Root Cause Analysis In Healthcare: What Accreditors and CMS Actually Want to See

August 27, 2026

Ready to be survey-ready?

See how AccrediCulture turns compliance into an operating system across every facility.

What a survey-ready RCA template must contain

A survey-ready healthcare root cause analysis template documents six things: the event timeline, contributing factors across human, process, equipment, and environment domains, a causal statement chain, risk-reduction actions with measurable outcomes, an action strength rating, and a senior leadership sign-off. That structure mirrors The Joint Commission’s Framework for Conducting a Root Cause Analysis and Action Plan, the IHI/NPSF RCA2 methodology, and the CMS Conditions of Participation at 42 CFR §482.21 for hospital QAPI programs.

The reason surveyors keep asking for more than a narrative: RCA is a plural exercise. The term implies there is one root cause, which is counter to the fact that health care is complex and that there are generally many contributing factors that must be considered in understanding why an event occurred, which means there generally needs to be more than one corrective action. A template that only captures a single “root cause” will not hold up in survey.

The fields I hand operators as a working checklist:

Event summary and timeline reconstructed to the minute, including the flowchart of what happened versus what should have happened.
Contributing factors categorized across human factors, process and workflow, equipment and technology, environment of care, communication, and leadership oversight.
Causal statement chain written in “cause, effect, event” format (five-why or fishbone output translated into full sentences).
Risk-reduction actions ranked by the IHI Action Hierarchy (stronger, intermediate, weaker) with named owners and due dates.
Measures of effectiveness defined before the action closes, not after.
Senior leadership approval with signature and date.

IHI is explicit: present the findings of the RCA2 process, including each recommended action, to a member of the organization’s senior leadership team for approval, and if an action isn’t approved, document the reason and select a replacement action. Your template needs a signature block, not a footnote.

Why the numbers demand a tighter template

The volume of what accreditors are seeing is the reason this template gets scrutiny. From January 1 to December 31, 2024, The Joint Commission received 1,575 reports of sentinel events. Patient falls continued to be the most frequently reported sentinel event, accounting for 776 events (49%). The other leading categories included wrong surgery, delay in treatment, patient suicide, unintended retention of foreign objects, and workplace violence-related events, together comprising 85% of reported sentinel events in 2024.

That is a roughly 13% jump from 1,411 reports in 2023, and the trajectory in state mandatory-reporting systems tells the same story. Minnesota hospitals and ambulatory surgery centers reported a total of 624 adverse events in 2024, up 14 from 2023. Under Minnesota’s mandatory reporting law, hospitals and ambulatory surgical centers must report 29 specific adverse health events to the Minnesota Department of Health and conduct a root cause analysis to identify the root causes of the event. Miss a field, and the state notices before the accreditor does.

The Joint Commission’s clock is the one operators forget. TJC requires hospitals to conduct a root cause analysis within 45 days and implement action plans, not only to comply with standards but to ensure such errors don’t happen again. Forty-five days sounds generous until you count backwards from the surveyor asking to see the closed loop.

RCA versus RCA2, and why TJC leans toward the second

RCA2 is not a rebrand. It is a correction. As the National Patient Safety Foundation authors put it, “Root Cause Analysis and Action, RCA2 (RCA squared), is the term used throughout this document.” The point is baked in: analysis without action does not prevent recurrence. The purpose of an RCA2 review is to identify system vulnerabilities and implement strong actions that will eliminate or mitigate those vulnerabilities. Review teams strive to identify actions that prevent or minimize the chances of the event recurring and reduce the severity or consequences if it should recur.

The practical difference at survey time is the Action Hierarchy. A “weaker” action like re-education alone will get flagged. A “stronger” action like a forcing function, a standardization change, or an equipment redesign will hold. Your template should force the RCA team to categorize every action they propose, and it should reject the file for leadership approval if every action falls in the “weaker” tier.

Beyond TJC, the same logic runs through CARF standards, AAAHC Chapter 5 quality improvement requirements, COA’s PQI process, DNV NIAHO, HFAP, and ACHC. Different acronyms, same expectation: contributing factors, action hierarchy, measurable follow-through, leadership sign-off. AHRQ’s Common Formats for Event Reporting give you the taxonomy for the contributing-factor fields, and PSOs operating under PSQIA give you a protected space to analyze the data honestly.

Operationalizing the template across sites

A PDF template is where most organizations stop. That is also where surveyors find gaps. The version that survives a resurvey is the one wired into your compliance program so every RCA is visible, every corrective action has a live owner, and every policy revision triggered by the RCA is tied back to the event that caused it.

What we help operators build inside AccrediCulture:

A single intake for incidents and grievances that promotes the case into an RCA when the severity threshold is hit.
The Joint Commission Framework fields and CMS §482.21 QAPI language embedded in the form, so nothing gets left blank.
Action Hierarchy tagging on every corrective action, with a rule that at least one “stronger” action is required before submission.
A command center view showing every open CAPA across sites, due dates, and owners, so the COO does not need to email seven directors to know where things stand.
Automatic linkage from the RCA to the policy that got updated, the training that got assigned, and the chart audit that verifies effectiveness.

The rule I use with clinical directors: if a surveyor asks about the event nine months later, you should be able to open one screen and show the event, the RCA, the actions, the owner, the completion evidence, and the measure that proves the fix held. If that takes more than one screen, the template is not doing its job.

Frequently asked questions

When is a healthcare organization required to perform an RCA versus an apparent cause analysis?
An RCA is required when the event meets your accreditor’s sentinel or reviewable event definition, or when state law mandates it (as in Minnesota’s 29 reportable events). Apparent cause analysis is a lighter-touch process used for lower-severity events or near-misses where a full multidisciplinary RCA is not warranted. Your incident policy should define the trigger thresholds so the decision is not made in the moment.

How long do we have to complete an RCA after a sentinel event under Joint Commission policy?
TJC requires hospitals to conduct a root cause analysis within 45 days and implement action plans. Start the clock when the event is identified, not when it is reported internally, and build your template to timestamp every stage.

What is the difference between RCA and RCA2, and which does TJC expect?
RCA2 is the current best-practice methodology from IHI and the former National Patient Safety Foundation. It adds the Action Hierarchy, mandatory leadership approval, and measures of effectiveness. The Action Hierarchy tool helps identify which specific actions will have the strongest effect for successful and sustained system improvement. The Joint Commission’s Framework is compatible with RCA2, and surveyors increasingly expect to see RCA2 elements in the file.

Who should sit on the RCA team, and does the CEO need to sign off?
Include the clinical staff closest to the event, a quality or patient safety leader, subject-matter experts for the systems involved, and a facilitator who was not part of the event. Senior leadership approval is required. In smaller organizations the CEO signs; in larger systems the CMO, CNO, or COO typically holds that role, provided they have authority to approve resource commitments.

How do we prove RCA corrective actions were effective during a resurvey?
Define the measure of effectiveness before you close the action. Then run the chart audit, the observation study, or the metric review at 30, 60, and 90 days post-implementation, and store the evidence next to the original RCA. A surveyor at resurvey wants to see the event, the action, the measure, the data, and the sustainment plan, all in one linked record.

References