Payroll Tax Compliance Risks for Long-Term Care Operators

Payroll tax compliance is a back-office function everywhere. In long-term care, payroll tax compliance risk affects Payroll-Based Journal reporting, outsourced labor disclosure under the new CMS cost report, multi-state employment tax complexity, and tightening IRS enforcement, and this piece maps where those exposure points cluster and why each carries more weight than it would in most other industries.

Why payroll tax compliance hits harder in long-term care than in most industries

Start with the workforce itself. A single skilled nursing facility might run payroll for licensed nurses, CNAs, therapy contractors, dietary staff, housekeeping, administrative personnel, and agency workers, all inside one building, all subject to different classification rules and different reporting obligations. Labor is also the dominant cost line in this industry, and unlike most sectors, that labor data doesn't stay internal: it feeds directly into CMS reporting, HUD audit requirements, and state agency filings that a manufacturing company or a retail chain would never touch.

The scale of the underlying problem is not small. The IRS's most recent tax-gap projection attributes $127 billion to employment taxes specifically, with an 85.0% voluntary compliance rate in that subcategory, which tells you the government sees payroll tax error as a live enforcement target rather than a rounding error. Industry research pegs the average cost of payroll noncompliance at $845 per employee per year once fines, back wages, penalties, and internal remediation get tallied up, and at LTC staffing levels, that number compounds fast. Layer on workforce pressure: an RSM US survey found 52% of organizations say workforce regulations affect their ability to hire, 56% cite effects on competitive compensation, and 49% call regulation a retention obstacle, and long-term care, already running a chronic staffing shortage, feels those pressures more acutely than most.

A payroll error rarely stays contained to payroll. It propagates into cost reports, into public quality ratings, into regulatory filings, and the exposure that results is often larger than the original penalty ever would have been. The sections that follow trace exactly where in the LTC operating model those exposures concentrate.

How the staffing mandate repeal shifted CMS oversight without reducing it

CMS published an interim final rule in December 2025 that repealed the Biden-era minimum staffing standards, and the rule took effect February 2, 2026, eliminating the 24/7 RN requirement and the minimum nurse hours per resident per day standard. A repeal like that sounds like less oversight. It isn't. CMS redirected its attention from minimum staffing ratios toward transparency around workforce cost and hours, which is arguably a harder target to hit cleanly.

Two data streams now carry that transparency burden. Payroll-Based Journal reporting was untouched by the repeal: facilities still submit direct care staffing data every quarter, that data still feeds the Five-Star Quality Rating System, and errors in it still affect public ratings and can trigger enhanced oversight.

CMS isn't just collecting this data and filing it away. Auditing of VBP and QRP data began in January 2026, covering a randomly selected group of skilled nursing facilities, roughly 10% of certified providers. That's an active audit environment, not a theoretical risk sitting somewhere down the road. Nine in ten nursing facilities still report difficulty recruiting, so the workforce gap that drove reliance on contract labor in the first place hasn't closed. So the disclosure requirement lands hardest on exactly the facilities most dependent on the labor category now under scrutiny.

What makes this especially uncomfortable is that most PBJ errors aren't intentional. They come from manual data entry across time-and-attendance systems, payroll systems, and reporting tools that don't talk to each other, a structural problem baked into the workflow rather than a one-off mistake by a careless employee. A facility can have completely accurate payroll records and still carry real compliance exposure if it can't reliably translate those records into a PBJ submission. That risk does not necessarily come down to underpaying anyone. It's about whether the systems can talk to each other accurately.

Origins of PBJ data errors and their costs when found

Where exactly does the breakdown happen? Usually at the seam between systems. Time and attendance lives in one platform, payroll runs in another, and PBJ data often gets compiled from a spreadsheet somewhere in between, and every handoff between those systems is a place where hours, employee classifications, or pay-period boundaries can slip out of alignment. A charge nurse coded as a CNA in one of those handoffs isn't just a payroll clerical error. It distorts the staffing-level data regulators use to judge care quality, so the mistake originates in payroll but lands as a regulatory problem.

Facilities flagged for PBJ inconsistencies face a specific set of consequences. There's downward pressure on Five-Star ratings, which is a public, reputational hit that follows a facility around in front of families making placement decisions. There's also elevated scrutiny in CMS VBP and QRP audits already underway.

The 2540-24 cost report adds a second layer of cross-checking. If the PBJ hours reported for contract staff don't match the cost-and-hours disclosure on the cost report, that gap is visible to auditors and state agencies at the same time, not sequentially. And the dollar stakes just went up: the FY 2026 SNF PPS rate update raised rates by 3.2%, an increase of $1.16 billion compared to FY 2025, which means more Medicare revenue now flows through cost reports and VBP calculations CMS.

None of this is really about any single transaction gone wrong. It's a systemic exposure built into how data moves between systems that were never designed to reconcile with each other automatically.

Contractor classification and 1099 reporting as a concentrated exposure point

Long-term care sits in an unusually 1099-heavy corner of healthcare. A mismatch between those two records is exactly the kind of thing that draws an auditor's attention.

The 2026 threshold change, raising the reporting floor from $600 to $2,000 for most contractor payments, thins out the paperwork for small vendor payments. It does nothing, though, to reduce the risk sitting with the high-dollar contractors, the therapy groups and staffing agencies, that make up most of LTC's contractor spend. Those relationships are exactly where the Labor Department's proposed joint employer standard becomes relevant: when a staffing agency places workers inside a skilled nursing facility, both the agency and the facility may share FLSA obligations around overtime and FMLA headcount eligibility, and a compliance failure by either party can produce joint-and-several liability for both. That's a real, concrete burden shared by both parties. That's full exposure landing on the facility even when the staffing agency made the mistake.

IRS information-return penalties add up quickly at LTC scale. The per-form penalty for a late or incorrect filing can run into the hundreds of dollars, and multiplied across the volume of W-2s, 1099-NECs, and 1099-MISCs a large LTC organization files in a year, a single systemic reporting failure produces a material penalty exposure rather than a nuisance fee. Under the SECURE 2.0 Act, IRS Notice 2026-33 requires plan administrators making qualified long-term care distributions to report them on Form 1099-R. Defined contribution plans that aren't governmental plans, aren't section 403(b) plans maintained by a public school, and aren't collectively bargained have until December 31, 2027 to amend their plan documents if they permit these distributions. LTC employers running defined contribution plans need to decide, deliberately, whether to allow these distributions at all, and if so, whether payroll and plan administration systems are actually configured to handle them. The classification of a worker as employee vs. independent contractor) carries compounding risk in LTC because the same worker often appears in both CMS PBJ data (which tracks hours by worker type) and IRS information returns (which depend on classification), and a mismatch in how the same person is treated across those systems is an audit flag.

Multi-state and remote workforce complexity for LTC operators with multiple locations

Operators running facilities across state lines carry payroll tax obligations in all 50 states, including the nine with no income tax, plus whatever local jurisdictions layer their own withholding rules on top, sometimes treating something like stock options differently at the local, state, and federal level simultaneously. That's complicated enough for clinical staff tied to a physical building. It gets worse for remote administrative employees, billing specialists, HR staff, finance teams, whose state residency can trigger payroll reporting obligations in a location that has nothing to do with where the facility itself is registered.

The One Big Beautiful Bill Act added another moving piece. It introduced provisions on tips and overtime that raised real questions about Form W-2 reporting obligations, and while transitional relief for 2025 let a lot of organizations sit on their hands, 2026 brought mandatory reporting requirements into effect. Operators who took a wait-and-see posture through 2025 now face near-term configuration work inside their payroll systems, work that should have started months ago in some cases CMS.

None of this gets simpler with growth. States follow different versions of the Internal Revenue Code and apply their own withholding logic on top, so an operator expanding from one state into another cannot assume the payroll configuration that worked in the first state transfers cleanly to the second. Add to that a practical wrinkle flagged in RSM's analysis: IRS funding cuts and government shutdown effects have made it harder for organizations to get timely guidance or even a response to correspondence, which shifts the burden of proactive compliance research further onto the employer, not less. The common failure mode among multi-site LTC operators is bandwidth. Lean payroll teams stay focused on getting the current pay cycle processed correctly, leaving little time to audit cross-jurisdictional exposure, and that gap becomes visible only once a notice arrives. Payroll Tax Compliance Risks for Long-Term Care Operators.

The federal penalty structure and the 2026 enforcement environment

The penalty math itself demands cold familiarity. Failure-to-file starts at 5% of unpaid tax per month, capped at 25%; failure-to-pay starts at 0.5% per month, also capped at 25%; and if a return runs more than 60 days late, the minimum penalty is $510 for 2026 returns, or 100% of the unpaid tax, whichever is smaller Payroll tax penalties: Federal rules and 2026 state rates. Failure-to-deposit penalties can climb to 15% of the unpaid deposit once a CP220 or CP504J notice has gone out, and this is the tier that most often catches operators who are current on filing but running into cash-flow timing issues on remittances Payroll tax penalties: Federal rules and 2026 state rates. An operator can be doing everything right on paperwork and still get hit hard because the money moved a few days late.

A new mechanism on the relief side changes how this works. The Automatic Exemption from Penalty, or AEP, gives automatic penalty relief to employers with a clean history of timely filing and payment, applied per-penalty rather than per-quarter, for taxpayers with a qualifying three-year or 12-quarter compliance record. The IRS hasn't said relief is limited to just the first penalty in a given quarter, though additional penalties beyond what AEP covers still require a separate abatement request. AEP starts phasing in during summer 2026 and fully replaces First Time Abate for returns with original due dates on or after January 1, 2027.

Meanwhile, mandatory e-filing thresholds keep dropping, pulling smaller and mid-sized LTC operators into electronic reporting environments with built-in validation checks, and operators who haven't made that transition yet face both a technical migration and heightened penalty risk during the changeover. There's also an older shadow still hanging over the sector: a GAO report found the IRS had processed nearly 5 million Employee Retention Credit claims as of June 2025 and identified aspects of the credit's design that increased improper payment risk. Operators that claimed the ERC during the pandemic remain exposed to review, disallowance, and repayment demands years later. And on top of all this, the IRS's 2026 "Dirty Dozen" scam list called out AI-enabled IRS impersonation and W-2 overstated withholding schemes, the kind of phishing that experts note tends to target payroll functions specifically, and a large workforce paired with lean internal controls makes LTC operators a plausible target.

How HUD Section 232 and cost-report audit requirements intersect with payroll data

A large share of SNF and assisted living operators carry HUD-insured debt under Section 232, a financing arrangement that comes with its own annual audit requirement, entirely separate from anything CMS demands. HUD requires two audits, not one: a financial statement audit and a compliance audit of major HUD programs, both performed under generally accepted auditing standards and government auditing standards. The thresholds are specific: profit-motivated multifamily projects need audited financial statements once annual expenditures or HUD-insured loan balances hit $500,000, and non-profit projects cross that line at $1,000,000, for fiscal years beginning on or after October 1, 2024.

The clock on this is tight. Submissions are due 90 days after fiscal year end, with the owner certifying accuracy and completeness, a narrow window for any operator whose payroll and cost-report reconciliation is still unfinished when the fiscal year closes. Operators entering the program fresh or refinancing existing debt also need to check which version of audit procedures actually governs their engagement, since updated Section 232 Handbook provisions took effect January 5, 2026 and apply to all new loan applications and transactional requests.

The connection back to payroll is direct. HUD's financial statement auditors have to evaluate the same cost-report data, labor costs, outsourced staffing hours, that CMS auditors are separately reviewing, so a discrepancy between what an operator tells CMS and what appears in its HUD-submitted financial statements becomes a finding in both channels at once. HUD treats these independent audits as its first line of defense in judging the financial condition of a multifamily ownership entity, which means the quality of the audit engagement itself, and how well the auditor understands the sector, directly shapes how HUD scores the operator. The HUD OIG focused desk reviews on 51 single audits submitted between April and June 2025 during the October–December 2025 period, reflecting active OIG oversight, not a latent risk.

The role of SOC 1 reports when payroll is outsourced to a third-party processor

More LTC operators are handing payroll processing, HR administration, and benefits management off to third-party service organizations. The compliance question remains, it just relocates where the evidence lives. When payroll runs through an outside vendor, the operator's own financial statement auditor still has to evaluate that vendor's SOC 1 Type II report, the document that assesses whether the vendor's internal controls actually support the operator's financial reporting.

Gaps or exceptions inside that vendor's SOC 1 report don't stay quietly at the vendor level. They force compensating controls or expanded audit procedures back at the operator, which drives up both the cost and the scope of the audit. If the vendor can't produce a clean SOC 1 report, the findings that follow don't stay contained to one channel: they can trigger scrutiny under HUD's Section 232 requirements, surface inside CMS financial reviews tied to cost-report submissions, and even affect an operator's standing under the Five-Star system if staffing data integrity gets called into question.

The assumption is that "the payroll vendor is reputable, so the compliance risk belongs to them."" It doesn't. The financial statement audit assigns responsibility back to the operator, for understanding the vendor's control environment and for documenting it. Which is really the throughline across every section here: LTC operators should request and review SOC 1 Type II reports from payroll, since the reporting obligation always traces back to the operator, no matter how many systems or vendors sit between the timesheet and the filing.