# CMS conditions of participation: the license to operate
A hospital in the United States can pass every accreditation review, employ brilliant surgeons, and still be shut down within weeks if it loses one thing: its Medicare certification. In 2017, a Florida nursing facility lost certification after a post-hurricane deaths investigation, cutting off federal payments and forcing closure. For a hospital, Medicare and Medicaid revenue often represents 40 to 60 percent of the payer mix (varies by facility). Losing it is not a fine. It is an extinction event.
That leverage flows from the Conditions of Participation (CoPs): the federal rules a hospital must satisfy to bill Medicare and Medicaid. This lesson dissects what they require and how they get enforced.
CMS (Centers for Medicare and Medicaid Services) is the federal agency inside the Department of Health and Human Services that runs Medicare and Medicaid. CMS does not directly license hospitals (states do that), but it controls who gets paid with federal dollars.
To bill CMS, a hospital must meet the CoPs, published in the Code of Federal Regulations at 42 CFR Part 482. You can read the current text at the eCFR site, which is free and authoritative.
Two paths prove compliance:
Either way, CMS retains authority to send in surveyors at any time.
The CoPs span roughly two dozen standards. Three carry the heaviest compliance weight in practice: patient rights, governance, and infection control.
This is the condition surveyors cite most often. Concrete requirements include:
Example: a surveyor observes a patient in wrist restraints. They pull the chart. No physician order within the required window, no documented reassessment. That is a citation, potentially at the "condition-level" (the most serious tier).
The CoPs require an identifiable governing body (usually the board) that is legally responsible for the hospital. Ambiguity here is not tolerated.
The board must:
Surveyors test this by asking for board meeting minutes. If quality data (infection rates, mortality reviews) never reaches the board, that gap alone is a finding. The board cannot claim it did not know.
Since a 2019 rule update, hospitals must have an infection prevention program and an antibiotic stewardship program, both led by qualified individuals with authority and adequate resources.
Requirements in practice:
Example: during a walkthrough, a surveyor sees a nurse skip hand hygiene between patients, then finds the hospital has no functioning monitoring of hand hygiene compliance. That connects a single observation to a systemic failure, which is what elevates a citation.
CMS surveys are unannounced. No advance warning, no chance to stage the units.
A typical hospital survey flow:
1. Entrance: surveyors arrive, present credentials, and brief leadership.
2. Tracer methodology: they pick real patients and "trace" their entire experience, from admission through medication, procedures, and discharge, cross-checking records against what they observe. TJC popularized this, and CMS surveyors use similar logic.
3. Observation and interviews: they watch care, interview staff at random, and ask patients directly.
4. Document review: policies, credentialing files, board minutes, infection data.
5. Exit conference: preliminary findings are shared.
🎬 [VIDEO: "How a Joint Commission Survey Works" - youtube.com - a plain-language walkthrough of tracer methodology and what surveyors look for on the floor]
Findings are documented on Form CMS-2567, the statement of deficiencies. Severity matters enormously:
The worst category is Immediate Jeopardy (IJ): a situation where noncompliance has caused or is likely to cause serious injury or death. IJ triggers the fastest and harshest response. The hospital typically has a very short window (often days) to remove the jeopardy or face termination of its Medicare agreement.
Example: a psychiatric unit with a ligature risk (a fixture a patient could use to self-harm) and a recent attempt can draw an IJ finding on the spot.
If a hospital falls out of compliance, CMS does not go straight to closure. There is a sequence:
If the hospital corrects in time, termination is rescinded. If not, the Medicare provider agreement ends. Once federal payments stop, most hospitals cannot survive the revenue loss, which is why the CoPs function as a de facto license to operate.
Note also EMTALA (the Emergency Medical Treatment and Labor Act), which requires Medicare-participating hospitals with emergency departments to screen and stabilize anyone regardless of ability to pay. EMTALA is enforced alongside the CoPs, and violations carry their own penalties plus certification risk. It is a separate law but part of the same compliance universe.
Knowledge check
1. Why is losing Medicare certification described as an 'extinction event' rather than merely a costly penalty for a hospital?
2. A hospital passes a Joint Commission accreditation review and receives deemed status. What does this mean about its relationship to the CoPs?
3. Why does CMS have such powerful leverage over hospitals even though it does not license them?
4. Select ALL correct answers about how a hospital can demonstrate compliance with the CoPs.
Select all the correct answers.
5. Select ALL correct answers about the structure and enforcement of the Conditions of Participation.
Select all the correct answers.
Understanding the CoPs explains a lot of otherwise puzzling hospital behavior.
Why documentation is obsessive. If a treatment happened but was not documented, to a surveyor it did not happen. The restraint order, the consent discussion, the infection surveillance log: all must exist on paper or in the electronic health record.
Why boards sit through quality dashboards. Governance liability under 482.12 means directors cannot delegate away accountability. Quality data reaching the board is a compliance artifact, not just good practice.
Why hospitals invest in survey readiness year-round. Because surveys are unannounced, "readiness" cannot be a project before a known date. Many hospitals run mock surveys and daily safety huddles specifically to stay CoP-ready.
Why one observation can cascade. Surveyors connect a single frontline lapse to a systemic gap. A missed hand hygiene moment becomes a condition-level infection control finding if the monitoring system is absent. This is why leadership cares about systems, not just individual behavior.
The CoPs are a United States construct tied to Medicare. There is no direct European equivalent because health systems there are largely public. In England, for example, the Care Quality Commission (CQC) inspects and rates providers, and can force closure of unsafe services. The mechanism differs (public regulator versus payment-linked federal rules), but the underlying logic (an external body enforces minimum standards through inspection) is similar.