Related-Party Transaction Disclosure Requirements on SNF Cost Reports

Related-party transactions sit at the center of every skilled nursing facility's Medicare cost report, and the rule governing them, 42 CFR §413.17, has stood unchanged for roughly four decades. That stability is deceptive: the volume of money flowing through related-party arrangements has grown substantially, while the systematic oversight needed to check it has stayed essentially absent.

Why Related-Party Transactions Are So Consequential on SNF Cost Reports

The regulation itself is narrow and specific. Under 42 CFR §413.17, a cost that a skilled nursing facility incurs from a related organization can only be counted as an allowable cost at that related party's actual cost. The facility cannot report a marked-up price, and it cannot report a figure above what it would pay an unrelated vendor on the open market for the same service. The rule defines "related" broadly, by common ownership or control. It reaches well past the obvious cases. Management companies count. So do real estate holding entities that own the building the SNF operates in, staffing agencies that supply nursing labor, pharmacies that fill resident prescriptions, and medical supply companies, as long as any of them share a parent company or controlling owner with the facility.

The dollar figures involved are large enough to explain why this single rule carries so much weight in the broader cost reporting structure. OIG audit A-07-21-02836 found that for Medicare cost reporting periods covering fiscal years 2015 through 2020, SNFs reported paying $65.4 billion to related parties. A January 2025 Medicare Advocacy report adds that facilities now direct a growing share of their Medicare payments to businesses they themselves own or control.

That scale exists because the structure of related-party ownership creates a straightforward incentive to inflate costs. A facility that owns its own staffing agency or its own real estate holding company can charge itself more than those entities actually spend to provide the service, and if the cost report is not adjusted down, Medicare reimburses the inflated amount. The profit appears as revenue inside a related company, moved there through intercompany pricing. Combine that incentive with $65.4 billion in related-party flows over a six-year window and oversight that, as later sections show, has been thin to nonexistent, and the result is a compliance environment where a single rule, one that has not changed in forty years, carries a level of financial risk that few other line items on the cost report can match.

What 42 CFR §413.17 Requires SNFs to Do on Their Cost Reports

Despite the stakes, the compliance obligation itself breaks down into two clear steps, and a facility has to get both right for its cost report to hold up.

The first step is disclosure. A SNF has to identify every related organization it deals with on the cost report, describe the nature of the relationship, whether it is common ownership, shared control, or some other connection, and specify the services, supplies, or facilities that organization furnished to the SNF during the reporting period. This is not a one-time registration. It has to happen on each cost report, for each related party active during that period.

The second step is cost adjustment. Where a related party charges the SNF more than the related party's own actual cost to provide that service, the facility has to adjust the reported figure downward, to whichever is lower: the related party's actual cost, or the comparable price available on the open market. This mechanism removes the financial incentive to profit through intercompany transactions. A facility cannot report a management fee paid to its own management company that is substantially higher than that company's actual cost to provide those services, and the excess above that actual cost has to come off the cost report.

There is a narrow exception. Under 42 CFR §413.17(d), a facility can argue that a given transaction was conducted at arm's length, structured and priced the way an unrelated party would have negotiated it, and should therefore be exempt from the downward adjustment. But claiming that exception requires documentation, and as the next section shows, Medicare Administrative Contractors have not been consistently reviewing, granting, or documenting these exception requests, which leaves a real gap between what the rule allows on paper and what gets checked in practice. Common arrangements that trigger both the disclosure step and the adjustment step include management fees, intercompany rent paid to a related real estate holding entity, staffing agency charges, pharmacy supply agreements, and shared administrative cost allocations across a multi-facility ownership group. The rule's language on all of this has not changed in decades, the Medicare Advocacy report states. Facilities are not working against a shifting or ambiguous standard. The standard has been settled for a long time. What has changed is how closely anyone checks whether facilities are meeting it.

What the December 2024 OIG audit found about how facilities actually comply

OIG audit A-07-21-02836, completed December 18, 2024, gives the clearest picture available of how SNFs actually perform against that settled standard, and the picture is not reassuring. Most facilities in the audit's sample had at least one deficiency tied to 42 CFR §413.17, and the audit found that oversight from Medicare Administrative Contractors was effectively nonexistent.

The failures split cleanly along the two steps the rule lays out. Several SNFs in the nonstatistical sample failed the first step outright: they did not properly disclose one or more related parties on their Medicare cost reports, so the relationship never appeared where a reviewer could find it. Half the facilities in the sample, 7 of 14, failed the second step: they did not properly adjust related-party costs down to Medicare-allowable levels, and that failure alone produced more than $1.7 million in overstated costs. OIG also found that MACs did not review related-party disclosure or cost reporting as part of their normal desk review or audit process, so the backstop meant to catch these errors was not functioning. CMS, for its part, had not given SNFs sufficient guidance on how to determine Medicare-allowable related-party costs in the first place, so part of the noncompliance traces back to an instruction gap.

The Medicare Advocacy report's Pruitt Health example puts a concrete face on the pattern. Pruitt Health owns nearly 90 nursing facilities across Florida, Georgia, North Carolina, and South Carolina, and its Medicare cost reports for 2018 through 2020 showed payments to related parties that ran substantially above the actual costs those related parties themselves reported, an overage the report describes as significant, and the pattern is not isolated to this one case. The same report notes that more than three-quarters of nursing facilities nationwide reported payments to related third parties, and yet no MAC, and no other federal entity, systematically checks whether those payments comply with the related-party rules. One might ask how a rule this specific, with a dollar-denominated test built directly into its text, could go unchecked at this scale for this long. The answer sits less in the rule itself and more in who was ever assigned to enforce it, which is the question the next section takes up directly.

Why CMS's response to the OIG audit leaves SNFs in a more exposed position

OIG's audit came with three recommendations, and CMS's response to them tells facilities a lot about where the compliance burden is headed next. CMS accepted two of the three and rejected the one that would have put a systematic check in place.

The rejected recommendation, numbered 25-A-07-028.01, called for MACs to build related-party disclosure and cost review into their normal desk review or audit process. CMS did not concur, and as of October 2026 the recommendation remains open and unimplemented. That leaves facilities without the kind of systematic check OIG itself described as necessary, having identified more than $1.7 million in overstated costs across a sample of just 14 facilities. CMS's stated reasoning was that additional costs, including non-allowable related-party costs, do not have a direct impact on Medicare payment to SNFs, and that requiring MAC audits would demand significant resources without a commensurate payment impact. That argument holds up only if cost report data stays walled off from rate-setting, and it does not. Overstated costs reported across the sector feed directly into the market-basket updates CMS uses to set prospective payment rates for the entire SNF industry. The rate effect is real even where the per-claim reimbursement effect that CMS cited is not.

The two recommendations CMS did accept matter for a different reason: they raise the standard facilities are held to without adding a new audit mechanism to enforce it. Recommendation 25-A-07-028.02, which called for CMS to develop and issue guidance on appropriate methods for determining allowable related-party costs, was concurred with and closed as implemented in mid-2026. Recommendation 25-A-07-028.03, calling for guidance to reeducate MACs on reviewing, granting, and documenting exception requests under 42 CFR §413.17(d), was also concurred with and closed as implemented in mid-2026. Practically, that means SNFs now have updated CMS guidance they are expected to apply, and MACs have been reeducated on how the exception process is supposed to work. A facility that had been treating the absence of MAC review as a quiet safety net has less cover now that the guidance has been formalized. The oversight structure itself has not tightened in the way OIG wanted. The standard facilities are measured against has.

CMS Cost Report Form CMS-2540-24 and the Disclosure Stakes

Running alongside the guidance changes is an operational shift that will matter more to most facilities day to day: CMS has overhauled the SNF cost report form itself, the most significant change to the form in over a decade, and the new version increases the granularity of cost reporting in ways that make related-party misstatements harder to hide.

The new form, CMS-2540-24, applies to cost reporting periods ending on or after September 30, 2025. All reports must now be filed electronically in ECR format, with MCReF as the preferred submission portal, though physical submission by mail or hand-delivery remains technically permissible. A new field, "Paid Claims Verified Current As Of," improves the accuracy of the underlying claims data the cost report draws on. CMS has built in a one-time grace period for 2025 only, covering cost reporting periods ending anywhere from March 1 through December of that year, to help facilities transition.

The part of this that matters most for related-party compliance is the added granularity in the cost lines themselves. Related-party costs that used to sit buried inside aggregated overhead categories will now be more visible to CMS analysts reviewing cost-to-charge ratios, even without any new formal audit requirement attached to the form. A facility does not need a MAC desk review to get flagged if the underlying data makes an inflated related-party charge stand out on its own. According to the Bencura analysis, cost report filings made under CMS-2540-24 will directly shape future SNF payment policy and rate-setting, which reinforces the same point OIG raised when CMS rejected the systematic MAC review recommendation: cost report accuracy feeds rate-setting whether or not anyone audits it line by line.

The ownership disclosure rule that compounds the cost report obligation

A second federal requirement now runs alongside the cost report and checks the same underlying facts from a different angle. The November 2023 CMS ownership disclosure rule, combined with a completed enrollment revalidation process, means the ownership information SNFs submit to Medicare now forms a public record, and that record can be checked against what a facility discloses as related parties on its cost report.

The revalidation deadline moved several times before settling. CMS originally set May 1, 2025, as the application due date for all SNFs regardless of state, then pushed it to August 1, 2025, then to January 1, 2026, before ultimately suspending the off-cycle revalidation process indefinitely. A large volume of ownership disclosure data is now in federal hands regardless of how the deadline shook out. The CMS Skilled Nursing Facility All Owners dataset draws on that enrollment data, updates monthly, and as of this writing reflects information through August 2026.

What this creates is a cross-check that did not meaningfully exist before. A related party that appears correctly in a facility's enrollment record but is missing from its cost report, or the reverse, now produces an inconsistency that a reviewer can spot simply by comparing the two public datasets side by side. The OIG finding that several SNFs failed to disclose related parties on their cost reports reads differently in this context than it would have five years ago. Those same entities are now required to show up in the enrollment system regardless. A facility's non-disclosure on the cost report, the specific failure that produced $857,169 in overstated costs from undisclosed related parties alone according to the HHS Office of Inspector General, is no longer just a common oversight. It is a far more detectable one: the enrollment record sitting next to it tells reviewers what should have been there.

Financial Statement Audits as a Parallel Disclosure Track

The same intercompany transactions that trigger disclosure and adjustment obligations on the Medicare cost report also fall under a separate, independent requirement: identification and disclosure in a facility's audited financial statements, governed by generally accepted auditing standards. In a number of state and federal contexts, those audited financial statements are not optional attachments. They are a mandatory part of the compliance record.

Under GAAS, auditors examining a SNF's financial statements are required to identify related-party relationships and transactions as part of the audit, evaluate whether those transactions have been properly accounted for and disclosed under the applicable financial reporting framework, and assess whether the statements fairly reflect an arm's-length characterization of the relationship or require some form of modification or added disclosure. This runs on a separate timeline from the Medicare cost report and answers to a separate set of standards, but it covers exactly the same underlying arrangements, the same management fees, the same intercompany rent, the same staffing and pharmacy agreements that 42 CFR §413.17 governs on the cost report side. A facility's management fee to its own management company has to be disclosed and justified to a financial statement auditor working under GAAS in the same reporting period it has to be disclosed and adjusted on the Medicare cost report. Two different standards, two different reviewing audiences, one transaction. Facilities that treat the cost report disclosure and the financial statement disclosure as separate compliance tasks, handled by separate teams working from separate records, are the ones most likely to find the two tracks drifting out of alignment with each other, at exactly the moment ownership data, cost report granularity, and audit attention are all converging on the same set of transactions.