A home health agency compliance checklist has to cover two tracks at once: the state license that lets you operate and the federal Conditions of Participation in 42 CFR Part 484 that keep you in Medicare and Medicaid. Missing a single condition can trigger payment suspension, civil monetary penalties, or termination from federal healthcare programs, so the working checklist below is organized around the requirements surveyors actually inspect and the statutes that carry the biggest consequences when something slips.
State License and Medicare Certification
No services can be delivered before the agency holds a license in the state where it operates. Each state sets its own standards, fees, documentation, and renewal timelines, but every state expects proof the agency can deliver care safely before it sees a first patient.1Centers for Medicare & Medicaid Services. Home Health Agencies
Medicare certification is separate. CMS uses state survey agencies to inspect the agency for compliance with the federal CoPs, checking qualified staff, written policies, a clinical records system, an overall plan and budget, and physician involvement in setting care policies.2Centers for Medicare & Medicaid Services. Certification and Compliance Process An agency can substitute an accreditation survey from a CMS-approved national accrediting organization to earn “deemed status,” but CMS-directed validation surveys still apply, and any deficiency found on validation overrides the deemed status.
Governing Body and Administrator
Every agency must have a governing body with full legal authority over management, service delivery, finances, and the quality improvement program.3eCFR. 42 CFR 484.105 – Condition of Participation: Organization and Administration of Services That body appoints an administrator who runs daily operations and must be available (or have a qualified pre-designated substitute available) during all operating hours. The administrator also has to make sure a clinical manager is on hand whenever the agency is operating.
The organizational structure, lines of authority, and list of services must be documented in writing, and the agency’s administrative, clinical, and financial policies serve as the operational record surveyors will ask to see. Those policies need periodic review to stay current.
Assessment, Plan of Care, and Physician Certification
A registered nurse must complete a comprehensive patient assessment within five calendar days of the start of services.4eCFR. 42 CFR 484.55 – Condition of Participation: Comprehensive Assessment of Patients If the only ordered service is physical therapy, speech-language pathology, or occupational therapy, the relevant therapist may perform the assessment. For Medicare patients, the assessing clinician also determines eligibility for the home health benefit, including homebound status.
The assessment must incorporate the current OASIS data set covering demographics, clinical status, functional abilities, medications, and other CMS-specified domains. OASIS accuracy is both a clinical and a financial issue: the data feeds quality measurement and reimbursement.
Assessment findings drive an individualized plan of care that a physician or allowed practitioner must establish and sign. The plan must cover diagnoses, mental and psychosocial status, services and visit frequency, medications, safety measures, rehospitalization risk factors, and discharge goals, among other elements.5eCFR. 42 CFR 484.60 – Condition of Participation: Care Planning, Coordination of Services, and Quality of Care The physician and the agency review and revise it at least every 60 days, or sooner if the patient’s condition changes, and the agency must promptly alert the physician when a change suggests the plan needs adjustment.
Face-to-Face Encounter
Before Medicare will pay, a physician or qualifying non-physician practitioner must have a face-to-face encounter with the patient related to the primary reason for home health care. The encounter has to occur no more than 90 days before the start of care or within 30 days after care begins, and the certifying clinician must document the encounter date as part of the certification.6eCFR. 42 CFR 424.22 – Requirements for Home Health Services Missing or poorly documented face-to-face encounters are among the most common causes of Medicare denials.
Physician Certification and Recertification
Along with the face-to-face requirement, a physician or allowed practitioner must certify that the patient is eligible for the Medicare home health benefit: homebound status, need for skilled services, and an established plan of care. Recertification is required at specified intervals for payment to continue.
Personnel Qualifications and Aide Requirements
Clinical staff must hold current state licensure or certification. The CoPs set specific educational, examination, and licensure standards for registered nurses, licensed practical nurses, physical therapists, occupational therapists, speech-language pathologists, and their respective assistants.7eCFR. 42 CFR 484.115 – Condition of Participation: Personnel Qualifications for Skilled Professionals and Paraprofessionals
Aide Training and Competency
Home health aides carry the most detailed federal training mandate. Before providing care, an aide must complete at least 75 hours of training combining classroom instruction and supervised practical experience, with a minimum of 16 hours of classroom time preceding at least 16 hours of hands-on practice under direct RN supervision.8eCFR. 42 CFR 484.80 – Condition of Participation: Home Health Aide Services A state-approved nurse aide program with current good standing on the state registry is an alternative path.
Every aide must pass a competency evaluation before furnishing services. An aide rated unsatisfactory on any task cannot perform that task without direct RN supervision until retrained and reevaluated. An aide who has not worked in a compensated home health role for 24 consecutive months has to start the whole training and evaluation process over. Once working, each aide must receive at least 12 hours of in-service training every 12 months.
Aide Supervision
For patients also receiving skilled nursing or therapy, a registered nurse or other appropriate skilled professional must complete a supervisory assessment of aide services at least every 14 days. That assessment must generally be in person, though one virtual visit using two-way audio-video technology is permitted per 60-day episode. For patients not receiving any skilled services, an RN must make an in-person visit every 60 days to evaluate aide care. If the supervising clinician spots a concern during any visit, the next supervisory assessment must happen on-site while the aide is providing care. Every aide must be observed in person at least once a year while actively providing patient care.
Exclusion and Background Screening
Before hiring, every prospective employee and contractor has to be checked against the OIG’s List of Excluded Individuals and Entities (LEIE); hiring an excluded person exposes the agency to civil monetary penalties.9Office of Inspector General. Background Information Criminal background screening rules are set at the state level, and most states require fingerprint-based checks with defined disqualifying offenses such as violent crimes, abuse convictions, and healthcare fraud.
Patient Rights
Every patient, and any representative, must be informed of their rights in a language and manner they understand before or at the start of care.10eCFR. 42 CFR 484.50 – Condition of Participation: Patient Rights The rights the agency has to protect and promote include:
- Respectful treatment and freedom from verbal, mental, sexual, and physical abuse, neglect, and theft of property.
- Information about, and the ability to consent to or refuse, all assessments, care planning, treatment decisions, visit frequency, and changes to care.
- Oral and written notice of what Medicare, Medicaid, or other programs will cover, what charges are not covered, and what the patient may owe before care starts.
- Advance written notice if a service may not be covered or if ongoing care is being reduced or ended.
- The ability to file complaints without discrimination or retaliation, with contact information for the state home health hotline and relevant federal and state advocacy agencies.
- A confidential clinical record, with access and disclosure governed by HIPAA.
Infection Prevention and Emergency Preparedness
Infection control is a documented program with three parts: following accepted standards of practice including standard precautions, running a coordinated agency-wide surveillance and investigation program integrated into QAPI, and providing infection control education to staff, patients, and caregivers.11GovInfo. 42 CFR 484.70 – Condition of Participation: Infection Prevention and Control The CoPs also require agencies to have policies ensuring that all staff, contractors, students, and volunteers with patient contact are vaccinated for COVID-19, with defined medical and religious exemption processes.
Emergency preparedness has four required elements, each reviewed and updated at least every two years.12eCFR. 42 CFR 484.102 – Condition of Participation: Emergency Preparedness
- An emergency plan built on an all-hazards risk assessment covering both facility-based and community-based risks and reflecting the agency’s patient population.
- Written policies and procedures built on the risk assessment and communication plan.
- A communication plan for coordinating with staff, patients, physicians, other providers, and emergency management authorities, consistent with federal, state, and local law.
- A training and testing program that drills staff on emergency procedures and tests the plan through exercises.
Surveyors look at whether the plan reflects real local risks rather than a boilerplate template, and whether staff can describe what they would do in an emergency.
QAPI
The Quality Assessment and Performance Improvement program has to be data-driven, cover all agency services including contracted ones, and remain the responsibility of the governing body.13eCFR. 42 CFR 484.65 – Condition of Participation: Quality Assessment and Performance Improvement It must focus on indicators tied to outcomes, patient safety, and quality of care, with particular attention to emergency department visits, hospital admissions, and readmissions. The agency has to track quality indicators including adverse events, use OASIS-derived measures where applicable, and analyze the data for improvement opportunities.
Performance improvement work concentrates on high-risk, high-volume, or problem-prone areas. Any problem that directly threatens patient health or safety must be corrected immediately. Each year the agency also has to conduct distinct performance improvement projects, with the number and scope reflecting the complexity of operations, and document the rationale and measurable progress for each.
Records Retention and HIPAA
Clinical records must be accurately documented, signed, and dated by the clinician who provided the service. The CoPs require retention for at least five years after discharge, unless state law requires longer.14eCFR. 42 CFR 484.110 – Condition of Participation: Clinical Records CMS’s general Medicare provider requirements call for maintaining medical records for seven years from the date of service.15Centers for Medicare & Medicaid Services. Medical Record Maintenance and Access Requirements Follow whichever retention period is longest among the CoP minimum, the general Medicare requirement, and state law. If the agency shuts down, it has to tell the state survey agency where records will be stored.
Privacy and Security
The HIPAA Privacy Rule protects the confidentiality of protected health information in electronic, paper, and verbal form while still permitting the sharing needed for care coordination, and it gives patients the right to examine and obtain copies of their records, including electronic copies.16U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule17Centers for Medicare & Medicaid Services. HIPAA Basics for Providers: Privacy, Security, and Breach Notification Rules The Security Rule adds requirements for electronic PHI: security policies, protection from unauthorized access, regular risk assessments, and employee compliance with safeguards.
Breach Notification
A breach of unsecured protected health information triggers notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery.18eCFR. 45 CFR Part 164 Subpart D – Notification in the Case of Breach of Unsecured Protected Health Information Breaches involving 500 or more residents of a single state or jurisdiction also require notice to prominent local media and contemporaneous reporting to HHS. Breaches affecting fewer than 500 individuals are reported to HHS annually.
Anti-Fraud Compliance
A formal compliance program to detect and prevent fraud, waste, and abuse is standard practice, and two federal statutes drive the highest-stakes exposure.
False Claims Act
The False Claims Act makes anyone who knowingly submits a false claim liable for three times the government’s damages plus a per-claim civil penalty adjusted annually for inflation.19Department of Justice. The False Claims Act As of the most recent adjustment in 2025, that penalty ranges from $14,308 to $28,619 per false claim, on top of treble damages. Common triggers include upcoding, billing for services not rendered, and claims without adequate documentation of medical necessity.
Anti-Kickback Statute
The Anti-Kickback Statute makes it a felony to knowingly offer, pay, solicit, or receive anything of value to induce referrals for services covered by a federal healthcare program, with fines up to $100,000 and imprisonment up to 10 years per violation.20Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs The reach extends well past outright bribes to marketing arrangements, free services, below-market leases, and referral bonuses structured to reward patient referrals.
Billing and Cost Reporting
Claims must use correct coding that reflects the services provided and the patient’s clinical condition, and every claim needs the supporting physician certification of eligibility and medical necessity. Medicare-participating agencies also file annual cost reports on Form CMS-1728 documenting the costs of care to Medicare beneficiaries.21Centers for Medicare & Medicaid Services. Provider Cost Reporting Forms and Instructions, Chapter 47 Inaccurate cost reporting can itself become a basis for False Claims Act liability.
Home Health Value-Based Purchasing
Since 2022, every Medicare-certified home health agency in the 50 states, the District of Columbia, and U.S. territories participates in the expanded Home Health Value-Based Purchasing Model. Medicare fee-for-service payments are adjusted from negative 5% to positive 5% based on performance scores drawn from OASIS-based outcomes, claims-based measures, and HHCAHPS patient satisfaction results.22Centers for Medicare & Medicaid Services. Expanded Home Health Value-Based Purchasing Model Underperformance means real reimbursement cuts, so QAPI quality and OASIS accuracy carry direct financial weight.
What Happens When Compliance Fails
Survey findings drive a graded response. CMS remedies range from a directed plan of correction to payment suspension for new admissions, civil monetary penalties, temporary management, and termination from Medicare. When surveyors identify an immediate jeopardy to patient health or safety, CMS can move toward termination within 23 days if the jeopardy is not removed.
Separately, the OIG can exclude individuals and entities from all federally funded healthcare programs. Exclusion is mandatory for conviction of Medicare or Medicaid fraud, patient abuse or neglect, felony healthcare fraud, or felony controlled substance offenses.9Office of Inspector General. Background Information The OIG has discretion to exclude for misdemeanor healthcare fraud, license revocation, providing unnecessary or substandard services, submitting false claims, and participating in kickback arrangements. Employing or contracting with an excluded person brings civil monetary penalties on top of any other consequence, which is why the LEIE check at hiring belongs on the same checklist as the CoPs themselves.