Executive Summary

How effective are your hospital's corrective actions in response to survey deficiencies? As you'll learn from this article, the Centers for Medicare and Medicaid Services (CMS) is getting tough with organizations that are repeatedly found out of compliance with its requirements to participate in the Medicare program.

In the article, we summarize the experience of one California hospital that CMS threatened with termination from the Medicare program because of repeated deficiencies that jeopardized patient safety. No one wants to go through the experience recounted by the hospital's senior leaders and board members.

A notice of Medicare termination can be devastating to an organization's bottom line, leading to closure. ECRI Institute was selected as the lead independent consultant to help the hospital achieve a turnaround so it could continue to serve its community, where it is the sole provider of hospital care.

Before I joined ECRI Institute, I was the administrator of a hospital in a state where surveys were conducted at least every two years to maintain state licensure. As occurs with most hospital surveys, the inspectors typically identified some deficiencies that they required us to address in a plan of correction. Once we submitted the plan, we usually did not see the inspectors again until it was time for another licensure survey.

By the time I left the facility, however, state investigators, on behalf of CMS, would revisit the facility several months after the plan of correction was submitted to check that the changes were in place and effective.

Nationally, other hospitals report similar experiences. Indeed, when state and federal inspectors do not see improvement, they will take action, often notifying a hospital that it will lose its federal funding if noncompliance continues.

Based on our experience with the California hospital and others, we have identified warning signs that can foretell trouble before CMS surveyors visit a facility. The article describes those warning signs and, most important, recommends how hospitals can proactively respond and sustain patient safety and quality.

These suggestions achieve results. Today, the California hospital, once threatened with closure, remains open and proudly serves its community.



Catherine Pusey, RN, MBA

ECRI Institute

Associate Director

Who Should Read This

​Administration, Chief medical officer, Health information management, Information technology, Nursing, Patient safety officer, Quality improvement, Risk manager, Staff education

The board chair of a California community hospital that recently faced near-termination from the Medicare program has a message for all healthcare organizations.

"If you don't believe you could be subject to termination, you are too complacent," says Janice Soohoo Nall, board chair of Rideout Health, which operates Rideout Memorial Hospital, a community hospital in Marysville, California. "Don't stay in your comfort zone." Nall joined the board in 2009 and was appointed to her current position in July 2016. She is president and chief executive officer of California Molded Products, Inc., Yuba City, California.

Termination Letter Sounds Death Knell

This summer, Rideout completed an expansion of the facility with the opening of a new six-story tower. The hospital serves about 140,000 residents in a two-county area north of Sacramento.

In December 2013, however, Rideout's future was uncertain. It had received a termination letter from the Centers for Medicare and Medicaid Services (CMS) saying that the hospital had repeatedly been found to be out of compliance with numerous Medicare requirements and had not taken measures to eliminate threats to patient safety. The letter further stated that the hospital could no longer participate in the federal program to provide care to Medicare beneficiaries.

For many hospitals, a termination letter is a death knell. Once a hospital is barred from the Medicare program, it can also no longer participate in its state Medicaid program. The combined loss of Medicare and Medicaid funds would have wiped out about 75% of Rideout's revenues. Medicare termination can also jeopardize a hospital's state license, threaten other payer contracts, damage its reputation, render the hospital vulnerable as a target for malpractice litigation, and more.

Instead of closing its doors, Rideout, under new leadership, achieved a turnaround while operating under an 18-month systems improvement agreement (SIA) with CMS. Rideout is one of only a handful of hospitals that has negotiated an SIA with the agency. Under the agreement, the agency suspends its order to terminate the hospital's Medicare license and, in return, the hospital agrees to achieve full compliance with the agency's Conditions of Participation (CoPs), which spell out 23 requirements to be a Medicare provider. CoPs cover issues ranging from patients' rights to the responsibilities of the hospital's governing board. A hospital may continue to bill the federal program for care while operating under an SIA.

"The termination notice and SIA were excruciatingly difficult to go through," says Nall, "but we are better [for] having gone through the experience." In July 2015, the hospital received the go-ahead from CMS that it was in full compliance and could continue to receive government program funding.

ECRI Institute was selected by the hospital and approved by CMS to serve as the lead independent consultant to identify gaps in the hospital's compliance with Medicare's CoPs and to develop a corrective action plan. The organization has worked with other hospitals that have successfully emerged from an SIA.

The lesson learned by those who have been through the experience is "to be proactive" in identifying and addressing their flaws before CMS is forced to take action, says Catherine Pusey, RN, MBA, ECRI Institute associate director.

In this article, we summarize CMS's use of SIAs, identify the warning signs leading to regulatory intervention, describe an organization's response to regulatory termination based on Rideout's experience, and provide prevention tips to avoid regulatory intervention and closure.

What Is an SIA?

A hospital cannot participate in the Medicare program unless it meets all 23 CoPs as well as the requirements of the Emergency Medical Treatment and Labor Act (EMTALA). While Table 1. Medicare Hospital Conditions of Participation lists only 23 CoPs, achieving compliance actually requires meeting hundreds of requirements. CMS's interpretive guidance explains these requirements in detail, and surveyors use this guidance to evaluate hospital compliance with CoPs.

CMS relies on state agencies, such as state departments of health, and approved accrediting organizations to evaluate a hospital's compliance with CoPs and EMTALA. The agency or its state surveyors may also conduct separate investigations in response to a patient complaint or a hospital report of a patient death associated with the use of restraints or seclusion. Although the inspection is targeted to the complaint's allegations, the surveyor can also evaluate areas of noncompliance unrelated to the complaint. CMS and its state surveyors annually conduct thousands of hospital investigations spurred by complaints.

The survey findings, called a "statement of deficiencies," list each violation and refer to them by a tag number from the surveyor's guidance for interpreting the CoP requirements. Many hospitals' statements of deficiencies are publicly available on a website maintained by the Association of Health Care Journalists.

If a surveyor finds any deficiencies in the hospital's compliance with CoPs or EMTALA, CMS will put the hospital on track for termination and give the facility a deadline for correcting the problems. The timing of the deadline depends on the findings. If a hospital's noncompliance puts patient safety in immediate jeopardy—that is, a situation that is likely to cause serious injury, harm, impairment, or death of a patient—the hospital has 23 days to correct the problems. Otherwise, the hospital has 90 days to address the problems to avoid termination. Most hospital surveys result in some findings that must be addressed.

Table 1. Medicare Hospital Conditions of Participation


Code of Federal Regulations Title 42 Citation

Compliance with federal, state, and local laws§ 482.11
Governing body§ 482.12
Patients' rights§ 482.13
Quality assurance and performance improvement (QAPI) program§ 482.21
Medical staff§ 482.22
Nursing services§ 482.23
Medical record services§ 482.24
Pharmaceutical services§ 482.25
Radiologic services§ 482.26
Laboratory services§ 482.27
Food and dietetic services§ 482.28
Utilization review§ 482.30
Physical environment§ 482.41
Infection control§ 482.42
Discharge planning§ 482.43
Organ, tissue, and eye procurement§ 482.45
Surgical services§ 482.51
Anesthesia services§ 482.52
Nuclear medicine services§ 482.53
Outpatient services§ 482.54
Emergency services§ 482.55
Rehabilitation services§ 482.56
Respiratory care services§ 482.57

In Rideout's case, the hospital had undergone several surveys resulting in deficient findings. Corrective actions were taken after each survey, but when the surveyors returned, they found the same deficiencies again—as well as additional ones. "There were deficiencies found on every survey plus repeat tags," says Monica Arrowsmith, JD, MSN, RN, Rideout's current vice president for strategic planning and business development. Arrowsmith was hired in December 2013 to help build the hospital's quality department and to respond to regulatory concerns. Serving as vice president of quality management, she was among the key people responsible for addressing the SIA.

Within a month of Arrowsmith's arrival, the hospital received its termination letter from CMS, prompted by an October 2013 state survey, which found multiple deficiencies in meeting CoPs as well as four immediate-jeopardy findings. The letter listed the hospital's history of deficiency findings and indicated a date for termination. "The letter gave us no options. It was just, 'You're done,'" says Arrowsmith.

As an alternative to immediate termination, the hospital's outside general counsel drafted and negotiated an SIA, which CMS had started to use with a few hospitals. Another California health system, Southwest Healthcare System, was among the first hospital systems to use an SIA to avoid termination, in 2010. ECRI Institute was also the consultant on that turnaround.

An SIA is "used as a vehicle to halt termination," says Cheryl Wagonhurst, Esq., who provides outside general counsel services for Rideout. Less than two weeks after Rideout received the termination letter, "we were talking with CMS about an SIA," says Wagonhurst, former partner at Foley & Lardner, LLP, and now owner of the Law Office of Cheryl L. Wagonhurst (Santa Barbara, California). "Swift action by the hospital avoided months of back-and-forth negotiating and potential litigation over the termination action," she says, and enabled the hospital to "get on the same page with CMS, instead of being in the position of arguing with the agency, it's in a position of partnering with the agency to move forward in a positive direction that is in the best interest of the hospital, its patients, caregivers, and community as a whole."

Previously used with nursing homes and transplant centers, an SIA is an agreement between the hospital and CMS that requires the hospital to make significant investments to improve the quality of care in exchange for more time before Medicare termination takes effect. Once the changes are made within the timeframe specified by CMS, the agency inspects the facility to determine whether it is in compliance with all CoPs.

In addition to Southwest and Rideout, CMS has negotiated SIAs with at least six hospitals in Texas and one each in North Carolina, Vermont, and the U.S. Virgin Islands, according to various news reports. The agency does not provide data about the number of SIAs it has negotiated or completed.

Because of the limited use to date of this type of agreement in the hospital sector, "a lot of hospitals and health systems are unfamiliar with an SIA," says Wagonhurst, who was aware of previous SIAs from her healthcare compliance work, including serving as a board member of the Health Care Compliance Association.

Federal regulators may negotiate an SIA with a hospital if termination jeopardizes patient access to care in the community. "CMS will consider an SIA in communities where there are a limited number of facilities and it is important for the facility to improve rather than close," says Rideout Health Chief Executive Officer (CEO) Gino Patrizio, who arrived at Rideout as chief operating officer (COO) in early 2014, soon after the SIA was in place. Patrizio had previous experience with an SIA; he was recruited as COO at Southwest while it was under an SIA.

Closure of Rideout Memorial Hospital would have left the community without a provider of hospital care. "We are a safety net hospital," says Nall. "If we closed, we failed our community."

SIA Terms

Typical among an SIA's provisions are the following:

  • The hospital obtains, at its expense, an independent consultant to conduct a hospital-wide gap analysis identifying areas of noncompliance with CoPs. The hospital's choice for a consultant must be approved by CMS.
  • The consultant recommends an action plan to achieve compliance with the CoPs; CMS must review and approve the plan. The plan includes implementation of an effective hospital-wide quality QAPI program.
  • The consultant works with the hospital to implement the plan.
  • CMS is kept informed of the hospital's progress in written reports and regularly scheduled phone calls.
  • CMS conducts a survey to ensure the hospital has achieved compliance with all CoPs before the SIA is completed.

The SIA specifies timeframes for meeting each of the provisions, giving the hospital a short period to achieve a turnaround. If CMS and the facility cannot agree on the terms of the agreement, CMS proceeds with termination.

The SIA terms do not specify who should serve as the point person for ongoing negotiations. A third party should serve as the contact person to work with the hospital, CMS, and the outside consultant, recommends Wagonhurst, who served in that role for Rideout's SIA. A third party can help to maintain independence in meeting the SIA's goals, while the hospital stays focused on taking ownership of the necessary corrective action as recommended by outside consultants, she says. In addition, in certain circumstances, if the person in charge of the SIA's provisions is also from a hospital department that is being reviewed, the outside consultant could encounter hospital resistance to some of its suggested improvement strategies, she explains.

Rideout had 18 months from the time the SIA was signed in January 2014 until June 2015 when CMS came on-site to conduct its full validation survey. "It's a stressful time for a hospital," says Patricia Neumann, RN, MS, HEM, ECRI Institute senior patient safety analyst and consultant, who, along with Pusey, worked with Rideout to address the SIA's provisions.

Patrizio agrees. "Operating under an SIA creates an overwhelming sense of urgency transcending all levels of the organization."

Warning Signs

Based on ECRI Institute's experience working with hospitals under SIAs, "We've identified warning signs" signaling a hospital is at risk of termination, says Pusey. The red flags are listed in Warning Signs of Compliance Troubles. Some of the warning signs and the response Rideout mounted in order to emerge from the SIA are described in detail below.

Survey Response

A hospital is at risk of termination from the Medicare program if it has multiple surveys with findings of deficiencies, including immediate-jeopardy findings, say ECRI Institute's Pusey and Neumann. Refer to Top Five CoPs Leading to Hospital Immediate-Jeopardy Findings to see which CoPs are more likely to result in immediate-jeopardy findings and put a hospital on a fast track for termination.

Warning Signs of Compliance Troubles

  • Multiple surveys with repeated findings
  • Immediate-jeopardy findings
  • Lack of meaningful effort by management to correct known CoP deficiencies
  • Minimal oversight by the governing board of the QAPI program
  • Inability to implement, measure, and monitor corrective action plans
  • Failure to involve compliance officer in CoP
  • Insufficient staff for infection control, quality, and medication safety
  • Unstable workforce (e.g., high use of agency and travel nurses)
  • Building expansion projects consuming management's attention
  • Insufficient credentialing and privileging of
    medical staff

Rideout had undergone various surveys for a period of about five years with findings of noncompliance, says Arrowsmith. Among the most problematic areas, she adds, were noncompliance with the CoPs for a QAPI program, infection control, and pharmaceutical services.

"Typically, there are three or four surveys where the surveyors find a pattern of unresolved issues," says Patrizio. Consequently, the regulators view the organization as refusing to commit the necessary resources to resolve the problems, he explains.

When a surveyor identifies deficiencies, "there must be a visible and meaningful effort from leadership to correct them," says Patrizio. "This doesn't mean every time they suggest something that we have to agree, but we can't be dismissive." The surveyor should be treated "with the utmost attention and seriousness," he adds.

ECRI Institute has found that organizations in regulatory trouble often fail to accept the regulators' findings. "A lot of times, hospitals [threatened with termination] feel blindsided," says Neumann. "They think that they're a good hospital and that any negative findings by surveyors are an aberration."

Denial, however, won't solve the hospital's compliance problems. "You can't allow yourselves to believe the organization is being picked on or targeted unfairly as an excuse for failure to commit resources [to improve]," says Patrizio.

"It's irrelevant," agrees Arrowsmith. "You need to correct the problem."

Management Priorities

Patrizio describes a "constant state of urgency" that Rideout's leadership faced while addressing the SIA's provisions under a compressed timeframe. That sense of resolve "needs to be there even before an SIA occurs," he adds.

In Rideout's case, management had not given sufficient attention to the hospital's compliance problems. The hospital did not recruit people with the right skills to respond to the deficiencies found during surveys until it was too late, says Patrizio. By the time Arrowsmith and others were hired to rebuild the hospital's quality and compliance programs, federal regulators were close to sending their termination letter. "There was a late commitment of resources," says Patrizio.

Top Five CoPs Leading to Hospital Immediate-Jeopardy Findings

  1. Patients' rights
  2. Nursing services
  3. Surgical services
  4. QAPI program
  5. Infection control

Source: Centers for Medicare and Medicaid Services. Full text statements of deficiencies hospital surveys—updated 01/28/2016. 2016 May 13 [cited 2016 Apr 22].

While operating under the SIA, Rideout's management team had to be "relentless to correct problems," he says. "Once the organization is recognized as requiring an SIA for compliance, there's a strong bias that the organization will not or cannot commit to correct. You need to make visible, meaningful changes."

For example, the organization must set aside its financial goals and commit resources to work through the process, says Patrizio. If the quality program needs to be rebuilt, as occurred at Rideout, the organization must commit resources to that effort. If the organization has been found out of compliance with life safety issues, bring in subject matter experts to help with the action plan, he suggests.

New leadership may be needed to achieve culture change. "There will be team members who will not survive because they cannot embrace the perpetual and relentless sense of urgency or they do not have the skill sets required to achieve change," says Patrizio.

While Rideout operated under the SIA, its executive suite saw multiple changes; in addition to Patrizio's appointment as COO, new individuals filled the positions for CEO, chief financial officer, and chief nursing officer. Additionally, along with Arrowsmith, new individuals were recruited to the quality and compliance departments, which were reorganized. The risk management and patient safety functions are within the quality department.

To demonstrate to staff its commitment to improving the organization, the new leadership's team members "were out on the floor" to talk to staff, says Patrizio. "We shared information about the actions we were taking as often and as versatilely as possible."

In addition to information sharing, the leadership team's visibility was important for boosting staff morale while the hospital was operating under the SIA. "It's a long process," says Patrizio. "You have to support the team physically, emotionally, and spiritually in the sense that they will question if we're on the right path and whether we will succeed."

Senior leaders were also visible within the community, participating in local events. If they encountered individuals who complained about a hospital encounter, they would try to meet one-on-one with each person. "If someone had a bad experience, the bullet was out of the gun, and we needed to address it," says Patrizio.

Board Oversight

When a hospital's senior leaders give low priority to CoP compliance, it's unlikely that they are keeping board members informed about ongoing survey deficiencies. "Part of the skill set of leadership is to ensure the board is adequately informed and understands the gravity of the situation and will commit the resources to resolve the problems," says Patrizio.

"The board has ultimate responsibility [for the hospital]," says Nall. "We should have been knowledgeable. We didn't have that." Having gone through the SIA, she understands the need for board members to ask questions about quality and patient safety in addition to monitoring the hospital's balance sheets. "If there's one lesson I've learned, it's not to just rely on the information given to you as [being] all . . . you need to know," says Nall, noting that Patrizio instructs Rideout's board members to "trust but verify."

Most hospital board members are "more comfortable with financials than quality measures," she notes. "We learned because we had to with the SIA, but it was evident we were lacking in our knowledge about quality," she says. For example, before the SIA was in place, Nall was unfamiliar with the term "QAPI." "Now we're talking about QAPI. Not just me, but all board members."

While the SIA was ongoing, Rideout formed an oversight subcommittee, comprising board members and senior leadership, to monitor weekly progress under the SIA. In addition to receiving status reports from ECRI Institute's consultants about the organization's action plan to achieve compliance, the committee reviewed performance data and received in-depth reports to learn about each CoP. As of mid-2016, the committee remains in place and meets every other week, but the organization may make it an ad hoc committee of its board or a subcommittee of its quality council.

The quality council, which meets monthly, enables Rideout's board members to ensure that improvement is sustained, says Nall, who chairs the council. The council's members consist of senior leaders, physicians, and board members, although only the board members have voting privileges. Previously, the council received quality data on a few issues, says Nall. "Now there are 20 to 30 different reports that we monitor [throughout the year]," she says, including root-cause analysis findings, adverse event data, patient satisfaction scores, and QAPI plans.

Corrective Actions

When a hospital receives a statement of deficiencies from regulators, it is asked to submit a plan of correction to avoid termination. A sign of a troubled hospital is that the plan "sits on a shelf" once it is accepted by the state or CMS, says Pusey. "When the surveyors are back in, they find the same problems, plus more."

Rideout encountered regulatory problems because "there was no infrastructure in place" to oversee its corrective action plan, says Arrowsmith. ECRI Institute's gap analysis of Rideout's compliance with the CoPs identified about 185 areas that needed to be addressed in an action plan.

"Each had a lot of depth," says Arrowsmith. "We had a massive program to address all the standards and conditions," she says, noting that the initiatives applied to all of Rideout's licensed facilities (i.e., two hospitals, a cancer center, and a surgery center).

Many of the items identified in the action plan required that a policy be developed or updated and that measures be established to monitor compliance with the policies. Neumann urges a "go slow" approach to policy development. "Sometimes there's a rush to implement a policy, but you need to look at processes to understand what the policy should address."

For example, one item that Rideout had to address in policy was the anesthesiologists' use of narcotics on patients in the operating room (OR). The organization opted to deploy automated dispensing cabinets in its ORs to better control the use of narcotics, but it had to work out the details for using the cabinets. "It took time to develop the policy and to make it right," says Neumann.

Rideout assigned a senior leader to oversee the organization's response to each CoP to ensure that any identified gaps were addressed. "There was organizational accountability up to the governing board," says Pusey.

As the organization held weekly meetings to monitor its action plan, the progress with each item was shown by a color—red to indicate incomplete, yellow for substantially resolved, and green for resolved. "Each time we had a fix, we'd call that 'getting to green,'" says Patrizio. "We'd celebrate each time we got to green."

Arrowsmith was also charged with developing a QAPI program compliant with the CoPs while building a quality department. Previously, only one person was assigned to oversee quality. "The program was underresourced. One person can't manage all the quality issues," says Arrowsmith.

Linking quality and compliance. Arrowsmith and others also recognized the need to link the hospital's quality and compliance activities to avoid a siloed approach. "The CoPs address clinical issues" that fall in the quality department's domain, says Arrowsmith. "But they also tie in to compliance. If you're not complying with the CoPs, you're not complying with the law."

Except for a compliance hotline, Rideout did not have a very robust compliance program, says Diana Salinas, JD, who was recruited to the organization in March 2014 as chief compliance and ethics officer to develop a compliance program.

"A lot of compliance officers do not traditionally pay attention to an organization's CoP compliance, but they should," says Salinas. For example, she recommends that the compliance officer review an organization's corrective action plan for CoP deficiencies before it is submitted to regulators. "I want to be sure it's been a collaborative effort. Did everyone sign off on it? Is the time frame for implementation adequate? And once it's submitted, I want to get reports on how the implementation is going," she says.

In fact, failing to ensure that CoP deficiencies are addressed by corrective actions can put a facility at risk for False Claims Act charges. "If the state regulatory body comes in for a quality inspection and requires corrective actions that you don't complete, yet you continue to bill for care, the government can view [the bills] as false claims," says Salinas, who left Rideout Health in January 2016 to return to her Florida roots as vice president and chief ethics and compliance officer at Mount Sinai Medical Center, Miami Beach.

"The changes put in place to oversee quality, patient safety, risk, and compliance matters were huge," says Arrowsmith. The organization hired more staff with experience in compliance and quality and reorganized the departments so that individuals with responsibilities for compliance, quality, risk management, and patient safety report to a vice president of quality who is a physician and reports to Rideout's chief medical officer. To promote communication between the quality and compliance departments, staff hold weekly meetings to share data. "The infrastructure is far more wired now," says Arrowsmith.


Another indicator of potential regulatory trouble "is the flight of good staff from the hospital," resulting in heavy reliance on temporary staff, such as travel nurses, says Neumann. Rideout was losing nursing staff, who were going to facilities paying higher wages in the nearby Sacramento area.

In particular, the staff shortages affected Rideout's emergency department (ED), which was cited in state surveys for failing to provide timely care and for other deficiencies in meeting the CoPs for emergency services. "The hospital was unable to recruit nurses because its pay was below market rates," recalls ED Medical Director Christopher T. Bradburn, DO. "Every day, we'd be short staffed. It doesn't matter how many great plays you draw up; if only half of the team shows up for a football game, you just can't be competitive. That's what it was like."

Bradburn credits the SIA for forcing needed changes. With new leaders in some positions, there was a "refreshing" change in management's approach, he says. "The attitude of administration became, 'We need to face up to our problems.'" The SIA "allowed us to get the critical resources we needed and to do it quickly."

For example, the hospital brought in a new ED manager with experience in managing ED patient flow issues. "We redesigned the intake of patients to include a provider in the lobby and key people to coordinate patient flow," says Bradburn. "As soon as we had the right staffing and resources, we knocked it out of the park." With improvements in place in the ED, the hospital even gained the state's approval to open an expanded ED while it was operating under the SIA.

Once the ED's critical resource needs were met, staff morale improved, says Bradburn. "The morale and pride of the staff began to change for the better. It has been a classic culture change from top to bottom that you always hear about."

In fact, Rideout's ED was recently recognized by CEP America, which manages the ED, for achieving the highest level of reductions in turnaround time to discharge among partner CEP sites.

"I'm proud of the hospital," says Bradburn. "It's a different place today."

More SIAs?

Those who have gone through an SIA expect CMS to increasingly use the procedure as a compliance tool with hospitals that are vital to their communities but fail to achieve sustained compliance with CoP requirements. "Over time, we'll see more," predicts Salinas. "The agency is using the SIA to say to those providers, 'Come on. Wake up.'"

When Salinas arrived at Rideout in March 2014, she was aware that the SIA was in place, but she thought, "How bad can it be?" She had previous experience with an SIA for a hospital-based transplant unit in another region and described the agency's approach with that unit as "gentle."

Operating under the SIA at Rideout turned out to be a different experience. "It was all hands on deck," says Salinas. "My first six months there I spent addressing the SIA demands."

Others agree that the experience was all-consuming. Board Chair Nall says she "ate, slept, and dreamt SIA." Arrowsmith recalls, "Every part of who I am went into this. But it was not just me. Everyone was performing at their top level." Patrizio agrees, noting, "People get tired."

Rather than waiting until an SIA or termination is imminent, Nall advises, hospital executives and board members should "address your shortfalls" before they become a compliance problem.

Prevention: CoP Gap Analysis

"Prevention is the best strategy" for avoiding the threat of closure from CoP compliance problems, says Pusey. Some of the key strategies to ensure compliance are listed in Reducing Regulatory Risks.

Reducing Regulatory Risks

  • Investigate self-reported events promptly
  • Perform root-cause analysis
  • Develop action plans
  • Monitor for sustainability
  • Recognize patterns of noncompliance
  • Monitor regulatory deficiencies
  • Increase oversight of corrective action plans
  • Devote resources to compliance and quality activities
  • Align compliance and quality functions
  • Improve publicly reported quality measures
  • Monitor performance compared with
  • Adopt strategies to continuously improve
  • Adopt accepted patient safety practices
  • Maintain a continuous learning environment
  • Adopt a patient safety culture

Hospitals typically look to the findings from their accreditation surveys to demonstrate that they are in compliance with Medicare CoP regulations. CMS has designated accrediting organizations such as the Joint Commission and DNV GL as having authority to deem that a hospital meets federal licensing standards if it meets the accrediting agencies' survey requirements. The hospital is then exempted from routine federal inspections to ensure compliance with CMS requirements.

Although hospitals devote resources to preparing for accreditation surveys, "they can still lose their license and funding" if CMS or state surveyors investigate a facility in response to a patient or EMTALA complaint and find it out of compliance with CoPs, says Pusey. Not enough attention is given to CMS survey readiness, she says.

Just as an SIA requires a facility to perform a gap analysis of its CoP compliance, hospitals should proactively evaluate their CMS survey readiness by performing a similar analysis, Pusey and Neumann recommend.

Hospitals often don't delve deep enough into identifying the underlying issues and developing and implementing best practices that are necessary to achieve sustainable compliance with CoPs, says Wagonhurst. Yet, if a hospital complies with the CoPs as they are intended, it can improve patient care and reduce compliance and legal risks, such as decertification from the Medicare program, she says. For many hospitals, spotting problem areas with CoP compliance can be difficult, she says, noting that it may help to proactively engage outside consultants such as ECRI Institute to evaluate the situation and recommend best practices.

To conduct a gap analysis, ECRI Institute consultants visit the hospital site to conduct staff interviews, review hospital documents, and observe various processes. "We look at how the facility is performing in meeting CoPs, identify any gaps in meeting the standards, examine why there are gaps, and develop an action plan based on our recommendations," says Pusey. A sample gap analysis for CMS's CoP requirements for medical staff organization is shown in Table 2. CoP Gaps and Action Plan: Medical Staff Requirements.

Table 2. CoP Gaps and Action Plan: Medical Staff Requirements

Survey Criterion Gap Root Cause Recommendation Action Plan
Verify that, at a minimum, criteria for appointment to the medical staff/granting of medical staff privileges are individual character, competence, training, experience, and judgment. Nurse midwife granted privileges to perform in the role of first assistant, but file contains no evidence the applicant had training for this role.Lack of reliable and consistent method to process new medical staff applications.Ensure that the appointment and reappointment files contain documentation that the applicant meets the requirements for appointment and that the file is completed before submitting to the credentials committee.Develop a checklist that contains all the requirements for appointment and reappointment.
Verify that granting of medical staff membership or privileges, both new and renewing, is based on an individual practitioner's meeting the medical staff's membership/privileging criteria. A provider's file lacked evidence that he/she had performed a particular procedure the specified number of times required to maintain that privilege.Lack of consistent process to review files for requested privileges at time of appointment and reappointment.For reappointment, identify a mechanism to collect verification that provider performed required number of procedures for requested privilege.Develop a mechanism to collect verification; for example, create privilege sheets indicating the number of procedures the provider must perform to maintain a particular privilege.
Verify that granting of medical staff membership or privileges, both new and renewing, is based on an individual practitioner's meeting the medical staff's membership/privileging criteria.Physician credential file contained at least five investigations regarding behavior, yet reappointment sheet indicated "Outstanding" in interpersonal skills category.Process not monitored by hospital and medical staff leadership. Require credentialing specialist to have all documents in order for department chair's review and approval before the credentialing committee meets.

Identify for the chair's review files of individuals who have unmet targets.
For files noted to have deficiencies, work with the credentials committee chair and appropriate department chair to develop an action plan.
Verify that the medical staff operates under current bylaws, rules, and policies that have been approved by the governing body.The medical staff peer review process is untimely and not comprehensive.No system in place to ensure peer review timeframes meet targeted goal.Include peer review timeliness as a quality goal. Peer review will occur within the timeframe identified in the medical staff policy.

The physician responsible for the peer review will be notified prior to the due date for completion.


At Rideout, nearly 20 health and safety experts from ECRI Institute visited the facility for its gap analysis. "Some came once, some came multiple times," says Neumann. The experts examined every process covered by the CoPs. "We'd go in the OR and watch procedures. Infection control staff watched room turnover. Experts in ED patient flow watched patients being triaged. We wanted to observe actual staff practices."

Very few hospitals have done this kind of CoP gap analysis, says Wagonhurst. Too often, they adopt "band-aid" approaches that are unsustainable. The few large health systems that have done a gap analysis have found that the effort can improve compliance and operations, she says. "They recognize the return on investment by being ready for their next CMS survey."

As required by CMS, Rideout's gap analysis was completed within 60 days from the date of the SIA for CMS's review. Once the gap analysis was approved by the agency, ECRI Institute had another 60 days to prepare an action plan. Rideout was ready to proceed with its action plan in July 2014, seven months after it entered into the SIA with CMS. One year later, the hospital announced in a press release dated July 8, 2015, that it had successfully met all the conditions of CMS's full validation survey and that the SIA "is now completed."


ECRI Institute's aim in implementing Rideout's action plan was to provide the hospital with the necessary tools and recommended best practices for it to independently sustain continued compliance. "Our goal is to implement best practices in whatever way is best for the hospital," says Neumann.

"When we walk away, the lessons learned from the gap analysis stay," says Pusey.

Patrizio says that the "level of intensity" required to operate under an SIA has subsided but that Rideout's journey as a learning organization continues. "You cannot maintain that level of intensity, but you also cannot forget the lessons you've learned. We're still on that journey. It's a journey without a finish line."




Resource List

Related Resources

Topics and Metadata


Laws, Regulations, Standards; Quality Assurance/Risk Management


Emergency Department; Hospital Inpatient

Clinical Specialty



Corporate Compliance Officer; Healthcare Executive; Legal Affairs; Patient Safety Officer; Quality Assurance Manager; Regulator/Policy Maker; Risk Manager

Information Type


Phase of Diffusion


Technology Class


Clinical Category



SourceBase Supplier

Product Catalog








Publication History

Published August 26, 2016