CMS Patient Rights Under 42 CFR 482.13: A Compliance Map

42 CFR 482.13, Condition of participation: Patient’s rights, is the broadest Condition of Participation in Part 482 by subject matter. It opens with a single instruction — ‘A hospital must protect and promote each patient’s rights’ — and then breaks that instruction into eight lettered standards, (a) through (h), each carrying its own documentation trail that a surveyor can pull independently. For patient-safety officers, quality directors, risk managers and infection preventionists building a survey-readiness binder, the practical problem is that 482.13 gets treated as a single line item when it is really eight separate compliance obligations wearing one section number.

This page maps all eight standards — notice of rights, the grievance process, exercise of rights, privacy and safety, confidentiality of records, restraint/seclusion, staff training and death reporting, and visitation rights — and what each one requires you to document. Restraint and seclusion, (e) through (g), already has its own exhaustive treatment on this site; this page summarizes those three standards and links out rather than duplicating that detail.

The eight standards, at a glance

Standard (a): Notice of rights and the grievance process

Notice of rights

482.13(a)(1) requires a hospital to inform each patient, or their representative where State law allows it, of the patient’s rights — in advance of furnishing or discontinuing patient care whenever possible. The regulation does not prescribe a specific document or delivery method; it requires that notice actually happen, early enough to be meaningful, and that a hospital be able to show it happened.

The grievance process

482.13(a)(2) is more procedural. The hospital’s governing body must approve the grievance process and is responsible for its effective operation — it can delegate day-to-day handling in writing to a grievance committee, but it cannot delegate away the responsibility itself. At minimum, the process must:

• Give patients a clearly explained procedure for submitting a written or verbal grievance;
• Specify time frames for reviewing the grievance and providing a response; and
• Resolve the grievance with written notice that names the hospital contact person, describes the investigation steps taken, states the results, and gives the date of completion.

The process must also include a mechanism to refer quality-of-care or premature-discharge concerns to the applicable Utilization and Quality Control Quality Improvement Organization (QIO).

A common misreading is that CMS sets a fixed federal deadline for resolving a grievance — it does not. 482.13(a)(2)(ii) requires the hospital’s own process to specify time frames; the regulation leaves the actual number of days to hospital policy. In practice, many hospitals build a two-tier target into policy — a short window for acknowledging receipt and a longer one for full resolution — but that split is a policy choice, not a number written into 482.13 itself. What a surveyor checks is whether your policy states a time frame and whether your grievance log shows you meeting it.

Where a concern is a complaint rather than a formal grievance — and the operational mechanics of drawing that line, plus the service-recovery workflow hospitals use to close the loop — is covered in depth in Patient Experience Improvement Programme.

Standard (b): Exercise of rights — care planning, informed decisions, advance directives

482.13(b) covers four related rights:

• Care-planning participation (b)(1) — the patient has the right to participate in developing and carrying out their own plan of care.
• Informed decisions (b)(2) — the patient or representative has the right to make informed decisions about care: being told of health status, being involved in planning and treatment, and being able to request or refuse treatment. The regulation is explicit that this right is not a mechanism to demand treatment or services that are medically unnecessary or inappropriate.
• Advance directives (b)(3) — the patient has the right to formulate an advance directive and to have hospital staff and practitioners comply with it, cross-referenced to the provider-agreement requirements at 42 CFR 489.100, 489.102 and 489.104.
• Admission notification (b)(4) — the patient has the right to have a family member or representative, and their own physician, notified promptly of their admission.

Note what (b)(2) is not: it is a general right to be informed and to accept or decline care, not a procedure-specific informed-consent form requirement. Consent-form content for specific procedures (surgery, for example) and research-context informed consent live in other regulatory frameworks entirely — this Condition establishes the baseline right, not the paperwork for every downstream consent event.

Standard (c): Privacy and safety

482.13(c) is short and states three rights directly: personal privacy (c)(1); the right to receive care in a safe setting (c)(2); and freedom from all forms of abuse or harassment (c)(3).

(c)(2) — the right to receive care in a safe setting — is the regulatory basis CMS cites for ligature-risk expectations, even though the phrase ‘ligature risk’ does not itself appear in the CFR text. CMS interprets a ‘safe setting’ as one a reasonable person in the patient’s position would consider safe, covering emotional as well as physical safety. The practical compliance work this drives — environmental assessment, hardware remediation, unit-by-unit risk categorization — is covered in Ligature Risk Assessment: CMS Expectations and How to Run One.

Standard (d): Confidentiality of patient records

482.13(d) gives patients two related rights: confidentiality of their clinical records (d)(1), and the right to access those records — including current records — on oral or written request, in the form and format they ask for if it’s readily producible, or in a readable hard-copy form otherwise, within a reasonable time frame (d)(2). The regulation states plainly that a hospital must not frustrate a patient’s legitimate efforts to access their own records and must actively work to meet those requests as quickly as its record-keeping system allows.

This is a Condition-of-Participation right, separate from and in addition to whatever the HIPAA Privacy Rule requires for the same records — the two frameworks point the same direction (patient access, controlled disclosure) but are enforced through different mechanisms and by different agencies. See HIPAA Privacy Rule for how that separate framework applies to the same clinical records.

Standards (e)-(g): Restraint, seclusion, training and death reporting — the short version

482.13(e) sets out the patient’s right to be free from restraint or seclusion used for coercion, discipline, convenience or retaliation, and permits restraint/seclusion only to protect immediate physical safety, using the least restrictive effective intervention, under a physician or licensed-practitioner order that is never written as standing or PRN. Order renewal limits and a 1-hour face-to-face evaluation apply specifically to restraint or seclusion used for violent or self-destructive behavior. 482.13(f) requires staff training, before performing restraint/seclusion tasks, at orientation, and periodically per hospital policy — CMS sets no federal annual interval. 482.13(g) requires reporting certain restraint/seclusion-associated deaths to CMS by close of business the next business day, with a narrower internal-logging exception for soft wrist-only restraints.

Because this is the single most prescriptive and most frequently cited part of 482.13, it has its own full treatment — order time limits by age, the 1-hour evaluation, monitoring and documentation requirements, staff training content, and the death-reporting mechanics — in Restraint and Seclusion Under the CMS Conditions of Participation (42 CFR 482.13).

Standard (h): Patient visitation rights

482.13(h) requires a hospital to have written policies and procedures on patient visitation rights, including any clinically necessary or reasonable restriction the hospital needs to place on visitation and the reasons for it. Within that, the hospital must:

• Inform each patient, or their support person where appropriate, of their visitation rights — including any clinical restriction — at the same time they’re informed of their other rights;
• Inform the patient of the right, subject to their consent, to receive the visitors they designate (spouse, domestic partner, other family member or friend) and the right to withdraw or deny that consent at any time;
• Not restrict, limit, or deny visitation on the basis of race, color, national origin, religion, sex, gender identity, sexual orientation, or disability; and
• Ensure all visitors get full and equal visitation privileges consistent with the patient’s own preferences.

Documentation checklist by standard

Where this shows up in a survey

Because 482.13 is the broadest Condition of Participation by subject matter, deficiencies against it get cited under the Patient Rights tag numbers in the State Operations Manual’s Appendix A — CMS’s interpretive guidance for hospitals — and land on the same CMS Form 2567 Statement of Deficiencies as any other cited Condition, with the same plan-of-correction clock attached. See CMS Form 2567: Tag Numbers, Deficiency Levels, and the Plan of Correction Clock for how that process and clock work once a deficiency is cited.

Frequently asked questions

Does CMS set a specific number of days for resolving a grievance?

No. 482.13(a)(2)(ii) requires the hospital’s own grievance process to specify a time frame for review and response — the regulation itself does not set the number of days. That number is a hospital-policy decision, which is exactly what a surveyor checks your grievance log against.

Is a patient complaint the same thing as a grievance?

Not necessarily. The general distinction hospitals use operationally is that a concern staff can resolve on the spot, at the time it’s raised, functions as a complaint; a concern that can’t be resolved immediately, is submitted in writing, or involves allegations of abuse, neglect, or harm typically has to go through the formal grievance process instead. See Patient Experience Improvement Programme for how that line gets drawn and closed out operationally.

Who is legally responsible for a hospital’s grievance process?

The hospital’s governing body. It must approve the process and is responsible for its effective operation, though it can delegate day-to-day review and resolution in writing to a grievance committee.

Does 482.13 itself require a specific informed-consent form?

No. 482.13(b)(2) establishes the general right to be informed and to make decisions about care — it does not prescribe consent-form content for specific procedures. Procedure-specific consent documentation (surgery, for example) and research-context informed consent are governed by other regulatory frameworks, not by this Condition.

How does 482.13(d) confidentiality differ from HIPAA?

482.13(d) is a Condition-of-Participation survey requirement — it’s enforced by CMS through the survey and certification process. The HIPAA Privacy Rule is a separate federal law enforced by HHS’s Office for Civil Rights. Both push toward patient access and controlled disclosure of the same clinical records, but they’re independent legal frameworks with independent enforcement.

Related reading

• CMS Conditions of Participation for Hospitals: The Subpart Map
• Restraint and Seclusion Under the CMS Conditions of Participation (42 CFR 482.13)
• Patient Experience Improvement Programme: Rounding, Service Recovery, and Closing the Loop
• Ligature Risk Assessment: CMS Expectations and How to Run One
• EMTALA: Screening, Stabilization, and Transfer Rules
• Sentinel Event: What It Means, and What Happens Next
• CMS Form 2567: Tag Numbers, Deficiency Levels, and the Plan of Correction Clock
• HIPAA Privacy Rule
• Patient Safety & Infection Prevention