HIPAA-Compliant AI for Skilled Nursing Facilities: The Complete Operator's Guide

The federal nursing home staffing mandate was repealed effective February 2, 2026. CMS removed the 3.48 hours-per-resident-day minimum and the 24/7 registered nurse requirement after two courts vacated parts of the rule and Congress imposed a moratorium through September 2034. The statutory 8-hour daily RN requirement and sufficient-staffing rules remain in force.

Most of what is currently published about the nursing home staffing mandate describes a rule that no longer exists. Articles written between 2024 and mid-2025 walk through compliance timelines, hardship exemptions, and phase-in dates for requirements that were vacated in court, suspended by Congress, and then formally removed from the Code of Federal Regulations.

If you are planning against a 3.48 hours-per-resident-day floor or budgeting for round-the-clock RN coverage to satisfy a federal requirement, stop. That requirement is gone. What replaced it is less numeric and, in some respects, harder to manage.

Key takeaways

  • The HPRD minimums and 24/7 RN requirement were repealed effective February 2, 2026.
  • Two federal district courts held CMS exceeded its statutory authority; the Justice Department withdrew its appeals in September 2025.
  • Public Law 119-21, enacted July 4, 2025, bars enforcement of those standards until September 30, 2034.
  • The statutory floor remains: 8 consecutive hours of RN services daily, 7 days a week, plus a full-time director of nursing, subject to waivers.
  • Enhanced facility assessment requirements were not repealed and now carry more weight, not less.
  • Sufficient-staffing citations, PBJ reporting, and daily staffing posting all remain fully in force.

What the 2024 rule required

The rule finalized in 2024 would have imposed the first federal numeric staffing floors in nursing home history:

RequirementStandard
Total nurse staffing3.48 hours per resident day
Registered nurse0.55 hours per resident day
Nurse aide2.45 hours per resident day
RN coverageOnsite 24 hours a day, 7 days a week
Facility assessmentEnhanced requirements, including staff and resident input

It was to phase in over several years with longer runways for rural facilities and a hardship exemption pathway.

How it ended

Three separate developments, and it is worth understanding that they are independent — which is why the repeal is unusually durable.

Litigation. Two federal district courts, including a case brought by the American Health Care Association in the Northern District of Texas, held that CMS had exceeded the authority Congress granted it when setting standards beyond the statute. The Department of Justice withdrew its appeals in September 2025, leaving those rulings in place.

Legislation. Public Law 119-21, signed July 4, 2025, prohibits CMS from implementing, administering, or enforcing the minimum staffing standards until September 30, 2034 — a ten-year moratorium.

Rulemaking. CMS issued an interim final rule with comment on December 3, 2025, formally repealing the provisions. CMS reasoned that leaving unenforceable requirements in the CFR would confuse facilities, regulators, and the public. The rule took effect February 2, 2026.

The practical significance of the court rulings is greater than the moratorium's. A moratorium expires. A holding that the agency lacked authority constrains future administrations from reissuing the same regulation without new statutory authority from Congress.

What was actually removed

  • The 3.48, 0.55, and 2.45 hours-per-resident-day minimums at 42 CFR 483.35.
  • The requirement for an RN onsite 24 hours a day, 7 days a week.
  • The definition of hours per resident day at 42 CFR 483.5, which existed solely to serve the repealed standards.

What still binds

This is the part that gets lost in coverage framing the repeal as deregulation.

The statutory RN requirement. The pre-existing floor is reinstated: RN services at least 8 consecutive hours a day, 7 days a week, and a full-time director of nursing, subject to the waiver provisions.

Sufficient staffing. The requirement to have sufficient nursing staff to meet residents' needs remains, and it is enforced through F725. This is the crucial point: the repeal removed the number, not the obligation. A surveyor citing insufficient staffing no longer measures you against 3.48 HPRD — they measure you against your own residents' assessed needs and your own facility assessment.

Enhanced facility assessment requirements, now located at 42 CFR 483.71, were not repealed. The facility assessment determines the staffing your resident population requires. With no federal number to point at, that document becomes the primary evidence of what adequate staffing means in your building — which means it is now the primary exposure too.

PBJ reporting and daily posting. Payroll-Based Journal submission and the daily staffing posting requirement are untouched, and PBJ data still drives the staffing component of the Five-Star rating. See the PBJ guide.

Nurse aide competency requirements remain in force.

State law. Several states impose their own ratios or minimum hours, and activity has increased as the federal floor dropped away. State requirements are unaffected by the federal repeal and are now the binding numeric constraint in the states that have them.

What this actually means for operators

The compliance question changed shape rather than disappearing. It moved from did you hit the number to can you defend your judgment — and the second is harder to evidence.

  • Your facility assessment is now the standard you are held to. A generic template that says staffing is determined based on resident needs gives a surveyor nothing and gives you no defense. It should name your actual acuity mix, the competencies your population requires, and the staffing levels you concluded follow from that.
  • Update it when acuity changes. An assessment describing a census you no longer have is worse than no assessment, because it documents that you knew what was required and staffed below it.
  • Sufficient-staffing citations may rise, not fall. Without a bright-line number, surveyor judgment carries more weight, and the evidence is your own documentation.
  • Watch your state. The binding numeric requirement in your market is now a state one or none at all.
  • PBJ accuracy matters as much as it did. Five-Star staffing ratings did not change.
  • Do not read the repeal as permission to cut. Residents' assessed needs remain the legal standard, and a facility that reduces staffing after the repeal has created a documented gap between assessed need and delivered care.

Where AI helps

The work that replaced numeric compliance is documentation work — building and defending a facility assessment against your own resident data.

  • Facility assessment drafting. Read your census, acuity, and MDS-derived data and draft an assessment grounded in your actual resident population rather than a template.
  • Acuity-to-staffing reasoning. Surface the documented care needs that support your staffing conclusions, so the assessment shows reasoning rather than assertion.
  • Gap detection. Compare the assessment against actual scheduled and worked hours and flag where the document and the schedule disagree — before a surveyor finds it.
  • Sufficient-staffing citation response. Draft a Plan of Correction for an F725 citation, tying monitoring back to QAPI.
  • State requirement tracking. Compare your staffing against the requirements of the states you operate in.

Hathr.AI runs Anthropic Claude models inside AWS GovCloud under a FedRAMP High authorization boundary and signs a Business Associate Agreement within 24 hours on every plan, with no seat minimum. Because this work involves resident census and acuity data, a general-purpose AI tool without a signed BAA cannot lawfully be used for it.

The policy memo telling staff to stop pasting resident data into consumer chatbots does not work. Giving them a tool that does the same job and is actually permitted does.

Test it on your facility assessment

Upload your current facility assessment and a recent census with acuity detail, and ask Hathr.AI where the assessment no longer matches the residents you actually have.

Start a free trial — $47 a month, no seat minimum, BAA in 24 hours →

Frequently asked questions

Is the nursing home staffing mandate still in effect?
No. CMS repealed the minimum staffing standards effective February 2, 2026, removing the hours-per-resident-day minimums and the 24/7 registered nurse requirement.

Why was the staffing mandate repealed?
Two federal district courts held CMS exceeded its statutory authority and the Justice Department withdrew its appeals. Congress separately imposed a moratorium on enforcement until September 30, 2034 through Public Law 119-21.

What were the staffing minimums?
3.48 total nurse staffing hours per resident day, including 0.55 registered nurse hours and 2.45 nurse aide hours, plus an RN onsite 24 hours a day, 7 days a week.

What RN coverage is required now?
The statutory requirement is reinstated: registered nurse services at least 8 consecutive hours a day, 7 days a week, plus a full-time director of nursing, subject to waivers.

Do facilities still have to submit PBJ data?
Yes. Payroll-Based Journal reporting and daily staffing posting were not affected, and PBJ data still drives the staffing component of the Five-Star rating.

Is the facility assessment requirement still in force?
Yes. Enhanced facility assessment requirements at 42 CFR 483.71 were not repealed, and with no federal numeric standard they now carry more weight as evidence of appropriate staffing.


Part of the HIPAA-Compliant AI for Skilled Nursing Facilities hub. Related: PBJ Reporting Requirements · F-Tags Explained · Survey Readiness Checklist

Last reviewed August 2026. This article is general regulatory information, not legal advice. The interim final rule was issued with a comment period and federal policy in this area has changed repeatedly. Verify current federal requirements against 42 CFR Part 483 and confirm state staffing law separately before making staffing decisions.

Category
No items found.
Written by
Sam Hart headshot - Founder at Hathr.ai
Hathr.AI Clinical Compliance Team
Date Published:
2026-08-17

Our Youtube Videos

Hathr.AI is the fastest, safest way to handle sensitive medical records with HIPAA-compliant artificial intelligence. In this demo, watch how you can:✅ Summarize a patient’s medical record  ✅ Generate an AI-assisted treatment plan  ✅ Write a letter to the patient in plain English  ✅ Suggest CPT billing codes  ✅ Draft an insurance appeal for a denied claim  ✅ Evaluate the case for potential malpractice — all in under 5 minutes.The only AI tool hosted in AWS GovCloud and Powered by Claude 4.0 Sonnet, Hathr.AI is trusted by hundreds of practices that need speed, security, and compliance.Learn more: hathr.ai  For healthcare teams: hathr.ai/healthcare  Reach out to learn more: contact@hathr.ai

#HIPAACompliantAI#ArtificialIntelligenceInMedicine#HealthcareAI#MedicalBillingAI#AIForDoctors#HIPAAAI#MedicalRecords#AIInHealthcare

Description

As Hathr.AI, we are dedicated to providing a private, secure, and HIPAA-compliant AI solution that prioritizes your data privacy while delivering cutting-edge technology for enterprises and healthcare professionals alike.

In this video, we’ll dive deep into the growing concerns around data privacy with AI tools—especially in light of recent revelations about Microsoft’s Word and Excel AI features. These new features have raised alarm over data scraping practices, where user data could be used without clear consent, leaving individuals and organizations exposed to potential privacy breaches. What makes this especially concerning is the "opt-in by default" design, which could lead to unintended data sharing.

In contrast, Hathr.AI ensures that your data stays yours. With a firm commitment to HIPAA compliance, we take the protection of sensitive healthcare data to the highest level. Our platform is built with the understanding that privacy is not an afterthought but a fundamental pillar of our design. We don’t collect, store, or sell user data, and we employ state-of-the-art encryption, secure access protocols, and clear user consent processes to keep you in full control.

We’ll also touch on why Hathr.AI, powered by advanced LLM (Large Language Models) like Claude AI, offers a secure and private alternative for businesses looking to leverage AI technology without compromising sensitive information. While some AI tools may collect or expose data through ambiguous or hard-to-find opt-out settings, Hathr.AI puts transparency and security at the forefront, offering peace of mind in an era of increasing digital vulnerability.

If you’re concerned about your privacy or looking for a HIPAA-compliant AI solution that respects your data, Hathr.AI provides the robust security, transparency, and ethical design that you need.

Key Points:

  • HIPAA Compliant AI: Built for healthcare professionals, ensuring compliance with privacy regulations.
  • Privacy-first: No data scraping, no data selling, full user control over information.
  • Claude AI: Secure, powerful LLM tools for advanced capabilities without compromising security.
  • Data Transparency: Say goodbye to hidden opt-in/opt-out toggles—Hathr.AI gives you clear, easy-to-understand privacy settings.

Tune in to learn how Hathr.AI ensures your AI tools remain private, secure, and trustworthy, while still delivering the performance and accuracy you need to thrive in a fast-evolving digital landscape.

Don't forget to like, comment, and subscribe for more insights on secure AI solutions and how to protect your organization from emerging privacy risks!

Description

Discover how Hathr AI's advanced AI tools transform federal acquisition processes with unparalleled security and efficiency. Designed for government professionals, this video showcases Hathr AI’s capabilities, including secure AI data analysis, HIPAA-compliant tools, and AWS GovCloud integration, to help streamline decision-making and document management. Perfect for agencies seeking private, compliant, and powerful AI solutions, Hathr.AI delivers tools tailored for healthcare and government needs.

Key Topics Covered:

AI-driven data analysis for governmentHIPAA-compliant, secure AI tools for federal agencies

Private deployment options with AWS GovCloud

Learn more about Hathr AI’s secure, high-performance solutions at hathr.ai and transform your agency’s acquisition process with cutting-edge AI.

Description

Discover how Hathr.AI simplifies NSF grant evaluations with advanced AI-driven compliance and proposal review tools. This video showcases Hathr.AI’s capability to streamline grant compliance checks, enhance accuracy, and save time for evaluators and applicants alike. Ideal for research institutions, government agencies, and proposal writers, Hathr.AI offers secure, HIPAA-compliant AI solutions tailored to meet the complex requirements of NSF and other grant processes.Highlights:AI-powered compliance checks for NSF grant proposalsFast, accurate, and secure evaluations with Hathr.AITailored solutions for research, government, and healthcareOptimize your grant proposal process with Hathr.AI's private, secure AI tools. Learn more at hathr.ai and transform how you handle grant evaluations and compliance.

Description

Join Hathr.AI at the Defense Information Systems Agency (DISA) Technical Exchange Meeting to explore innovative AI solutions tailored for federal and defense applications. In this session, we highlight Hathr.AI's secure, private AI tools designed for efficient data handling, HIPAA compliance, and seamless integration within government systems, including AWS GovCloud. Perfect for agencies seeking reliable AI for data analysis, document summarization, and secure decision-making, Hathr.AI provides cutting-edge technology for defense and healthcare needs.Highlights:AI tools for federal and defense data managementSecure, HIPAA-compliant AI solutions with AWS GovCloudEnhancing operational efficiency with private AI deploymentsDiscover how Hathr.AI's solutions empower government and defense agencies to stay at the forefront of innovation. Visit https://hathr.ai to learn more about our services.

Blog and articles

Latest insights and trends

AI Healthcare solutions with Hathr.AI
HIPAA Compliant AI

AI Healthcare Solutions: How a HIPAA Compliant LLM can Revolutionize your practice

Learn how HIPAA compliant AI healthcare solutions can revolutionize your practice. Hathr AI offers secure, HIPAA & NIST-certified tools that automate billing, enhance diagnostics, and improve patient care while ensuring complete data privacy and compliance.
deepseek-ai-is-dangerous-for-healthcare
Security & Compliance

DeepSeek AI: Interesting Methods, Dangerous Product

Analysis of DeepSeek AI's computational efficiency innovations and why its security risks, censorship issues, and compliance concerns make it unsuitable for healthcare, government, and other regulated industries in the United States.
Challenges Finding Compliant AI
Security & Compliance

Challenges Finding Compliant AI: ChatGPT is Watching You

This blog post explores the recent discovery of AI-powered surveillance by Chinese intelligence using ChatGPT, highlighting the vulnerabilities of commercial AI tools in terms of security, privacy, and compliance. It discusses the implications for regulated industries and offers guidance on implementing secure, HIPAA-compliant AI solutions like Hathr.AI to safeguard operations without compromising functionality.
HIPAA Compliant AI

Low-Code HIPAA Compliant AI: Hathr.AI Integrates with Pipedream.com to Deliver HIPAA-Compliant AI Integration

Hathr.AI partners with Pipedream.com to offer HIPAA-compliant AI integrations, transforming healthcare automation with secure, low-code solutions. This collaboration empowers healthcare providers and developers to create compliant workflows, enhancing efficiency and patient outcomes while maintaining robust data security.