How to Build and Audit a Nursing Home Compliance Program

A nursing home compliance program turns regulatory duties into repeatable controls for daily work. For owners and administrators, it helps verify that written policy matches what happens on the floor and in facility records.

• Federal baseline: Medicare- or Medicaid-certified facilities must maintain a program under 42 CFR §483.85.

• State duties: Licensing and Medicaid-provider rules can add separate requirements.

• OIG framework: OIG guidance is voluntary and nonbinding, but it provides a practical model for operating the program.

What is a nursing home compliance program?

A nursing home compliance program is a documented system of controls that detects and corrects violations of applicable federal and state rules in daily operations.

What the controls test

• Whether written policies match the records and decisions used in daily care and operations.

• Whether a reported concern has an investigation and documented resolution when practice departs from policy.

Compliance and quality

• Compliance controls test whether care, payment, and operating practices follow governing rules.

• Quality assurance tests clinical performance against care goals. The programs can share evidence, but neither replaces the other.

Who is required to have one?

Each Medicare- or Medicaid-certified long-term care facility must operate an effective compliance and ethics program under 42 CFR §483.85.

Organizations operating five or more facilities have additional duties under §483.85(d). These include mandatory annual training, a designated compliance officer with direct governing-body access and reporting independence, and a compliance liaison at each facility.

Federal and state applicability should be assessed separately:

Section 483.85 sets the mandatory minimum. OIG guidance helps facilities identify risks and organize their program around those requirements.

State applicability is less uniform. Review licensing, Medicaid-provider, and payer rules for every state where the organization operates.

Private-pay homes outside Medicare and Medicaid certification may fall outside §483.85, but state licensure or payer rules can still apply. Confirm scope with the relevant state agency or qualified counsel.

Build the program around facility risks

Start by assigning responsibility for the program and identifying the risks in the facility's actual work. The result should be a work plan with named owners, resources and review dates.

Use this sequence to turn the requirements into that plan:

1. Confirm the federal, state and payer requirements that apply to each facility. Record who will track changes to them.

2. Assign a high-level program lead with authority, resources and access to the governing body. Add the officer and facility liaisons required for larger organizations.

3. Review incident logs, survey findings, staff concerns, staffing records and billing corrections. Identify where an existing safeguard failed or a required safeguard is missing.

4. Create a risk register, a working list of risks, priorities, owners and actions. Rank risks by resident impact, legal exposure and likelihood of recurrence.

5. Translate priority risks into policies, training, reporting routes and audit checks. Name who performs each control and what record demonstrates it happened.

6. Set review dates and a reporting schedule for oversight. Keep immediate incident reporting separate from scheduled program reviews.

The 7 core elements of an effective program

OIG's General Compliance Program Guidance describes seven linked elements: policies, oversight, training, reporting, auditing, enforcement, and corrective action. Its nursing facility guidance applies that framework to care, payment and business risks in nursing facilities.

• Written policies and standards of conduct.

• Compliance leadership and oversight.

• Training and education.

• Reporting channels and non-retaliation.

• Monitoring and auditing.

• Consistent enforcement.

• Response and corrective action.

Reporting channels bring concerns to the program, while monitoring and auditing test daily practice. Consistent enforcement and corrective action address both individual conduct and the conditions that allowed a violation.

Written policies and standards of conduct

Auditors compare the approved policy with the records staff created during real incidents. The policy must give staff a clear next action and escalation route.

Each policy record should name its owner, approval date, effective date, current version, and retraining trigger. Sample operating records after rollout to confirm staff stopped using the retired workflow.

• Quality of care: Set requirements for assessment, care planning, fall management, and timely escalation when a resident’s condition changes.

• Abuse and neglect policies must cover recognition, resident protection, investigation and both reporting routes under 42 CFR §483.12.

• Data integrity: Control who enters, reviews, corrects, and submits required facility data.

• Conduct and referrals: Set boundaries for gifts, conflicts of interest, vendor relationships, and compensation connected to referrals.

• Staff screening must cover applicable background, registry and licence checks, plus federal exclusion screening for relevant employees and contractors.

Under §483.85(c)(4), use due diligence before delegating substantial discretionary authority. Keep screening results and follow-up decisions, including relevant OIG exclusion checks.

Review the compliance and ethics program at least annually, as required by 42 CFR § 483.85. Record which policies changed, who approved them, and when staff must be retrained.

Reopen a policy sooner after a regulatory or payment change. Do the same when an audit, incident, or workflow change exposes a gap.

Compliance officer and oversight structure

Every facility needs high-level oversight, adequate resources, a reporting contact, and an anonymous reporting route. Organizations operating five or more facilities must designate a compliance officer who reports directly to the governing body.

• Maintain the risk register: Rank open risks by resident impact, legal exposure, and likelihood of recurrence.

• Triage concerns: Route reports to the right reviewer while protecting confidentiality and checking for retaliation.

• Track the work plan: Follow policy reviews, training gaps, audits, investigations, and corrective actions to closure.

• Advise operations: Help clinical, billing, human resources, and contracting leads apply requirements to daily decisions.

For organizations operating five or more facilities, compliance must be a major responsibility of the designated officer. The officer reports directly to the governing body and cannot be subordinate to the general counsel, CFO or COO.

A designated compliance liaison must be located at each facility under §483.85(d). Smaller organizations must still give their high-level program lead sufficient resources and authority to oversee the program.

Test the escalation route before a crisis. The responsible leader should be able to place an unresolved issue before oversight without approval from the department under review.

Use scheduled reports for three purposes:

• Show risk trends and overdue actions.

• Record decisions about owners and resources.

• Escalate immediately: Do not hold §483.12 reports for a scheduled committee meeting. Apply the facility-allegation and covered-individual crime-reporting routes separately.

Ongoing staff training and education

Build compliance training around the decisions each role makes during care and business operations. Repeat it often enough to cover policy changes and risks identified through incidents or audits.

Organizations operating five or more facilities must provide mandatory annual compliance training under §483.85(d)(1). Every facility must communicate program requirements to staff, contracted service providers and volunteers, consistent with their roles.

Tailor training to the decisions each group makes:

• Direct-care staff should practise resident protection and both §483.12 reporting routes, including each route's trigger, recipients and deadline.

• Assessment and clinical teams need training in care planning, condition changes, service documentation and the Minimum Data Set (MDS), the standardized resident assessment.

• Billing staff need training in coding, claims and the Patient Driven Payment Model (PDPM), which uses assessment data to classify residents for Medicare Part A SNF payment.

• Leaders and contracting staff: Gifts, conflicts, referral arrangements, and vendor due diligence.

• Compliance and governing-body members: Oversight duties, risk assessment, investigation boundaries, and corrective-action follow-through.

Keep the role, policy version, training date, trainer, attendance record, and competency result. Map retraining to the risk register or relevant F-tags, the identifiers surveyors use for specific federal requirements and deficiencies.

1. Define the required competency for each high-risk role.

2. Compare that standard with audit results, incident findings, and reporting trends.

3. Collect feedback from current and exiting staff about unclear or unworkable procedures.

4. Retrain the affected roles, reassess competency, and revise the policy when the process itself caused the gap.

Reporting channels, monitoring and internal audits

Every concern needs a traceable route from intake to review and closure. Monitoring and internal audits test whether daily safeguards hold before a gap becomes a survey finding or liability risk.

Set the cadence and independence for each control. The compliance officer should receive results directly and track exceptions through correction.

A reporting channel needs an assigned reviewer, due date, investigation record, and closure decision. Without them, the facility cannot show that it acted on a known concern.

• Offer two routes: Maintain a confidential hotline or web form plus direct access to compliance.

• Protect reporters: Prohibit retaliation, limit identity disclosure, and check for adverse treatment after a report.

• Monitor routine controls: Review recurring indicators tied to care, billing, staffing, and referral risks.

• Audit independently: Sample higher-risk work outside the team that performed or approved it.

• Close the loop: Document each concern from intake through resolution, with an assigned reviewer and due date; update the reporter when contact will not compromise confidentiality or the investigation.

Report allegations and suspected crimes

Under §483.12(c)(1), facilities must immediately report allegations of abuse, neglect, exploitation, mistreatment, injuries of unknown source and misappropriation of resident property.

Reports go to the administrator and officials required by state law, including the State Survey Agency and adult protective services where it has jurisdiction. The maximum reporting time depends on the allegation:

• Report no later than 2 hours after the allegation is made when it involves abuse or results in serious bodily injury.

• Report no later than 24 hours after the allegation is made when it involves neither abuse nor serious bodily injury.

Protect residents from further potential harm while investigating. Under §483.12(c)(4), report investigation results within 5 working days of the incident to the administrator or designee and other required officials, including the State Survey Agency.

The separate suspected-crime rule applies to covered individuals in federally funded long-term care facilities. Reasonable suspicion of a crime against a resident or person receiving care triggers reporting to the State Agency and local law enforcement.

That individual's clock starts when they form the suspicion:

• Report immediately, no later than 2 hours after forming the suspicion, when the events result in serious bodily injury.

• Report no later than 24 hours after forming the suspicion when the events do not result in serious bodily injury.

An internal report does not replace the individual's external crime-reporting duty. Both routes can apply to the same incident, so training must make clear who reports through each route.

Audit whether controls work

Monitoring checks recurring indicators, such as overdue investigations. An internal audit examines selected records to establish whether the underlying control worked, including who acted, when and whether the requirement was met.

• Use this sequence for each risk-based internal audit:

1. Name the risk and exact requirement being tested. For allegation reporting, test whether the trigger, recipients and deadline were applied correctly.

2. Define the period and records to review. Include original allegations, incident logs, notification records and investigation results where they bear on the requirement.

3. Select samples across relevant shifts, departments or facilities. Record why you chose them and use a reviewer independent of the work being tested.

4. Trace each sample from the original event to the action taken. Compare the evidence with the requirement and record missing or conflicting information.

5. Document each finding, its resident or payment impact, and the control that failed. Assign a corrective-action owner and due date.

6. Retest the changed control using subsequent records. Close the finding only when the evidence shows the correction works, and escalate unresolved risks to oversight.

Keep a working audit record with the fields below. They link the finding to the person responsible and the evidence needed to close it.

For example, an audit of an abuse allegation should compare when the allegation was made with when each required recipient was notified. The investigation-result deadline needs its own check.

Consistent enforcement, response and corrective action

A proper investigation protects residents first, establishes the facts, and tests the control that failed. Corrective action then changes the conditions that allowed the failure.

The common mistake is stopping at the employee's conduct. A root-cause review must test whether staffing, supervision, or the workflow exposed other residents to the same risk.

1. Define the allegation, scope, and decision-maker for the investigation.

2. Secure relevant information and interview involved people separately.

3. Identify contributing gaps in staffing, supervision, workflow, or training.

4. Assign an owner and due date, then correct the system condition and individual conduct.

5. Test the revised control in the same ward, shift, or workflow.

6. Revise the policy, process, staffing plan, contract, or training that allowed recurrence.

7. Apply discipline consistently by role and conduct, while recognizing prompt reporting or prevention.

8. Close the action only after verification. Reopen it if the revised control still fails.

OIG's current focus areas for fraud and abuse risk

OIG's voluntary nursing facility guidance treats clinical care and financial relationships as connected fraud-and-abuse risks. Use its categories to focus internal review alongside mandatory federal and state requirements.

Start with the resident record and claim, then inspect contracts around referrals. The OIG nursing facility guidance identifies four focus areas:

• Quality of care and life: Compare care plans with clinical records and delivered care.

• Billing and reimbursement: Match MDS and clinical support to the submitted claim.

• Anti-Kickback Statute: Compare compensation, documented duties, approvals, and referral patterns.

• Other risks include related-party transactions, physician self-referral law, anti-supplementation, HIPAA privacy and security rules, and civil rights. Anti-supplementation rules restrict extra charges for services Medicaid already covers. Include these areas in the risk register when they apply to the facility's payment, contracting or resident-care practices.

Billing accuracy and anti-kickback arrangements

Hold a claim when the clinical record does not support it. The common failure is correcting one field without tracing whether the MDS, claim, and source notes now agree.

A common mismatch has three parts:

• An MDS that supports a lower PDPM classification

• A progress note that does not support the higher level

• A submitted claim using the higher classification

Resolve the conflicting source record, update every affected document, and retain the correction trail before releasing the claim.

1. Confirm that the assessment and MDS support the PDPM classification. A classification without matching documentation is a billing exposure.

2. Match the billed service and level of care to the clinical record. A service absent from the record is a billing exposure.

3. Check separately billed Part B services against other payments. Billing the same service twice creates duplicate-payment risk.

4. Verify the qualifying hospital stay and coverage prerequisites before Medicare billing. Missing eligibility support puts the claim at risk.

5. Reconcile claims with external provider records when another organization delivered the service. A mismatch can leave the facility unable to support payment.

Referral risk can hide in ordinary contract language. Pause an arrangement when compensation lacks documented duties or varies with admissions, then review the federal fraud-and-abuse rules.

• Medical directors and referral sources: Paying a medical director without duty logs or fair-market support can create Anti-Kickback Statute exposure, especially if the fee rises with admissions.

• Hospice and ancillary providers: Free staff support conditioned on resident access or referrals can be remuneration, even when the contract describes a service relationship.

• Joint ventures and related parties: Undisclosed shared ownership or payments without arm's-length support can obscure whether referrals affected the deal.

• Gifts and free services: A vendor gift or free service that influences a referral or purchasing decision can create liability for the facility and the recipient.

Linking compliance to resident safety and quality of care

OIG nursing facility guidance treats quality of care and quality of life as a core compliance risk area, not a separate clinical silo.

False Claims Act scrutiny may arise when claims state that required services were delivered while care records repeatedly show gaps. Governing bodies should treat those gaps as a fraud-prevention issue, not only a clinical one.

• Board oversight: Coordinate compliance with quality assurance and performance improvement work.

• Care decisions: When financial and care decisions conflict, give resident safety and quality priority.

Using early-warning tools like Stop and Watch

Stop and Watch is a structured frontline checklist for recording early resident changes and escalating them before harm or a reportable failure.

Record the observed change, time, resident baseline, person notified, and response. Link the entry to the care-plan review or follow-up action it triggered.

Near-miss records need their own review. Unassisted standing or a loss of balance can reveal when supervision or the care plan needs correction before an injury occurs.

What happens when facilities fall out of compliance?

Facilities that fall out of compliance can face CMS certification or payment remedies, separate state licensing action, and fraud or overpayment enforcement when the relevant legal elements are met.

Enforcement can follow three separate routes:

• CMS remedies include civil money penalties, denial of payment for new admissions, temporary management, directed correction and termination of the provider agreement.

• State licensing: Correction orders, licence restrictions, suspension, or closure under state law.

• Fraud and overpayment: Depending on the facts, consequences can include:

  • repayment or civil monetary penalties

  • False Claims Act liability or federal program exclusion

  • criminal prosecution when the required criminal elements are present

• Correct the process that permitted the incident. Report alleged violations under §483.12, return identified overpayments under applicable law, and use OIG self-disclosure only when its criteria apply.

Where daily operations make or break compliance

Daily operations make or break compliance when the record no longer matches the care delivered. A rota proves the plan; an audit asks what actually happened.

If an overnight review finds complete end-of-shift notes but no timestamps for a resident check or response, reviewers must reconstruct the sequence. They need that sequence to investigate whether care was missed or delayed.

• Visits and rounds: Missing or copied-forward entries leave the facility unable to prove who checked a resident, when, or for how long.

• Alerts: A late acknowledgement or missing arrival time can make a delayed response impossible to investigate or defend.

• Incident follow-up: A record that names no revised care step or review cannot show that the facility addressed the cause.

• Record corrections: A staffing or billing correction should identify who made it, what entry changed, and why. Without that audit trail, an unexplained change can appear to be an alteration rather than a correction.

A usable evidence trail links the event time, resident, staff response, correction, owner, and verification result. Regular billing and Requirements of Participation audits should compare that trail with reported care.

A visit timestamp helps establish that a visit occurred and how long it lasted. The care record must still show what staff did, observed and escalated during that visit.

Turn daily monitoring into records your compliance team can review

Guardian records visit arrival, duration, response time, alerts, resident identity, and room-level location as work happens. Camera-free bed and room sensors add activity records without video.

Managers can review visit timestamps and response records in Guardian Insight alongside the facility's care and investigation records. The compliance team assigns corrective-action owners and tracks corrections through its own process.

Guardian supplies operational records for review. The facility remains responsible for investigating concerns, assessing compliance and verifying corrective action.