CMS Form 2567: Tag Numbers, Deficiency Levels, and the Plan of Correction Clock

A Form CMS-2567, titled “Statement of Deficiencies and Plan of Correction,” is what a state survey agency leaves behind after a hospital survey conducted on CMS’s behalf finds the hospital out of compliance with one or more Medicare Conditions of Participation. It is not the only survey document a hospital will ever see — a Joint Commission or other accrediting-organisation survey generates its own finding format, a Requirement for Improvement, scored on the SAFER Matrix — but the 2567 is the one that carries official federal weight, the one with a fixed clock attached to it, and the one that eventually becomes a public record. For an infection preventionist, patient-safety officer, quality director or risk manager, knowing how to read one and what it obligates the facility to do next is not optional reading.

This page covers the structure of the form itself, what separates a standard-level finding from a condition-level one, what an acceptable plan of correction has to contain and by when, and what happens to the document after your facility submits its response.

What Triggers a Form 2567

A hospital receives a Form CMS-2567 any time a state survey agency, acting as CMS’s agent under the Conditions of Participation at 42 CFR Part 482, conducts a survey and records at least one deficiency. That covers several distinct survey types, not just the periodic recertification visit:

• Initial certification — before a new hospital can bill Medicare or Medicaid.
• Standard recertification — unannounced, on a cycle the state agency sets rather than the hospital.
• Complaint investigation — triggered by a complaint the state agency decides warrants an on-site look, which can be as narrow as a single unit or condition.
• Validation survey — a state-agency survey of a sample of hospitals that hold deemed status through an accrediting organisation, used to check whether the AO’s own survey process is finding what CMS would find.

Every one of those, when it turns up a deficiency, produces a Form 2567. What it does not produce a 2567 is a routine Joint Commission, DNV, or HFAP accreditation survey conducted under the AO’s own deeming authority — that process generates the accreditor’s own finding format instead. Joint Commission’s tracer methodology, for example, produces a Requirement for Improvement placed on the SAFER Matrix, resolved through an Evidence of Standards Compliance submission on its own clock — a parallel track with different mechanics, different paperwork, and a different public-disclosure path than the one this page covers. A hospital that holds deemed status can still receive a Form 2567 from a validation or complaint survey even though its routine surveys run through the accreditor.

How to Read the Form

The header identifies the facility, its provider number, the survey dates, and the survey type. Below that, the body of the form is organised as one block per cited deficiency, split into two columns:

• Left column — the surveyor’s finding. Each block opens with a tag number and the specific regulatory citation it corresponds to, followed by the “Summary Statement of Deficiencies”: a narrative description of the deficient practice and the evidence the surveyor observed — record reviews, interviews, direct observation — that supports the finding. This column is entirely the state agency’s language; the hospital does not edit it.
• Right column — the provider’s plan of correction. Blank when the form is issued. This is where the hospital writes what it will do about each cited tag, cross-referenced to that tag, plus a completion date for each item.

The tag number itself tells you which regulatory family the deficiency belongs to. For a hospital surveyed under 42 CFR Part 482, deficiencies are cited as A-tags (for example, A-0000-series numbers keyed to the interpretive guidelines in State Operations Manual Appendix A). That A-prefix is specific to the hospital Conditions of Participation — a fire-safety finding from the same survey shows up as a K-tag instead, cited against a different appendix and, for hospitals, against NFPA 101 as applied through Form CMS-2786R; a laboratory finding under CLIA uses yet another tag family. Knowing which prefix you’re looking at tells you which regulation, which interpretive guidance, and in practice which internal team should own the response before you’ve read a word of the narrative.

Standard-Level vs. Condition-Level Deficiencies

Each Condition of Participation is not a single pass/fail test — it is built from a set of underlying standards, and a surveyor can find a hospital out of compliance with an individual standard without that failure being severe or widespread enough to threaten the Condition as a whole. That distinction is the single most consequential thing on the form, because the two levels lead to different places:

• Standard-level deficiency. The hospital failed to meet a specific standard, but the surveyor’s overall determination is that the Condition itself is still met. The hospital still has to submit and implement an acceptable plan of correction, but the finding alone does not put certification at risk.
• Condition-level deficiency. Either enough standards under one Condition are cited, or a single finding is serious enough on its own, that the surveyor determines the Condition itself is not met. A condition-level finding is what can move a hospital onto a track toward termination of its Medicare and Medicaid provider agreement, and it typically requires a follow-up survey to confirm the deficiency has actually been corrected — a desk review of the paperwork is not enough to close it out.

The most severe tier sits inside condition-level: a finding of immediate jeopardy, where noncompliance has caused or is likely to cause serious injury, harm, impairment or death. Immediate jeopardy is always condition-level, but it adds its own acute-harm requirement and its own compressed timeline on top — see immediate jeopardy: writing the removal plan and working the 23-day clock for how that specific case differs from the standard plan-of-correction process described below.

The Plan of Correction Requirement and Deadline

Once a hospital receives its Form 2567, it is required to submit an acceptable plan of correction to the state survey agency — and under CMS’s survey and enforcement procedures, that clock runs in calendar days, not business days, and is short: hospitals are generally expected to return an acceptable POC within 10 calendar days of receiving the Statement of Deficiencies. This requirement flows from the plans-of-correction rule at 42 CFR 488.28, which conditions continued participation on the facility submitting, and then carrying out, an acceptable POC for every cited deficiency.

An acceptable plan of correction, for each tag cited, needs to address:

1. What corrective action will be taken for the specific patient, situation, or system the deficiency describes.
2. How the facility will identify other patients potentially affected by the same deficient practice, not just the one the surveyor happened to observe.
3. What systemic changes will be put in place so the practice does not recur — a process or policy fix, not just a one-time correction.
4. How the facility will monitor that the corrective action is actually working, and for how long.
5. A completion date for each item, realistic enough to survive a revisit.

A POC that only restates the finding, or promises a fix without a monitoring mechanism, is a common reason a state agency sends one back for revision — which itself eats into the time available before enforcement consequences start to attach. You can submit an acceptable plan of correction while formally noting disagreement with a specific finding; annotating disagreement does not forfeit your appeal rights, but it also becomes part of the same public record described below.

Writing a Plan of Correction That Passes on the First Read

The five required elements above tell you what a plan of correction has to cover. They don’t tell you how to write each one so a reviewer accepts it without sending it back — and for a state survey agency working through a stack of POCs on a deadline, specificity is what separates an accepted submission from a returned one. The corrections below are not about writing more; a POC that is twice as long but still vague in the same places fails the same way a short one does.

The elements, written to survive scrutiny

• Corrective action tied to the cited deficiency, not the general topic. If the tag cites a specific medication-administration lapse on a specific unit, the corrective action has to name that lapse and that unit before it says anything else. “Staff will be re-educated on medication administration” answers a different, broader question than the one the surveyor actually cited.
• A named responsible party, not a department. “Nursing” or “staff” is not a responsible party a state agency can hold accountable on a revisit; a title — Director of Pharmacy, Unit Manager, Infection Preventionist — is. Some facilities name the specific individual by role for internal tracking and use the title alone in the version that becomes a public record.
• A systemic change, distinct from the one-time fix. Correcting the instance the surveyor found (retraining one nurse, replacing one expired kit) closes that single finding. It does not answer how the facility will keep the same gap from recurring on the next shift, on the next unit, or with the next new hire — that requires a process or policy change: a revised order set, a new double-check step, a change to how a supply cart is stocked and checked.
• Identification of who else could have been affected — not just the patient or record the surveyor happened to review. This usually means a defined look-back: which unit, which date range, which patient population shares the same condition that let the deficiency occur, and what the facility actually did to check that group, not just assert that it did.
• A monitoring plan with a real metric, not a promise to “continue monitoring.” An acceptable monitoring plan states what will be measured (e.g., percentage of charts meeting the corrected documentation standard), how it will be sampled (audit size, selection method), how often, for how long, and who reviews the results and where they get reported — a committee, a director, a QAPI meeting. “Ongoing” with no end point or reporting line reads as no monitoring plan at all.
• A completion date the facility can actually defend on a revisit. A date that assumes everything goes right the first time is a date a records request or resurvey can catch out. Build in the time the systemic change genuinely needs, not the date that looks fastest on paper.

A worked contrast

Illustrative example, not a real survey finding or a real facility — constructed to show the difference in specificity, not to represent an actual cited deficiency.

Weak: “Staff will be re-educated on proper hand hygiene. This will be monitored going forward by the Infection Prevention department.”

Stronger, for the same hypothetical tag: “All Med-Surg 3 nursing staff will complete documented hand-hygiene competency validation by [date]. The unit’s hand-hygiene observation protocol is revised to require two unannounced audits per shift instead of one, effective [date]. A chart of the affected patient population from the preceding 30 days was reviewed by the Infection Preventionist to confirm no related exposure; findings documented in the IP log. Compliance will be tracked via direct observation, target 95%, audited weekly for 90 days by the Infection Preventionist and reported monthly to the Infection Control Committee; results below target trigger a documented follow-up plan. Responsible party: Infection Preventionist. Completion date: [date].”

The second version answers every element above in one paragraph: the specific unit, a systemic protocol change (not just retraining), an affected-population check, a named metric and audit cadence, a reporting line, a named responsible party, and a completion date.

Why plans of correction get sent back

Beyond the general pattern described above — restating the finding or promising a fix with no monitoring mechanism — the specific patterns a reviewer is trained to catch include:

• Education-only corrective action for a process failure. Re-training addresses knowledge; most cited deficiencies are process gaps that recur even among staff who already know the correct practice.
• No affected-population look-back — addressing only the single patient or record named in the finding, with no statement of how the facility checked whether the same gap touched anyone else.
• A monitoring plan with no measurable target, sample size, or end date. “Will continue to monitor” is not a plan a revisit can check the facility against.
• No named responsible party, or one written broadly enough (“nursing staff,” “the department”) that no one is actually accountable for it.
• A completion date that has already passed, is left blank, or is vague (“ongoing,” “in progress”) rather than a specific calendar date.
• One response covering multiple tags, or a response that doesn’t cross-reference its tag number at all — the state agency processes each tag’s response individually and a merged answer is difficult to verify against any one of them.

If the plan of correction is rejected

A returned POC is not a new 10-day clock in most jurisdictions — it is time borrowed from what was already a short window, so the practical fix is building the stronger version described above the first time, not planning to revise after a rejection. If a POC is bounced, the survey agency’s feedback typically identifies which element is missing per tag; the fastest path back is addressing that specific gap rather than rewriting the submission from scratch. See immediate jeopardy: writing the removal plan and working the 23-day clock for how the compressed version of this same process works when a finding carries an acute-harm designation.

What Happens After You Submit

What happens next depends on the level of the finding. For a standard-level deficiency, the state agency will often accept and verify the plan through a desk review of the POC and any supporting documentation the hospital submits. For a condition-level deficiency, verification typically requires an on-site revisit survey before the state agency will confirm the Condition is met again — the hospital’s written assurance is not sufficient on its own.

If the POC is rejected outright, or if a revisit finds the deficient practice was not actually corrected, the state agency can recommend that CMS apply enforcement remedies short of termination — a directed plan of correction, denial of payment for new admissions, or civil money penalties among them — while termination of the provider agreement remains the remedy of last resort for deficiencies that are not resolved. That escalation ladder is a separate, longer process than the 23-day track that applies specifically to immediate jeopardy.

The 2567 Becomes a Public Record

Once a survey is complete, the Statement of Deficiencies is public information — it is released through CMS’s own public data channels and through state public-records processes, and from there it is picked up by third-party aggregators. HospitalInspections.org, a project of the Association of Health Care Journalists, is one of the more widely used of these: it publishes deficiency details from complaint inspections at acute-care, critical-access and psychiatric hospitals nationwide going back to January 2011.

One detail worth knowing before a reporter, patient, or board member asks you about it: HospitalInspections.org’s own dataset does not include the hospital’s plan of correction. The public record most people encounter is the finding by itself, without the response — which is exactly why it is worth being able to explain, in plain terms, what the finding actually says and what the hospital did about it, rather than letting the bare deficiency stand as the whole story.

A Practical Checklist for the Receiving Team

1. Log the date and time of receipt. The 10-calendar-day clock starts there, not at the exit conference.
2. Sort by tag prefix first. An A-tag, a K-tag and a CLIA tag from the same survey belong with different owners; route them immediately rather than treating the 2567 as one undifferentiated document.
3. Build the POC against the required elements, not just a narrative. Corrective action, affected-population identification, systemic change, monitoring, and a completion date — for every tag, not just the ones that read as serious.
4. Name the population, not just the patient. A surveyor cites what they observed in one record; your POC has to address who else could have been affected by the same gap.
5. Set completion dates you can actually re-audit against. A revisit or a records request will test whether the date was real.
6. Loop in your accreditor if you hold deemed status. A validation-survey 2567 does not automatically become an accreditor finding, but it can still have consequences with your AO, and your AO will likely want to know before it hears about it elsewhere.

Frequently Asked Questions

Does every hospital survey produce a Form 2567?
No. Only surveys conducted by (or validated by) the state survey agency acting for CMS produce a 2567. A hospital’s routine accreditation survey through Joint Commission, DNV, or HFAP produces that accreditor’s own finding format instead, even though both processes ultimately test compliance with the same underlying Conditions of Participation.

What does the letter prefix on a tag number mean?
It identifies which regulation the finding is cited against. Hospital Conditions-of-Participation findings use A-tags; life-safety findings use K-tags cited against a different form and appendix; other provider types and CLIA laboratory findings use their own separate prefixes.

What is the practical difference between a standard-level and a condition-level deficiency?
A standard-level finding still requires a plan of correction but does not by itself put certification at risk. A condition-level finding means the surveyor determined an entire Condition of Participation is not met, which can move the hospital toward the termination track and typically requires an on-site revisit to clear.

How long does a hospital have to submit a plan of correction?
Generally 10 calendar days from receiving the Statement of Deficiencies, under CMS’s survey and enforcement procedures. The clock is shorter and separate for an immediate-jeopardy finding, which carries its own removal-plan requirement.

Is our plan of correction public along with the deficiency?
Not always, and not through every channel. HospitalInspections.org, for example, publishes the deficiency findings from complaint inspections but not the hospital’s plan of correction. Other channels, including CMS’s own data releases and state public-records requests, may include both documents — check the specific source before assuming which one a given audience is seeing.

What is the most common reason a plan of correction gets sent back for revision?
Corrective action that only restates the finding or promises to “re-educate staff” without a systemic process change, and a monitoring plan with no measurable target or end date. Both are checked against every tag individually, so one weak element on one tag can hold up that tag’s acceptance even if the rest of the POC is strong.

Does a plan of correction need to name a specific responsible person?
It needs a named responsible party the facility can be held to on a revisit — a title or role (Director of Pharmacy, Unit Manager) rather than a department name like “nursing” or “staff,” which isn’t specific enough for a reviewer to verify accountability against.

Is there an official CMS plan of correction template?
No standalone CMS-issued template exists beyond the blank right-hand column of Form CMS-2567 itself, which the facility fills in per tag. What functions as a template in practice is the five-element structure required at 42 CFR 488.28 (corrective action, affected-population identification, systemic change, monitoring, and completion date) plus a named responsible party for each — write to that structure, tag by tag, rather than a single narrative covering the whole survey.

Related Reading

• CMS Conditions of Participation for Hospitals: The Subpart Map — the underlying regulations every A-tag cites back to.
• Immediate Jeopardy: Writing the Removal Plan and Working the 23-Day Clock — the most severe, time-critical version of the condition-level finding described above.
• Joint Commission Tracer Methodology — how the accreditor’s parallel survey track turns a tracer observation into a Requirement for Improvement instead of a 2567 tag.
• NFPA 101 Life Safety Code in the Hospital Survey — how K-tags and Form CMS-2786R work as the life-safety counterpart to the A-tag process on this page.
• Sentinel Event: What It Means, and What Happens Next — the internal review process that runs alongside, not instead of, a survey response.