Introduction
Every CMS-regulated nursing home and long-term care facility must complete a facility assessment under 42 CFR 483.71 (F-Tag 838). Yet many facilities still manage this requirement through disconnected spreadsheets, outdated templates, and files scattered across shared drives.
That approach creates real risk. Facilities that treat the facility assessment as a checkbox exercise, rather than a living, data-driven document, face survey deficiencies, staffing citations, and exposure they can't easily explain to a surveyor.
This guide covers what CMS requires:
- What a facility assessment is and why it matters
- The components F-Tag 838 mandates
- When facilities must update their assessment
- Common pitfalls that trip up well-run facilities
- How a modern facility assessment tool simplifies the process
Key Takeaways
- Facility assessments are federally required, evidence-based evaluations, not a once-a-year formality
- CMS expects assessments to directly shape staffing, contingency plans, and resource decisions
- Reviews must happen annually, plus anytime resident population or services change significantly
- Leadership, direct care staff, residents, and families must all have documented input
- Purpose-built compliance software replaces manual, siloed processes that create gaps and outdated data
What Is a Facility Assessment?
A facility assessment is a CMS-mandated evaluation under 42 CFR 483.71, tracked under survey tag F838. Its purpose: help long-term care facilities determine what resources they actually need to care for their resident population safely, competently, and consistently — during normal operations and during emergencies.
CMS requires the assessment to cover three foundational elements:
- Resident population profile — who lives at the facility and what they need
- Facility resources — staff, equipment, services, and contracts available to meet those needs
- Risk assessment — facility-based and community-based hazards that could disrupt care
A Regulatory Requirement That Keeps Evolving
The facility assessment requirement itself isn't new. But interpretive guidance released through QSO-24-13-NH, effective August 8, 2024, expanded expectations considerably. Facilities must now show:
- Use evidence-based, data-driven methods to assess resident needs
- Document staffing decisions using unit- and shift-level data
- Maintain a recruitment and retention plan for direct care staff
- Plan for non-emergency disruptions with documented contingency measures
A facility assessment is not a building inspection. It centers on resident care capacity and organizational readiness, not structural or mechanical systems, which fall under a separate process entirely.
CMS is explicit: the assessment must be "evidence-based and data-driven," consistent with individual resident assessments under 42 CFR 483.20, not a generic template filled out to satisfy an auditor. Typically, this work involves administrators, directors of nursing, and compliance or quality officers, with required input from direct care staff and resident or family representatives woven in throughout.
Key Components of a Comprehensive Facility Assessment
Each of the three required domains carries its own data requirements and its own stakeholder expectations. Skipping or shortchanging any one of them creates direct F838 exposure.
Resident Population Profile
This section documents who your facility serves and what that population actually requires. At minimum, it must cover:
- Resident count and current capacity
- Diseases, conditions, and overall acuity levels
- Physical and cognitive limitations
- Specialized needs — equipment, assistive technology, communication devices, physical space requirements
The profile can't exist in a vacuum. It must align with individual resident assessments, using sources like MDS data rather than estimates or assumptions.
Facility Resources and Services
This domain inventories everything the facility has available to meet resident needs:
- Staff competencies and skill sets
- Medical and non-medical equipment
- Contracted services and third-party agreements
- Health IT and electronic resident records
Following the 2024 guidance update, this section must now explicitly address behavioral health, pharmacy, and rehabilitation therapy services as distinct resource categories, not afterthoughts folded into a general staffing note.
Risk Assessment (Facility- and Community-Based)
This component evaluates what could go wrong and whether the facility is prepared. It covers internal risks like equipment failure, staffing shortages, and care delivery breakdowns, as well as external and community risks such as natural disasters, public health emergencies, and supply chain disruptions.
CMS requires contingency plans for disruptions that don't rise to the level of activating a full emergency plan. A common example from CMS guidance: covering several holiday shifts with contract licensed nurses when regular staff availability drops. That's a facility assessment issue, not just a scheduling headache.
Configurable risk registers, like the ones built into ComplyGovern, help track these scenarios as they evolve so the assessment stays current between formal review cycles.
When Must a Facility Assessment Be Completed and Updated
Facilities need a documented facility assessment in place right now: this is not optional or pending. Beyond that baseline, CMS requires review and updates at least annually.
But annual review is only the floor. An off-cycle update is required whenever:
- The resident population changes significantly (new dietary, cultural, or religious needs; new clinical populations like ventilator or dialysis residents)
- New services are added or existing ones change
- Major renovations affect care delivery or physical space
- Staffing models shift in ways that affect care capacity
CMS has documented real consequences for missing these triggers. In one cited example, a facility went 15 months without updating its assessment after admitting residents with vegan and religious dietary needs, and menus never caught up. This is the kind of gap surveyors are trained to find.
The part facilities often underestimate is this: the assessment must directly inform staffing decisions for every unit and every shift. An outdated assessment does not just sit quietly in a binder — it creates a direct line of exposure the moment a state surveyor starts asking staffing questions. Continuous monitoring tools, like ComplyGovern's Governance Intelligence Engine, can flag these triggers automatically so updates happen before a surveyor ever asks.
Common Challenges Facilities Face When Conducting Assessments
Even facilities with good intentions run into the same recurring problems:
- Fragmented data sources. Resident data lives in the EHR, staffing data lives in scheduling software, and incident data sits in a separate system. Manually pulling "evidence-based and data-driven" information from three or four disconnected platforms invites errors and gaps.
- Inconsistent stakeholder documentation. CMS requires active involvement from leadership, direct care staff, and solicited input from residents and families. Facilities often fail to prove this engagement happened, which draws scrutiny during survey.
- Treating the assessment as static. The biggest risk is letting the facility assessment become an annual paperwork exercise instead of a living document tied to real-time staffing and risk decisions. A stale assessment can't reflect current census acuity, leaving gaps exposed during survey.
How a Facility Assessment Tool Simplifies Compliance
CMS doesn't mandate specific software for facility assessments. But facilities that rely on spreadsheets and shared drives tend to run into the exact problems described above: fragmented data, undocumented stakeholder input, and assessments that go stale between surveys.
This is where a unified governance platform like ComplyGovern changes the equation.
One Connected System Instead of Scattered Files
ComplyGovern's Governance Intelligence Engine links regulations, policies, controls, evidence, risks, and corrective actions into a single connected chain. Rather than maintaining separate documents for resident data, staffing plans, and risk registers, facilities work from one governed source of truth.
- Policy & Document Governance handles version control, scheduled reviews, and audit history, so the assessment doesn't expire unnoticed between review cycles
- Configurable risk registers cover clinical, operational, regulatory, and enterprise risk categories, applicable to both facility-based and community-based hazards
- Native integration with Epic, Oracle Health (Cerner), MEDITECH, and athenahealth via HL7 and FHIR standards means resident population data doesn't have to be manually re-entered from the EHR
Continuous Visibility Replaces Reactive Scrambling
Real-time executive dashboards give administrators and nursing leadership ongoing visibility into compliance status, open risks, and accreditation readiness. That continuous line of sight supports year-round survey readiness, replacing the last-minute scramble before inspectors arrive.
The platform also maps facility assessment requirements against broader frameworks: CMS Conditions of Participation, Joint Commission standards, and DNV Healthcare requirements. Compliance, quality, and risk teams no longer duplicate the same evidence collection for three separate audiences.
Security Built for Resident Data
Because facility assessments involve sensitive resident information and risk documentation, security matters as much as functionality. Look for:
- HIPAA-aligned architecture with encryption at rest and in transit
- Role-based access control and MFA/SSO
- Comprehensive audit logging
- Native Microsoft 365 and SharePoint integration, so documentation lives inside tools your team already uses
This security baseline is the minimum any facility should expect before trusting a platform with resident-level data.
Frequently Asked Questions
What is a facility risk assessment?
This component of the facility assessment evaluates internal risks, like equipment failure or staffing shortages, and external or community-based risks, like natural disasters, that could affect resident care and safety.
When must facility risk assessments be completed?
Facilities must have one completed initially, then reviewed and updated at least annually. Any significant change in population, services, or risk factors also triggers an off-cycle revision.
What should the resident profile section include in a facility assessment?
This section covers resident count, diagnoses and conditions, acuity levels, physical and cognitive limitations, and specialized needs such as equipment, assistive technology, or communication devices.
What is F-Tag 838?
F-Tag 838 is the CMS State Operations Manual tag governing the facility assessment requirement under 42 CFR 483.71. It's the specific citation surveyors reference when a facility's assessment falls short.
Who is responsible for completing a facility's assessment?
Completing the assessment requires active involvement from leadership, management, and direct care staff, along with input solicited from residents and families. Compliance officers or nursing leadership typically coordinate the process.
What happens if a nursing home fails to properly complete or update its facility assessment?
The facility risks a survey deficiency citation under F838, and possibly related citations if understaffing or inadequate resources caused actual harm. That exposure compounds during CMS or state inspections.
