CARF Personnel File Requirements for Behavioral Health Providers (2026)

CARF's standards are in its standards manuals, which it sells. The current Behavioral Health Standards Manual is the 2026 edition, which CARF's online store describes as being "for surveys conducted between July 1, 2026 and June 30, 2027." The printed copy costs $214.00, and an electronic license starts at $322.00 for one user. Opioid treatment programs are surveyed against a separate 2026 Opioid Treatment Program Standards Manual, office-based opioid treatment stays in the behavioral health manual, and a certified community behavioral health clinic surveyed on its own uses CARF's CCBHC manual.

What CARF gives away is useful but partial:

• Program descriptions for each behavioral health program, and a page listing every program in the manual, including the sobering center program that is new in 2026.
• Process pages on the steps to accreditation, survey preparation and accreditation decisions.
• News releases announcing new standards.
• Two complimentary standards documents: a supplement for networks and a workbook for unaccredited providers that participate in an accredited network.
• One complete manual, for continuing care retirement communities, which carries the same Section 1 business-practice standards as CARF's other manuals.

What CARF does not publish is the behavioral health manual's text, its table of contents, its appendix list, or a free summary of what changed from 2025. The manual itself includes "changes in the standards from the previous year," so that list is inside the paid copy. Payers and regulators can read current manuals through CARF's password-protected payer portal.

This guide follows one rule as a result: it gives a CARF standard number only where a public CARF document prints it, and it says which document that is. For everything else, read your own current manual. Be wary of any checklist that claims to reproduce CARF's personnel standards item by item: the text is not public, and CARF's own complimentary documents prohibit "Any copying, republication, or redistribution of the content by any means."

Every CARF manual opens with Section 1, ASPIRE to Excellence, CARF's business-practice standards; CARF says the AI standard it added for 2026 sits in that framework, "which is in all CARF standards manuals." For 2026 CARF dissolved the old 1.J Technology subsection and relettered the ones after it:

The 2026 names are from the contents page of CARF's complimentary 2026 continuing care retirement community manual. CARF's 2026 supplement for networks, which is used alongside whichever primary manual applies, confirms the range by applying "Sections 1.A. and 1.C.-1.M." where its 2025 edition said 1.C.-1.N. If your policies, crosswalks or software cite CARF by subsection letter, check them: a 2025 reference to 1.K, 1.L, 1.M or 1.N now points to a different subsection.

Personnel files live mostly in 1.I. CARF's November 2025 report on a behavioral health survey, which a Delaware state agency published, lists the key areas of 1.I as composition of workforce, ongoing workforce planning, verification of backgrounds, credentials and fitness for duty, workforce engagement and development, performance appraisals, and succession planning. The same report lists "Competency-based training on health and safety procedures and practices" under 1.H, alongside emergency procedures, critical incidents and infection control. Section 2, the general program standards, reaches staff too: the report lists "Education and training provided to direct service personnel at orientation and at least annually" under 2.E Medication Use, and competency-based training on preventing unsafe behaviors, and on seclusion and restraint where they are used, under 2.F Promoting Nonviolent Practices.

Three 2026 changes in Section 1 touch the file. As printed in CARF's 2026 continuing care retirement community manual, whose numbers may differ from the behavioral health manual's: documented personnel training on cybersecurity and the technology used in job duties moved into 1.I as Standard 1.I.13, with the requirements unchanged; the standard on a cultural competency, diversity and inclusion plan was deleted, with diversity now addressed in the accessibility plan; and a new standard on policies for augmented or artificial intelligence was added, with "regular training and education for those using and performing oversight of the AI tool(s)" among its accountability measures (CARF news release, April 21, 2026). In behavioral health specifically, CARF's new sobering center standards call for "Annual competency-based training for direct services personnel on topics unique to services and the population served."

The appendices. CARF's store says the behavioral health manual includes "appendices for required written documentation and operational timelines." Every public 2026 CARF document with appendices, including the networks supplement and the unaccredited providers workbook, titles Appendix C "Required Training": a table of the standards that require the organization to train people, marking which training must be competency-based and how often. The behavioral health manual's own appendix list is not public, so confirm your copy before you cite an appendix by letter.

CARF describes its surveyors' approach as consultative rather than inspective, but the survey team still "determines your conformance to all applicable standards by observing services, interviewing persons served and other stakeholders, and reviewing your documentation" (carf.org, Steps to accreditation). CARF's 2025 behavioral health report lists the people interviewed as including "Business unit resources, such as finance and human resources," along with the personnel who serve persons in the programs being surveyed. CARF's accreditation conditions, as printed in its 2026 continuing care retirement community manual, give CARF access to documents "including but not limited to files of persons served (active and closed), human resource files," and warn that the unavailability of key staff at the survey may be grounds for nonaccreditation. A week before the survey, CARF's preparation page says to "Assemble or arrange for access to relevant files and other documents."

The timeline that matters to HR:

The decisions are Three-Year Accreditation, One-Year Accreditation, Provisional Accreditation (one year, after a One-Year Accreditation expires), Inaugural One-Year Accreditation (formerly Preliminary), accreditation with stipulations, and Nonaccreditation (carf.org, Accreditation decisions). Between surveys, licenses renew, training comes due and staff turn over, so a file that was ready at the last survey does not stay ready on its own.

CARF accreditation is voluntary until a payer or regulator makes it a condition, and that is the point at which its personnel standards become enforceable against you. Three federal programs write accreditation into their rules.

Opioid treatment programs. To be certified by SAMHSA, an OTP "must be the subject of a current, valid accreditation by an Accreditation Body or other entity designated by the Secretary" (42 CFR 8.11(a)(2)) and must "operate in accordance with Federal Opioid Use Disorder treatment standards and approved accreditation elements" (42 CFR 8.11(e)(7)). Accreditation bodies survey "for initial accreditation, and then at least every three years" (42 CFR 8.4(a)(1)). CARF is one route, not the only one: SAMHSA's list of approved accreditation bodies, last updated April 24, 2026, names CARF International, Social Current (previously the Council on Accreditation), The Joint Commission, the National Commission on Correctional Health Care and the Washington State Department of Health.

Psychiatric residential treatment facilities. Medicaid covers inpatient psychiatric services for individuals under 21 in a facility that is not a hospital only if the facility is accredited by the Joint Commission, "the Commission on Accreditation of Rehabilitation Facilities," the Council on Accreditation, or another accreditor with comparable standards that the state recognizes (42 CFR 441.151(a)(2)(ii)). The regulation still uses the older names of the Joint Commission and the Council on Accreditation.

TRICARE. Residential treatment centers, substance use disorder rehabilitation facilities, partial hospitalization programs and intensive outpatient programs must be "currently accredited by an accrediting organization approved by the Director," and free-standing OTPs accredited by one the Director recognizes (32 CFR 199.6(b)(4)(vii), (xii), (xiv), (xviii), (xix)). The regulation does not name CARF or any other accreditor for these programs; the approved list is set outside the regulation.

Florida, North Carolina and New Jersey show the range, from a licensing condition to an inspection discount.

Florida requires accreditation for substance use treatment. License renewal applications must include "proof of application for accreditation for each licensed service component providing clinical treatment by an accrediting organization that is acceptable to the department for the first renewal, and proof of accreditation for any subsequent renewals" (s. 397.403(3), F.S.), and rule 65D-30.003(2)(a) requires accreditation "for all clinical treatment services and for each location services are offered." Neither names an accreditor. DCF's licensing page lists four recognized accrediting agencies: CARF, the Council on Accreditation, the Green Apple Accreditation Commission of Social Services and The Joint Commission. Accreditation also buys inspection relief, since DCF accepts the accreditor's survey "in lieu of its own inspections for licensure" (s. 397.411(2), F.S.), but DCF still conducts full licensure inspections of substance abuse services every 3 years (s. 394.741(4), F.S.), and a provider must notify DCF within 10 days of noncompliance with its accrediting standards (r. 65D-30.003(2)(b)). On the mental health side, accreditation is optional for crisis stabilization units, short-term residential programs and children's residential treatment centers, whose rules name CARF, and required for 988 Florida Lifeline call centers (r. 65E-12.104(2); 65E-9.003(3); 65E-5.604(2)(a)). The state's own file requirements are in the Florida DCF 65D-30 personnel guide.

North Carolina requires it for designated services. G.S. 122C-81 requires national accreditation, from an accreditor the Secretary approves, for the mental health, developmental disabilities and substance abuse services DHHS designates, and a newly enrolled provider must be accredited "within one year of enrollment in the Medicaid program or within two years following the provider's first contract to deliver a State-funded service requiring national accreditation" (G.S. 122C-81(d)). NC Medicaid's April 16, 2026 chart lists CARF, COA and The Joint Commission for each service and CQL for some, and gives existing providers with an active service as of April 20, 2026 until April 20, 2027 to complete post-enrollment accreditation. For psychiatric residential treatment facilities the licensing rule names CARF directly (10A NCAC 27G .1901(g)). The statute and rules allow deemed licensure for accredited facilities (G.S. 122C-22(b); 10A NCAC 27G .0403), but we found no published list of qualifying accreditors, so do not count on it.

New Jersey rewards it. New Jersey does not make accreditation a licensing condition, except that an opioid treatment program must hold federal certification (N.J.A.C. 8:43K-8.1(a)1), which requires accreditation. Accredited programs can seek deemed status, which narrows or replaces routine inspections: the integrated outpatient rule allows "license renewal by deemed status" (N.J.A.C. 8:43K-2.6), and the mental health and community residence rules name CARF among the recognized accreditors (N.J.A.C. 8:121-1.2; 10:37A-1.2). Deemed-status site reviews still "primarily focus on, but may not be limited to, staffing and clinical records" (N.J.A.C. 8:121-1.7(g)), so personnel files stay a state survey focus. And since April 6, 2026, a behavioral health program licensed under 8:43K must comply "with any applicable accrediting organizations" (N.J.A.C. 10:36-3.1(b)), which makes an accredited program's CARF standards part of its state program standards. The state file lists are in the New Jersey SUD personnel guide.

Other states that name CARF in statute or rule. At least eight more states name CARF in operative licensing, certification or Medicaid text. This is not a 50-state survey, so check your own state's rules:

Whatever your accreditor, these federal rules apply to the file itself.

• Form I-9. The employee completes Section 1 "at the time of hire," the day employment actually begins, and you complete Section 2 "within three business days of the hire" (8 CFR 274a.2(b)(1)(i)(A), (b)(1)(ii)(B); 274a.1(c)). Keep the form for three years after hire or one year after termination, whichever is later (8 CFR 274a.2(b)(2)(i)(A)). Copying the identity documents is optional (8 CFR 274a.2(b)(3)).
• Exclusion screening. No federal health care program pays for an item or service furnished by an excluded person (42 CFR 1001.1901(b)(1)), and OIG may impose a civil money penalty on anyone who arranges or contracts, "by employment or otherwise," with a person they know or should know is excluded (42 CFR 1003.200(b)(4)). No federal regulation sets a screening frequency for providers; monthly is OIG's recommendation.
• HIPAA training. A covered entity trains every workforce member on its privacy policies, trains new members "within a reasonable period of time" after they join, retrains members affected by a material change, and documents the training (45 CFR 164.530(b)). It also runs "a security awareness and training program for all members of its workforce (including management)" (45 CFR 164.308(a)(5)(i)). Neither rule sets an annual frequency. Training documentation is kept "for six years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.530(j)(2)). Workforce includes volunteers and trainees (45 CFR 160.103).
• Part 2. The 2024 amendments to 42 CFR part 2 have required compliance since February 16, 2026 (89 FR 12472). Part 2 requires formal security policies for records (42 CFR 2.16(a)) but no workforce training; HHS wrote that "part 2 does not expressly require training" (89 FR 12590). A program that is also a HIPAA covered entity trains under HIPAA.
• Background checks run through a screening company. The Fair Credit Reporting Act requires a written disclosure "in a document that consists solely of the disclosure" and the applicant's written authorization before the report is obtained, and, before any adverse action based on it, "a copy of the report" and a written description of the person's rights (15 U.S.C. 1681b(b)(2)(A), (b)(3)(A)). The statute sets no waiting period between the two.
• Medical information. An employer with 15 or more employees keeps information from post-offer and employee medical examinations "on separate forms and in separate medical files" as a confidential medical record (29 CFR 1630.14(b)(1), (c)(1); 1630.2(e)(1)). A test for illegal drug use "is not considered a medical examination" (29 CFR 1630.16(c)(1)), though other medical information the test reveals stays confidential.
• Bloodborne pathogens. Staff with occupational exposure to blood are trained "At the time of initial assignment to tasks where occupational exposure may take place" and then within one year of their previous training, and are offered the hepatitis B vaccine within 10 working days of initial assignment, with a signed declination if they refuse (29 CFR 1910.1030(g)(2)(ii), (iv); (f)(2)(i), (iv)). Training records are kept 3 years and medical records for the duration of employment plus 30 years (29 CFR 1910.1030(h)(2)(ii), (h)(1)(iv)).
• Drug-free workplace. An organization that receives a grant or cooperative agreement directly from HHS publishes a drug-free workplace statement, gives a copy to each employee working on the award, runs an ongoing awareness program, and requires employees to report a workplace drug conviction within five calendar days (2 CFR 382.20; 2 CFR 182.205-182.215). The rule reaches only an entity that receives an award "directly from a Federal agency" (2 CFR 182.660), so federal money that arrives through a state pass-through does not by itself bring you under it, though the state contract may impose similar terms.

Part 8 sets one general standard for staff and leaves the personnel file to the accreditor and the state. "Each person engaged in the treatment of OUD must have sufficient education, training, and experience, or any combination thereof, to enable that person to perform the assigned functions," and practitioners and other licensed or certified providers, "including counselors," must keep their licensure or certification current (42 CFR 8.12(d)). Counseling is provided by "a program counselor, qualified by education, training, or experience" to assess patients and contribute to the care plan (42 CFR 8.12(f)(5)(i)).

Other provisions that touch staff:

• The medical director is "a physician, licensed to practice medicine in the jurisdiction in which the OTP is located" (42 CFR 8.2). Part 8 sets no board certification requirement, and "program physician" is no longer a defined term.
• The program notifies SAMHSA in writing "within 3 weeks of any replacement or other change in the status of the program sponsor or medical director" (42 CFR 8.11(e)(5)).
• The diversion control plan assigns "specific responsibility to the OTP providers and administrative staff" for its measures (42 CFR 8.12(c)(2)).
• Medications for opioid use disorder are administered or dispensed only by a practitioner licensed and registered to do so, or by that practitioner's supervised agent (42 CFR 8.12(h)(1)).

What Part 8 leaves out matters as much. It has no personnel file rule, no staff training frequency and no requirement to train staff on overdose response or diversion; "overdose education" appears only as a patient service in the definition of harm reduction (42 CFR 8.2). The "annual reviews of program policies and procedures" in 8.12(c)(1) are reviews of the policies, not staff training. The revised Part 8 took effect April 2, 2024, with a compliance date of October 2, 2024 (89 FR 7528).

An OTP is also a DEA registrant (42 CFR 8.2). DEA's security regulations include employee screening provisions at 21 CFR 1301.90 to 1301.93, and which of them bind a given program depends on its registration category, so confirm that with DEA guidance or counsel.

For a psychiatric residential treatment facility the federal personnel file rule is specific. Staff, defined to include full-time, part-time and contract workers who manage a resident's health or take part in an emergency safety intervention (42 CFR 483.352), must have ongoing education, training and demonstrated knowledge of what triggers emergency safety situations, nonphysical intervention skills such as de-escalation, and the safe use of restraint and seclusion (42 CFR 483.376(a)). They are trained and demonstrate competency before participating in an emergency safety intervention (483.376(e)), then "demonstrate their competencies as specified in paragraph (a) of this section on a semiannual basis and their competencies as specified in paragraph (b) of this section on an annual basis," paragraph (b) being CPR certification "including periodic recertification" (483.376(b), (f)).

The record itself: "The facility must document in the staff personnel records that the training and demonstration of competency were successfully completed. Documentation must include the date training was completed and the name of persons certifying the completion of training" (483.376(g)). Trainers must be "qualified by education, training, and experience" (483.376(c)), and the regulation names no curriculum or vendor. A PRTF also trains all staff, people providing services under arrangement and volunteers in emergency preparedness at the start and then every 2 years, and keeps documentation of that training (42 CFR 441.184(d)(1)).

A community mental health center certified by Medicare is surveyed against its own conditions of participation, which reach the personnel file in four places:

• Professionals are licensed, certified or registered as the law requires, and "All personnel qualifications must be kept current at all times" (42 CFR 485.904(a)), with discipline-specific qualifications in 485.904(b).
• Each individual furnishing services gets "an initial orientation" on the duties of the job; the CMHC assesses the skills and competence of everyone furnishing care and keeps "a written description of the in-service training provided during the previous 12 months" (42 CFR 485.918(d)(2)-(3)). Volunteers meet the same training standard (42 CFR 485.902).
• Where restraint and seclusion are permitted, client care staff are trained before using them, at orientation and then "on a periodic basis, consistent with the CMHC's policy," and the CMHC "must document in the staff personnel records that the training and demonstration of competency were successfully completed" (42 CFR 485.910(f)(1), (4)). Where they are not permitted, staff are trained in the alternatives.
• Emergency preparedness training at the start and then "at least every 2 years" (42 CFR 485.920(d)(1)).

A practical personnel file audit for a CARF-accredited behavioral health provider runs in five steps:

1. Build the list from the roster, not the file cabinet. Include employees, contract personnel, students, interns and volunteers who served persons during the period under review, plus anyone who left. HIPAA counts volunteers and trainees as workforce (45 CFR 160.103), and the PRTF and CMHC rules reach contract staff and volunteers (42 CFR 483.352; 485.902).
2. Set the items by role and program. Start from the federal rows in the checklist below, add the rows for each program type you run, add your state's licensing rules, then add your current CARF manual's 1.I, 1.H and Section 2 requirements and its required-training table. An OTP counselor's file and a residential direct care worker's file fail for different reasons.
3. Check verification, not just presence. Verification of backgrounds, credentials and fitness for duty is a key area of 1.I, and a copy of a license handed in by the employee is not a check with the issuing board. Record what was verified, against which source, by whom and on which date.
4. Separate competency from attendance. Where a rule or standard calls for demonstrated competency, as the PRTF rule does and as CARF's required-training tables mark, a sign-in sheet is not enough: the record should show the demonstration, the date and who certified it (42 CFR 483.376(g)).
5. Fix forward and date honestly. A missing record obtained today carries today's date, and a correction that names the gap reads better to a surveyor than a backdated document. CARF's QIP asks for the same kind of documented correction after a survey.

Repeat the audit at least once a year, and again when your survey application goes in, at least three months before the survey window.