Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Direct Answer: The Manual Is the Survey
The 2026 Comprehensive Accreditation Manual for Behavioral Health Care and Human Services (CAMBHC) requires operators to continuously reconcile written policies against the live E-dition across the CTS, HRM, IM, LD, MM, NPSG, PI, PC, RC, and EC chapters, with the sharpest surveyor focus on individualized treatment planning (CTS), medication orders (MM), suicide risk reduction (NPSG.15.01.01), and staff qualification verification (HRM). A printed binder is not a compliance program.
Last quarter our team walked into a 60-bed residential program in the Pacific Northwest, two weeks before their triennial. The executive director had a copy of CAMBHC on a shelf. Spine uncracked. The Care, Treatment, and Services (CTS) chapter had been printed from the internet in 2021 and never refreshed. That is the gap that costs accreditations.
The Joint Commission updates standards on a rolling basis through Prepublication Standards and R3 Reports. If your compliance lead is not pulling the E-dition monthly and reconciling against your policies, your team is surveying against a manual that no longer exists. CMS deemed status for behavioral health under 42 CFR 441 and 42 CFR 482 depends on operators actually meeting the current version, not the version they bought. Surveyors trace patients through every chapter in a single tracer. Your documentation needs to do the same.
Where Operators Actually Get Cited
The most common Requirements for Improvement (RFI) our auditors see in behavioral health surveys cluster in four places: CTS.02.01.01 (individualized treatment planning), MM.04.01.01 (medication orders), NPSG.15.01.01 (suicide risk reduction), and HRM.01.02.01 (verifying staff qualifications and licensure). None of these are exotic. All of them are documentation discipline.
The suicide risk standard is where surveyors write the most expensive findings. R3 Report Issue 18 and the environmental risk assessment requirements under NPSG.15.01.01 are not optional reading. The Joint Commission published the underlying rationale plainly: effective July 1, 2019, seven new and revised elements of performance were applicable to all Joint Commission-accredited behavioral health care organizations, and these new requirements are at NPSG 15.01.01. The Commission also explained why it re-opened the standard: because there has been no improvement in suicide rates in the U.S., and since suicide is the 10th leading cause of death in the country, Joint Commission re-evaluated the NPSG in light of current practices relative to suicide prevention. That is the framing surveyors bring on-site.
Our team had a client in Ohio cited last year because their environmental risk assessment was completed annually but not after a unit renovation. The surveyor found a new closet rod. That was the finding. One closet rod.
On the medication side, programs still running buprenorphine induction under the old X-waiver framework have policies referencing DATA 2000. That framework is gone. On December 29, 2022, President Biden signed the Consolidated Appropriations Act of 2023, which incorporated the Mainstreaming Addiction Treatment (MAT) Act. Per SAMHSA, Section 1262 of the Consolidated Appropriations Act, 2023 removes the federal requirement for practitioners to submit a Notice of Intent (have a waiver) to prescribe medications, like buprenorphine, for the treatment of opioid use disorder, and all practitioners who have a current DEA registration that includes Schedule III authority, may now prescribe buprenorphine for opioid use disorder in their practice if permitted by applicable state law. The DEA Administrator confirmed to registrants that “A DATA-Waiver registration is no longer required to treat patients with buprenorphine for opioid use disorder. Going forward, all prescriptions for buprenorphine only require a standard DEA registration number”. If your P&P library still references X-numbers, your MM chapter is out of date and a surveyor will notice.
Crosswalking the Manual to ASAM and State Licensure
The Joint Commission manual does not replace state licensure rules. It does not replace the ASAM Criteria, 4th Edition. It sits on top of both.
When AHS builds a compliance program for a behavioral health operator, our team crosswalks three documents: the CAMBHC chapter requirements, the applicable ASAM 4 level of care decision rules (whether the program is a residential level, a residential withdrawal-management level, Level 2.5 partial hospitalization which is an outpatient level of care, or Level 2.1 intensive outpatient), and the state licensing regulations. Florida AHCA, Texas HHSC, and New Jersey DMHAS all publish their own admission criteria, staffing ratios, and documentation timelines that frequently exceed Joint Commission minimums.
The manual says assessment within a defined timeframe set by the organization. Florida 65D-30 sets its own numbers for licensed SUD facilities. Whichever is stricter wins. Your policy needs to reflect the stricter number, not the manual’s more permissive language.
This is where compliance programs collapse. Operators write policies to one source and assume the others are covered. They are not.
What Federal Enforcement Has Changed in the Last 18 Months
DOJ and OIG investigators have leaned hard into behavioral health. The OIG Work Plan is updated monthly and now includes active items on Medicaid managed care behavioral health services, telehealth-delivered SUD services, and EPSDT behavioral health.
OIG’s broader behavioral health enforcement is also live. An October 2025 HHS-OIG data brief found that many Medicare Advantage and Medicaid managed care plans offer access to a limited proportion of behavioral health providers, and inaccurately list 72% of in-network behavioral health care providers as being available. On average, 55% of behavioral health providers listed in plans’ networks did not provide care for plan enrollees, and the average MA plan contracts with only 16% of behavioral health providers. Those numbers set the stage for scrutiny of anyone billing under those contracts.
What does this have to do with the Joint Commission manual? Everything. The RC (Record of Care) chapter standards on assessment, reassessment, and discharge planning are the same documentation that supports medical necessity for billing. A surveyor finding under RC.02.01.01 can become a False Claims Act exhibit. Our team has seen it happen.
HHS-OCR enforcement on the HIPAA Security Rule touches the IM chapter directly. OCR published its NPRM in the Federal Register on January 6, 2025, marking the first significant changes to the regulations since their inception over 20 years ago. OCR documented the reason: from 2018-2023, reports of large breaches increased by 102 percent, and the number of individuals affected by such breaches increased by 1002 percent, primarily because of increases in hacking and ransomware attacks. In 2023, over 167 million individuals were affected by large breaches, a new record. HHS estimates that the first-year costs attributable to this proposed rule total approximately $9 billion, and for years two through five, the estimated annual costs for recurring compliance activities are estimated at approximately $6 billion. OCR Director Melanie Fontes Rainer put it plainly: “The number of people affected every year has skyrocketed exponentially”. If your Information Management policies were written before this NPRM was published, your manual alignment is already drifting.
How to Actually Use the Manual
Three practices separate the operators who sail through survey from the ones who get conditional accreditation.
- Assign a chapter owner. Your Clinical Director owns CTS. Your CHRO or HR lead owns HRM. Your medical director and pharmacy consultant own MM. Each owner reviews the E-dition quarterly and signs off in writing. No named owner, no accountability.
- Run real tracers. Not table-top exercises. Your compliance lead pulls a discharged patient’s chart and walks it against every applicable chapter. Where does the documentation break? That is your finding. Fix your gap before a surveyor does.
- Calibrate to current enforcement. Your team reads the OIG Work Plan monthly. Reads every R3 Report when it drops. Cross-references both against your policies in real time, not at re-accreditation.
The AHS team will be at NAATP National in Amelia Island May 4 to 6, sponsoring the Women in Leadership Luncheon. Allison, Benjamin, Leah, and Sariah will be on site. If you want to compare your manual alignment against what our auditors are seeing in current surveys and federal investigations, find us there.
Operators build audit readiness as a habit, not a binder.
Frequently asked questions
What is the most-cited Joint Commission behavioral health standard in 2026?
NPSG.15.01.01 (suicide risk reduction) remains the leading source of deficiencies, particularly EP 1, the environmental risk assessment requirement. The Joint Commission re-evaluated the standard because suicide is the 10th leading cause of death in the country, and effective July 1, 2019, seven new and revised elements of performance became applicable to all accredited behavioral health care organizations. Surveyors continue to cite programs for failing to re-assess ligature and environmental risks after renovations or unit changes.
Do we still need to reference DATA 2000 or X-waivers in our buprenorphine policies?
No. Section 1262 of the Consolidated Appropriations Act, 2023, signed December 29, 2022, eliminated the federal DATA-Waiver requirement. SAMHSA no longer accepts Notices of Intent, and any practitioner with a current DEA registration that includes Schedule III authority may prescribe buprenorphine for OUD if permitted by state law. The DEA Administrator has confirmed that a DATA-Waiver registration is no longer required to treat patients with buprenorphine for opioid use disorder. Policies still referencing X-numbers are out of date and should be revised in your MM chapter policies.
How does the proposed HIPAA Security Rule update affect Joint Commission IM chapter compliance?
OCR’s January 6, 2025 NPRM proposes removing the distinction between addressable and required implementation specifications and mandating asset inventories, MFA, encryption, and testing of security measures. HHS estimates first-year industry compliance costs at approximately $9 billion, with $6 billion per year for the following four years. Behavioral health operators should treat the proposed rule as the floor when updating IM chapter policies, because OCR has documented a 102 percent increase in large breach reports from 2018 to 2023 and a 1002 percent increase in the number of individuals affected.
Does NPSG.15.01.01 apply to partial hospitalization and IOP programs?
Yes, in part. Non-inpatient behavioral health settings such as PHP (ASAM Level 2.5, which is outpatient) and IOP do not need to be ligature-resistant, but the R3 Report Issue 18 guidance still requires these programs to conduct an environmental risk assessment, identify individuals at high risk for suicide, and take action to safeguard them. Joint Commission surveyors regularly cite non-inpatient programs that skip this assessment.
References
- The Joint Commission, R3 Report Issue 18: National Patient Safety Goal for Suicide Prevention
- SAMHSA, Waiver Elimination (MAT Act)
- DEA, Letter to All DEA Registrants on DATA-Waiver Elimination (Jan. 12, 2023)
- HHS OCR, HIPAA Security Rule NPRM (published Jan. 6, 2025)
- HHS-OIG Data Brief, OEI-02-23-00540 (October 2025): Many MA and Medicaid Managed Care Plans Have Limited Behavioral Health Provider Networks and Inactive Providers
- Federal Register, HIPAA Security Rule NPRM, 90 FR 898 (Jan. 6, 2025)