Every requirement below links to the regulation it comes from. Before publishing, have the policy team review the summaries; this post explains requirements in plain language and isn't legal advice.
TL;DR
- Some written policies are required by federal rules, but they are dispersed across several rules and are not consistent across care settings.
- Almost everyplace, emergency preparedness policies are necessary, but nursing homes review them annually and CAHs review them biennially.
- A CAH has a list of required patient care policies identified and reviewed at least every two years by a professional advisory group.
- Written policies on abuse prevention, infection control and others are required in nursing homes, and the infection control program is reviewed on an annual basis.
Programs with SUD records in behavioral health had to update consent, notice and breach policies for the revised 42 CFR Part 2 by Feb. 16, 2026.
Why ‘what do we need in writing?’ is more difficult than it sounds
Ask most compliance or nursing leaders what policies they have to have and you’ll get a confident answer for their own department and a shrug for everything else. That’s not a diss on anybody. Federal requirements for written policies are scattered across different regulations, vary depending on the care setting, and have review cycles that don’t line up.
Here’s a summary of requirements for three settings we work in every day: critical access hospitals, skilled nursing facilities and behavioral health programs. Each requirement is cross-referenced to the regulation or agency guidance it is derived from so you can check the source yourself. This is a starting point for a policy review, not legal advice, and your state and accreditor may add their own requirements.
One thing all settings have in common: emergency preparedness
If you want an example of how specific federal policy requirements can get, start here. CMS’s emergency preparedness rule applies to most all types of Medicare and Medicaid providers and it’s not just looking for a plan. It calls for written policies and procedures based on that plan, a risk assessment and a communication plan. It puts a clock on reviewing those policies and procedures.
The clock is not the same for all. Critical access hospitals must review and update its emergency preparedness policies and procedures at least every 2 years. A long-term care facility must do the same at least annually, as well as its emergency plan, communication plan and training program. Nursing homes also must conduct drills twice a year, including unannounced staff drills.
It’s a small difference, but it’s the kind of thing that trips teams up. A policy set copied from a hospital or a review calendar built around one setting can quietly throw another out of compliance.
Critical access hospitals: names, reviewed every two years
The written policy requirement in the federal rules is among the simplest for CAHs. The services of a CAH are to be provided in accordance with written policies required by the CAH Conditions of Participation. The regulation spells out what those policies must contain:
- Description of services provided by the CAH including services provided under contracts or arrangements
- Emergency medical services policies and procedures
- Medical management protocols, including when patients should be consulted or referred, how health records are kept, and how services are periodically reviewed
- Rules for the storage, handling, dispensing and administration of drugs and biologicals
- Reporting procedures for adverse drug reactions and medication errors- Procedures to meet the nutritional needs of patients
- Policies to meet the post-acute care needs of patients
The same section explains who writes them and how often they are revisited. Policies are developed with input from the CAH’s professional staff, including at least one physician and one PA, NP or clinical nurse specialist, if they are on staff. The group has to review them every 2 years at least and the CAH updates them as necessary.
The real question for a small team is not do those policies exist somewhere. It's if you could show a surveyor the list, the last review of the advisory group and what changed because of it.
Skilled nursing facilities: written policies all over the rules
Nursing homes don’t get a clean list like CAHs get. The long-term care requirements in 42 CFR Part 483 are written out policy by policy, so they’re easy to miss if you don’t know where to look. Some of the most important ones:
- Abuse, neglect and exploitation. Facilities shall develop and implement written policies and procedures prohibiting and preventing abuse, neglect, exploitation and misappropriation of resident property. Those policies also need to specify how allegations will be investigated, connect to required staff training, and work with the facility’s QAPI program. Surveyors call this F607 and it shows up in public inspection reports all the time.
- Infection control and prevention. The facility’s infection prevention and control program must include written standards, policies and procedures, including hand hygiene procedures for staff with direct resident contact. The program will also be subject to annual review and updating as necessary.
- Emergency preparedness. Nursing homes must review emergency preparedness policies annually, not every two years, as discussed earlier.
Operators with more than one building face the challenge of consistency. Every facility needs these policies, and every facility needs to be the current copy. Corporate updates that only reach some buildings are still a gap.
Behavioral Health: Confidentiality Rules Just Changed
Of the three, behavioral health is the most difficult to generalize because the needs are different depending on what kind of program you operate. A psychiatric hospital, a community mental health center and an outpatient counseling practice are subject to different federal rules, state licensing agencies and accreditors such as CARF or The Joint Commission.
One federal requirement runs through many of them, and it’s a new one. Programs with a history of treating substance use disorders are subject to 42 CFR Part 2, which HHS substantially modified in 2024. The HHS fact sheet gave organizations until Feb. 16, 2026 to comply with the amended rule.
The changes go directly into written policy. The rule now permits one patient consent to cover future uses and disclosures for treatment, payment and health care operations; harmonizes Part 2 notice requirements with HIPAA; and introduces HIPAA-style enforcement and breach notification to Part 2 records. For most programs, that means revising consent forms, privacy notices, breach procedures and staff training.
If you haven’t updated your SUD confidentiality policies since early 2026, that’s a good place to start. What was right two years ago is not necessarily right today.
Turning a list into a review plan
Having a list of requirements only helps if it changes what your team does next. A simple way to use this one is:
- Identify the sections that apply to your setting. 2. Find the policy that addresses each requirement. The first gap is any non-matching.
- ensure each policy has the correct review cycle. On paper, annual and biennial reviews look the same, but not having the annual is a finding.
- Verify the dates. For example, a policy that was last reviewed prior to a rule change (eg the 2026 Part 2 compliance date) has to be reviewed again, even if it has been recently reviewed.
- Ensure the current version is the one staff can find, everyplace.
How Ntracts Can Help
The Ntracts Policy Manager puts every policy, its review cycle and its approval history all in one place so a missed annual review is flagged before a surveyor spots it. In our Policy & Procedure Library, we have care-setting libraries for Critical Access Hospitals, Long Term Care and Behavioral Health that include manuals that are cross-referenced to CMS regulations and accreditation standards. For example, the Long Term Care Library has a dedicated Infection Prevention and Control Manual, a Long Term Care Environment of Care Manual and an Influenza Pandemic Preparedness Guide so the requirements above have a starting point. And StayAlert! tracks federal agencies and accrediting bodies daily, and emails your team when there’s a change.