AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor hospital compliance, quality and accreditation leads who keep emergency preparedness, QAPI and patient rights documentation ready for an unannounced survey.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Hospitals participating in Medicare and Medicaid must meet Part 482; other provider types meet their own parts, such as Part 483 for long-term care facilities.
State survey agencies on behalf of CMS, or a CMS-approved accrediting organization for deemed hospitals, using State Operations Manual guidance such as Appendix Z for emergency preparedness
Unannounced surveys; accrediting organizations resurvey deemed hospitals no later than 36 months after the prior accreditation date; emergency plan, policies and training reviewed at least every two years
42 CFR Part 482, last amended January 13, 2025 (90 FR 2636); eCFR current to October 15, 2026, 2025-01-13. Free to read.
| Date | What happens | Status |
|---|---|---|
| 2025-07-01 | Hospital transfer protocol and emergency services readiness standards take effect | Done |
| 2026-01-01 | Obstetrical services organization, staffing and delivery of care standards take effect | Done |
| 2026-03-27 | CMS issues surveyor guidance on the obstetrical services conditions (QSO-26-07) | Done |
| 2026-06-16 | CMS publishes the accrediting organization oversight final rule (CMS-3367-FC) | Done |
| 2027-01-01 | Obstetrical staff training policies and maternal health QAPI requirements take effect | Scheduled |
| 2027-06-16 | Accrediting organization oversight rule takes effect, one year after publication | Scheduled |
Each one needs an owner, an approval, and proof it reached the people it covers.
42 CFR 482.15(a)-(c)
An all-hazards emergency plan based on a documented risk assessment, with policies and procedures and a communication plan, each reviewed and updated at least every two years.
42 CFR 482.15(d)
Initial training for staff, contractors and volunteers, refresher training at least every two years and after significant policy updates, documented, plus two exercises each year.
42 CFR 482.21
An ongoing, hospital-wide, data-driven QAPI program whose data frequency and detail the governing body specifies, with evidence of the program maintained for CMS review.
42 CFR 482.13(a)(2)
A grievance process approved by the governing body, with a clear submission procedure, time frames for review and response, and written notice of each decision to the patient.
42 CFR 482.43(c)
Since July 1, 2025, written policies and procedures for transferring patients to the appropriate level of care, with annual training for relevant staff on those policies.
42 CFR 483.85(c)-(e)
Nursing facility operators keep written compliance and ethics standards, policies and procedures, review the program annually, and with five or more facilities run mandatory annual training.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
Appendix Z directs surveyors to ask to see the written emergency plan and program documentation, check training records, and review the most recent two years of exercise documentation for inpatient providers, including after-action reports.
The hospital must maintain and demonstrate evidence of its QAPI program for CMS review, covering the indicators tracked, the data frequency the governing body set, and improvement activity.
Expect review of the governing body's approval of the grievance process or its written delegation to a committee, the time frames the process sets, and written decision notices sent to patients.
Where standards add training, such as annual transfer policy training since July 1, 2025 or obstetrical staff training from January 1, 2027, expect requests for completion records by role.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of CMS Conditions of Participation? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
For hospitals, the emergency plan, policies and procedures, communication plan, and training and testing program are each reviewed and updated at least every two years. Training is also required after significant policy updates, and exercises run twice a year.
Appendix Z encourages keeping documentation and the written program for at least two years for inpatient providers and four years for outpatient providers. That matches how far back surveyors look at exercise records.
From January 1, 2027, hospitals offering obstetrical services must have policies and procedures to train relevant staff on maternal care topics, informed by QAPI findings. Their QAPI programs must also add maternal health activities.
Deemed hospitals are surveyed by a CMS-approved accrediting organization whose standards must meet or exceed the Medicare conditions. The June 2026 oversight rule, effective in June 2027, requires accrediting organizations to adopt the CMS standards language and comparable survey processes.
42 CFR 483.85 requires long-term care facility operators to have had a compliance and ethics program in operation since November 28, 2019. Part 482 for hospitals contains no parallel compliance and ethics program condition.
free for 30 days