CMS Conditions of Participation Financial Recordkeeping Requirements

CMS Conditions of Participation impose specific, enforceable financial recordkeeping obligations on skilled nursing facilities, and treating those obligations as background paperwork rather than binding law is where a lot of facilities get into trouble. What follows breaks down what the standards actually demand, how surveyors and auditors check for compliance, and what happens when a facility gets it wrong.

Why CMS Conditions of Participation carry legal force

CoPs, along with their counterpart for certain facility types, Conditions for Coverage (CfCs), are federal standards that a health care organization has to meet just to start participating in Medicare and Medicaid, and then has to keep meeting to stay in either program. This is not a one-time entry exam. Participation is conditioned on meeting every applicable Condition, continuously.

The structure of a Condition has its own logic, distinct from the standards subordinate to it. Fail enough of those subordinate standards, or fail one badly enough, and the whole Condition is at risk, not just the specific line item that tripped the survey. That's a meaningfully different structure than a checklist where each item stands alone, and it explains why financial recordkeeping deficiencies rarely appear in survey findings as an isolated citation. They tend to cascade.

Financial recordkeeping isn't confined to one tidy section of that framework either. It appears woven through multiple Conditions, which is a big part of why administrators tend to underestimate how much of the survey actually touches finance. Surveyors enforce these Conditions on an ongoing basis, not just at initial certification, so the enrollment paperwork a facility filed years ago is not the finish line. It's the starting gate.

The federal mandate to file cost reports and maintain accrual-basis records

The requirement to file an annual cost report doesn't come from CMS policy preference hklaw.com. It comes from statute, specifically 42 U.S.C. 1395g, which corresponds to section 1815(a) of the Social Security Act, paired with the implementing regulation at 42 CFR § 413.20(b). Together, section 1815(a) of the Social Security Act (1395g) and 42 CFR § 413.20(b) mandate annual cost reports from providers as a condition of receiving Medicare payments.

The accounting method matters just as much as the filing itself. Under 42 CFR 413.24(b)(2), cost data must be based on accrual-basis accounting. A facility running its internal books on a cash basis and then trying to convert everything at year-end for the cost report is inviting exactly the kind of reconciliation gap that draws scrutiny.

This obligation isn't unique to skilled nursing facilities, for what it's worth. The SNF obligation is not unique, but the SNF form and instructions are facility-specific.

Why does the accuracy of a cost report matter beyond avoiding a citation? Because that data doesn't just sit in a file somewhere. It feeds directly into how future prospective payment rates get calculated, including IPPS and OPPS base rates and wage index adjustments. A facility that files a sloppy or understated cost report isn't only risking a compliance finding. It may be shaping its own future reimbursement rate downward, which turns a recordkeeping lapse into a multi-year revenue problem.

What non-filing or inaccurate filing triggers

Start with the worst case, because it's also the most immediate one. If a facility fails to file its cost report, every interim Medicare payment received for that fiscal year is deemed an overpayment, automatically. Not flagged for review. Deemed.

From there, the Medicare Administrative Contractor issues a demand letter requiring immediate repayment of the full amount, which for a mid-sized or large facility can run into the millions of dollars. There's no grace period built into this mechanism, no phased warning system working up to the penalty. It is contractual and immediate, tied directly to the provider agreement that lets the facility bill Medicare in the first place.

CMS's treatment of medical records requests offers a useful parallel hklaw.com. Per CMS's MLN Fact Sheet MLN4840534, failing to produce even a single medical record listed in a request letter can count as one instance of non-compliance under 42 CFR 424.516(f) hklaw.com. CMS can then weigh each instance separately when deciding how long a re-enrollment bar should last, following a revocation under 42 CFR 424.535(a)(10)(ii), applied through 42 CFR 424.535(c) hklaw.com. The mechanism differs from the cost report penalty, but the underlying philosophy is the same: CMS treats documentation failures as substantive violations, not clerical footnotes hklaw.com. That ought to reframe how a finance department schedules its filing deadlines, giving them the same institutional urgency as a clinical survey date, not a lower tier of internal priority. Ultimate consequence: jeopardizes the provider agreement and participation in Medicare entirely.

How long records must be kept

Medicare Advantage organizations face a longer bar: under 42 CFR § 422.504, they must maintain books, records, documents, and other evidence of accounting procedures and practices for 10 years, to accommodate periodic auditing.

What exactly falls under this retention umbrella? Cost, revenue, and statistical information tied to reimbursement, data on Medicare utilization, the computation behind bids, and documentation of financial risk all count. CMS and its contractors can request access to this material not only to check the numbers but to evaluate the quality, appropriateness, and timeliness of the services those numbers represent, and to audit whether an organization can actually bear the financial risk it has taken on.

Treat the seven-year and ten-year figures as floors, not ceilings. These are minimums; facilities with multiple payer types or HUD-insured mortgages, a topic worth its own section further down, may face longer retention obligations layered on top. CMS does allow providers to rely on employers or third parties to physically maintain records, but that arrangement doesn't shift the responsibility. The provider is still the one who has to produce them when asked. General medical record retention is 7 years from the date of service, per 42 CFR 424.516(f) and CMS MLN4840534 (hklaw.com, cms.gov).

How surveyors evaluate financial recordkeeping compliance

Most Medicare-participating hospitals go through what's called deemed status, where a CMS-approved accreditation body, The Joint Commission being one example, conducts unannounced site visits in place of a direct CMS survey credenzahealth.com. Roughly a quarter of hospitals skip that route and face CMS surveyors directly instead credenzahealth.com. Either way, the underlying question surveyors are asking about financial records is consistent: can this data actually be verified by a qualified auditor, or does it just look internally tidy?

That's a meaningful checkpoint before a facility is even fully seated in the program, and it sets the tone for what ongoing surveys will keep checking.

Regulatory momentum is heading in a certain direction, but what's actually changed so far is narrower than that. CMS issued a proposed rule for FY 2026, the IPPS and LTCH Rule (CMS-1833-P), on April 11, 2025, signaling an intent to streamline overlapping and duplicative reporting requirements, though that intent has not yet been finalized hklaw.com. Until CMS finalizes it, current recordkeeping standards remain in full force, and treating a proposed streamlining signal as if enforcement has already relaxed is a mistake with real financial consequences hklaw.com. For newly participating providers, the MAC examines fiscal and other records before ongoing participation is confirmed, covering the full range of cost, revenue, and statistical data.

SNF-specific financial recordkeeping obligations layered on top of the baseline

Skilled nursing facilities and nursing facilities operate under their own Requirements for Participation, separate from the hospital CoP framework, so the financial standards aren't simply borrowed wholesale from what applies to a hospital down the street.

One obligation stands out as having essentially no parallel elsewhere in the provider landscape: resident trust fund accounting. Facilities that hold or manage resident personal funds have to maintain a full, separate accounting of those funds, prepared according to GAAP, with zero commingling between resident money and facility money. Quarterly statements go out to residents, and complete accounting records have to be kept behind them. This is a standalone financial control system sitting inside a nursing facility's operations, and it gets surveyed as such.

Layer on top of that the reality that most SNFs participating in Medicaid also face state-level cost reporting requirements running alongside the federal Medicare cost report.

The FY 2026 IPPS proposed rule (CMS-1833-P) expands use of the SNF three-day rule waiver under the TEAM Model, allowing patients to transfer to SNFs without a prior three-day inpatient stay, giving them wider choice of and access to post-acute care hklaw.com. That likely means more volume and more documentation obligations landing on the receiving SNF's side of the ledger. For a SNF tied into an ACO's Shared Savings Program arrangement, an ownership change now carries a reporting trigger with direct financial recordkeeping consequences hklaw.com.

Putting those pieces side by side, Medicare cost report, Medicaid cost report, resident trust fund accounting, and potential ACO reporting obligations, shows that a SNF finance team needs one coordinated internal calendar tracking all of it. Siloed ownership, where each department manages its own deadline in isolation, is how something slips.

HUD Section 232 financial reporting requirements for SNFs with insured mortgages

Section 232 insures mortgages for nursing homes, intermediate care facilities, board-and-care homes, and assisted living facilities, and audits of these financed facilities fall under the Deputy Assistant Secretary for Healthcare Programs, per HUD's Consolidated Audit Guide, Handbook 2000.4 brightdefense.com.

The financial statements these facilities produce have to comply with HUD's Uniform Financial Reporting Standards, governed by 24 CFR 5.801, with 24 CFR 200.36 cross-referencing that same standard for multifamily mortgage insurance program mortgagors brightdefense.com. An updated Section 232 Handbook takes effect January 5, 2026, and its provisions apply to all new loan applications and transactional requests going forward, meaning auditors and finance teams need to be working from the current version, not an outdated one sitting in a shared drive brightdefense.com hklaw.com.

It gets genuinely tricky operationally. The HUD audit is a wholly separate examination from the CMS cost report audit, and a facility carrying both obligations has to satisfy each one, often on overlapping timelines. The accrual-basis requirement under CMS's CoPs and the UFRS standards under HUD are compatible but not identical, and facilities that manage them as one process risk gaps in one or the other.

That's part of why auditor selection carries real weight here. HUD requires auditors familiar with both the Section 232 Handbook and UFRS, and a generalist CPA firm without healthcare housing experience is not a safe choice for a dual-obligated SNF brightdefense.com. A firm with specialized HUD 232 and SNF audit experience, the combination the CMS and HUD obligations together demand, provides measurable value over a general practitioner brightdefense.com.

The audit and assurance standards governing financial statement examinations of SNFs

Most SNFs are nonissuers, and the AICPA's GAAS framework, embodied in the Statements on Auditing Standards, governs their financial statement audits, with the current codified SAS list reflecting changes as of August 2026 hklaw.com. Facilities that happen to be subsidiaries of publicly traded health systems, or otherwise tied to an SEC-registered parent, fall instead under PCAOB standards, applicable to audits of fiscal years beginning on or after December 15, 2024, with certain amendments phasing in for fiscal years beginning on or after December 15, 2025.

An audit standard accomplishes something distinct from the cost report requirement, with which it is easy to conflate. It governs how the financial statements themselves get examined. It doesn't replace or satisfy the CMS cost report obligation in any way.

A supply-chain dimension also factors in. Billing companies, claims administrators, and EHR vendors that touch data feeding into a SNF's financial statements may themselves be subject to SOC 1 examination under AT-C 320, governed by SSAE 18 and, going forward, SSAE 23 brightdefense.com. SSAE 23 takes effect for engagements beginning on or after December 15, 2025, and aligns attestation standards with the AICPA's quality management standards, SQMS No. 1 brightdefense.com. What does that mean practically for a SNF? Any facility outsourcing billing or claims processing should be asking that vendor for a current SOC 1 Type II report, because the vendor's internal controls flow directly into the SNF's own financial statement assertions, and from there into the integrity of its cost report data.

One might argue the audit is just another compliance box to check. It isn't, or at least it shouldn't be treated that way. A well-executed financial statement audit surfaces weaknesses in the underlying recordkeeping system before a surveyor or a MAC auditor ever gets there, because the audit process examines those records directly, and that timing difference is the entire gap between fixing something quietly and receiving a demand letter.

A practical internal recordkeeping compliance program for a SNF finance team

Start by mapping every deadline onto one calendar rather than several. Medical record retention requires a 7-year minimum from date of service (10-year minimum for MA-related records); HUD Section 232 audits need to coordinate with updated handbook provisions effective January 5, 2026; and for any SNF that is a Shared Savings Program affiliate, ownership changes must be reported during the performance year under the proposed CY 2026 PFS rule brightdefense.com hklaw.com.

Accrual-basis discipline deserves attention at month-end close, not just once a year at filing time. The single most common cost report deficiency comes from a mismatch between cash-basis internal reporting and the accrual-basis figures the cost report actually requires, and building that reconciliation into the monthly close cycle catches the gap early, rather than scrambling to bridge it under deadline pressure.

Resident trust fund accounting should run as its own standalone function, with its own reconciliation cycle separate from general operating accounts.

Poor vendor oversight can expose a facility to control failures and compliance gaps in its own financial statements. Facilities should be pulling SOC 1 Type II reports annually from any billing or claims processing vendor, and documenting that review as part of the facility's own internal control environment. The standard to hold internal documentation to is simple to state and harder to live up to: records need to be verifiable by a qualified auditor, and knowing the data exists somewhere in the system isn't the same as being able to produce it, in the format CMS expects, the moment it's requested.

CMS's own regulatory posture, acknowledging overlap and duplication across its reporting requirements, is actually useful information for a compliance program, not just a policy footnote. A strong working relationship with an audit team can help a facility figure out which obligations are genuinely redundant and which carry distinct enforcement risk on their own, which matters enormously when compliance staff and budget are finite. The FY 2026 IPPS proposed rule signals a streamlining direction, but proposed rules are not final rules, and compliance programs built on anticipated relaxation before final publication create enforcement exposure hklaw.com.

None of these frameworks, CMS CoPs, HUD Section 232, the Medicare cost report, and GAAS-based financial statement audits, sit neatly inside a single department's job description brightdefense.com. SNFs managing the intersection of CMS CoPs, HUD Section 232, Medicare cost reports, and GAAS-based financial statement audits need advisors who understand all four frameworks, not separate specialists who optimize each in isolation brightdefense.com. That's less a compliance checklist than a description of how the whole system actually holds together, or doesn't, depending on how seriously a facility treats the recordkeeping that produces this outcome.