Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Direct Answer: The Manual Is the Survey
The 2026 Comprehensive Accreditation Manual for Behavioral Health Care and Human Services (CAMBHC) requires operators to reconcile written policies against the live E-dition every month across the CTS, HRM, IM, LD, MM, NPSG, PI, PC, RC, and EC chapters. Surveyors focus hardest on individualized treatment planning (CTS), medication orders (MM), suicide risk reduction (NPSG.15.01.01), and staff qualification verification (HRM). A printed binder is not a compliance program.
Last quarter our team walked into a 60-bed residential program in the Pacific Northwest, two weeks before their triennial. The executive director had a copy of CAMBHC on a shelf. Spine uncracked. The CTS chapter had been printed from the internet in 2021 and never refreshed. That is the gap that costs accreditations.
The Joint Commission updates standards on a rolling basis through Prepublication Standards and R3 Reports. If your compliance lead is not pulling the E-dition monthly and reconciling against your policies, your team is surveying against a manual that no longer exists. CMS deemed status for behavioral health under 42 CFR 441 and 42 CFR 482 depends on operators actually meeting the current version, not the version they bought. Surveyors trace patients through every chapter in a single tracer. Your documentation needs to do the same.
Where Operators Actually Get Cited
The most common Requirements for Improvement (RFI) our auditors see in behavioral health surveys cluster in four places: CTS.02.01.01 (individualized treatment planning), MM.04.01.01 (medication orders), NPSG.15.01.01 (suicide risk reduction), and HRM.01.02.01 (verifying staff qualifications and licensure). None of these are exotic. All of them are documentation discipline.
The suicide risk standard is where surveyors write the most expensive findings. R3 Report Issue 18 and the environmental risk assessment requirements under NPSG.15.01.01 are not optional reading. The Joint Commission published the rationale plainly: “Effective July 1, 2019, seven new and revised elements of performance (EPs) were applicable to all Joint Commission-accredited behavioral health care organizations,” and these EPs sit at NPSG.15.01.01. The Commission explained why it re-opened the standard: “Because there has been no improvement in suicide rates in the U.S., and since suicide is the 10th leading cause of death in the country, Joint Commission re-evaluated the NPSG in light of current practices relative to suicide prevention.” That framing is what surveyors bring on-site.
Our team had a client in Ohio cited last year because their environmental risk assessment was completed annually but not after a unit renovation. The surveyor found a new closet rod. That was the finding. One closet rod.
On the medication side, programs still running buprenorphine induction under the old X-waiver framework have policies referencing DATA 2000. That framework is gone. On December 29, 2022, President Biden signed the Consolidated Appropriations Act of 2023, which incorporated the Mainstreaming Addiction Treatment (MAT) Act. Per SAMHSA, Section 1262 removed the federal requirement for practitioners to submit a Notice of Intent to prescribe buprenorphine for OUD, and any practitioner with a current DEA registration that includes Schedule III authority may now prescribe buprenorphine if permitted by state law. The DEA confirmed to registrants that as of December 29, 2022, there is no longer any federal requirement that only DATA-waived practitioners can prescribe FDA-approved medications for the treatment of OUD. If your P&P library still references X-numbers, your MM chapter is out of date and a surveyor will notice.
Crosswalking the Manual to ASAM and State Licensure
The Joint Commission manual does not replace state licensure rules. It does not replace the ASAM Criteria, 4th Edition. It sits on top of both.
When AHS builds a compliance program for a behavioral health operator, our team crosswalks three documents: the CAMBHC chapter requirements, the applicable ASAM 4 level of care decision rules (whether the program is a residential level, a residential withdrawal-management level such as Level 3.7 Residential Detoxification, Level 2.5 Partial Hospitalization which is an outpatient level of care, or Level 2.1 Intensive Outpatient), and the state licensing regulations. Florida AHCA, Texas HHSC, and New Jersey DMHAS all publish their own admission criteria, staffing ratios, and documentation timelines that frequently exceed Joint Commission minimums.
The manual says assessment within a defined timeframe set by the organization. Florida 65D-30 sets its own numbers for licensed SUD facilities. Whichever is stricter wins. Your policy needs to reflect the stricter number, not the manual’s more permissive language. This is where operators write policies to one source and assume the others are covered. They are not.
What Federal Enforcement Has Changed in the Last 18 Months
DOJ and OIG investigators have leaned hard into behavioral health. The OIG Work Plan is updated monthly and now includes active items on Medicaid managed care behavioral health services, telehealth-delivered SUD services, and EPSDT behavioral health.
An October 2025 HHS-OIG report found that many Medicare Advantage and Medicaid managed care plans offer access to a limited proportion of behavioral health providers, and that 72% of inactive providers should not have been listed as network providers. OIG also documented that three-quarters of the Medicare Advantage plans reviewed had less than 25% of the county’s behavioral health workforce in their networks, and on average 55% of behavioral health providers listed in plans’ networks did not provide a single service to enrollees in 2023. Those numbers set the stage for scrutiny of anyone billing under those contracts.
What does this have to do with the Joint Commission manual? Everything. The RC (Record of Care) chapter standards on assessment, reassessment, and discharge planning are the same documentation that supports medical necessity for billing. A surveyor finding under RC.02.01.01 can become a False Claims Act exhibit. Our team has seen it happen.
HHS-OCR enforcement on the HIPAA Security Rule touches the IM chapter directly. OCR published its NPRM in the Federal Register on January 6, 2025, the first significant proposed rewrite of the Security Rule since its inception. OCR documented the driver: from 2018-2023, reports of large breaches increased by 102 percent, and the number of individuals affected by such breaches increased by 1,002 percent, primarily because of increases in hacking and ransomware attacks. In 2023, over 167 million individuals were affected by large breaches, a new record. If your Information Management policies were written before this NPRM was published, your alignment is already drifting.
How to Actually Use the Manual
Three practices separate operators who sail through survey from the ones who get conditional accreditation.
- Assign a chapter owner. Your Clinical Director owns CTS. Your CHRO or HR lead owns HRM. Your medical director and pharmacy consultant own MM. Each owner reviews the E-dition quarterly and signs off in writing. Without a named owner, no one is accountable.
- Run real tracers. Not table-top exercises. Your compliance lead pulls a discharged patient’s chart and walks it against every applicable chapter. Where does the documentation break? That is your finding. Fix the gap before a surveyor does.
- Calibrate to current enforcement. Your team reads the OIG Work Plan monthly. Reads every R3 Report when it drops. Cross-references both against your policies in real time, not at re-accreditation.
The AHS team will be at NAATP National in Amelia Island May 4 to 6, sponsoring the Women in Leadership Luncheon. Allison, Benjamin, Leah, and Sariah will be on site. If you want to compare your manual alignment against what our auditors are seeing in current surveys and federal investigations, find us there.
Operators build audit readiness as a habit, not a binder.
Frequently asked questions
What is the most-cited Joint Commission behavioral health standard in 2026?
NPSG.15.01.01 (suicide risk reduction) remains the leading source of deficiencies in behavioral health surveys, particularly the environmental risk assessment element. Per R3 Report Issue 18, the Joint Commission re-opened the standard because suicide is the 10th leading cause of death in the U.S., and effective July 1, 2019, seven new and revised elements of performance became applicable to all accredited behavioral health care organizations. Surveyors continue to cite programs that fail to reassess ligature and environmental risks after renovations or unit changes.
Do we still need to reference DATA 2000 or X-waivers in our buprenorphine policies?
No. Section 1262 of the Consolidated Appropriations Act, 2023, signed December 29, 2022, eliminated the federal DATA-Waiver requirement. Per SAMHSA, NOIs are no longer accepted, and any practitioner with a current DEA registration that includes Schedule III authority may prescribe buprenorphine for OUD if permitted by state law. The DEA has confirmed that as of December 29, 2022, there is no longer any federal requirement that only DATA-waived practitioners can prescribe FDA-approved medications for OUD. Policies still referencing X-numbers are out of date and should be revised in your MM chapter.
How does the proposed HIPAA Security Rule update affect Joint Commission IM chapter compliance?
OCR’s January 6, 2025 NPRM proposes removing the distinction between addressable and required implementation specifications, and mandating asset inventories, network maps, MFA, encryption, and testing of security measures. Behavioral health operators should treat the proposed rule as the direction of travel when updating IM chapter policies, because OCR has documented a 102 percent increase in large breach reports from 2018 to 2023 and a 1,002 percent increase in the number of individuals affected, with over 167 million individuals affected by large breaches in 2023 alone.
Does NPSG.15.01.01 apply to partial hospitalization and IOP programs?
Yes, in part. Per R3 Report Issue 18, non-inpatient behavioral health care settings and unlocked inpatient units do not need to be ligature resistant, but these settings must still conduct a risk assessment to identify potential environmental hazards, identify individuals at high risk for suicide, and take action to safeguard those individuals. PHP (ASAM Level 2.5, which is outpatient) and IOP programs that skip this environmental assessment regularly get cited.
References
- Joint Commission, R3 Report Issue 18: National Patient Safety Goal for Suicide Prevention
- SAMHSA, Waiver Elimination (MAT Act)
- DEA Diversion Control, Prescribing Buprenorphine Under the MAT Act (2023)
- HHS-OIG, Many Medicare Advantage and Medicaid Managed Care Plans Have Limited Behavioral Health Provider Networks and Inactive Providers (October 2025)
- HHS OCR, HIPAA Security Rule NPRM
- Federal Register, HIPAA Security Rule to Strengthen the Cybersecurity of ePHI (January 6, 2025)