and applicable law; medical records must be retained for a minimum of 5 years (longer in many states) or 3 years after a minor reaches majority; records must be completed within 30 days after discharge; records must include authenticated physician orders, consent forms, history and physical, operative reports, nursing notes, and discharge summary; unauthorized alterations are a serious CoP violation
• § 482.25 — Condition: Pharmaceutical services: the hospital must have pharmaceutical services that meet patient needs; a registered pharmacist must be responsible for the pharmaceutical service; a pharmacist must review medication orders before administration — except in emergencies; the pharmacy must maintain accurate drug accountability records; high-alert medications must be managed under special controls; the standard requires drug formulary management and a drug utilization review program
• § 482.42 — Condition: Infection prevention and control, and antibiotic stewardship programs: the hospital must have an infection control officer designated (typically an infection preventionist); the program must include surveillance systems for healthcare-associated infections, implement evidence-based infection control practices, and report HAI data to the CDC's National Healthcare Safety Network (NHSN); the antibiotic stewardship program (added in 2020) must include a multidisciplinary committee, antibiogram data, evidence-based protocols for common infections, and prospective audit with feedback
• § 482.43 — Condition: Discharge planning: the discharge planning process must begin at admission; hospitals must screen all patients for post-discharge needs within 24 hours of admission; the hospital must develop a discharge plan for patients who need one; patients and families must be given a written list of all Medicare-certified providers in their geographic area that can provide needed services — including quality data from CMS databases (this is the "choice list" requirement); the hospital cannot limit the list to preferred or affiliated providers
• § 482.55 — Condition: Emergency services: if the hospital provides emergency services (required for Joint Commission "general hospital" accreditation), the service must be organized under medical staff direction, adequately staffed 24 hours, and equipped with lifesaving equipment; the condition incorporates the EMTALA obligation — any hospital with an emergency department must provide a medical screening exam and stabilizing treatment regardless of ability to pay; EMTALA is separately enforced under 42 U.S.C. § 1395dd but the CoP condition confirms the obligation is a Medicare participation requirement

A hospital that loses Medicare certification faces catastrophic revenue loss — the average hospital derives 45–55% of revenues from Medicare, with some rural hospitals exceeding 70%. CMS terminates participation by issuing a Notice of Termination, with an effective date typically 60–90 days out; during that window, the hospital can achieve compliance and request a resurvey. Immediate Jeopardy findings — where surveyors conclude that noncompliance has caused or is likely to cause serious injury or death — trigger emergency action: the hospital may receive a 2-day notice of termination unless it submits an acceptable plan of immediate correction. The Joint Commission's standards largely mirror Part 482's conditions but may impose additional requirements; hospitals with Joint Commission accreditation are surveyed by JC rather than state agencies unless CMS conducts a "validation survey."

Recent rulemakings: 81 FR 39448 (June 2016) — comprehensive rewrite of Part 482 (patient rights, QAPI, infection control, discharge planning, medical records). 85 FR 54820 (September 2020) — added antibiotic stewardship condition (§ 482.42(b)) and requirements for infection preventionist training and evidence-based infection control protocols. 88 FR 82782 (November 2023) — updated discharge planning condition to add electronic notifications to receiving providers.

Hospital Conditions of Participation (42 CFR Part 482)

The foundation of Medicare hospital participation is 42 CFR Part 482 — Conditions of Participation for Hospitals (46 sections). Every hospital that wants to participate in Medicare and Medicaid must satisfy all applicable CoPs; failure to meet any Condition can result in termination of Medicare participation — cutting off 50–70% of most hospitals' revenue. CMS surveys hospitals against these standards through accreditation organizations (The Joint Commission, DNV GL) or state survey agencies. Part 482's structure mirrors hospital operations:

• § 482.12 — Governing body: the hospital must have a governing body (board of directors/trustees) that is legally responsible for the hospital's operation; the governing body must appoint a CEO, approve the medical staff bylaws, and ensure that licensed practitioners are eligible to practice in the hospital; governing body accountability is the source of hospital board compliance obligations
• § 482.13 — Patient rights: a comprehensive bill of rights, including the right to receive care in a safe setting free from abuse, harassment, and seclusion (§482.13(e)); the right to make informed decisions (including the right to refuse treatment); the right to formulate advance directives; the right to privacy and confidentiality; and specific protections around restraint and seclusion — restraints may only be used when clinically necessary and not for staff convenience, with physician orders, monitoring, and time limits
• § 482.15 — Emergency preparedness: hospitals must have an all-hazards emergency preparedness plan with four components: (1) risk assessment and emergency plan (updated annually); (2) policies and procedures for the types of hazards likely to affect the community; (3) a communication plan for coordinating with local emergency management; (4) training and testing (annual exercises)
• § 482.21 — Quality assessment and performance improvement (QAPI): the hospital must have an ongoing, hospital-wide QAPI program that identifies opportunities for improvement, collects and analyzes data, implements changes, and measures the results; the governing body must approve QAPI activities; the QAPI requirement is the regulatory basis for hospital quality committees, performance improvement programs, and peer review processes
• § 482.22 — Medical staff: the hospital must have an organized medical staff operating under CMS-approved bylaws; the medical staff must be accountable to the governing body; credentialing and privileging — verifying a physician's credentials and granting specific clinical privileges — must follow written procedures; hospitals may grant privileges only to practitioners with appropriate qualifications; the medical staff peer review process (evaluation of practitioner performance) must be protected from antitrust challenge under state peer review statutes
• § 482.23 — Nursing services: the hospital must have an organized nursing service with 24-hour coverage by a registered nurse; staffing must be adequate to meet patient needs; the nursing service must have a director of nursing who is a licensed RN; nursing must document patient assessments and care planning; this is the CoP basis for hospital nurse staffing requirements (separate from any state minimum staffing ratio laws)
• § 482.24 — Medical record services: each patient must have a medical record containing adequate information to identify the patient, support the diagnosis, justify the treatment, document the results, and facilitate continuity of care; records must be retained for at least 5 years (or longer if state law requires); records must be complete within 30 days of discharge; the requirement to maintain records forms the basis for hospitals' e-health record obligations
• § 482.25 — Pharmaceutical services: the hospital must have pharmaceutical services meeting patient needs; a pharmacist must be responsible for developing, supervising, and coordinating pharmaceutical activities; drug formularies must include all drugs used in the hospital; medication reconciliation (checking for interactions and duplications when patients are admitted, transferred, or discharged) must be performed; all medication orders must be reviewed by a pharmacist before administration except in emergencies
• § 482.42 — Infection prevention and control and antibiotic stewardship: the hospital must have a functional infection prevention and control program (IPCP) and a separate antibiotic stewardship program; the IPCP must include surveillance for healthcare-associated infections (HAIs), policies for hand hygiene, isolation precautions, and personal protective equipment; the antibiotic stewardship program (added to Part 482 in 2020) requires hospitals to have policies and leadership support to optimize antibiotic use — reducing antibiotic overuse and resistance
• § 482.43 — Discharge planning: the hospital must have an effective discharge planning process beginning at admission; the hospital must evaluate every patient's discharge needs; evaluate the availability of post-acute care services in the community; provide information about post-acute care options (home health, SNF, rehabilitation) and comparative quality data for options in the area; this is the regulatory basis for mandatory discharge planning that connects hospitalized patients to post-hospital care
• § 482.55 — Emergency services: if the hospital provides emergency services, they must meet specific quality and safety requirements; the emergency department must be supervised by a qualified physician; emergency care must be available 24 hours a day; the section is read together with 42 CFR 489.24 (EMTALA), which governs who must be served and on what basis — Part 482 governs the quality standards for the emergency service itself

Part 482 is enforced through the Conditions of Participation certification process: the Joint Commission and other CMS-approved accreditation organizations conduct periodic surveys; state survey agencies conduct complaint investigations and validation surveys; a deficiency cited at the "Condition level" (rather than the less severe "Standard level") triggers a plan of correction within 90 days before termination proceedings begin. Immediate jeopardy findings (where a deficiency poses immediate serious harm to patients) trigger emergency action — suspension of Medicare participation or imposition of a temporary manager — without waiting for a correction period. Recent rulemakings: 81 FR 63860 (September 2016) — comprehensive Part 482 update adding QAPI, discharge planning, emergency preparedness, and patient rights enhancements; 85 FR 25510 (May 2020) — antibiotic stewardship program requirement added to § 482.42.

The Medicare home health conditions of participation and payment rules live at 42 CFR Part 484 — Home Health Services (47 sections across 6 subparts). Home health agencies (HHAs) serve approximately 9 million Medicare beneficiaries annually, delivering skilled nursing, physical therapy, occupational therapy, speech-language pathology, and home health aide services in patients' residences — at total Medicare expenditures exceeding $18 billion per year. To participate in Medicare, an HHA must meet Part 484's conditions of participation and bill under its prospective payment system:

Conditions of Participation (Subparts A–C):

• § 484.50 — Patient rights: patients must be informed of their rights in writing before care begins; rights include the right to choose among participating Medicare providers, to be informed of services and charges, to refuse treatment, to receive care without discrimination, to be informed of the HHA's complaint process, and to have personal health information protected; HHAs must maintain documentation of rights notices
• § 484.55 — Comprehensive assessment: within 5 days of the start of care, an HHA must conduct and document a comprehensive patient-specific assessment using the OASIS instrument (Outcome and Assessment Information Set) — a standardized CMS data collection tool capturing functional status, diagnoses, medications, clinical conditions, and discharge goals; for Medicare beneficiaries, the OASIS assessment also verifies homebound status (the patient must leave home only with considerable effort); reassessment required within 48–60 hours of return from a hospital stay and at every significant change in condition
• § 484.60 — Care planning: the plan of care must be established and periodically reviewed by a physician or allowed practitioner; must specify diagnoses, types and frequency of services, prognosis, goals, medications, and discharge plans; the HHA's treating nurse or therapist may not initiate services without an established plan
• § 484.65 — Quality assessment and performance improvement (QAPI): HHAs must maintain a data-driven QAPI program that measures clinical outcomes, adverse events, and patient satisfaction; the QAPI program must include performance improvement projects and incorporate OASIS outcome data; the governing body must review QAPI findings at least annually
• § 484.75 — Skilled professional services: physical therapy, occupational therapy, speech-language pathology, and skilled nursing services must be provided by licensed professionals within their scope of practice; medical social services must be furnished by a licensed social worker under physician orders
• § 484.80 — Home health aide qualifications: aides must complete a training and competency evaluation program (minimum 75 hours of training), including hands-on demonstration of specified skills before performing those skills unsupervised; aides may perform only tasks within their competency; a registered nurse must provide a supervisory visit at least every 60 days for each patient receiving home health aide services

Prospective Payment System (Subpart E — §§ 484.200–484.245):

• § 484.205 — Method of payment: CMS pays HHAs a national, standardized 30-day period payment rate under the Patient-Driven Groupings Model (PDGM), which took effect January 1, 2020; PDGM replaced the prior 60-day episode payment with two consecutive 30-day periods per episode and shifted payment from being largely based on therapy visit volume to being based on the patient's clinical condition, functional status, and comorbidities
• § 484.220 — Case-mix and wage adjustment: each 30-day payment is adjusted for the patient's PDGM case-mix group (one of 432 payment groups based on admission source, timing, primary diagnosis, functional impairment level, and comorbidity) and for geographic wage differences using the hospital wage index; agencies serving more complex patients receive higher payments
• § 484.240 — Outlier payments: when an episode's estimated costs substantially exceed the standard payment rate, the HHA receives an outlier payment equal to 80% of the excess above the threshold — protecting agencies that serve unusually high-cost patients from financial losses that could deter access to care
• § 484.245 — Home Health Quality Reporting Program (HH QRP): HHAs must submit quality data (from OASIS and claims) to CMS; failure to report results in a 2 percentage point reduction in the annual payment rate update — a significant financial penalty

Home Health Value-Based Purchasing (Subpart F — §§ 484.300–484.335): Effective January 1, 2023, CMS expanded the HHVBP Model nationally to all Medicare-certified HHAs. Under § 484.310, CMS calculates an annual Total Performance Score for each HHA based on quality measures drawn from OASIS outcomes, claims-based measures, and patient experience surveys (HHCAHPS). Each agency is ranked against its peers and receives a payment adjustment ranging from ±5% for CY2025 (increasing over time); high-performing agencies receive bonuses while low-performing agencies receive reductions. HHVBP creates direct financial incentives for HHAs to improve outcomes including acute care hospitalization rates, emergency department use without hospitalization, and functional improvement in walking, bathing, and medication management.

Recent rulemakings: 85 FR 27628 (June 2020) implemented PDGM effective January 1, 2020 — the most significant home health payment reform in 20 years, eliminating the per-visit therapy visit threshold that had driven overutilization. 86 FR 62422 (November 2021) expanded HHVBP to a mandatory national model and finalized the PDGM case-mix methodology refinements. 82 FR 4578 (January 2017) finalized the updated conditions of participation, including new requirements for QAPI programs, discharge planning, and home health aide supervision.

• 42 CFR Part 486 — Conditions for Coverage of Specialized Services Furnished by Suppliers (34 sections across four subparts — CMS coverage conditions for portable X-ray suppliers and organ procurement organizations (OPOs); distinct from hospital or home health CoPs, these apply to specialized Medicare supplier types):

  Portable X-Ray Suppliers (Subpart B, §§ 486.100–486.110):

  • § 486.102 — Physician supervision: portable X-ray services must be provided only on the order of a physician; the X-ray examination must be performed under physician supervision; the supervising physician is responsible for interpretation; portable X-ray is Medicare-covered only when performed by a Medicare-enrolled supplier meeting all Part 486 conditions
  • § 486.104 — Technician qualifications: portable X-ray technicians must meet state licensure requirements (where applicable) and must have training adequate to safely operate the equipment; technicians must undergo health screening appropriate to their radiation exposure
  • § 486.108 — Radiation safety standards: all portable X-ray examinations must be conducted using techniques and equipment that minimize radiation exposure to patients, technicians, and bystanders; collimation must limit the field to the area under study; shielding must be used for radiosensitive organs where feasible

  Organ Procurement Organizations (OPOs) (Subpart G, §§ 486.301–486.348):

  • § 486.303 — OPO certification requirements: an OPO must be certified by CMS to procure and allocate organs for transplantation; certification requires meeting CMS performance standards and operating a service area designated by CMS; OPOs are the only entities authorized to recover organs from deceased donors in their service area
  • § 486.304 — Designated service areas: CMS designates one OPO per geographic service area — no two OPOs may compete in the same area; the service area includes hospitals within the designated region; OPOs must have organ procurement agreements with all hospitals in their area containing a viable donor pool
  • § 486.306 — Service area size: CMS requires OPOs to document their service area boundaries; area size is balanced between being large enough for operational efficiency (dedicated organ procurement staff, 24/7 response capability) and small enough for the OPO to effectively manage all donor hospitals in the area
  • § 486.318 — Performance standards: CMS evaluates each OPO against national performance benchmarks including donation rate (organs recovered per 100 eligible deaths in the service area) and organ utilization rate; OPOs that fail to meet these thresholds in two consecutive performance periods are decertified — their service area is reassigned to a competitor OPO through a competitive process
  • § 486.322 — Donor management: OPOs must maintain 24/7 capacity to respond to all referrals from hospitals, assess potential donors, coordinate with hospital staff on donor management protocols, and obtain consent from legally authorized representatives; response time standards require OPOs to arrive at the hospital bedside promptly after referral

  OPO performance reform has been one of the most significant CMS regulatory initiatives in organ transplantation. Prior to 2021, OPOs self-reported donation rates using methodology that allowed substantial under-performance to go undetected. CMS's 2020 OPO final rule (85 FR 77898) overhauled the performance measurement methodology using CDC death certificate data as the denominator rather than OPO self-reported eligible deaths — a change that revealed that many OPOs were dramatically underperforming and that an estimated 28,000 additional organs per year could be recovered under best-practice performance. The new standards took effect January 1, 2022, with OPOs evaluated against 2022-2023 data for the first recertification cycle under the new rules.

• 42 CFR Part 476 — Quality Improvement Organization Review (CMS/CMCS, 29 sections — the procedural rules governing how Quality Improvement Organizations (QIOs) conduct Medicare utilization review, investigate beneficiary complaints about care quality, and perform general quality of care reviews; authority: 42 U.S.C. §§ 1302, 1154(a)(1), 1155; companion to Part 480 which governs QIO information confidentiality). QIOs are private physician-led organizations under contract with CMS that serve as Medicare's external quality review mechanism — auditing whether care was medically necessary, appropriate, and provided at the right quality level:

  • § 476.100 — Use of norms and criteria: QIOs must use national (or regional) norms in conducting their reviews — standardized criteria reflecting accepted medical practice for each covered procedure or condition; the norm-based approach ensures that QIO determinations reflect what mainstream physicians would do in comparable situations, not idiosyncratic judgments; QIOs must use criteria developed with substantial physician input and updated to reflect current clinical standards; CMS approves the norms and criteria sets used by each QIO
  • § 476.102 — Involvement of health care practitioners other than physicians: QIOs must involve practitioners with relevant specialization when reviewing care outside general medicine — a cardiologist review panel for cardiac care, an oncologist for chemotherapy appropriateness; the specialization requirement ensures reviews are conducted by clinicians who understand the clinical context, not general reviewers applying formulaic criteria to specialized care
  • § 476.104 — Coordination of activities: QIOs must coordinate their review activities with Medicare Advantage plans, state Medicaid agencies, and other review entities to avoid duplicative review of the same episode of care; the coordination requirement reflects the reality that many Medicare beneficiaries have overlapping coverage, and multiple entities may have overlapping review authority for the same hospitalization
  • § 476.110 — Immediate advocacy for oral beneficiary complaints: when a Medicare beneficiary files an oral complaint about care quality (rather than a formal written complaint), the QIO may offer to resolve the complaint through immediate advocacy — an informal process in which the QIO contacts the provider, explains the beneficiary's concern, and attempts to achieve rapid resolution without triggering the full formal review process; immediate advocacy must be offered within 3 business days of the complaint
  • § 476.120 — Written beneficiary complaints: formal written complaints trigger mandatory QIO review; the QIO must acknowledge receipt and begin review; the complainant and the relevant provider must be notified; the timeframe for completing review is specified in the QIO's contract with CMS; results of written complaint reviews are disclosed to the beneficiary, the provider, and (in cases involving possible violations) to appropriate oversight authorities
  • §§ 476.130–476.140 — Complaint review and reconsideration procedures: the QIO must evaluate all information from the beneficiary, the provider, and any relevant clinical records; the QIO's review is guided by whether the care met professionally recognized standards of health care — the statutory standard from 42 U.S.C. § 1154(a)(1)(A); when the QIO's initial review finds a quality concern, the provider receives an opportunity to submit additional information (the "discussion stage") before a final determination is issued; beneficiaries and providers may request reconsideration of the QIO's initial finding by a higher-level QIO physician reviewer
  • § 476.160 — General quality of care review: in addition to beneficiary-initiated complaint reviews, QIOs may conduct CMS-directed general quality of care reviews — systematic audits of care at specific providers showing statistical outliers in outcomes, readmissions, or complication rates; general reviews may be triggered by CMS referral, statistical anomaly detection, or whistleblower allegations; the general review authority allows QIOs to proactively identify quality problems without waiting for individual patient complaints

  QIOs serve as the primary external quality review mechanism for traditional Medicare — the counterpart to Medicare Advantage plans' internal quality assurance processes. There are currently 14 Beneficiary and Family Centered Care QIOs (BFCC-QIOs) covering all 50 states, D.C., and territories under CMS contract; they handle discharge planning disputes (a Medicare beneficiary's right to appeal a premature hospital discharge in real time), complaint investigations, and quality reviews. The BFCC-QIO system was restructured in 2014 when CMS separated the QIO program into BFCC-QIOs (focused on beneficiary rights and complaint resolution — Part 476) and Quality Innovation Network-QIOs (focused on quality improvement projects — separate contracts). Recent rulemakings: 77 FR 68561 (November 2012) — comprehensive QIO program reform restructuring the BFCC-QIO and QIN-QIO contract structure; 64 FR 66279 (November 1999) — prior major update adding immediate advocacy provisions.

• 42 CFR Part 480 — Acquisition, Protection, and Disclosure of Quality Improvement Organization Information (33 sections — the confidentiality framework governing how QIOs handle medical records, practitioner information, and quality review data obtained in the course of Medicare review activities; authority: Social Security Act §§ 1154(a)(7)(C), 1154(a)(10); the companion to Part 476's procedural rules):

  • § 480.101 — Scope: Part 480 governs all information a QIO acquires or generates in conducting Medicare review — including medical records, practitioner profiles, and analytical data derived from review activities; the confidentiality protections apply regardless of whether the underlying information was already publicly available, because QIO review creates a distinct protected relationship between the QIO and the reviewed party
  • § 480.103 — Statutory bases for disclosure: QIOs may disclose information only for purposes expressly authorized by statute: (1) to the reviewed institution or practitioner; (2) to CMS for oversight; (3) to government agencies for licensing, certification, or criminal enforcement; (4) to appropriate professional review bodies for peer review action; (5) to the public when the disclosure concerns an institution or practitioner that has received a final sanction; (6) for research purposes with patient identifying information removed; unauthorized disclosure outside these categories is prohibited regardless of who requests it
  • § 480.104 — Disclosure procedures: each disclosure must be accompanied by a written notice advising the recipient that the information is confidential under the Social Security Act and that redisclosure is prohibited except in accordance with Part 480; the notice requirement applies even when the disclosure is to another government agency
  • § 480.105 — Notice to practitioners: when a QIO discloses nonconfidential information about a practitioner's care (e.g., discloses a public sanction determination), the QIO must simultaneously notify the practitioner that the disclosure has been made, the basis for it, and the name and address of the recipient; the notice ensures practitioners are aware of adverse information circulating about their practice
  • § 480.106 — Exceptions to notice requirements: the QIO need not provide advance notice when immediate disclosure is required to prevent imminent danger to individuals or to the public health; criminal investigations; or when the practitioner has already been informed through the formal review process; the imminent danger exception is narrow — it applies when a QIO review reveals that a practitioner poses an ongoing risk of patient harm that cannot wait for the normal notice-and-disclosure cycle
  • § 480.107 — Redisclosure limitations: persons or organizations that receive confidential QIO information — including government agencies, professional review bodies, and researchers — may use it only for the specific purpose for which it was disclosed; they may not further disclose it without Part 480 authority; this limitation applies to government agencies as well as private recipients, restricting the normal information-sharing that occurs within government health oversight
  • § 480.108 — Penalties: unauthorized disclosure of confidential QIO information subjects the disclosing person to civil monetary penalties under the Social Security Act; the penalty applies to individuals, not just organizations — a QIO employee who improperly shares review information can be personally liable; sanctions for willful or knowing unauthorized disclosure may be referred to the OIG
  • § 480.111 — QIO access to institutional records: QIOs have statutory authority to access the medical records, financial records, and other pertinent documents of any Medicare-participating institution to carry out review functions; institutions must provide access and cannot require the QIO to pay copying fees; the access right is immediate — QIOs need not follow HIPAA's minimum-necessary standards or business associate agreement requirements when accessing records for Medicare review purposes, because the Social Security Act's grant of access authority supersedes
  • § 480.113 — QIO access to previously collected information: QIOs may access information that has already been collected for QIO purposes — including information compiled by prior QIO contractors, CMS quality databases, and claims data — without re-obtaining individual consents; this provision allows successive QIO contractors to inherit their predecessors' review work product without privacy barrier interruptions

  Part 480's confidentiality framework reflects the tension inherent in Medicare quality review: effective review requires candid information sharing between QIOs, providers, and practitioners, but unlimited disclosure would undermine cooperation and expose patient data. The statute's specific enumerated disclosure categories create a controlled disclosure regime — more permissive than HIPAA (which governs the same records under a different federal authority) but more restrictive than general government records. QIO information confidentiality protections have been litigated in the context of state medical board proceedings and plaintiff attorney discovery requests, where courts have generally upheld the federal statutory bar against redisclosure even in the face of contrary state law.

• 42 CFR Part 456 — Utilization Control (141 sections across 10 subparts — the CMS/CMCS Medicaid regulation requiring hospitals, mental hospitals, intermediate care facilities, and other institutions participating in Medicaid to maintain formal programs to control unnecessary utilization of services; authority: 42 U.S.C. § 1302; implements Social Security Act § 1902(a)(30), which requires state Medicaid plans to include methods and procedures to safeguard against unnecessary utilization of care). Part 456 is the Medicaid-side counterpart to Medicare utilization review requirements — while Medicare uses external QIOs (Part 476), Medicaid relies on internal institutional UR committees as a condition of participation. Key provisions:

  • § 456.101 — Written UR plan required: each hospital providing inpatient services under the state Medicaid plan must have a written utilization review plan providing for review of each beneficiary's need for the services the hospital furnishes; the plan must be current and available for CMS review
  • § 456.105 / 456.106 — UR committee composition: each hospital's UR plan must describe and establish a UR committee of at least two physicians, assisted by other professional personnel; the committee may be a hospital staff committee, a local medical/osteopathic society group, or an approved external body; committee members who are directly responsible for the care of the patient under review — or who have a financial interest in any hospital — are disqualified from participating in that patient's review
  • §§ 456.121–456.129 — Admission review: the UR plan must provide for review of each beneficiary's admission to determine medical necessity; admission reviews must be completed within the standard timeframes specified in the state plan; the UR committee (not individual treating physicians) determines whether the admission was necessary under accepted standards of care
  • §§ 456.131–456.137 — Continued stay review: the UR plan must provide for periodic review of each inpatient's continued need for hospitalization; the attending physician must submit reasons and a plan for continued stay when the UR committee requires it; the UR committee issues a notice of non-certification if continued hospitalization is not approved, triggering the beneficiary's appeal rights; payment stops on the day after the committee's determination that continued stay is not necessary
  • §§ 456.141–456.145 — Medical care evaluation studies: the UR plan must provide for at least one medical care evaluation study per quarter — a systematic review of a pattern of care at the institution (e.g., all appendectomies in a quarter, all diabetic patients' blood glucose management) designed to identify and correct deficiencies in care quality; studies feed back into institutional quality improvement, not individual patient coverage decisions
  • Subpart D — Mental Hospitals (26 sections): mental hospitals have additional requirements — UR plans must address the specific issues of long-term psychiatric hospitalization (particularly for patients with severe mental illness who may require extended stays); the mental hospital UR committee must include a psychiatrist; continued stay review for psychiatric patients requires a treatment plan with goals and estimated duration
  • Subpart F — Intermediate Care Facilities (24 sections): ICFs (facilities providing nursing care below the SNF level for individuals not requiring hospital-level care but needing supervision) must have UR plans addressing the appropriateness of the ICF level of care; regular reviews assess whether each resident still requires ICF-level services or could be cared for in a less intensive (and less costly) setting — the "most integrated setting" principle embodied in Olmstead applies here
  • Subpart K — Drug Use Review (DUR) Program (12 sections): states must establish outpatient drug use review programs — both prospective (pharmacist point-of-sale review before dispensing) and retrospective (electronic review of pharmacy claims to detect patterns of unnecessary prescribing, drug-drug interactions, or therapeutic duplication); the DUR program must include educational interventions for prescribers and pharmacists when problematic patterns are identified; the DUR Board's composition (including pharmacists, physicians, and consumer representatives) and operating procedures are specified
  • Subpart J — Penalties (8 sections): states that fail to make a satisfactory showing of an effective institutional utilization control program face a 10% reduction in federal Medicaid matching funds for long-stay inpatient services; CMS may reduce the federal medical assistance percentage (FMAP) for a quarter in which the state cannot demonstrate effective UR; the penalty mechanism is the primary lever for federal enforcement of UR requirements

  Part 456 creates the structural framework for Medicaid cost containment at the institutional level: hospitals and facilities cannot bill Medicaid for services that their own UR committees have determined to be unnecessary. For states, maintaining effective UR programs is both a Medicaid plan requirement and a defense against the federal FMAP penalty. For hospitals, the UR committee is an internal quality function that must be documented and operational — not just a formality. Recent rulemakings: 61 FR 38399 (July 1996) updated several subparts; 85 FR 87104 (December 2020) made technical amendments. Most substantive requirements date to the late 1970s original rulemaking (43 FR 45266, October 1978) and have remained stable.

• 42 CFR Part 480 — Acquisition, Protection, and Disclosure of Quality Improvement Organization (QIO) Information (the CMS rule governing confidentiality of clinical records and information collected by QIOs — the Medicare contractors that review quality of care and investigate beneficiary complaints at hospitals, nursing homes, home health agencies, and other providers; authority: 42 U.S.C. §§ 1302, 1154(a), 1155):

  • § 480.101 — Scope and definitions: Part 480 applies to all information "obtained by a QIO in the exercise of its duties" — including patient medical records, physician and hospital documentation, QIO's own analyses and findings, and testimony from practitioners; this information is categorized as either "deliberative" (the QIO's own analysis, findings, and recommendations — strictly protected) or "factual" (objective clinical information such as dates of service, diagnosis codes, procedure codes, and test results — less protected); the distinction determines how soon the QIO must notify the provider before disclosure and what disclosure channels are available
  • § 480.104 — Procedures for QIO disclosure: QIOs may disclose information in defined circumstances — to federal and state health programs for program integrity purposes, to law enforcement for healthcare fraud investigations, to accreditation organizations, and to the public in statistical or aggregate form that cannot identify individual patients or providers; all disclosures require advance written notice to the affected practitioner or provider under § 480.105 (the "notice before disclosure" requirement)
  • § 480.105 — Notice before disclosure: at least 30 days before disclosing non-confidential information, the QIO must notify the affected provider of the planned disclosure; for imminent public health dangers (§ 480.106), the notice requirement is waived — the QIO may disclose immediately and notify the provider simultaneously or promptly after; the 30-day notice period allows providers to seek administrative review of proposed disclosures they believe are incorrect or improperly classified
  • § 480.107 — Confidential QIO information: "deliberative" QIO information — the QIO's internal analysis, preliminary findings, draft reports, and recommendations during an active quality review — cannot be disclosed to anyone outside the CMS/QIO network except in specific circumstances; providers may not obtain a copy of the QIO's preliminary analysis of their own care during an active review; final QIO determinations (whether a hospital admission was necessary, whether care met professionally recognized standards) are disclosable to the affected provider and to the patient or authorized representative
  • § 480.120 — Sanctions for unauthorized disclosure: a QIO employee or contractor who improperly discloses confidential QIO information is subject to civil monetary penalties and possible exclusion from Medicare; the disclosure prohibition runs to QIO staff personally, not just the organization — creating individual accountability for information security breaches

  QIOs are private entities (typically physician review organizations, quality improvement nonprofits, or university-affiliated organizations) operating under contracts with CMS to serve defined geographic jurisdictions. There are currently 14 QIO contracts covering all 50 states, the District of Columbia, and U.S. territories. QIOs review hospital and other provider quality on CMS referral, investigate Medicare beneficiary complaints, and support CMS quality improvement initiatives (the Hospital Improvement Innovation Networks, nursing home quality improvement projects, etc.). The Part 480 confidentiality framework is what allows providers to participate in QIO review processes without fear that preliminary quality concerns will be disclosed publicly before the review is complete — a balance between QIO transparency and provider due process that has been calibrated over decades of Medicare quality oversight experience.

Recent Rulemakings

• Rural Emergency Hospital conditions finalized (88 FR 82183, November 2023): CMS finalized the Conditions of Participation for the new Rural Emergency Hospital provider type, effective January 1, 2024. The final rule established the staffing standards, emergency department requirements, QAPI provisions, and the requirement for transfer agreements with inpatient hospitals. CMS simultaneously finalized the enhanced payment rates for REHs under the Medicare outpatient prospective payment system.
• CAH flexible staffing clarification (73 FR 69941, November 2008): Updated CAH staffing and telemedicine provisions to clarify the conditions under which remote physician supervision (via telemedicine) satisfies CAH staffing requirements — important for facilities in medically underserved areas where in-person physician coverage is difficult to maintain around the clock.

Recent Developments

• Rural Emergency Hospital (REH) provider type launch (2024): CMS finalized Conditions of Participation for Rural Emergency Hospitals effective January 1, 2024 (88 FR 82183). REHs allow former Critical Access Hospitals and small rural hospitals that can no longer sustain inpatient services to convert to emergency-only status while retaining Medicare certification and receiving enhanced outpatient payment rates. Early REH conversions have been concentrated in the Midwest and South, where small rural hospitals have faced the greatest financial pressure.
• FQHC telehealth and virtual care expansion: Federally Qualified Health Centers received permanent telehealth flexibilities following the COVID-19 pandemic's temporary expansions. CMS expanded FQHCs' ability to provide mental health and substance use disorder services via telehealth — addressing a critical gap in rural and underserved community care — and updated the conditions of participation to reflect virtual care delivery modalities.
• CAH 96-hour physician certification: The 96-hour condition — requiring physicians to certify that CAH inpatients will be discharged or transferred within 96 hours — remains a source of compliance difficulty and Medicare payment disputes. OIG has flagged CAH inpatient stays exceeding 96 hours as a recurring audit finding. CMS has clarified that the condition requires a physician's reasonable expectation at admission, not a guarantee, but enforcement remains inconsistent.
• PACE enrollment growth: Programs of All-Inclusive Care for the Elderly (PACE) have expanded to serve more frail elderly beneficiaries as states and CMS have prioritized managed community-based care over nursing home placement. New PACE organization applications increased after CMS streamlined application processes. PACE organizations face Conditions of Participation requirements under 42 CFR Part 460 that are distinct from the specialized provider conditions under Parts 485–491.
• Hospice survey and integrity initiative: CMS launched a hospice survey and integrity initiative following OIG reports finding widespread fraud in for-profit hospices — particularly inappropriate enrollment of patients who do not meet the six-month terminal prognosis requirement, and billing for patients never seen by hospice staff. CMS increased survey frequency for high-risk hospice providers and tightened Conditions of Participation enforcement. Congress has considered legislation to further restrict hospice benefit access and enhance fraud penalties.

Pending Action

CMS continues processing new Rural Emergency Hospital (REH) applications as small rural hospitals evaluate the conversion option. Watch for CMS proposed rulemaking updating REH Conditions of Participation as early operational experience reveals ambiguities in the 2024 rule. The hospice integrity initiative — driven by OIG findings of widespread fraud in for-profit hospices — may produce a proposed rule strengthening hospice admission and recertification requirements; CMS has flagged hospice CoP revision as a regulatory agenda priority. Critical Access Hospital CoP clarification on the 96-hour certification requirement is a perennial legislative request; standalone legislation or a CMS interpretive rule clarifying physician certification standards could reduce audit exposure for rural CAH operators.