# Hospital QAPI under 42 CFR 482.21: what surveyors check

> A hospital must run a hospital-wide QAPI program, the quality program CMS requires. It tracks medical errors, near misses and adverse events, finds causes and checks that fixes last. The governing body, medical staff and administrators are accountable. CMS's March 2026 guidance tells surveyors to sample at least three tracked events.

Source: https://incidentkit.ai/compliance/cms-qapi/hospitals · Updated Oct 5, 2026

## Key facts

- **Rule:** 42 CFR 482.21, condition of participation
- **Survey guidance:** State Operations Manual Appendix A, A-0263 and related tags, Rev. 238 (March 20, 2026)
- **Accountable:** Governing body, medical staff and administrators
- **Project count:** Proportional to services and decided each year
- **Survey sample:** At least three tracked events or errors
- **Records:** CMS guidance: keep records of projects completed in the previous six years
- **Obstetric QAPI:** Effective January 1, 2027
- **Deemed options:** Joint Commission, DNV, CIHQ, ACHC

- **Citation:** 42 CFR 482.21
- **Authority:** CMS
- **Applies to:** Medicare-participating hospitals, including every campus and service under the provider agreement, Multi-hospital systems that elect a unified and integrated QAPI program

## What does 42 CFR 482.21 require?

An effective, ongoing QAPI program that runs on data in every department and service, even contracted ones. It is a condition of participation, a rule a hospital must meet to take part in Medicare. The hospital must show CMS proof that it runs.

*42 CFR 482.21 in plain language*

| Standard | What it asks for |
| --- | --- |
| Program scope | Show gains in indicators tied to outcomes. Measure, analyze and track quality indicators, including adverse patient events. |
| Program data | Use quality data, including Medicare reporting on readmissions and hospital-acquired conditions. The governing body sets how often and how much data is collected. |
| Program activities | Prioritize high-risk, high-volume and problem-prone areas. Track medical errors and adverse events, analyze causes, act, then measure and sustain results. |
| Improvement projects | Run projects in proportion to the hospital's services. Record each project's purpose and measurable progress. |
| Executive responsibilities | The governing body, medical staff and administrators define the program, set safety goals and fund it. They decide how many projects to run each year. |
| Unified program | A system governing body may run one combined program for several certified hospitals if each hospital's needs are met. |

## Who does what in hospital QAPI?

Three groups are named: the governing body, the medical staff and administrative officials. CMS says administrative officials include at least the chief executive, chief operating officer and chief nurse executive.

- **Governing body:** approves how often and how much data is collected, approves the yearly project count and reviews results.
- **Medical staff:** may hand its QAPI role to the medical staff executive committee.
- **Administrative officials:** fund the program and show up in the minutes.
- **Contractors:** contracted services must be inside the program. Their quality data goes to leaders, and QAPI roles go into contracts.

CMS names this proof: budget documents, minutes with QAPI as a standing item, attendance rosters, and signatures on yearly QAPI project reviews.

## What do surveyors look for?

Surveyors ask whether the hospital has an effective system to find problems, act and follow up. They also ask whether gains last. They do not judge which measures it chose. CMS revised the guidance in State Operations Manual Appendix A, Rev. 238, issued March 20, 2026, covering tags A-0263, A-0273, A-0283, A-0286, A-0297, A-0309 and A-0315.

- Show the error and adverse event reporting policy and demo the system. Can it sort data by type, date, shift and unit?
- Show training on what to report and how, with records. Staff in various units are interviewed.
- For at least three tracked events or errors, show the systematic analysis and the changes. Show the later data and proof the gain lasted.
- Show governing body minutes that set how often and how much data is collected.

> **When material is called privileged** Privileged means legally protected from disclosure. Surveyors ask if the hospital can give other proof that is not protected. If it gives none, or too little, CMS says a deficiency must be cited.

## What should a hospital show?

- The QAPI program document, covering all locations and services
- Governing body minutes: QAPI as a standing item, data frequency, yearly project count
- Indicators tracked, including adverse events
- The reporting policy, with a demo of the system
- Root cause analyses, resulting changes and later data
- Current projects, with the reason and measurable progress for each. Keep records of projects completed in the previous six years, per CMS guidance.
- Quality data from contracted services
- Budget lines for QAPI staff, time, systems and training

## Where do hospitals fall short?

- **Events tracked, no action.** CMS's example: three wrong-site surgeries and five near misses in a year. No analysis and no change to pre-surgical verification.
- **Near misses ignored.** CMS says they must be tracked and analyzed.
- **Indicators that show no gains.** CMS wants several analyses over time, not one data point.
- **Non-clinical measures.** Employee satisfaction used in place of clinical indicators such as infection rates.
- **Contracted services left out.** The hospital stays responsible for their quality and safety.
- **No proof the governing body set data frequency and detail.**
- **A one-time fix with no follow-up data.**

## How do incident reports fit?

CMS does not set the reporting method. It expects one that lets the hospital track and analyze errors and adverse events meaningfully. Preventive actions include policy changes, repaired equipment and staff training, with proof of each.

CMS adopts the QuIC (federal quality task force) definition of an error. It treats a near miss as an error. Sentinel-level events carry extra accreditor expectations. See [sentinel events](https://incidentkit.ai/compliance/reporting-deadlines/sentinel-events) and the [Joint Commission](https://incidentkit.ai/compliance/accreditation/joint-commission).

Surveyors ask whether data can be sorted by type, date, shift and unit. [IncidentKit analytics](https://incidentkit.ai/product/analytics) use the same cuts. [Corrective actions](https://incidentkit.ai/product/corrective-actions) keep the owner, evidence and effectiveness check CMS asks to see.

## What changes for hospitals with obstetric services?

Starting January 1, 2027, a hospital with obstetrical services must use QAPI to assess and improve outcomes and disparities among obstetrical patients. The eCFR, current through October 1, 2026, shows this.

| Requirement | What it means |
| --- | --- |
| Subpopulation analysis | Analyze QAPI data by the subpopulations the hospital finds among its obstetrical patients. |
| Measure and track | Track outcomes and disparities in processes of care, services and operations. |
| Act and sustain | Prioritize outcomes and disparities, act, measure results and track that gains last. |
| Annual project | At least one measurable improvement project a year on obstetrical outcomes and disparities. |
| State review data | If a maternal mortality review committee exists, build its public data and recommendations into QAPI. |

CMS's fiscal year 2027 priorities say the obstetric organization and staffing rules took effect January 1, 2026. Hospitals with a CMS-approved accreditor are surveyed by the [Joint Commission](https://incidentkit.ai/compliance/accreditation/joint-commission), [DNV](https://incidentkit.ai/compliance/accreditation/dnv), [CIHQ](https://incidentkit.ai/compliance/accreditation/cihq) or [ACHC](https://incidentkit.ai/compliance/accreditation/achc).

## What the rule asks for, and how IncidentKit supports it

| Requirement | IncidentKit |
| --- | --- |
| 482.21(a)(2), (c)(2): measure, analyze and track errors, near misses and adverse events | Intake by text, QR code, email or web form, plus routing. A pack sets incident types for each site. |
| A-0286: the system can organize data by type, date, shift and unit | Analytics cluster incidents by location, shift, equipment and cause. |
| 482.21(c)(2): analyze causes with a systemic approach | Investigations record contributing factors and five whys. Lauren drafts. A person signs. Human-authored RCA templates are rolling out. |
| 482.21(c)(3): measure success and keep improvements in place | Corrective actions with owner, due date, evidence and an effectiveness check. Nothing closes until verified. |
| 482.21(d): document each project's reason and measurable progress | A compliance packet carries the trends and closed actions behind a project. |
| Executive oversight and contracted services | The audit trail and compliance packets give leaders a record to review. Contractors use the same intake. |
| 482.21(b)(4): obstetric subpopulation analysis from 2027 | Not an IncidentKit measure. Obstetric outcome data comes from your clinical systems. |

## Frequently asked questions

### Does CMS require specific quality measures for hospitals?

No. A hospital may use its own measures. It must track them, analyze the data and show measurable improvement. CMS sets no threshold.

### How many performance improvement projects must a hospital run?

The number must fit the hospital's services, with no fixed ratio. The governing body decides it each year. A patient safety IT project can count, and joining a QIO (quality improvement organization) project is not required.

### Do near misses count under hospital QAPI?

Yes. CMS says a near miss is an error from a patient safety view. Hospitals must track, analyze and work to prevent near misses.

### Who is accountable for hospital QAPI?

The governing body, medical staff and administrators share it. They must oversee it: review the program, approve yearly projects, judge improvement actions and fund staff, time, systems and training.

## Sources

- [42 CFR 482.21, Quality assessment and performance improvement program (eCFR)](https://www.ecfr.gov/current/title-42/section/482.21)
- [CMS Transmittal 238: State Operations Manual Appendix A, Hospitals (March 20, 2026)](https://www.cms.gov/files/document/r238soma.pdf)
- [CMS Fiscal Year 2027 Mission and Priorities Document](https://www.cms.gov/files/document/fy-27-mpd.pdf)
- [CMS: Accrediting organizations](https://www.cms.gov/medicare/health-safety-standards/accreditation-programs)
- [Federal Register: CMS approval of the Joint Commission's hospital accreditation program, 2025](https://www.federalregister.gov/documents/2025/06/23/2025-11451/medicare-and-medicaid-programs-application-from-the-joint-commission-for-continued-cms-approval-of)

## Related

- [Joint Commission sentinel event policy: definition and RCA](https://incidentkit.ai/compliance/reporting-deadlines/sentinel-events)
- [Joint Commission accreditation: surveys and sentinel events](https://incidentkit.ai/compliance/accreditation/joint-commission)
- [Patient safety event reporting software for hospitals](https://incidentkit.ai/solutions/hospitals)
- [QAPI program guide for ASCs, nursing homes and hospitals](https://incidentkit.ai/guides/qapi-program-guide)
- [Adverse event: definition and meaning](https://incidentkit.ai/glossary/adverse-event)
- [Near miss: definition and meaning](https://incidentkit.ai/glossary/near-miss)
- [Performance improvement project: definition and meaning](https://incidentkit.ai/glossary/performance-improvement-project)
- [Medication Error Reporting: Steps, Severity and Follow-Up](https://incidentkit.ai/use-cases/medication-error-reporting)