Medical Staff Bylaws Requirements: What CMS and Joint Commission Actually Require

A hospital’s medical staff bylaws are not one document doing one job — they are the operating charter for self-governance, sitting on top of a federal floor and, for accredited hospitals, a second layer of accreditation standard on top of that. Medical staff offices that treat “bylaws requirements” as a single checklist miss the fact that CMS sets a baseline every Medicare-participating hospital must clear, while Joint Commission’s Medical Staff (MS) chapter adds specific procedural machinery — principally the fair hearing and appeal mechanism — that the federal regulation does not itself spell out.

This page works through what each source actually requires, then assembles both into a single document-structure checklist a bylaws committee can work from directly.

Scope. This describes published regulatory and accreditation requirements and their sources. It is not legal advice, and it does not tell you whether a specific bylaws provision at your hospital satisfies a specific surveyor on a specific day — confirm current standard language with your accreditor and legal counsel before finalizing bylaws text.

The two-layer structure: CMS sets the floor, accreditation adds to it

The federal baseline is 42 CFR §482.22, the Condition of Participation (CoP) for Medical Staff, which every hospital participating in Medicare must meet regardless of accreditation status. It requires that the hospital have “an organized medical staff that operates under bylaws approved by the governing body,” and that the medical staff be “well organized and accountable to the governing body for the quality of the medical care provided to patients.” That accountability structure — medical staff self-governance, subject to governing body approval — is the load-bearing relationship the rest of §482.22 hangs on.

Hospitals accredited by Joint Commission (or another CMS-approved accrediting organization operating under deemed status) meet the CoP by satisfying that accreditor’s standards instead of a direct CMS survey. Joint Commission’s Medical Staff (MS) chapter, anchored by standard MS.01.01.01, restates the CMS bylaws-content baseline and then adds requirements the regulation itself does not spell out in comparable procedural detail — most notably a defined fair hearing and appeal process for adverse professional review actions. A hospital surveyed directly by a CMS State Survey Agency is held to §482.22 as written; a Joint Commission-accredited hospital is held to both, because deemed status doesn’t waive the underlying CoP, it substitutes the accreditor’s more detailed standard as the means of demonstrating compliance with it.

What 42 CFR §482.22 actually requires bylaws to contain

Read directly from the regulation, the CoP requires medical staff bylaws to establish, at minimum:

• Self-governance under governing body approval. The medical staff must be organized and must operate under bylaws the governing body has approved — the bylaws are staff-developed and board-approved, not board-authored.
• Membership eligibility. The medical staff “must be composed of doctors of medicine or osteopathy” and may include other categories of physicians and non-physician practitioners the governing body determines eligible for appointment.
• Categories of staff and their duties/privileges. Bylaws must include a statement of the duties and privileges attached to each staff category (active, courtesy, consulting, and so on, as the hospital defines them).
• Organization and accountability description. How the medical staff is structured, and how it is accountable to the governing body for care quality.
• Candidate qualifications and the credentialing process. The medical staff must examine the credentials of every eligible candidate and make an appointment recommendation to the governing body — the governing body makes the final appointment decision, but only on the medical staff’s recommendation.
• Criteria for privileges. Bylaws must include criteria for determining which privileges are granted to individual practitioners — the regulatory hook for a criteria-based delineation of privileges process rather than a blanket specialty grant. See delineation of privileges forms for how hospitals build that criteria set into an actual form.
• Periodic appraisal. The medical staff must periodically reappraise its members — the regulatory basis for the reappointment cycle, distinct from the ongoing performance monitoring Joint Commission separately requires between reappointments (OPPE) and when a new privilege is first granted or a concern is flagged (FPPE); see OPPE vs. FPPE.

What is notably absent from §482.22 itself: the regulation does not spell out a required fair hearing procedure, specific due-process steps for an adverse action, or peer-review confidentiality mechanics. Those come from elsewhere — accreditation standards for accredited hospitals, and independently, federal peer-review law for any hospital relying on it.

Credentialing and privileging are two different bylaws sections, not one

Bylaws that collapse credentialing and privileging into a single section tend to produce a file that can show a practitioner is qualified in general but can’t show what evidence supported the specific privileges granted. They are different evidentiary questions and the bylaws should treat them as different processes with different criteria sets:

• Credentialing verifies identity and baseline qualifications — license, education and training, board status, work history, malpractice history — largely through primary source verification against issuing bodies.
• Privileging asks a narrower, ongoing question: is this practitioner currently competent to perform this specific procedure, at this hospital, right now. It depends on the criteria-based delineation of privileges the bylaws (or their referenced credentials manual) establish, and it is what OPPE and FPPE data feed back into at reappraisal.

Bylaws typically state the process and the governing-body approval sequence for both; the detailed criteria and forms usually live in a referenced credentials policy or manual rather than in bylaws text itself, precisely so the criteria can be updated without a full bylaws amendment.

What Joint Commission’s MS chapter adds: the fair hearing and appeal mechanism

This is the area where accreditation standards go materially further than the CMS text. Joint Commission’s Medical Staff chapter requires bylaws to establish a defined fair hearing and appeal process for practitioners facing an adverse professional review action — denial, restriction, suspension, or revocation of privileges, or non-reappointment for cause. In substance, and consistent with how hospital fair hearing plans are built across the field, that process generally includes:

• Written notice of the proposed adverse action and the reasons for it.
• The right to request a hearing within a defined window after notice.
• A hearing before a panel, typically drawn from medical staff peers rather than direct economic competitors of the practitioner involved.
• The right to present evidence and witnesses, and in most bylaws, to be represented at the hearing.
• A written decision from the hearing body, with stated reasons.
• An appellate review step, typically to the governing body or a designated appeal panel, before the action becomes final.

Bylaws should state each of these elements explicitly rather than by cross-reference to “applicable law,” because the fair hearing plan is also what a hospital points to when it later needs to rely on peer-review immunity.

Why the fair hearing process also matters under federal peer-review law

Separately from accreditation, the Health Care Quality Improvement Act of 1986 (HCQIA, 42 U.S.C. §11101 et seq.) conditions a hospital’s federal immunity for professional review actions on the action having been taken in the reasonable belief it was in the interest of quality care, after a reasonable effort to obtain the facts, with adequate notice and hearing procedures (or other procedures that are fair under the circumstances), and in the reasonable belief the action was warranted by the facts. A bylaws fair hearing section that meets Joint Commission’s standard will generally also support the notice-and-hearing element HCQIA immunity depends on — but the two are legally distinct protections, and satisfying one is not automatically a legal finding that the other applies. Confirm current HCQIA procedural requirements with counsel before relying on bylaws language alone.

Peer review protections belong in bylaws too — and they are not one protection

Bylaws (or the credentials/peer-review policy they reference) should state what confidentiality protection applies to peer-review materials — committee minutes, OPPE/FPPE data, incident review findings — and that protection is not a single, uniform thing:

• State peer-review privilege statutes vary substantially by state in what they cover and what procedural conditions (e.g., a properly constituted committee, a defined purpose) must be met to keep the protection intact.
• The federal Patient Safety and Quality Improvement Act creates a separate, narrower protection for work product developed for reporting to a listed Patient Safety Organization — see PSO reporting and the work product privilege for how that protection actually works and what breaks it.
• Morbidity and mortality conference discussion sits inside this same protective structure when properly constituted as a peer-review activity — see the M&M conference guide for the structural conditions that keep it protected.

Neither protection is automatic, and bylaws that assume “peer review” is a single legal shield tend to be the ones that lose the protection when it is tested — usually because the underlying activity wasn’t structured the way the applicable statute requires.

The medical-staff-proposes, governing-body-approves amendment sequence

Because §482.22 requires bylaws to operate under governing body approval while also requiring the medical staff to be self-organized, the standard amendment sequence runs: the medical staff (usually via its bylaws committee, then a vote of the full staff or its representative body) proposes bylaws changes, and the governing body approves or rejects them — the board does not draft bylaws unilaterally, and the medical staff cannot self-amend without board sign-off. Bylaws should state this sequence explicitly, including any interim/emergency-amendment provision and how disputes between the two bodies are resolved, since an amendment adopted outside the stated process is a real accreditation and governance exposure, not just a technicality.

Document-structure checklist

Assembled from the CMS and accreditation requirements above, a complete medical staff bylaws document should be able to show a reviewer where each of these lives:

• Statement of purpose and medical staff self-governance
• Membership eligibility criteria (physician and eligible non-physician practitioner categories)
• Staff categories and the duties/privileges attached to each
• Medical staff organizational structure (officers, departments, committees) and its accountability line to the governing body
• Credentialing process: application, primary source verification, medical staff recommendation, governing body appointment decision
• Privileging process: criteria for privileges, delineation of privileges by specialty, temporary/emergency privileging provisions
• Reappointment/periodic reappraisal cycle and its evidentiary basis (OPPE data feeding the reappraisal)
• Corrective action and adverse action process, with the triggering thresholds stated
• Fair hearing and appeal mechanism: notice, hearing panel composition, evidentiary rights, written decision, appellate review
• Peer review confidentiality provisions, stated consistently with applicable state privilege law and, where used, PSQIA reporting
• Amendment process: proposal by medical staff, approval by governing body, effective-date and interim-amendment handling

FAQ

Who has to approve medical staff bylaws?

The governing body. CMS’s Condition of Participation requires the medical staff to operate under bylaws the governing body has approved; the medical staff proposes and develops bylaws content under its self-governance role, but the board holds final approval authority, and cannot be cut out of that role by the bylaws themselves.

Do medical staff bylaws and medical staff rules and regulations serve different purposes?

Yes, and hospitals generally keep them as separate documents on purpose. Bylaws establish the structural and procedural framework — membership, organization, credentialing/privileging process, fair hearing rights, amendment procedure. Rules and regulations (and often a separate credentials policy manual) hold the operational detail — specific privilege criteria, clinical protocols the medical staff can revise without a full bylaws amendment. Keeping detail out of the bylaws proper lets it be updated on a faster cycle.

Does CMS require a specific fair hearing procedure in the bylaws?

Not in comparable procedural detail to what accreditation standards require. 42 CFR §482.22 does not itself spell out fair hearing steps. For Joint Commission-accredited hospitals, the MS chapter requires a defined fair hearing and appeal mechanism as a matter of accreditation compliance; separately, having adequate notice-and-hearing procedures is also a condition of HCQIA’s federal peer-review immunity, regardless of accreditation status.

What happens if bylaws conflict with a CMS or accreditation requirement?

The regulation and the accreditation standard govern regardless of what the bylaws say — a hospital cannot bylaws its way out of a Condition of Participation or an accreditation standard. A conflict surfaces at survey as a deficiency or a standard finding, and the practical fix is a bylaws amendment through the normal medical-staff-proposes, governing-body-approves sequence, not a case-by-case exception.

Does a hospital need separate bylaws for telemedicine/distant-site privileging?

Not necessarily separate bylaws, but bylaws (or referenced policy) need to address it: 42 CFR §482.22(a)(3) and (a)(4) allow a hospital to rely on the credentialing and privileging decisions of a distant-site hospital or telemedicine entity under specific conditions, but the originating hospital must still have a mechanism for internal performance review of the privileges exercised and for feeding that information back to the distant site.