Behavioral health and IDD providers: what an audit looks like
Accreditation surveyors, state reviewers and OCR each pull different records from a CARF or Joint Commission accredited provider. This page lists what they request, how they sample, and the findings that recur, using New York as the state example.
help
Who comes, and how often
CARF survey team
Peer surveyors review documentation, observe services, and interview persons served, personnel and other stakeholders to decide conformance to the standards. Access to all documents is an accreditation condition, including active and closed files of persons served and human resource files.
The Joint Commission (Behavioral Health Care and Human Services)
Surveyors trace individuals served through their care, then review competence files, environment of care and leadership data use.
HHS Office for Civil Rights (HIPAA and 42 CFR Part 2)
Complaints, breach reports and compliance reviews. Part 2 violations are enforced through the HIPAA civil penalty and breach provisions.
What they ask to see
CARF leadership and compliance documents
CARF's required written documentation includes written ethical codes of conduct, procedures for alleged violations, a corporate compliance policy adopted by leadership, written procedures on exclusion from federally funded programs, and documentation of the designated compliance officer.
CARF 2026 Standards Manual, Appendix A, Section 1.A (1.A.6, 1.A.7)Source ↗
CARF risk, safety and workforce documents
Appendix A lists the risk management plan, technology and data policies, emergency procedures with written evidence of unannounced tests, critical incident procedures with annual analysis, and health and safety training documented at orientation and at least annually. For the workforce it adds job descriptions, background and credential verification procedures, competency documentation and cybersecurity training.
CARF 2026 Standards Manual, Appendix A, 1.G, 1.H and 1.ISource ↗
CARF rights, complaints and performance documents
Policies on the rights of persons served, the formal complaint procedure, complaints received and their annual documented analysis, plus documented analyses of service delivery performance with action plans.
CARF 2026 Standards Manual, Appendix A, 1.J, 1.L and 1.MSource ↗
Joint Commission requested documentation list
On arrival surveyors ask for the organization chart, results of data analysis (performance improvement, infection control, environment of care, emergency management evaluations), lists of individuals served by program with diagnosis, reports from licensing and other external bodies, and the latest culture of safety data.
Behavioral Health Care and Human Services Survey Activity Guide, Requested Documentation List (issued June 15, 2026)Source ↗
What they pick on the day
Individual tracers through records of care
Joint Commission picks tracer candidates from the services in the e-application and the risk areas in the Intra-Cycle Monitoring Profile, and starts from the record of care. Tracers typically run 60 to 120 minutes and can add program-specific topics such as suicide prevention, violence prevention and elopement.
Staff and credential files chosen from the tracers
The Joint Commission surveyor names the staff, licensed practitioners and physicians whose personnel or credential files to review, based on what the tracers showed.
Case records, starting with five active files
The OASAS instrument scores the first five active case records. If fewer than 65% of items are met, reviewers add records until 65% is reached or ten are reviewed.
Documents, files and interviews on the CARF survey
The survey team determines conformance by observing services, interviewing persons served and other stakeholders, and reviewing documentation. Unavailability of key staff needed to show conformance can be grounds for Nonaccreditation.
What gets cited, with counts where they are published
Screening for risk of harm to self or others
12 of 105 surveys (11%) July 1, 2019 to September 30, 2020
In Joint Commission's review of opioid treatment program surveys, 12 of 105 had moderate to high risk observations on the screening procedure standard. Contributing factors included staff not educated on existing policies, screening tools and documentation expectations.
What is not published
CARF publishes no list of most-cited standards or outcome rates, and the Joint Commission's only public survey-finding dataset for this program covers 2019 and 2020 opioid treatment programs.
Where written policies come in
Policies adopted by leadership and applied to everyone
CARF requires a corporate compliance policy adopted by leadership for organizations receiving federal funds. OMIG's most common policy finding is wording that does not cover all affected individuals, which includes the governing body and contractors.
Who was trained and when
CARF requires documented competency-based health and safety training at orientation and at least annually. OMIG expects compliance training at orientation and annually and suggests documenting who completed it, and OASAS asks for Code of Conduct attestations at hire and every year.
Whether staff can describe the policy
Joint Commission surveyors interview staff on processes such as risk screening, workplace violence prevention and down-time procedures. Its opioid treatment program review lists staff not being educated on existing policies and screening tools as a contributing factor.
Part 2 and HIPAA written procedures
Part 2 requires formal written policies and procedures to protect patient identifying information, and OCR's corrective action plan for the Illinois provider required written HIPAA policies and procedures with annual training for workforce members who access ePHI.
Dates that matter
| Date | What happens | Status |
|---|---|---|
| February 16, 2026 | Compliance date for the 2024 final rule on 42 CFR Part 2 confidentiality of substance use disorder records Source ↗ | Done |
| July 1, 2026 | CARF 2026 standards manuals apply to surveys (through June 30, 2027) Source ↗ | Done |
| 2027-07 | HIPAA Security Rule overhaul final action (listed under long-term actions) Source ↗ | Expected |
Questions people ask
How much notice do CARF and Joint Commission give?
CARF sends written notice of survey dates at least 30 days ahead. Joint Commission surveys most behavioral health organizations unannounced or on short notice, and every CMS deemed survey is unannounced.
Which Part 2 provisions call for written policies?
Section 2.16 requires formal policies and procedures for paper and electronic records, and section 2.22 requires a patient notice at admission. Section 2.16(b) applies the HIPAA breach rules, and section 2.3(c) applies HIPAA enforcement provisions, with a compliance date of February 16, 2026.
What does OMIG assess in a compliance program review?
OMIG assesses seven elements: written policies and standards of conduct, compliance officer and committee, training, communication lines, disciplinary standards, auditing and monitoring, and response to compliance issues. Part 521 was adopted December 28, 2022, and reviews began July 3, 2023.
How are OASAS case records sampled?
The instrument scores the first five active case records. Reviewers add records until 65% of items are met or ten are reviewed.
What follows a CARF survey?
CARF notifies the organization of the decision about six to eight weeks after the survey with a written report. A Quality Improvement Plan addressing all recommendations is due within 90 days, and annual conformance reporting follows.
Sources
- carf.org /accreditation/steps-accreditation/
- carf.org /accreditation/survey-preparation-accreditation/
- carf.org /accreditation/providers/accreditation-decisions/
- carf.org /wp-content/uploads/2026/02/2026-CCRC-SM.pdf
- digitalassets.jointcommission.org /api/public/content/46fe695a5ffd41ceaf8a82999263e8ec
- jointcommission.org /accreditation-and-certification/health-care-settings/behavioral…
- digitalassets.jointcommission.org /api/public/content/94f42e328b6b4960beed70dcfb5d4d64
- oasas.ny.gov /site-review-instruments
- oasas.ny.gov /node/19031
- osc.ny.gov /files/state-agencies/audits/pdf/sga-2024-23f17.pdf
- omig.ny.gov /media/90436/download
- omig.ny.gov /compliance/compliance-library
- omig.ny.gov /compliance/compliance-certification
- oig.hhs.gov /reports/all/2023/new-york-improved-its-monitoring-of-medicaid-c…
- federalregister.gov /documents/2024/02/16/2024-02544/confidentiality-of-substance-us…
- ecfr.gov /current/title-42/section-2.16
- ecfr.gov /current/title-42/section-2.22
- ecfr.gov /current/title-42/section-2.3
- hhs.gov /press-room/ocr-settles-hipaa-security-rule-investigation-twrtc.…
- hhs.gov /press-room/ocr-settles-four-ransomware-investigations.html
- reginfo.gov /public/do/eAgendaViewRule
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.