How CMS-3367-FC redefines “survey-ready” and why continuous credentialing is no longer optional
For decades, healthcare organizations have approached accreditation surveys as scheduled events: predictable windows on a multi-year cycle, with enough lead time to prepare documentation, staffing, and facilities in advance. That model is coming to an end. Starting June 16, 2027, a sweeping new Centers for Medicare and Medicaid Services (CMS) final rule closes the door on advance notice, blackout dates, and predictable survey windows for good.
This isn’t a minor adjustment to survey logistics. It’s a fundamental shift in what “compliant” means: not “compliant when we know someone’s coming,” but compliant at all times, because no one will tell you when they’re coming.
What the rule actually changes
CMS’s final rule, published in the Federal Register on June 16, 2026, formally defines “unannounced survey” in federal regulation for the first time (not just in sub-regulatory guidance) and closes several loopholes that Accrediting Organizations (AOs) had used for years:
- No advance notice, period. Some AOs had been giving facilities up to 60 minutes’ notice before a survey team’s arrival. That practice is now explicitly prohibited.
- Blackout dates are gone. Facilities will no longer be able to request dates they’d prefer not to be surveyed.
- “Administrative” tip-offs are also off the table. CMS called out the practice of AOs inadvertently signaling an upcoming survey through billing calls, address-confirmation contacts, or other routine touchpoints, and closed that gap too.
- AOs must now operate more like State Survey Agencies (SAs), standardizing training and survey activity requirements so there’s no more “easier AO to work with” arbitrage.
- Remediation consulting is barred for self-identified deficiencies. An AO can no longer sell an audited provider consulting to fix the very deficiencies it found, since CMS flagged the conflict of interest this created.
CMS was direct about the intent behind all of this. In its response to public comments, the agency stated plainly that it expects facilities to be “survey-ready, meaning always in compliance with the Medicare conditions, at all times,” and that any advance warning “could give leadership an opportunity to appear involved in the facility, when in normal operations, leadership could be absent or not as involved as made out to appear.”
Why this is happening now
The rule isn’t just about tightening survey logistics. It’s a response to real, documented gaps CMS found in AO performance:
- Providers keeping accreditation even after being terminated from Medicare or Medicaid for safety concerns.
- Conflicts of interest created by AOs selling fee-based consulting to the same facilities they accredit.
- Inconsistent survey outcomes tied directly to AOs notifying facilities ahead of time, a practice CMS says is “against CMS policy” and undermines the entire point of a survey.
CMS’s own annual Reports to Congress flagged these issues repeatedly, and this final rule is the agency’s answer: standardize AO practices to match SA practices, and remove every mechanism a facility could use to look compliant for a day rather than be compliant every day.
What “survey-ready at all times” actually requires
This is where the mandate stops being a regulatory headline and starts being an operational problem, and most organizations already know it. In Propelus’s State of Workforce Compliance survey with Becker’s, 55% of respondents said they didn’t feel prepared for an unannounced regulatory audit. CMS-3367-FC just made that gap a regulatory liability instead of an internal worry.
Under the old model, organizations could reasonably concentrate credentialing cleanup, license verification, and documentation review into a “survey prep” sprint ahead of a known reaccreditation window (every 32 to 36 months). CMS has now made clear that predictability, even the loose predictability of a three-year cycle, is a problem, because it lets facilities time-box their compliance effort instead of sustaining it.
That has direct implications for one of the areas CMS scrutinizes most closely: verified, current credentials for everyone providing care, not just full-time employed staff. The final rule reinforces credentialing standards like the requirement that hospitals verify credentials for all providers, including contracted staff and individuals under arrangement, before they’re allowed to work, with no exceptions for staff who are temporary, cross-covering, or off-site.
That’s exactly where most organizations’ audit-readiness quietly breaks down:
- Complex, non-traditional positions, such as telehealth providers, float staff covering multiple facilities, and contracted specialists, are harder to track continuously and easier to lose sight of between survey cycles.
- Pre-hire verification gaps create exposure the moment someone starts seeing patients, not just at the next audit.
- Manual, periodic license and credential checks were built for a world where you knew when the survey was coming. That world is gone.
Where Propelus EverCheck fits
This is precisely the shift EverCheck is built for. Continuous, automated primary source verification means an organization’s credentialing status isn’t a snapshot taken before a scheduled survey. It’s a live, defensible record, every day of the year.
- EverCheck for complex positions extends that same continuous monitoring to the staffing categories that are hardest to keep current manually, including contracted, cross-covering, and multi-location providers, so there’s no gap between “employed here” and “verified here.”
- EverCheck Prehire moves that readiness earlier still, verifying credentials before someone starts working rather than catching a gap after the fact, directly addressing the standard CMS highlighted requiring verification prior to official hiring.
Together, they answer the question this rule is really asking every healthcare organization: not “will you be ready when they call,” but “are you ready right now, without knowing they’re coming?”
Get ahead of the June 2027 deadline
CMS has spent years signaling that “survey-ready” should mean “always compliant.” With CMS-3367-FC, that expectation is now written into federal regulation, with an effective date of June 16, 2027, giving organizations roughly a year to move from periodic prep to continuous readiness.
The organizations that move fastest won’t be scrambling when CMS-3367-FC takes effect, since they’ll already have continuous, audit-ready credentialing in place.
Visit the EverCheck “Reactive to ready” resource hub for more tools to help you stay ahead of compliance, or talk to our team about what continuous readiness would look like for your organization.
Sources