A hospital voluntarily invites a private national organization to review it against that organization's published standards in order to demonstrate its quality. This process is best described as:
Choose an answer, then check it.
Health Administration · Law and Policy
Healthcare Regulation
On this page 9 sections
In 30 seconds
U.S. healthcare is regulated on three levels at once. The federal government sets Conditions of Participation, approves drugs and devices, and polices fraud; states license facilities and professionals and decide who may practice; and private organizations accredit hospitals voluntarily. Three ideas are easy to confuse: Licensure Mandatory permission from a state government that allows a facility to operate or a professional to practice within that state; operating or practicing without it is illegal. Full entry → is mandatory state permission, Certification A determination that a provider complies with a specific program's requirements — for healthcare, meeting the federal Conditions of Participation in order to bill Medicare or Medicaid. Full entry → is meeting federal program rules, and Accreditation A voluntary evaluation by a private, non-governmental organization that reviews a provider against the organization's own published standards; not legally required to operate. Full entry → is a voluntary private review. Enforcement runs through surveys, plans of correction, and, ultimately, loss of Medicare participation.
Why this matters
Almost every administrative decision a health organization makes happens inside a web of overlapping rules, and knowing which body wrote a rule tells you who enforces it and how hard it binds. A manager who cannot tell a Statute A law enacted by a legislature such as Congress; the highest-authority source of a regulatory requirement, usually broad and implemented in detail by agencies. Full entry → from a manual, or licensure from accreditation, will misjudge what is legally required versus merely recommended, and will not know whether a deficiency threatens the Medicare provider agreement or just an accreditation report. Understanding the regulatory machinery is the foundation for compliance, contracting, quality reporting, and reading the constant stream of proposed rules that reshape how care is paid for and delivered.
The college version
Three levels of oversight at once
No single agency regulates American healthcare. Oversight is layered, and the same hospital answers to all three layers simultaneously. At the federal level, the Centers for Medicare & Medicaid Services (CMS) writes the Conditions of Participation (CoPs) Federal health and safety requirements, set by CMS in regulation, that a provider must meet to participate in and be paid by Medicare and Medicaid. Full entry → that a hospital must meet to bill Medicare and Medicaid; the Food and Drug Administration (FDA) decides, under the Federal Food, Drug, and Cosmetic Act, whether drugs and medical devices may be marketed; the HHS Office of Inspector General (OIG) and the Department of Justice enforce fraud-and-abuse laws; the Occupational Safety and Health Administration (OSHA) sets workplace safety rules; and statutes such as EMTALA (the Emergency Medical Treatment and Labor Act, 42 U.S.C. 1395dd) impose specific duties, here requiring Medicare hospitals with emergency departments to screen and stabilize anyone who comes in, regardless of ability to pay. At the state level, governments license the facilities and the professionals inside them, define each profession's scope of practice, and in many states run certificate-of-need programs that require approval before a facility makes a major capital expenditure. As of January 2025, 35 states and the District of Columbia operated certificate-of-need programs (NCSL). The third layer is private and voluntary: national accrediting organizations review hospitals against their own published standards. The key relationship among the layers is that private accreditation can be tied back to federal certification through a mechanism called Deemed status A CMS designation, authorized by Section 1865 of the Social Security Act, under which accreditation by a CMS-approved organization is accepted as evidence of meeting the Conditions of Participation, substituting for the state agency's compliance survey. Full entry →, described below.
Licensure, certification, and accreditation are not the same thing
These three words are routinely used loosely, but they name three distinct processes with different sources of authority. Licensure is mandatory government permission: a state licenses a hospital, nursing home, or laboratory to operate within its borders, and licenses physicians, nurses, and other professionals to practice. Operating or practicing without the required license is illegal. Certification means meeting the requirements of a specific payment program. To receive Medicare or Medicaid dollars, a provider must be certified as complying with the federal Conditions of Participation; certification is about program eligibility, not about the legal right to exist. Accreditation is a voluntary evaluation by a private, non-governmental organization against that organization's standards, most prominently The Joint Commission, with DNV and others also accrediting hospitals. Accreditation is not legally required to operate. A hospital can hold a state license, be certified for Medicare, and be accredited all at once, and each says something different: the license says the state permits it to operate, certification says it qualifies to bill a federal program, and accreditation says a private body judged it to meet voluntary quality standards. Confusing them leads administrators to overstate or understate what a given review actually controls.
Statutes, regulations, and sub-regulatory guidance
Regulatory requirements come in a hierarchy of legal force, and knowing where a rule sits tells you how tightly it binds. A statute is a law passed by Congress (or a state legislature); it sits at the top. Statutes are usually broad and delegate details to an agency. A Regulation A rule an agency issues to carry out a statute, generally through notice-and-comment rulemaking under the Administrative Procedure Act, codified in the Code of Federal Regulations, and carrying the force of law. Full entry → is a rule an agency issues to carry out a statute. Federal agencies generally must use notice-and-comment rulemaking under the Administrative Procedure Act (5 U.S.C. 553): the agency publishes a proposed rule in the Federal Register, takes public comment, and then issues a final rule that is codified in the Code of Federal Regulations. A properly issued regulation has the force and effect of law. Beneath regulations sits Sub-regulatory guidance Agency materials such as CMS manuals, transmittals, and FAQs that interpret and operationalize regulations; used day to day but, in theory, lacking the force of law, so a regulation controls where they conflict. Full entry →: CMS manuals, transmittals, program memoranda, and frequently asked questions that explain how the agency interprets and applies its regulations. Guidance is the material surveyors and auditors reach for day to day because it is operational, but in theory it does not have the force of law, and where a manual and a regulation conflict, the regulation controls. So the practical reading order is: the statute says what Congress required, the regulation says what the agency legally requires, and the guidance says how the agency expects the regulation to be met.
Deemed status and how enforcement works
The layers connect through deemed status. Under Section 1865 of the Social Security Act, if a hospital is accredited by an accrediting organization whose program CMS has approved, its accreditation can be 'deemed' to demonstrate compliance with the Conditions of Participation, so the accreditation survey substitutes for the routine compliance survey a state survey agency would otherwise perform (42 CFR Part 488). Deemed status does not exempt a provider from the CoPs, and CMS still conducts validation surveys on a sample of accredited providers to confirm the accrediting organization's judgment. Enforcement itself is survey-driven. State survey agencies, acting for CMS, and accrediting organizations inspect providers against the CoPs and standards. When a survey finds deficiencies, the provider must submit and carry out a Plan of correction A provider's written commitment, following a survey that found deficiencies, describing the actions and timeline by which it will return to compliance. Full entry → describing how it will come back into compliance. If deficiencies are minor, correction resolves the matter; if they are serious, CMS can impose remedies, and the ultimate federal sanction for uncorrected condition-level noncompliance is termination of the Medicare provider agreement, which cuts off federal payment. Separately, the fraud-and-abuse laws carry their own enforcement: the Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)) is a criminal, intent-based prohibition on paying for referrals, while the physician self-referral law, the Stark Law (42 U.S.C. 1395nn), is a strict-liability civil law that bars referrals to entities a physician has a financial relationship with, and OIG can exclude violators from federal programs. Administrators explain and comply with these rules; they do not give legal advice on them.
Eli explains
The same idea, in plain words
Explain it like I’m 10
Running a hospital is like running a food truck, but with three different inspectors. The city gives you a license to open at all — no license, no truck. A big delivery app will only pay you if you follow its rules, which is like Medicare certification: it is about getting paid, not about being allowed to exist. And you can pay a private restaurant club to come judge your kitchen against its own gold-star checklist, which is accreditation — nobody forces you, but the gold star means something. The rules themselves also come in strengths: a law from the government is strongest, an agency's detailed rulebook comes next, and the little how-to manuals that explain the rulebook come last. If an inspector finds problems, you get a chance to fix them with a written plan; if you never fix the serious ones, the app stops paying you.
Picture it like this
Three inspectors at one food truck: the city license to open, the delivery app's payment rules, and the voluntary gold-star club.
Where the picture stops working
The analogy understates how the layers interlock: in real healthcare a private accreditor's gold star can actually stand in for the government's own inspection through deemed status, which has no clean food-truck equivalent. It also skips fraud-and-abuse laws, where paying for referrals is a separate crime unrelated to inspections, and it makes the inspectors sound independent when the state survey agency is really acting on the federal government's behalf.
Worked example
Imagine Riverbend Medical Center. It holds a license from its state health department, which lets it legally operate; without that license it could not open its doors. Because it wants to treat Medicare patients, it is also certified as meeting CMS's Conditions of Participation, which is what makes it eligible for federal payment. Riverbend has additionally chosen to be accredited by The Joint Commission, and because CMS has approved that accreditor's hospital program, Riverbend has deemed status: its accreditation survey stands in for the routine state compliance survey. One year a CMS validation survey turns up a condition-level deficiency in the hospital's medication management. Riverbend is not immediately shut down. It submits a plan of correction, retrains staff, and fixes the workflow. Had it ignored the deficiency, CMS could ultimately have terminated its Medicare provider agreement, ending federal payment — a business-ending event even though the state license would technically remain. The example shows the three concepts operating at once and why administrators track which review controls which consequence.
Key takeaway
U.S. healthcare is regulated on three interlocking levels — federal (CMS Conditions of Participation, FDA, fraud-and-abuse laws), state (licensure, scope of practice, certificate of need), and voluntary private accreditation. Keep licensure (mandatory state permission), certification (meeting federal program rules), and accreditation (voluntary private review) distinct, know that statutes outrank regulations which outrank non-binding guidance, and remember that enforcement runs through surveys, plans of correction, and, ultimately, loss of Medicare participation.
Quick check
3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.
Under CMS 'deemed status,' what does accreditation by a CMS-approved accrediting organization allow a hospital to do?
Choose an answer, then check it.
Which option correctly orders sources of a healthcare regulatory requirement from highest legal authority to lowest?
Choose an answer, then check it.
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related
You’ll learn to
- Describe the three levels of U.S. healthcare regulation: federal, state, and private accreditation.
- Distinguish licensure, certification, and accreditation as three separate concepts.
- Explain the difference between statutes, regulations, and sub-regulatory guidance and how strongly each binds.
- Explain CMS 'deemed status' and how accreditation relates to the Conditions of Participation.
- Analyze how regulatory enforcement works through surveys, plans of correction, and termination of participation.
Common mistakes
Treating licensure, certification, and accreditation as interchangeable words for the same approval.
They are three separate things: licensure is mandatory state permission to operate, certification is meeting federal program requirements to be paid by Medicare/Medicaid, and accreditation is a voluntary private review against a private organization's standards.
Assuming a CMS manual or FAQ is as legally binding as a regulation.
Sub-regulatory guidance interprets regulations and is used operationally, but it does not have the force of law; where guidance and a regulation conflict, the regulation controls.
Thinking accreditation by The Joint Commission or DNV is legally required to run a hospital.
Accreditation is voluntary. What is required is a state license to operate and, to bill Medicare, certification against the Conditions of Participation. Accreditation matters largely because, through deemed status, it can substitute for the certification survey.
Confusing the Anti-Kickback Statute with the Stark Law because both involve money and referrals.
The Anti-Kickback Statute is a criminal, intent-based law against paying to induce referrals; the Stark Law is a strict-liability civil law that bars physician self-referral to entities the physician has a financial relationship with, regardless of intent.
Believing all healthcare regulation is federal.
States do much of the regulating: they license facilities and professionals, define scope of practice, and, in many states, run certificate-of-need programs. Federal, state, and private accreditation operate together.
Easily confused
Licensure vs. Accreditation
Licensure is mandatory government permission to operate or practice; accreditation is a voluntary review by a private organization against its own standards and is not required to open.
Certification vs. Accreditation
Certification is a public determination that a provider meets a federal program's requirements so it can be paid; accreditation is a private judgment of quality. Through deemed status, approved accreditation can substitute for the certification survey, but they remain different acts by different bodies.
Regulation vs. Sub-regulatory guidance
A regulation is issued through notice-and-comment rulemaking and carries the force of law; guidance such as CMS manuals interprets regulations for daily use but does not, and the regulation controls in a conflict.
Anti-Kickback Statute vs. Stark Law
The Anti-Kickback Statute is criminal and requires wrongful intent to pay for referrals; the Stark Law is civil strict liability, triggered by a physician's financial relationship and self-referral regardless of intent.
Key vocabulary
- Conditions of Participation (CoPs)
- Federal health and safety requirements, set by CMS in regulation, that a provider must meet to participate in and be paid by Medicare and Medicaid.
- Licensure
- Mandatory permission from a state government that allows a facility to operate or a professional to practice within that state; operating or practicing without it is illegal.
- Certification
- A determination that a provider complies with a specific program's requirements — for healthcare, meeting the federal Conditions of Participation in order to bill Medicare or Medicaid.
- Accreditation
- A voluntary evaluation by a private, non-governmental organization that reviews a provider against the organization's own published standards; not legally required to operate.
- Deemed status
- A CMS designation, authorized by Section 1865 of the Social Security Act, under which accreditation by a CMS-approved organization is accepted as evidence of meeting the Conditions of Participation, substituting for the state agency's compliance survey.
- Statute
- A law enacted by a legislature such as Congress; the highest-authority source of a regulatory requirement, usually broad and implemented in detail by agencies.
- Regulation
- A rule an agency issues to carry out a statute, generally through notice-and-comment rulemaking under the Administrative Procedure Act, codified in the Code of Federal Regulations, and carrying the force of law.
- Sub-regulatory guidance
- Agency materials such as CMS manuals, transmittals, and FAQs that interpret and operationalize regulations; used day to day but, in theory, lacking the force of law, so a regulation controls where they conflict.
- Certificate of need (CON)
- A state requirement that a healthcare facility obtain government approval before certain major capital expenditures or new services, intended to limit duplication and control costs; in force in some but not all states.
- Plan of correction
- A provider's written commitment, following a survey that found deficiencies, describing the actions and timeline by which it will return to compliance.
Sources & references
- 42 CFR Part 482 — Conditions of Participation for Hospitals (482.12 Governing body; 482.22 Medical staff) — Electronic Code of Federal Regulations (National Archives / GPO)
- 42 CFR Part 488 — Survey, Certification, and Enforcement Procedures — Electronic Code of Federal Regulations (National Archives / GPO)
- 42 U.S.C. 1395dd — Examination and treatment for emergency medical conditions and women in labor (EMTALA) — Office of the Law Revision Counsel, U.S. House of Representatives (United States Code)
- Fraud & Abuse Laws (Physician Education) — False Claims Act, Anti-Kickback Statute, Physician Self-Referral (Stark) Law, Exclusion Statute, Civil Monetary Penalties Law — U.S. Department of Health and Human Services, Office of Inspector General (OIG)
- Certificate of Need State Laws (brief) — National Conference of State Legislatures (NCSL)
- General Controls for Medical Devices; Overview of Device Regulation (risk-based classification, 510(k) and PMA) — U.S. Food and Drug Administration (FDA)
- Accrediting Organizations (AOs) and deeming authority (Section 1865 of the Social Security Act) — Centers for Medicare & Medicaid Services (CMS)
- 5 U.S.C. 553 - Rule making (Administrative Procedure Act) — Office of the Law Revision Counsel, U.S. House of Representatives (United States Code)
EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.
Researched 2026-08-19
Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.