# Home health QAPI under 42 CFR 484.65: what an HHA must show

> A home health agency (HHA) must run an agency-wide QAPI program, the quality program CMS requires. It tracks adverse patient events and runs improvement projects. It uses measurable indicators, including OASIS (patient assessment data) measures, and fixes any threat to patient safety at once. A governing body oversees it, and CMS tags G640 through G660 cover it.

Source: https://incidentkit.ai/compliance/cms-qapi/home-health · Updated Oct 5, 2026

## Key facts

- **Rule:** 42 CFR 484.65, condition of participation
- **CMS tags:** G640 to G660, State Operations Manual Appendix B (Rev. 219)
- **Data:** Quality indicators including OASIS-derived measures where applicable
- **Projects:** At least one in development, ongoing or completed each calendar year (CMS guidance)
- **Immediate correction:** Required for problems that threaten patient health and safety
- **Governing body:** Approves data frequency and detail, addresses fraud and waste
- **Survey interval:** No more than 36.9 months between completed surveys (CMS FY2027)

- **Citation:** 42 CFR 484.65
- **Authority:** CMS
- **Applies to:** Medicare-certified home health agencies surveyed by a state agency, Deemed home health agencies accredited by a CMS-approved accrediting organization

## What does 42 CFR 484.65 require?

An effective, ongoing QAPI program that runs on data across all services, even those under contract. It focuses on outcomes such as emergent care use, hospital admissions and readmissions. It also aims to prevent medical errors. It is a condition of participation, a rule an agency must meet to bill Medicare.

*42 CFR 484.65 in plain language*

| Standard | What it asks for |
| --- | --- |
| (a) Program scope | Be able to show measurable gains in indicators tied to outcomes, safety and quality. Measure, analyze and track quality indicators, including adverse patient events. |
| (b) Program data | Use quality indicator data, including measures from OASIS where they apply. The governing body approves how often and how much data is collected. |
| (c) Program activities | Focus on high-risk, high-volume or problem-prone areas. Fix at once any problem that directly or potentially threatens patient health and safety. Track adverse patient events, analyze causes, act, then measure and sustain results. |
| (d) Improvement projects | Run projects that fit the agency's scope, complexity and past performance. Document each project, why it was done and the measurable progress. |
| (e) Executive responsibilities | The governing body makes sure the program is defined and maintained. It covers priorities and evaluates every improvement action. It sets clear patient safety expectations and addresses any findings of fraud or waste. |

## Who does what in home health QAPI?

- **Governing body:** approves how often and how much data is collected. It ensures every improvement action is evaluated and addresses any findings of fraud or waste. If it is unclear who the governing body is, surveyors may check ownership and managing control data on the CMS-855A enrollment form.
- **Agency staff:** report adverse patient events and near misses, often from the field.
- **Infection control:** the infection program must be an integral part of QAPI under 42 CFR 484.70(b).

## What do surveyors look for?

The guidance is State Operations Manual Appendix B, Rev. 219, issued April 12, 2024. Each standard has its own tag.

| Tag | Standard | Focus |
| --- | --- | --- |
| G640 | Condition | The program as a whole. A condition-level citation is possible |
| G642 | Program scope | Indicators that data can measure, with a set frequency of measurement and analysis |
| G644 | Program data | Quality indicator data, OASIS-based measures, governing body approval |
| G646 | Program activities | High-risk, high-volume and problem-prone priorities, immediate correction |
| G654 | Adverse patient events | Tracking events and analyzing causes |
| G656 | Measure and sustain | Success measured and gains sustained |
| G658 | Projects | Project records and results |
| G660 | Executive responsibilities | Governing body oversight, including meeting minutes |

CMS guidance says the agency should have at least one project in development, ongoing or completed each calendar year. Surveyors ask for records of current and prior-year projects, with the reason for each and the results. If a project failed, they ask what the agency did next.

## What should an HHA show?

- The written QAPI program, with indicators data can measure
- Measure and analysis frequency, approved by the governing body
- OASIS-based measures and other quality data in use
- An adverse patient event log with analyses and actions
- Records of immediate fixes made for safety threats
- Project records for this and last year, with reasons and results
- Governing body minutes showing ongoing oversight
- Infection control data built into QAPI

## How do adverse events and immediate correction work?

CMS describes adverse patient events as negative and unexpected. They affect the patient's plan of care and can cause a decline in condition. The agency must track all of them and analyze whether preventable errors caused them. It should also think about how to identify near misses.

The rule goes further. Improvement work must lead to immediate correction of any problem that directly or potentially threatens patient health and safety. CMS gives no deadline in days.

Reports often start in a patient's home. [IncidentKit intake](https://incidentkit.ai/product/incident-reporting) accepts a text from the field. [Routing and escalation](https://incidentkit.ai/product/routing-and-escalation) sends a serious event to the right owner at once. Voice reporting is rolling out.

## Where do HHAs fall short?

Gaps measured against CMS guidance:

- Indicators that data cannot measure, so a change in procedure cannot be evaluated
- No stated frequency for measurement and analysis
- No project in development, ongoing or completed in the calendar year
- Project files with no reason, or no follow-up when a project failed
- Safety threats left open while analysis continues
- Infection data kept apart from QAPI
- A governing body that cannot show ongoing oversight

## How often is an HHA surveyed?

CMS's fiscal year 2027 priorities set a maximum of 36.9 months between completed recertification surveys for any home health agency. An agency may choose a CMS-approved accreditor instead. ACHC says it has held home health deeming authority (CMS approval to survey in place of the state) since 2006. It also says CMS no longer lets accreditors warn an organization before an unannounced deemed survey. See [ACHC](https://incidentkit.ai/compliance/accreditation/achc).

## What the rule asks for, and how IncidentKit supports it

| Requirement | IncidentKit |
| --- | --- |
| 484.65(a)(2), (c)(2): track adverse patient events | Intake by text, QR code, email or web form, plus routing and escalation. Voice reporting is rolling out. |
| 484.65(c)(1)(iii): immediate correction of safety threats | Routing and escalation put a serious event in front of its owner at once. A corrective action carries a due date. |
| 484.65(c)(2): analyze causes | Investigations record contributing factors and five whys. Lauren drafts. A person signs. Human-authored RCA templates are rolling out. |
| 484.65(c)(3), (e)(2): measure success and evaluate every improvement action | Corrective actions with owner, due date, evidence and an effectiveness check. Analytics show whether the cluster went away. |
| 484.65(b)(1): OASIS-derived measures | Not an IncidentKit measure. OASIS data stays in your home health system. IncidentKit adds incident and corrective action data. |
| 484.65(d)(2), (e): project documentation and governing body oversight | Compliance packets give the governing body a QAPI summary. The audit trail logs every change. Charters stay in your QAPI documents. |
| 484.70(b): infection program integral to QAPI | Infection incidents are recorded like any other event. Surveillance data stays in your infection control system. |

## Frequently asked questions

### How many performance improvement projects must a home health agency do?

At least one project in development, ongoing or completed each calendar year, per CMS guidance. The agency decides which fit, based on its QAPI data.

### What counts as an adverse patient event for a home health agency?

CMS describes negative, unexpected events that affect the patient's plan of care and could cause a decline in condition. The agency must track them all and analyze whether preventable errors caused them.

### What does immediate correction mean in the QAPI rule?

Under 42 CFR 484.65(c)(1)(iii), improvement work must lead to immediate correction of any problem that directly or potentially threatens patient health and safety. CMS gives no deadline in days.

### What data must a home health agency use in QAPI?

Quality indicator data, including OASIS-based measures where they apply, plus other relevant data. The governing body approves how often and how much data is collected.

## Sources

- [42 CFR 484.65, Quality assessment and performance improvement (eCFR)](https://www.ecfr.gov/current/title-42/section/484.65)
- [CMS Transmittal 219: State Operations Manual Appendix B, Home Health Agencies (April 12, 2024)](https://www.cms.gov/files/document/r219soma.pdf)
- [CMS Fiscal Year 2027 Mission and Priorities Document](https://www.cms.gov/files/document/fy-27-mpd.pdf)
- [ACHC: Home health accreditation](https://achc.org/home-health/)
- [ACHC: Frequently asked questions](https://achc.org/faqs/)

## Related

- [Home health incident reporting software for field staff](https://incidentkit.ai/solutions/home-health)
- [ACHC accreditation: deemed status, surveys and standards](https://incidentkit.ai/compliance/accreditation/achc)
- [Adverse event: definition and meaning](https://incidentkit.ai/glossary/adverse-event)
- [QAPI: definition and meaning](https://incidentkit.ai/glossary/qapi)
- [QAPI program guide for ASCs, nursing homes and hospitals](https://incidentkit.ai/guides/qapi-program-guide)
- [Near-Miss Reporting: How to Build a Program That Works](https://incidentkit.ai/use-cases/near-miss-reporting)