Build the manual from a cross-walk: one row for each requirement in your state licensing rule, your accreditor's standards and federal rules such as 42 CFR Part 2, each tied to a policy and the evidence a surveyor would check. Cite standards rather than copying them, add state addenda for multistate programs, and review every policy yearly.
Every licensing rule and every accreditation standard assumes a written policy behind it. Texas wants an operational plan with a chemical dependency treatment facility application (26 Tex. Admin. Code 564.403). Nevada's initial certification application includes the policy manual itself. Part 2 requires "formal policies and procedures" for protecting patient identifying information (42 CFR 2.16). CCBHCs need written policies for their sliding fee discount schedule and for crisis services (2023 criteria, 2.d.4 and 2.c.2). A manual that satisfies one reader and ignores the others gets cited by whichever reader comes next.
Why build the manual from a cross-walk?
Because the requirements overlap but do not match. A state rule might require a grievance procedure with a specific response time; the accreditor wants the same procedure plus evidence that grievances feed quality improvement; Part 2 adds a complaint process with a ban on retaliation (42 CFR 2.4). Three sources, one policy. If you write from any single source, you miss the other two.
A cross-walk is a table with one row per requirement: the citation, the requirement in plain words, the policy that meets it, and the evidence a surveyor would ask to see. Built first, it becomes the manual's outline, the mock survey's checklist and the map you update when a rule changes.
Which sources go into the cross-walk?
- The state licensing rule for each service you are licensed for, and for each state you operate in. Rules are organized by service type and level of care, so a program with outpatient, IOP and residential components may have three sets.
- The accreditor's standards for the programs you are accrediting. The accreditors sell their manuals, so the policy cites the standard by number and meets it in your own words rather than reproducing it.
- Federal program rules. 42 CFR Part 2 for federally assisted substance use disorder programs; 42 CFR Part 8 for opioid treatment programs; the Medicare conditions of participation at 42 CFR 485.904 to 485.920 for community mental health centers; the 2023 CCBHC criteria if you are one.
- Payer and contract terms that require specific policies, such as Medicaid provider agreements, which require you to keep records of the services you furnish and provide them on request (42 CFR 431.107(b)).
Which sections cause the most citations?
Confidentiality and records
The 2024 Part 2 rule, with a compliance date of February 16, 2026, made this the section most likely to be out of date. Your policies must address paper records (transfer, destruction, secure storage, workstation access, de-identification) and electronic records (creation, transmission, destruction, access, de-identification) under 42 CFR 2.16, plus breach notification, the complaint process, the Patient Notice under 2.22 and consent forms meeting 2.31. A HIPAA privacy manual does not cover these by itself. See the 2024 Part 2 rule and Part 2 consent and the Patient Notice.
Personnel and credentials
Qualifications, background checks, licensure verification and ongoing training. CMHC professionals must be licensed, certified or registered and act within scope, with qualifications "kept current at all times" (42 CFR 485.904(a)). Many state rules add role-specific minimums. The policy should say who verifies licenses, how often and where the proof is filed.
State-specific operating rules
These are the lines a national template misses. Florida's license application must name every recovery residence the provider plans to refer patients to or accept patients from (Fla. Stat. 397.403(1)(j)), and the referral rules behind it need their own policy; see Florida's recovery residence certification and the referral rule. Washington requires an agency to offer education on all FDA-approved medications for opioid or alcohol use disorder before it may advertise or treat those disorders. Arizona bars a licensee from offering or implying rebates or fee splitting to regulated persons (A.R.S. 36-407(D)).
Opioid treatment program clinical policies
The 2024 Part 8 rule left take-home methadone decisions to the practitioner within the schedule at 42 CFR 8.12(i), and set telehealth intake rules in 8.12(f). Your manual needs the decision criteria and documentation, not a promise of outcomes. See take-home methadone under the 2024 rule.
Crisis, emergencies and incidents
What staff do, who they call, what they document and how incidents reach the quality process. CCBHCs must publish their crisis methods (2.c.2).
How detailed should each policy be?
Detailed enough that a new employee could follow it and a surveyor could test it. A good policy names its purpose and scope, the rule or standard it answers, the responsible role, the steps, the forms used, and the review date. "Staff will maintain confidentiality" is not a policy. "The clinical director reviews each consent form against the 42 CFR 2.31 elements before the first disclosure" is.
Avoid promising more than you do. If the policy says supervision is weekly and the logs show monthly, you have created a citation that a shorter policy would have avoided.
How do you keep the manual current?
- Assign an owner and an annual review date for every policy, and record the review even when nothing changes.
- Watch the sources. Agencies reorganize and rules are renumbered: Georgia moved treatment program licensing to DBHDD on January 1, 2026, and West Virginia moved its OTP licensing article from chapter 16-5Y to 16B-13. A citation to the old rule is an easy finding.
- Update the cross-walk first, then the policies it points to, then train staff on what changed.
- Keep versions. Surveyors sometimes ask which policy was in force on a given date.
Can one manual serve several states?
Yes, with a core manual and state addenda. Organization-wide policies (governance, quality, human resources, confidentiality) live in the core; anything that differs by state rule (staffing ratios, documentation timelines, reporting deadlines, recovery residence referral limits) goes in a state addendum that the core points to. The cross-walk shows which rows differ. A telehealth service line adds its own policies; our sister site White Glove Telemedicine lists the policies a telehealth practice needs on day one.
What do we deliver?
Our Policy and Procedure Manual is a $1,495 add-on to a state license or accreditation package: a cross-walk to your state rule, your chosen accreditor's standards and the federal rules that apply, and the policies and blank forms written to it. It contains no patient information. A Part 2 Policy Alignment alone is $395, policy templates and readiness rather than legal advice. Your leadership adopts the manual and is responsible for following it. Test it with a mock survey before the real one.
Common questions
- Can we buy a generic policy manual?
- A template can be a starting point, but state rules differ in ways templates miss, such as Florida's requirement to list recovery residences in the license application. A cross-walk to your own state rule and accreditor shows the gaps.
- Does our HIPAA manual cover Part 2?
- No. Part 2 has its own requirements for record security policies, consent form elements, the Patient Notice and complaint handling. A Part 2 program needs policies written to 42 CFR Part 2 as well as to HIPAA.
- How often should policies be reviewed?
- At least annually, with the review recorded, and whenever a rule, standard or service changes. Agencies reorganize and rules are renumbered, and a citation to a superseded rule is an easy survey finding.
Need Help with Enrollment or Licensing?
We prepare your Medicare enrollment, accreditation survey and state licenses in the order CMS requires, for your official to sign, and track every one to a decision.