Your Abuse Investigation Protocol Expires April 30 — Here's What Changed

1 What QSO-26-03-NH Actually Is

CMS doesn't usually redo the State Operations Manual and casually announce it two weeks before implementation. QSO-26-03-NH is a fairly big deal — two memo releases, multiple chapter revisions, and a hard April 30 deadline. If you haven't read it (and statistically, most Directors of Nursing and compliance officers haven't read the actual document), here's what it does.

QSO-26-03-NH stands for Quality, Safety & Oversight memo 26-03 for Nursing Homes. It was first issued January 30, 2026, with an effective date of March 30, 2026. Then CMS came back on April 3, 2026 with a revised version that extended full implementation to April 30, 2026 and added several clarifications.

The memo updates two chapters of the State Operations Manual: Chapter 5 (Complaint Procedures) and Chapter 7 (Survey and Enforcement for Nursing Homes). Chapter 5 gets the most substantial changes and the ones most directly relevant to your facility's day-to-day operations. Chapter 7 changes matter for understanding how surveyors will behave when they show up.

The short version of why this memo exists: CMS is tightening the connection between confirmed abuse findings and the criminal justice and Medicaid fraud systems. For years, abuse citations stayed in the regulatory lane — state agency confirms noncompliance, facility gets cited and fined, case closed. QSO-26-03-NH starts pulling law enforcement and the Medicaid Fraud Control Unit into that loop systematically.

CMS memos like this one don't come with much warning — most facilities didn't find out about QSO-26-03-NH until a few weeks before implementation. Our Regulatory Radar tracks active CMS compliance deadlines and new guidance as it's issued, so you catch the next one before the countdown starts.

2 The Five F-Tags at the Center of These Changes

The SOM revisions don't create new F-tags — they update the investigative guidance surveyors use when citing the existing abuse-related tags. Understanding which tags are in play is the first step to understanding where your documentation gaps might be.

F-Tag	Title	What QSO-26-03-NH Changed	Severity Risk
F600	Free from Abuse, Neglect, Exploitation	Reinforced Immediate Jeopardy prioritization for abuse allegations with serious injury, harm, or likelihood thereof	High
F602	Policies Prohibiting Mistreatment	Policy requirements must now align with updated law enforcement notification obligations	High
F605	Training — Abuse, Neglect, Exploitation	Training programs must reflect updated investigation and reporting timelines	Medium
F606	Investigate/Prevent/Correct Alleged Violations	Internal investigation quality standards now effectively benchmarked against what will trigger law enforcement referral	High
F609	Reporting of Alleged Violations	Reporting chain must now document the interface with the new state agency/law enforcement notification requirement	High

If a surveyor walks in on May 1 under these new rules and requests your abuse and neglect investigation files, they're reviewing against these five tags simultaneously. A citation under F606 for inadequate investigation will now also flag whether proper reporting occurred under F609 — and whether that incomplete investigation is what caused law enforcement not to be notified when it should have been.

3 The Big One: Mandatory Law Enforcement Notification

Section 5330 of SOM Chapter 5 was updated to add a mandatory law enforcement notification requirement. Here's exactly what it says in plain English:

When a State Agency or CMS confirms noncompliance related to abuse, it must report the cited finding of noncompliance to local law enforcement.

Let's unpack what "confirms noncompliance" means, because this distinction matters enormously for your operations.

This is not a facility obligation directly — it's a surveyor obligation. The State Agency, upon confirming that your facility violated the abuse-related requirements, must notify local law enforcement of that confirmed finding. You don't call the police when you get an abuse citation; the state agency does, and they're now required to do it.

So why does this change anything for your facility? Because it fundamentally changes the downstream consequences of an abuse-related citation. Before, an F600 citation meant a civil enforcement action — deficiency, potential civil money penalty, possible repeat deficiency tracking. After May 1, an F600 citation means the State Agency is required to contact local law enforcement about what they found. That law enforcement contact may or may not result in a criminal investigation, but it now happens as a matter of course.

The Immediate Jeopardy Prioritization Clause

The Chapter 5 updates also clarified that the following types of abuse allegations must be prioritized as Immediate Jeopardy investigations:

• Allegations of abuse involving serious injury, serious harm, or serious impairment
• Allegations involving death where resident protection circumstances are uncertain
• Allegations with a likelihood of serious harm — meaning even potential or probable harm is enough to trigger IJ prioritization
• Cases where residents were discharged to unsafe settings or discharged in ways that created serious harm risk

The "likelihood of serious harm" language is the one to watch. Under the old framework, surveyors had more discretion about whether an abuse allegation rose to IJ priority. The new language tightens that — if there's any credible possibility of serious harm, IJ prioritization is the expected pathway.

4 Medicaid Fraud Control Unit: What "If Appropriate" Really Means

Section 5330 requires law enforcement notification for all confirmed abuse findings. It requires Medicaid Fraud Control Unit (MFCU) referral when appropriate. That qualifier is doing a lot of work, and it's worth understanding what it means in practice.

The MFCU is a state-level office that investigates Medicaid fraud, patient abuse, and neglect in Medicaid-funded facilities. Every state has one. They have criminal investigative authority and can pursue criminal prosecution of individuals — staff, contractors, administrators — not just civil enforcement against the facility.

When is MFCU referral "appropriate" under the new framework? CMS guidance generally treats MFCU referral as appropriate when:

• The confirmed abuse involves a Medicaid resident (which, in most SNFs, is the majority of your census)
• The abuse appears to be criminal in nature rather than a regulatory compliance failure
• There is evidence of financial exploitation in addition to physical or emotional abuse
• The abuse appears systematic or repeated rather than isolated
• The alleged perpetrator is a staff member or contractor rather than another resident or visitor

In a typical SNF census that's 60–80% Medicaid, almost any confirmed staff-on-resident abuse that involves physical harm or financial exploitation is going to qualify for MFCU referral under this framework. If you've been treating abuse allegations as purely regulatory compliance issues, that mental model needs to update.

5 Offsite vs. On-Site Investigation — The Updated Framework

Section 5075.5 of SOM Chapter 5 was updated to address when State Agencies can conduct offsite investigations and how they confirm findings. This section matters because it affects how a complaint about your facility can be investigated and resolved without a physical survey visit.

Under the February 2026 version of the revisions, State Agencies may conduct a review and offsite investigation and confirm their findings at the next on-site survey — but only with advance CMS approval. This represents a significant constraint on independent state-level offsite investigation authority.

What this means practically:

• State agencies can't just decide on their own to close a complaint investigation offsite anymore without CMS sign-off
• If a complaint comes in about your facility and the state wants to investigate it remotely, they need CMS approval to do so
• This creates pressure toward more on-site investigations, not fewer — states don't want to go through the approval process, so they'll default to showing up

The April 2026 revision to Section 5300 added another element: abbreviated surveys must be conducted on two consecutive calendar days from the entrance date, with exceptions only for state-declared emergencies or competing Immediate Jeopardy situations at other facilities.

That "two consecutive days" requirement is meaningful. Previously, surveyors had more flexibility on abbreviated survey duration. Codifying two consecutive days means that when they come in for a complaint investigation, they're committed to two full days on-site — which changes the calculus on what they'll look at while they're there.

6 Chapter 7: Minimum Surveyor Time Is Now Codified

The Chapter 7 updates in QSO-26-03-NH address the Long-Term Care Survey Process more broadly, but the most operationally relevant addition is the codification of minimum surveyor time for certain investigation types.

Previously, how long surveyors spent on various survey components was largely guided by professional judgment and workload. The April 2026 revisions start codifying minimum time commitments for certain survey activities. The two-consecutive-day requirement for abbreviated surveys is the clearest example, but it reflects a broader CMS direction: survey time is now a floor, not a suggestion.

Exit conference requirements also got updated under Section 5300.5. Facilities must now receive notification regarding:

• Corrected past noncompliance — if a prior deficiency has been corrected, surveyors must communicate that both orally and in writing
• Absence of noncompliance findings — if a complaint investigation finds nothing, the facility must be formally notified of that outcome

That second point is actually good news — it creates a paper trail of clean investigation outcomes that facilities can point to during future surveys. Keep records of any formal notices you receive about absence of findings. They're documentation of a clean record, and they matter when you're trying to establish survey history context.

7 What This Means for Your Internal Investigation Quality

Here's the under-discussed part of QSO-26-03-NH: the law enforcement notification requirement doesn't apply only when surveyors confirm abuse. It applies when they confirm noncompliance related to abuse — which can include a finding that your investigation was inadequate under F606.

Think about that carefully. If your facility receives an abuse allegation, investigates it, and concludes it's unsubstantiated — but surveyors review your investigation and conclude it was inadequate — the citation isn't for the abuse itself. It's for the deficient investigation under F606. That citation still triggers the law enforcement notification requirement.

This creates a powerful incentive to run thorough internal investigations. Not just because incomplete investigations put residents at risk (which should be reason enough), but because the new framework means that a poorly documented internal investigation can trigger the same downstream law enforcement contact as a confirmed abuse incident.

What "Adequate Investigation" Looks Like Under the New Framework

Your F606 investigation must now demonstrate:

• Timely initiation — investigation begins immediately upon allegation, same shift where possible
• Witness interviews documented in writing — not just a note that staff were questioned, but documented interview records with specific statements
• Physical evidence preservation — any relevant medical records, surveillance footage, or physical evidence is preserved and noted in the investigation file
• Supervisor notification chain documented — who was notified, when, and what their response was
• Separation of accused staff — documented removal from direct resident care pending investigation, with dates and times
• Reporting to state agency within required timeframes — both the allegation report and the investigation outcome
• Written investigation summary with finding and rationale — not "unsubstantiated," but a documented reasoning chain for why it's unsubstantiated

That last point is where most facilities fall short. Concluding an investigation is not the same as documenting why you reached that conclusion. A surveyor reviewing your investigation file needs to be able to trace your reasoning — what evidence supported each finding, who made the determination, and what the basis for that determination was.

8 Your Self-Reporting Posture Just Changed

Most compliance officers understand that self-reporting abuse to the state agency before surveyors discover it is generally favorable — it demonstrates compliance intent and often influences enforcement disposition. That logic still holds under QSO-26-03-NH, but with some nuance.

When you self-report, you're essentially initiating the chain that now includes mandatory law enforcement notification. That doesn't mean you shouldn't self-report — you absolutely should, and the requirement to report allegations to the state agency within 24 hours hasn't changed. But your compliance team and legal counsel need to understand that self-reporting a substantiated abuse finding will now result in the state agency contacting law enforcement about that finding.

The risk-benefit calculus hasn't flipped — self-reporting appropriately is still the right posture. What's changed is the downstream landscape you're reporting into. It's no longer a purely regulatory conversation after May 1.

9 7 Things to Do Before May 1

The deadline is April 30. Here's your operational checklist:

10 Timeline Recap

The regulatory history on this one moved fast. Here's the full sequence so you can explain it to your administrator or medical director:

QAPI Program Requirements