For Medicare-participating skilled nursing facilities and Medicaid-participating nursing facilities, 42 CFR 483.85 requires the operating organization to run a compliance and ethics program reasonably designed, implemented and enforced to prevent and detect criminal, civil and administrative violations under the Social Security Act and promote quality of care. Organizations operating five or more such facilities have additional duties. Integral Healthcare Solutions (IHS) drafts program documents, reporting procedures, training plans and annual review tools for the operator to implement.
Last reviewed: November 5, 2026. We checked 42 CFR 483.85 against the current eCFR that day; the section was last amended in 2017 (82 FR 32259).
What is the nursing facility compliance and ethics program requirement?
Section 483.85(b) states that "Beginning November 28, 2019, the operating organization for each facility must have in operation a compliance and ethics program (as defined in paragraph (a) of this section) that meets the requirements of this section" (42 CFR 483.85). The requirement sits on the operating organization, which paragraph (a) defines as the individual or entity that operates a facility, not only on each building.
Sources: 42 CFR 483.85, 483.1 and 483.5, current eCFR, pages opened November 5, 2026.
What are the base components?
Under 42 CFR 483.85(c), the operating organization must develop, implement and maintain an effective program with at least these eight components:
- (c)(1): written standards, policies and procedures reasonably capable of reducing criminal, civil and administrative violations under the Social Security Act and promoting quality of care; a reporting contact; an alternate anonymous reporting method without fear of retribution; and disciplinary consequences for all staff, contracted service providers and volunteers, consistent with volunteers' expected roles.
- (c)(2): specific high-level personnel assigned overall responsibility for overseeing compliance with the program. Examples include the CEO, board members and major-division directors.
- (c)(3): sufficient resources and authority for those individuals to reasonably assure compliance with the program's standards, policies and procedures.
- (c)(4): due care against delegating substantial discretionary authority to anyone the organization knew, or should have known through due diligence, had a propensity for criminal, civil and administrative violations under the Social Security Act.
- (c)(5): effective communication to all staff, contracted service providers and volunteers, consistent with volunteers' expected roles. Methods include mandatory participation in training under 483.95(f) or orientation programs, or practical explanatory information.
- (c)(6): reasonable compliance steps, including monitoring and auditing reasonably designed to detect violations under the Act by staff, contracted service providers or volunteers; a publicized system for those individuals to report others' violations anonymously within the organization without fear of retribution; and safeguards for reported data integrity.
- (c)(7): consistent enforcement through appropriate discipline, including, as appropriate, discipline for failing to detect and report a violation to the designated program contact.
- (c)(8): after detection, all reasonable steps identified in the program to respond appropriately and prevent similar violations, including necessary program changes to prevent and detect criminal, civil and administrative violations under the Act.
What changes at five or more facilities?
Section 483.85(d) adds three minimum components for organizations operating five or more facilities, while retaining the duties in (a), (b), (c) and (e): annual mandatory training meeting 483.95(f); a designated compliance officer with the program as a major responsibility, reporting directly to the governing body and not subordinate to the general counsel, chief financial officer or chief operating officer; and designated compliance liaisons located at each facility.
How often must the program be reviewed?
Section 483.85(e) provides that the operating organization for each facility "must review its compliance and ethics program annually and revise its program as needed to reflect changes in all applicable laws or regulations and within the operating organization and its facilities to improve its performance in deterring, reducing, and detecting violations under the Act and in promoting quality of care."
Who needs it and what triggers it
The duty applies to the operating organization of each facility within the federal participation scope; reaching five facilities triggers the additional components in 483.85(d). Acquisitions, a new operator, and gaps between written policies and actual practice are situations in which IHS offers a program review; they are not separate triggers stated in 483.85. Annual review and revisions as needed remain required under 483.85(e).
How IHS helps
IHS is a consulting firm with three practice lines: accreditation consulting, compliance services and program development. This work is compliance services and program development together. Thomas G. Goddard, JD, PhD, who founded IHS in 2002 and served as URAC's Chief Operating Officer and General Counsel, leads it.
- Assess gaps against 483.85 and map policies and evidence to each requirement.
- Draft the program charter, code of conduct and disciplinary standards for client approval, with any clinical content reviewed by the client's clinicians.
- Draft reporting procedures, including the anonymous route, and a training plan with completion records.
- Prepare an annual review template and a record of revisions.
- Conduct a mock review and help assigned personnel organize evidence and address identified gaps before a survey.
What you supply: the organization chart, oversight assignments, facility list, policies, training records and available reporting records. Your organization approves and operates the program; its designated personnel carry out their assigned responsibilities. Counsel handles privilege and investigations.
The real limit: documents alone do not satisfy the requirement for a program in operation. IHS does not serve as your compliance officer or file with or communicate with CMS or any agency for you; your organization handles agency communications.
What to have ready
This is IHS's preparation checklist, mapped to 42 CFR 483.85, current eCFR, page opened November 5, 2026. The suggested record formats are preparation tools, not separately mandated forms.
- Current written standards, policies and procedures supporting an operating program under (b) and (c)(1).
- The reporting contact, anonymous route and nonretaliation provisions under (c)(1) and (c)(6), with available reporting records; reports need not exist merely to complete this checklist.
- Oversight assignments and evidence of sufficient resources and authority under (c)(2) and (c)(3).
- Delegation due-diligence records supporting (c)(4).
- Communication and training records under (c)(5) and 483.95(f), current eCFR, page opened November 5, 2026; annual mandatory training for organizations operating five or more facilities.
- At five or more facilities, the officer's major program responsibility, direct governing-body reporting line and independence from the general counsel, chief financial officer and chief operating officer under (d)(2).
- At five or more facilities, designated liaisons located at each facility under (d)(3).
- Monitoring, auditing and data-integrity records under (c)(6), enforcement and response records under (c)(7)-(8), and annual review and any revisions under (e).
To see where your records stand, start with the introductory call.
How it compares
The base program under 483.85(c) applies throughout the federal participation scope; (d) adds duties at five or more facilities. Compliance-program support focuses on 483.85. Broader skilled nursing facility survey readiness addresses the participation requirements across the subpart, including 483.85; the work and evidence can overlap. Section 483.1(b) identifies these participation requirements as the basis for survey activities.
What it costs
Section 483.85 sets no fee for adopting a program. IHS scopes each engagement after a free introductory call. Scoping considers the facility count, the duties that apply and gaps in the existing program. The client also needs personnel time to approve, implement, monitor and review the program.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm; privilege, investigations and enforcement questions belong with counsel.
- IHS does not offer a compliance officer for hire. Your organization retains responsibility for program operation.
- It is not a guarantee of a survey result or of any enforcement outcome.
Frequently asked questions
Who must have a compliance and ethics program?
The operating organization of each Medicare-participating SNF or Medicaid-participating nursing facility must operate a program under 42 CFR 483.85(b). Sections 483.1 and 483.5 establish this federal participation scope.
Since when has this been required?
The requirement has applied since November 28, 2019. That date appears in 42 CFR 483.85(b).
What are the minimum components?
Paragraph (c) requires eight components, described above: written standards and reporting routes, high-level oversight, resources and authority, delegation due care, communication, monitoring and auditing, enforcement, and response. These support an effective program that the organization develops, implements and maintains under 42 CFR 483.85(c).
What changes at five or more facilities?
At five or more facilities, 42 CFR 483.85(d) adds mandatory annual training meeting 483.95(f), an officer for whom the program is a major responsibility, and liaisons located at every facility. The officer must report directly to the governing body and cannot be subordinate to the general counsel, chief financial officer or chief operating officer.
Who counts as high-level personnel?
Under 42 CFR 483.85(a), high-level personnel have substantial control over the organization or a substantial policymaking role. Paragraph (c)(2) gives the CEO, board members and major-division directors as examples; IHS documents the client's oversight assignment.
How often must we review the program?
The operating organization must review the program annually under 42 CFR 483.85(e). It must revise it as needed for changes in applicable laws or regulations and within the organization and its facilities, to improve deterrence, reduction and detection of violations under the Act and promote quality of care.
Can the compliance officer report to our general counsel or chief financial officer?
At five or more facilities, the officer must report directly to the governing body. Section 483.85(d)(2) also prohibits subordination to the general counsel, chief financial officer or chief operating officer.
Does the program cover contractors and volunteers?
Yes: 42 CFR 483.85(c)(1), (c)(5) and (c)(6) include contracted service providers and volunteers. Paragraphs (c)(1) and (c)(5) expressly qualify volunteer coverage by their expected roles; (c)(6) includes volunteers in monitoring and reporting without repeating that qualification.
How does this differ from survey readiness?
This service focuses on the compliance and ethics program under 483.85. Broader survey readiness addresses the participation requirements, including that section, so evidence can overlap; see our skilled nursing facility survey readiness page.
Can IHS act as our compliance officer?
No; IHS offers program-development support, not compliance-officer staffing. Section 483.85(c)(2) assigns oversight to specified high-level personnel, while (d)(2) requires a designated officer for organizations operating five or more facilities.