Skip to main content
42 CFR · CMS Compliance Platform

CMS surveys, decoded.

FileFlo is the survey-ready document layer for CMS-certified providers. It maps every Condition of Participation to the documents a state surveyor will request — across Home Health (Part 484), Hospice (Part 418), and Long-Term Care (Part 483).

By Chad Griffith·Founder & CEO·Reviewed May 26, 2026

5-day trial · No credit card · No setup fees · Cancel anytime

600+
Document types
and growing
3
CMS provider types
HHA · Hospice · SNF
42 CFR
CoP coverage
Parts 484 · 418 · 483
5-day
Free trial
No credit card
What you get

Three things FileFlo does for CMS providers that your EHR doesn't.

Every CoP, document-mapped

The 42 CFR Conditions of Participation each surveyor cites — comprehensive assessments, QAPI, infection control, clinical records, personnel qualifications, emergency preparedness — indexed by Part 484, 418, or 483 subpart.

42 CFR Parts 484 · 418 · 483

Credentials current, expirations captured

Medical licenses, DEA registrations, board certifications, malpractice COIs, BLS/CPR cards. FileFlo stores each credential and captures the expiration date — alerts fire at 90/60/30/7 days before lapse.

42 CFR §484.115 / §418.62 / §483.35

Survey-ready binder, one click

When the state surveyor arrives unannounced, export a complete CoP-indexed binder in inspector format — credentials, training records, policies and procedures, QAPI minutes, infection control logs, clinical record samples.

CMS-2567 surveyor format
How it works

Four steps. One business day.

01

Connect your folder

Google Drive, Dropbox, SharePoint, or OneDrive. Works alongside MatrixCare, PointClickCare, Homecare Homebase.

02

AI classifies every doc

Each file mapped to its 42 CFR CoP subpart. Credentials by provider. Training records by employee.

03

Track and alert

Credential expirations, training-due dates, policy review cycles, equipment calibration deadlines.

04

Survey-ready, always

One-click binder for state surveys, complaint investigations, validation surveys, recertification.

The stakes
$22,320

per day max Civil Money Penalty per deficiency. Plus accreditation risk.

42 CFR §488.408 · 2024 inflation-adjusted SNF Immediate Jeopardy

A condition-level deficiency triggers a Plan of Correction and re-survey. Immediate Jeopardy citations can produce termination from Medicare/Medicaid within 23 days if uncorrected — the financial impact dwarfs any single fine.

FileFlo Professional costs $3,588 / year. The most-cited surveyor finding nationally is missing or expired credentials — exactly what FileFlo's expiration alerts are built to prevent.

Pricing

Two tiers. No per-provider fees.

Starter
$89/mo
or $890/yr · annualized $74/mo
  • · 100 documents per month
  • · 3 users
  • · Solo or small clinic operators
  • · Single-location agencies
Most popular
Professional
$299/mo
or $2,990/yr · annualized $249/mo
  • · Unlimited documents
  • · Unlimited users
  • · Employee auto-detection
  • · Audit trail · Project management
  • · Multi-location agencies, SNFs, hospice networks

5-day free trial on both tiers. No credit card required to start. Annual pricing available with ~17% discount. Cancel anytime.

From verified G2 reviewers
"Quick onboarding, AI-powered compliance tracking that delivers clear ROI. The real-time dashboard makes it easy to check compliance status at a glance, and the automated alerts have reduced our admin work and made collaboration across branches smoother."
Marlon U.
Operations Manager · Small business · Using FileFlo
Read more on G2
The technical detail · For directors of compliance
Platform definition

FileFlo is a healthcare compliance management platform built for CMS-certified providers operating under 42 CFR Conditions of Participation. It manages the documents a state surveyor will request during a survey or complaint investigation — provider credentials, comprehensive assessments, care plans, QAPI minutes, infection control logs, training records, emergency preparedness plans, equipment calibration evidence, and the 5-year minimum clinical-record retention required under §484.110, §418.104, and §483.70(i). FileFlo operates alongside your EHR (MatrixCare, PointClickCare, Homecare Homebase, Epic, eClinicalWorks) — not as a replacement.

CMS enforcement

The five most common survey-finding penalties.

Common CMS survey findings with civil money penalty exposure and the source regulation cite.
FindingSourceExposure
Immediate Jeopardy finding (SNF max CMP)42 CFR §488.408$22,320 / day
HHA condition-level deficiency (category 3)42 CFR §488.730$10,000 / day
Hospice condition-level deficiency42 CFR §488.1265Up to $10,000 / day
Missing or expired provider credential at survey42 CFR §484.115 / §483.35Condition-level finding
Inadequate clinical record retention (5-year minimum)42 CFR §484.110 / §418.104Condition-level finding

State survey agencies conduct surveys on behalf of CMS — annual recertification, complaint-triggered, validation, post-survey follow-up. The inspector arrives with a CoP-mapped document checklist.

42 CFR map

The 14 Conditions of Participation each surveyor cites most.

Each CoP has its own subpart, its own document evidence, and its own surveyor focus areas. FileFlo maps each one to the documents you'll be asked to produce.

The 14 most-cited CMS Conditions of Participation across HHA, Hospice, and SNF, with source 42 CFR subpart and which provider types each applies to.
#Condition of ParticipationSource 42 CFRHHA
Part 484
Hospice
Part 418
SNF
Part 483
1Patient / Resident rights§484.50 · §418.52 · §483.10
2Comprehensive assessment of patient / resident§484.55 · §418.54 · §483.20
3Care planning + coordination§484.60 · §418.56 · §483.21
4QAPI (Quality Assurance & Performance Improvement)§484.65 · §418.58 · §483.75
5Infection prevention and control§484.70 · §418.60 · §483.80
6Skilled / nursing / professional services§484.75 · §418.64 · §483.35
7Aide / homemaker services§484.80 · §418.76
8Emergency preparedness§484.102 · §418.113 · §483.73
9Organization and administration of services§484.105 · §418.100 · §483.70
10Clinical records + 5-year retention minimum§484.110 · §418.104 · §483.70(i)
11Personnel qualifications + primary-source verification§484.115 · §418.62 · §483.35
12OASIS reporting (HHA only)§484.45
13Bereavement counseling (Hospice only)§418.64(c)
14Resident behavioral health (SNF only)§483.40

The clinical record retention rule (#10) is the silent killer. §484.110(e) and §483.70(i) require 5 years; state law often requires longer. FileFlo enforces the longer-of-state-or-federal minimum and blocks deletion of in-retention records.

Layered positioning

How FileFlo works alongside your EHR.

Most CMS-certified providers run three layers of software. The EHR handles clinical records. Operational platforms handle census, billing, and scheduling. FileFlo handles the survey-ready documentation layer historically managed in shared drives.

Layered positioning of healthcare compliance software: EHR / EMR, operational platforms (MatrixCare ops, PointClickCare, Homecare Homebase), and FileFlo as the compliance document layer.
FunctionEHR / EMR
Epic, eClinicalWorks, MatrixCare
Ops platform
PCC, Homecare Homebase
FileFlo
(document layer)
Clinical record (chart, progress notes, orders)Yes (primary system)PartialNo (not an EHR)
Census · billing · schedulingPartialYes (primary system)No
OASIS / MDS / hospice assessment instrumentsYesPartial (varies by platform)Partial (stores PDFs)
Provider credential documents (license, DEA, board cert)NoPartial (inconsistent HR)Yes (expiry-tracked, alerts)
Training records (HIPAA, infection control, BLS)NoPartial (varies)Yes (per-employee, expiry-tracked)
Policies + procedures + SOP version historyNoNoYes (audit trail)
Equipment calibration + maintenance recordsNoPartialYes (deadline-tracked)
QAPI committee minutes + performance dataNoPartialYes (stored + cited)
5-year clinical record retention enforcementPartial (depends on contract)NoYes (cannot delete in-retention)
CMS-2567 inspector-format survey binderNoPartial (partial)Yes (CoP-indexed)

Honest positioning

FileFlo is not your EHR. We don't replace MatrixCare, PointClickCare, Homecare Homebase, Epic, or eClinicalWorks. We're the survey-prep document layer those platforms historically didn't own — credentials, training records, policies, QAPI evidence, emergency preparedness, equipment calibration — organized by 42 CFR CoP and exportable in CMS-2567 surveyor format.

Honest limits

What's not in FileFlo for CMS providers.

EHR / EMR (electronic health records)

FileFlo doesn't replace Epic, eClinicalWorks, MatrixCare, PointClickCare, Homecare Homebase, or any EHR. We're the compliance documentation layer that lives alongside your EHR.

Primary source verification as a service

FileFlo stores the PSV evidence document and tracks the verification date but does not query the NPDB, state medical board, or AMA Physician Masterfile in real time. Use a credentialing-as-a-service provider (Verifiable, MedTrainer, symplr) for live PSV.

OASIS / MDS / Hospice Item Set submission to CMS

FileFlo stores completed assessment instruments but does not submit OASIS, MDS, or Hospice Item Set data to CMS — that remains the EHR's job through the iQIES portal.

Billing + claims submission

FileFlo is not a billing platform. Use your existing claims clearinghouse (Waystar, Availity, Change Healthcare, EHR-native billing module) for Medicare/Medicaid claims.

HIPAA Security Risk Assessment as a service

FileFlo stores SRA documents and tracks the annual review cycle but does not conduct the assessment. Use a HIPAA compliance partner (Compliancy Group, HIPAA Vault, your CISO) for the actual SRA work.

About the author

Built by a founder who studied state-surveyor finding patterns.

Chad Griffith, Founder & CEO of FileFlo, built the healthcare rule pack against the CMS State Operations Manual Appendix B (HHA), Appendix M (Hospice), and Appendix PP (Long-Term Care) — the actual surveyor protocols that drive state-survey findings. FileFlo's 42 CFR CoP taxonomy was reviewed against the published F-tags and L-tags before launch.

Frequently asked

Director of compliance Q&A.

Every answer cites a specific 42 CFR Part. Last reviewed May 26, 2026.

Does FileFlo replace my EHR (MatrixCare, PointClickCare, Homecare Homebase, etc.)?+

No. FileFlo is the compliance documentation layer that lives alongside your EHR. The EHR handles clinical records, orders, OASIS/MDS/Hospice Item Set instruments, and claims. FileFlo handles the documents a state surveyor asks for during a survey — credentials, training records, QAPI minutes, policies and procedures, equipment calibration, emergency preparedness plans, and the 5-year retention required under 42 CFR.

Which CMS provider types does FileFlo support?+

Three CMS-certified provider types are anchored: Home Health Agencies under 42 CFR Part 484, Hospice under 42 CFR Part 418, and Long-Term Care / SNFs under 42 CFR Part 483. The rule pack maps each Condition of Participation to the documents a state surveyor will request. Outpatient credentialing for ambulatory clinics is also supported but is not Medicare-certified-provider focused.

How does FileFlo handle the 5-year clinical record retention rule?+

42 CFR §484.110(e) requires HHAs to retain clinical records at least 5 years after discharge (or longer per state law). 42 CFR §418.104(c) requires hospices to retain records as required by state law (typically 5-10 years). 42 CFR §483.70(i) requires SNFs to retain records 5 years (or longer per state). FileFlo enforces the longer-of-state-or-federal minimum and prevents deletion of in-retention records, with an audit trail showing every access.

Can FileFlo generate a survey binder for a state surveyor?+

Yes. FileFlo's Survey Binder export produces a complete CoP-indexed document binder in surveyor-preferred format. Includes provider credentials with primary source verification dates, comprehensive assessments, care plans, QAPI minutes, infection control logs, training records, emergency preparedness drills, equipment calibration, and policies/procedures. Export takes 60-180 seconds depending on provider size.

How does FileFlo track provider credentials?+

FileFlo stores the medical license, DEA registration, board certification, malpractice COI, NPI registration, state-required certifications, and BLS/CPR cards for each provider. The system extracts the expiration date from each document and fires alerts at 90, 60, 30, and 7 days before expiration. Primary source verification documents are stored with the verification date for the next re-verification cycle.

Does FileFlo perform primary source verification (NPDB queries, state board lookups)?+

No. FileFlo stores the PSV evidence document but does not query the National Practitioner Data Bank, state medical board, or AMA Physician Masterfile in real time. Use a credentialing-as-a-service provider (Verifiable, MedTrainer, symplr CVO, MD-Staff) for live PSV. FileFlo provides the document repository, expiration tracking, and survey binder export.

Does FileFlo handle HIPAA training and Security Risk Assessment?+

FileFlo tracks HIPAA Privacy and Security training completion per employee with 12-month renewal alerts. The annual HIPAA Security Risk Assessment document is stored with the next-review-date tracked, but FileFlo does not conduct the SRA — use a HIPAA compliance partner or your in-house security team for the actual assessment work.

Does FileFlo support emergency preparedness compliance?+

Yes. 42 CFR Part 484.102 (HHA), §418.113 (Hospice), and §483.73 (SNF) require emergency preparedness programs with risk assessments, policies, communication plans, training, and testing. FileFlo stores all required documents, tracks the annual review and biennial full-scale exercise dates, and surfaces the documentation needed for a survey.

What does FileFlo cost?+

Starter: $89/month (100 documents/month, 3 users). Professional: $299/month (unlimited documents, unlimited users, employee auto-detection, audit trail, project management) — suitable for most HHA, Hospice, and SNF operators. Annual pricing available with approximately 17% discount. No per-provider or per-bed fees.

Is there a free trial?+

Yes. 5-day free trial with no credit card required. Includes the full 42 CFR CoP rule pack, Survey Binder export, credential tracking, and training records management.

How long does FileFlo take to set up?+

One business day. FileFlo connects to your existing folder structure (Google Drive, Dropbox, SharePoint, or OneDrive), classifies the documents automatically against 42 CFR CoP subparts, and produces a baseline gap report within 24 hours. Most providers find 8-20 missing or expired documents in that first scan.

See your survey-readiness before the state surveyor arrives.

Three-minute self-assessment. No signup. We'll surface your top 42 CFR CoP gaps and what to fix first.

Or email chad@getfileflo.com directly