Skip to main content
Compliance Reference

42 CFR § 484.70

Condition of participation: Infection prevention and control

Effective: Last amended: Last reviewed:

See your compliance status for this section

3-minute free audit. CFR-cited gap report. No signup.

Run free audit →

What does 42 CFR § 484.70 require?

42 CFR 484.70 is the Infection Prevention and Control Condition of Participation. Every certified HHA must have a documented program covering surveillance (tracking infections), prevention (hand hygiene, PPE, standard precautions), and control (transmission-based precautions, isolation when home-care permits). Required: infection control program written and followed; competency-based education for ALL staff (employed and contracted); surveillance data fed into the HHA's QAPI program; documentation of education, surveillance findings, and corrective actions. Surveyors check for: vaccination tracking, hand hygiene policies, PPE use, and incident logs. Common citation pattern: 'staff trained but no documentation of competency' or 'infection data collected but never analyzed for QAPI.'

Regulation text (summary)

The HHA must maintain and document an infection control program that has, as its goal, the prevention and control of infections and communicable diseases. The program must follow accepted standards of practice, including the use of standard precautions, and include a method for surveillance, identification, prevention, control, and investigation of infectious and communicable diseases. The HHA must provide infection control education to staff, patients, and caregivers. Findings must be incorporated into the agency's QAPI program. The HHA must also follow accepted standards of practice for infection control, including transmission-based precautions when appropriate, and must educate all HHA staff and contracted personnel on the program.

Read full regulation at eCFR.gov

Who must comply with 42 CFR § 484.70?

All Medicare/Medicaid certified HHAs. The program must cover ALL personnel providing patient care — employed clinicians, aides, and contracted therapy or nursing services. The HHA cannot outsource infection control obligations; contracted personnel must be educated under the HHA's program.

What happens if you violate 42 CFR § 484.70?

Standard or condition-level CMS deficiency. CMPs up to $25,000 per day per CoP deficiency. Infection control deficiencies often rise to immediate jeopardy when patient harm is documented (e.g., HHA-acquired infection traced to staff hand hygiene failure or undiagnosed communicable disease exposure). COVID-era guidance elevated infection control to a top-five HHA citation category.

$11,317–$25,000

Penalty range

~3,200

Annual citations

+11.4%

YoY penalty trend

How to comply (implementation checklist)

  1. 1Establish written infection prevention and control program — surveillance, prevention, control, education.
  2. 2Adopt CDC standard precautions and transmission-based precautions as the foundation.
  3. 3Document competency-based education at hire and annually for all HHA staff (employed + contracted).
  4. 4Track hand hygiene compliance — observation logs or self-attestation with periodic audit.
  5. 5Maintain staff vaccination + TB screening records (influenza, hepatitis B offers, TB baseline + annual).
  6. 6Log all HHA-identified infections (patient + staff); analyze for trends quarterly.
  7. 7Feed infection surveillance data into the QAPI program (42 CFR 484.65) — at least one PIP per year may target infection control if data warrants.
  8. 8Provide patient + caregiver infection control education at start of care — document delivery.
  9. 9Train staff on PPE use, sharps safety, bloodborne pathogens, and exposure response.
  10. 10Maintain exposure incident log — track all needlestick / body-fluid exposures with follow-up documentation.

Common misinterpretations

  • Misinterpretation: 'Annual training is enough.' Reality: 42 CFR 484.70(c) requires COMPETENCY-based education, not just training. Documentation must show the staff member can demonstrate the skill (hand hygiene, PPE donning/doffing), not just that they attended a session.
  • Misinterpretation: 'Contract therapists follow their own infection control program.' Reality: The HHA's program governs all personnel providing patient care, including contracted PT/OT/SLP. The HHA must document that contracted personnel received education under the HHA's program.
  • Misinterpretation: 'Surveillance means counting infections.' Reality: Surveillance requires identification, analysis, and action. Counting alone without analysis or feedback into QAPI is a citable deficiency under 42 CFR 484.70(a)(1).
  • Misinterpretation: 'Vaccination tracking is optional.' Reality: While there is no universal CMS HHA staff-vaccination mandate, the infection control program must document staff health screening relevant to communicable disease prevention. Influenza and TB screening documentation is commonly requested by surveyors. CDC-recommended HHA staff vaccinations should be tracked.

Real enforcement examples

Anonymized from public FMCSA enforcement summaries. Penalty amounts reflect assessed and final settled values where disclosed.

HHA received condition-level §484.70 deficiency in 2024 after a surveyor sampled 8 clinical staff records — 5 had no annual competency assessment for hand hygiene or PPE. The agency had training rosters but no skill-competency verification. Plan of correction required with re-survey within 45 days.

Source: CMS state survey agency findings, anonymized

How FileFlo handles 42 CFR § 484.70

FileFlo's compliance rule-pack CMS-42CFR484.70 automatically checks every document you upload against this regulation. Auto-detects document type, parses key fields, sets renewal alerts, and surfaces this section in your audit binder if a gap is found.

Run free audit covering this section →

Already evaluating? Start a 5-day free trial →

Frequently asked questions

What must the HHA's infection control program include?

Per 42 CFR 484.70: (1) surveillance — identifying infections and communicable diseases among patients and staff; (2) prevention — standard precautions, hand hygiene, PPE, environmental controls; (3) control — transmission-based precautions, exposure follow-up, outbreak response; (4) education — competency-based training for all HHA staff (employed + contracted), patients, and caregivers; (5) integration with QAPI per 42 CFR 484.65.

Does infection control apply to contracted therapy or nursing services?

Yes. The HHA's program must cover all personnel providing patient care. Contracted PT, OT, SLP, and nursing must be educated under the HHA's program — not just under their employer's program. The HHA must document this education for contracted personnel just as for employees.

How often must infection control education occur?

At hire and at least annually for all clinical staff. The 42 CFR 484.70(c) standard is competency-based, meaning documentation must show the staff member can demonstrate the skill, not just attended a class. Many HHAs combine annual skills fair with infection control competency verification.

Do HHA staff need flu shots?

There is no universal federal HHA staff influenza vaccination mandate, but CDC strongly recommends it for all healthcare personnel, and many states + accreditation bodies require offers and declination documentation. Track offers, vaccinations, and signed declinations. TB baseline + annual screening IS required under most state regulations and accepted infection control practice.

How is infection surveillance integrated with QAPI?

Per 42 CFR 484.70(a)(1) and 42 CFR 484.65, infection surveillance data must flow into QAPI. The HHA analyzes trends (e.g., wound infection rates, UTI rates, staff exposure incidents), identifies improvement opportunities, and may launch a PIP. Documentation must show the analysis → action cycle, not just data collection.

What's a typical §484.70 deficiency?

(1) Staff trained but no competency verification documented. (2) Contracted personnel not included in HHA's education records. (3) Infection data collected but not analyzed or fed into QAPI. (4) No TB screening or vaccination declination documentation. (5) Hand hygiene policy exists but no compliance monitoring. Each is a citable standard-level finding; patterns become condition-level.

Related regulations

Author

Chad Griffith

Founder + CEO, FileFlo · Defense + Aviation + healthcare operations background

LinkedIn

Sources + reviewer

Primary source: eCFR.gov — 42 CFR § 484.70

Reviewed by Chad Griffith (Founder + CEO, FileFlo) on

Disclaimer: This page summarizes a federal regulation in plain English. FileFlo is not a law firm; this is not legal advice. The regulation text and primary sources at eCFR.gov are authoritative. Consult qualified counsel for advice specific to your operation.