Medicaid home and community-based services must be delivered in places that are part of the wider community and that protect a person's privacy, choices and daily freedoms. That requirement, known as the HCBS settings rule, is written at 42 CFR 441.301(c)(4) and (5). CMS adopted it in a final rule published in the Federal Register on Jan. 16, 2014, and states' transition period to comply ended March 17, 2023, according to CMS and the Administration for Community Living.
The rule reaches into daily life in group homes, supported living and day programs. This brief explains what it requires, how a right can be limited, which settings are presumed not to qualify and where the rule stands as of September 2026.
Where the rule applies
The same settings standards appear in the rules for three Medicaid authorities:
- 1915(c) waivers, the most common way states fund community services for people with intellectual and developmental disabilities (42 CFR 441.301(c)(4)-(6)).
- 1915(i) state plan HCBS (42 CFR 441.710).
- 1915(k) Community First Choice (42 CFR 441.530).
It covers where people live and where they spend their days when Medicaid HCBS pays for services there. A state must assure CMS that its waiver services are delivered in settings that meet it (42 CFR 441.302(a)(5)).
What every HCBS setting must do
Under 441.301(c)(4), every setting must:
- Be part of the community. It must support full access to community life, including the chance to seek work in competitive integrated settings, control personal resources and receive services in the community, to the same degree as people who don't receive Medicaid HCBS.
- Be chosen by the person. The person selects the setting from options that include settings not specific to disability and, for housing, a private unit. The options are documented in the person-centered service plan.
- Protect rights. Privacy, dignity and respect, and freedom from coercion and restraint.
- Support independence. The setting should optimize, and not regiment, a person's initiative, autonomy and independence in life choices, such as daily activities and whom to spend time with.
- Support choice of services and staff. The person chooses their services and supports and who provides them.
Extra rules for provider-controlled homes
When a provider owns or controls the home, the rule adds specific protections:
| Requirement | What it means day to day |
|---|---|
| A lease or written agreement | The same responsibilities and eviction protections tenants have under local landlord-tenant law, or a comparable written agreement where that law doesn't apply |
| Privacy in one's room | Entrance doors the person can lock, with only appropriate staff holding keys |
| Roommate choice | People who share a room choose their roommate |
| Decorating | Freedom to furnish and decorate within the lease |
| Schedules and food | Freedom and support to control one's schedule and activities, and access to food at any time |
| Visitors | Visitors of the person's choosing at any time |
| Accessibility | The setting is physically accessible to the person |
How a right can be limited
The rule allows the lease, privacy, schedule, food and visitor conditions to be changed for one person, but only for a specific, assessed need. The person-centered service plan must document all of the following (441.301(c)(4)(vi)(F)):
- The specific, individualized assessed need.
- The positive interventions and supports used first.
- Less intrusive methods that were tried and did not work.
- A clear description of the condition, directly proportionate to the need.
- Regular collection and review of data on whether the change is working.
- Time limits for periodic review of whether it is still needed.
- The person's informed consent.
- An assurance that the interventions and supports will cause no harm.
Because each change must rest on one person's assessed need and plan, a blanket house rule, such as locking the kitchen for everyone, doesn't fit this process.
Settings presumed to be institutional
Nursing facilities, institutions for mental diseases, ICFs/IID and hospitals are never HCBS settings (441.301(c)(5)). The rule also presumes a setting has the qualities of an institution if it:
- is in a building that also provides inpatient institutional treatment;
- is in a building on the grounds of, or right next to, a public institution; or
- has the effect of isolating people who receive Medicaid HCBS from the broader community.
A state can overcome that presumption only if CMS finds, through a process called heightened scrutiny, that the setting does not have institutional qualities and does have the qualities of a home and community-based setting.
Where the rule stands as of September 2026
The rule took effect March 17, 2014, and gave states time to bring existing settings into line through statewide transition plans. In May 2022, CMS told states they needed final approval of those plans, and compliance with every criterion not directly affected by the COVID-19 emergency, by March 17, 2023. States could get time-limited corrective action plans for criteria the emergency did directly affect.
The settings criteria date from the 2014 rule. The 2024 federal Access Rule amended other parts of the same section, adding a minimum performance standard for annual plan reviews and a grievance process. CMS has said it will not take enforcement action on the grievance requirement until Dec. 31, 2027, Disability Scoop reported; see our coverage of the grievance delay. A CMS proposed rule now under federal review could revise parts of the 2024 rule.
For how the rule fits with the Supreme Court's community integration ruling, see Olmstead v. L.C.: what it requires.
Why this matters for providers and DSPs
- The rule is carried out on shift. Whether a person can get a snack at 10 p.m., lock their door or have a friend over depends on what DSPs and house staff do in the moment. Knowing the rule helps staff say yes by default.
- Limits need paperwork, not habit. A restriction that isn't justified in the person's plan, with the eight required elements, can put the agency out of compliance. Supervisors should know which restrictions are in each plan and when they come up for review.
- Data collection is part of the job. When a plan includes a modification, staff notes and data show whether it is working and whether it can end. That record matters at plan reviews.
- Community access is a standard, not an extra. Outings, work and community activities are part of what makes a setting qualify. Staffing shortages that keep people home are a compliance issue as well as a quality one.
- Settings can be reviewed. Settings near institutions or that isolate people may face heightened scrutiny. Agencies planning new sites should check the location rules first.