Florida DCF 65D-30 Personnel File Requirements and Staff Qualifications (2026)

Rule 65D-30.004(4)(a), in the text effective 10-16-2025, is the core of the Florida DCF 65D-30 personnel file requirements. It opens "Records on all personnel shall be maintained," and each personnel record shall contain:

1. "The individual's current job description with minimum qualifications for the position and documentation that the staff meets the minimum qualifications outlined in the job description" (65D-30.004(4)(a)1.). That is two separate proofs, and the word "current" is doing real work.
2. "The employment application or resume" (65D-30.004(4)(a)2.). Either satisfies the rule.
3. "The employee's annual performance appraisal" (65D-30.004(4)(a)3.). Annual, and recurring. The rule prescribes no form.
4. "A document signed and dated by the employee indicating that the employee received new staff orientation and understand the personnel policies and the programs operating policies and procedures" (65D-30.004(4)(a)4., quoted as printed). Note the acknowledgment must cover both the personnel policies and the operating policies and procedures.
5. "A verified or certified copy of degrees, licenses, or certificates of each employee" (65D-30.004(4)(a)5.). The rule does not define "verified or certified," but a plain photocopy handed over by the employee is thin. Primary-source verification against the licensing board or credentialing entity, dated and filed alongside the copy, is recommended practice.
6. "Documentation of employee screening as required in paragraph (b)" (65D-30.004(4)(a)6.). Print or export the eligibility determination with its date so the file stands on its own.
7. "Documentation of required staff training" (65D-30.004(4)(a)7.). DOC and DMS inmate substance abuse programs and DJJ commitment programs and detention facilities are exempt from this subparagraph only, per (4)(a)8. Almost no private community provider qualifies.

Two more documents are expressly required to sit in the personnel record, and they come from the training rule rather than 65D-30.004. For direct care staff, "a copy of the valid certificate must be filed in the personnel record" for CPR and first aid (65D-30.0046(1)(c)6.). For anyone who supervises the self-administration of medication, "Proof of training shall be documented in the personnel file and shall be completed prior to implementing the supervision of self-administration of medication" (65D-30.0046(1)(h)). An expired CPR card in the file is a live deficiency, not a paperwork lag.

Behind the individual files sit agency-level documents each file is measured against. Rule 65D-30.004(1) requires organizational capability to be demonstrated "through a written, indexed system of policies and procedures that are descriptive of services, and the population served," and "All staff shall have a working knowledge of the operating procedures." Rule 65D-30.004(4) requires personnel policies that "clearly address recruitment and selection of prospective employees, promotion and termination of staff, code of ethical conduct, sexual harassment, confidentiality of individual records, attendance and leave, employee grievance, non-discrimination, abuse reporting procedures," and the orientation of staff to universal infection control procedures. The same subsection requires a drug-free workplace policy for employees and prospective employees, and requires that the code of ethical conduct "prohibit employees and volunteers from engaging in sexual activity with individuals receiving services for a minimum of two (2) years after the last professional contact with the individual." A generic HR ethics policy that omits that two-year clause does not meet the rule.

How to use the checklist at the end of this guide: rows in the first seven categories (Identity and role, Performance, Orientation, Credentials, Background screening, Training and Supervision) are per person, so work them once for each staff member. Everything from "Renewal application" down is checked once for the organization, not once per file.

The population is broader than payroll. Section 397.311(46), F.S. defines the term this way: "'Service provider personnel' or 'personnel' includes all owners, directors, chief financial officers, staff, and volunteers, including foster parents, of a service provider." The rule definitions point the same direction. "Clinical Staff" at 65D-30.002(14) means "employees, independent contractors, and volunteers of a provider who are responsible for providing clinical services to individuals," and "Direct Care Staff" at 65D-30.002(28) uses the same three categories for direct services.

There is a drafting wrinkle worth knowing before you argue it with a licensing specialist. Rule 65D-30.004(4)(a) opens "Records on all personnel shall be maintained," but four of its seven content subparagraphs are written in employee-specific terms: "the employee's" (3), "the employee" (4), "each employee" (5) and "employee screening" (6). An eighth subparagraph, (a)8., is an exemption rather than a file item. The definitions above support opening files for contracted clinicians and volunteers in clinical roles, and the duties that unambiguously reach them are the ones written in those terms: the 10 hours of annual training for "All staff and volunteers who provide direct care or prevention services" (65D-30.0046(1)(d)), the code of ethical conduct binding "employees and volunteers" (65D-30.004(4)), and the exposure control plan applying to "all staff, volunteers, and individuals receiving services" (65D-30.004(9)(a)1.).

The rule does not settle whether a licensing specialist expects the full seven-item file for a 1099 clinician or a contracted medical director. Two texts point toward yes and neither closes it. For methadone medication-assisted treatment, "Any entity or qualified professional who has entered into a written agreement with a licensed provider is bound by these regulations" (65D-30.0142(2)(q)2.c.). And 65D-30.0037(4)(d) treats an individual "who is an independent contractor who is licensed under Chapter 458, 459, 490 or 491, F.S." as an authorized route for delivering services in Department of Juvenile Justice settings. Ask your regional licensing office what it expects for contracted and agency-supplied clinicians and write the answer into your policy rather than deciding it yourself. Until you have that answer, the safe course is a full file for anyone who delivers clinical or direct care services under your license, whatever the tax form says.

Volunteers get one carve-out and it is narrow. Under s. 397.4073(1)(c), F.S., "A volunteer who assists on an intermittent basis for fewer than 40 hours per month and is under direct and constant supervision by persons who meet all personnel requirements of this chapter is exempt" from fingerprinting and background check requirements. All three conditions must hold, the exemption reaches screening only, and a volunteer who reaches 40 hours in a month loses it going forward. Keep a volunteer file with training records regardless.

Students are not named anywhere in Chapter 65D-30 or in s. 397.4073, F.S. A student is covered only insofar as they meet the volunteer or contractor description. If you use interns, confirm the expectation with your regional office rather than assuming a rule exists.

This guide covers one license: the substance abuse treatment license the Florida Department of Children and Families issues under Chapter 397, Florida Statutes, with the operating standards in Chapter 65D-30, Florida Administrative Code. If your organization holds a DCF license for addictions receiving, detoxification, intensive inpatient, residential, day or night treatment with community housing, day or night treatment, intensive outpatient, outpatient, aftercare, intervention, prevention or medication-assisted treatment, this is your rule chapter.

It may not be your only license. The Agency for Health Care Administration is a different agency and licenses a range of facilities under its own statutes and its own Title 59A rules, including home health agencies, hospices and nurse registries, and, most relevantly for this audience, health care clinics under ch. 400, part X, F.S. (rules 59A-33 and 59A-35). Many non-physician-owned Florida outpatient substance use providers that tender charges to third-party payors hold an AHCA health care clinic license alongside the DCF license unless an exemption applies. Those AHCA requirements are not covered here, so confirm your status with AHCA rather than assuming the DCF license is the only one you need. If you also hold a home health agency license, the AHCA file rules for that side are set out in our guide to Florida home health agency personnel file requirements. Mental-health-only services may instead sit under Chapter 394, F.S., and children's mental health under other DCF rules.

The distinction matters operationally, not just on paper. If you hold both an AHCA license and a DCF license, you satisfy both rule sets, and clearances do not automatically travel between them. Section 435.07(5), F.S. is explicit: "Exemptions granted by one agency shall be considered by subsequent agencies, but are not binding on the subsequent agency." A person exempted on the AHCA side is not thereby cleared for the DCF-licensed side. Even within DCF, an exemption can be narrower than it looks: s. 397.4073(4)(c), F.S. lets the Department grant exemptions "to work solely in substance use disorder treatment programs, facilities, or recovery residences or in programs or facilities that treat co-occurring substance use and mental health disorders," and further limit them to working with adults. Read the exemption letter before you reassign anyone.

One more layer sits on top of the license itself. Under 65D-30.003(1)(b), the Department issues one electronic license per site covering that site's components, "A license is valid only for the specific service component(s) listed for the specific site identified on the license," and "The provider shall print the most recent version of the license and display a copy in the facility." Rule 65D-30.0032(1) adds that the display must be in a conspicuous, publicly accessible place. Whenever DCF issues an amended license, the copy on the wall is out of date.

Finally, accreditation, managing entity contracts and Medicaid or managed-care agreements add personnel obligations on top of 65D-30. They are covered near the end of this guide, and each one is labeled so you can tell what is rule, what is contract and what is practice.

If you also operate in New Jersey, where residential and outpatient substance use disorder programs run to two different chapters and the residential one mandates fingerprint-supported checks, the parallel analysis is in our guide to New Jersey SUD personnel file requirements under N.J.A.C. 8:111 and 8:43K.

Qualified professional. Chapter 65D-30 does not define the term; 65D-30.002(66) defers to s. 397.311, F.S. The statutory definition gives four routes: "a physician or a physician assistant licensed under chapter 458 or chapter 459; a professional licensed under chapter 490 or chapter 491; an advanced practice registered nurse licensed under part I of chapter 464"; or "a person who is certified through a department-recognized certification process for substance abuse treatment services and who holds, at a minimum, a bachelor's degree." Both halves of that fourth route are required. A registered nurse who is not an APRN does not qualify on the face of the text. Someone certified in another state at the time of employment "may perform the functions of a qualified professional as defined in this chapter but must meet certification requirements contained in this subsection no later than 1 year after his or her date of employment." There is also a live grandfather clause: under s. 397.416, F.S., a person certified through a process recognized by the former Department of Health and Rehabilitative Services before January 1, 1995 may perform qualified professional duties. Keep the historical certificate.

"Department-recognized" is not a synonym for "well known." Rule 65D-30.0031(2)(a) makes DCF the gatekeeper for certifying organizations for addiction professionals, and 65D-30.0031(2)(c) does the same for peer specialist credentialing entities. In both cases the rule says the list "can be found at the following link: https://www.myflfamilies.com/services/licensing/samh." No credential is named anywhere in Chapter 65D-30 or Chapter 397, F.S. Check the current DCF list before you accept a certificate, and do not assume a Florida Certification Board or IC&RC credential is on it because a job posting says so.

Clinical supervisor. Section 397.311(8), F.S. defines this as "a person who meets the requirements of a qualified professional whose functions include managing personnel who provide direct clinical services or maintaining lead responsibility for the overall coordination and provision of clinical services." The test is function, not job title, and it matters because clinical supervisors are one of the four roles that must be level 2 screened. Rule 65D-30.0046(2) then requires that "A qualified professional shall supervise clinical services, as permitted within the scope of their qualifications. In addition, all licensed and unlicensed staff shall be supervised by a clinical supervisor." That is deliberately broad. An independently licensed therapist is not exempt from having a named clinical supervisor. The one carve-out is medical: "In the case of medical services, medical staff may provide supervision within the scope of their license," so a physician or APRN performing medical services is supervised through the medical line rather than by a non-medical clinical supervisor.

Degreed clinical staff. Rule 65D-30.0046(4)(b) requires that "Bachelor's or master's degree level clinical staff must hold a degree from an accredited university or college with a major in counseling, social work, psychology, nursing, rehabilitation, special education, health education, or a related human services field." The paragraph is written as a flat requirement with no waiver language on its face. "Related human services field" is undefined; if you rely on it, document your reasoning in the file at hire and expect it to be tested.

Scope of practice. Rule 65D-30.0046(4)(a) states that "Staff must provide services within the scope of their professional licensure certification or training and competence in applicable clinical protocols" (quoted as printed). Subsection (3) then limits clinical staff who are not qualified professionals to a listed set of tasks, subject to the opening line of the subsection, "unless otherwise specified in this rule." The list is: (a) Screening; (b) Psychosocial assessment; (c) Treatment planning; (d) Referral; (e) Service coordination; (f) Consultation; (g) Continuing assessment and treatment plan reviews; (h) Recovery support services; (i) Crisis intervention; (j) Individual, family, and community education; (k) Documentation of progress; (l) Any other tasks permitted in these rules and appropriate to that licensable component; and (m) Counseling, including individual counseling, group counseling, and counseling with families, couples, and significant others.

Item (m) is the one to read carefully. Individual counseling, group counseling, and counseling with families, couples and significant others are all inside the permitted scope for clinical staff who are not qualified professionals. What changes is the countersignature trail, not the permission. Do not treat the list as closed, because the opening line says "unless otherwise specified in this rule" and item (l) is itself a catch-all, but do treat it as the default job description boundary.

Four countersignature deadlines follow from this, and the two that recur run on every individual's treatment calendar rather than once per hire. Where a screening is not completed by a qualified professional, "it shall be countersigned and dated by a qualified professional" (65D-30.0042(1)). Where a psychosocial assessment was not completed initially by a qualified professional, it "shall be reviewed, countersigned, and dated by a qualified professional within 10 calendar days of completion" (65D-30.0042(2)(b)3.), with 30 calendar days for DOC and DMS inmate programs. A treatment plan not completed by a qualified professional "shall be reviewed, countersigned, and dated by a qualified professional within 10 calendar days of completion," again 30 calendar days for DOC and DMS inmate programs (65D-30.0044(1)(a)). And "if the treatment plan reviews are not completed by a qualified professional, the review shall be countersigned and dated by a qualified professional within five calendar days of the review" (65D-30.0044(1)(b)). Two related signature rules sit alongside them: documentation of appropriateness of level of care must be "countersigned by the qualified professional or clinical supervisor" (65D-30.0042(2)(b)o.), and a single-event progress note "shall include the credentials of the person who signed the notes" (65D-30.0044(1)(c)). The practical file consequence: you need to be able to show that each countersigner met the qualified professional definition on the date they signed, which means a dated credential trail rather than only a current certificate.

Where a provider accepts involuntary referrals, "The decision to refuse to admit or to discharge shall be made by a qualified professional" (65D-30.0049(1)(b)3.), and the provider must define the means by which the physician's review and signature for involuntary assessment and stabilization, and the qualified professional's signature for involuntary assessments, will be secured (65D-30.0049(1)(c)).

Medical director and medical consultant. For addictions receiving facilities, detoxification, intensive inpatient, residential and methadone or medication-assisted treatment for opioid use disorder, "Providers shall designate a medical director who shall oversee all medical services. The medical director's responsibilities shall be clearly described" (65D-30.004(6)). Rule 65D-30.004(6)(a) says what those responsibilities must cover: medical services provided by the program; oversight of the development and revision of medical policies, including "Procedures and ongoing training for routine medical care, specialized services, specialized medications, and medical and psychiatric emergency care"; "Collaborative supervision with the clinical supervisor of non-medical staff in the provision of substance use disorder services"; and supervision of medical staff in the performance of medical services. Two of those are personnel obligations. The ongoing training duty does not sit in 65D-30.0046, so it will not appear in the training table below, and the shared supervision relationship with the clinical supervisor should be visible on your organizational chart.

The rule also caps how many individuals one medical director may serve at any given time: 32 for addictions receiving facilities, inpatient detoxification and intensive inpatient; 33 for outpatient detoxification; 120, 137, 142 and 137 for residential levels 1 through 4; and 1,745 for methadone medication-assisted treatment (65D-30.004(6)(d)). A provider licensed for multiple components applies the percentage of the director's time dedicated to each component to the Department's methodology, submits that calculation with the licensure application, updates it at every renewal, and must produce supporting documentation on request (65D-30.004(6)(e)).

On any change of medical director, the provider must notify the regional office in writing within 24 hours and "provide proof that the new or interim medical director holds a current license in the state of Florida" and is free of administrative actions (65D-30.004(6)(f)). The medical director must also meet at least twice a year with the risk management and quality assurance program, documented in committee minutes (65D-30.004(6)(b)). Medical protocols carry their own chain: "each physician working with a provider shall establish written protocols for the provision of medical services" and for managing medication, and "Such protocols will be implemented only after written approval by the chief executive officer and medical director" (65D-30.004(7)(a)). The protocols must also address delegation of medical functions to licensed practitioners used as clinical staff, issuing orders, signing and countersigning results of physical health assessments, and documented procedures for medication administration within scope of practice (65D-30.004(7)(b)1.-4.). All medical protocols must then be "reviewed and approved by the medical director and chief executive officer on an annual basis" (65D-30.004(7)(d)). One discrepancy to resolve locally: the incorporated application form CF-MH 4024 (August 2025) lists a broader component set for the medical director item than the rule does, adding day or night treatment. Confirm which you are being held to.

Providers running treatment components not listed in that subsection are not off the hook. Under 65D-30.004(6)(g), "the provider shall have access to a physician, physician assistant, or APRN through a written agreement who will be available to consult on any medical services required by individuals involved in those components," and that consultant is held to all medical director requirements and restrictions. Rule 65D-30.004(6)(h) adds an unusually severe consequence: a medical director or medical consultant in violation of any requirement of the chapter or of Chapter 397, F.S. "is permanently barred from being employed by or contracting with a service provider" licensed under the chapter. The rule describes no published bar list, so verification in practice means license discipline history plus direct inquiry.

Nursing support staff. Rule 65D-30.002(46) defines these as "persons who assist Registered Nurses and Licensed Practical Nurses in carrying out their duties, but who are not licensed nurses." Their job description should stay within assisting licensed nurses, and their training record must predate the first shift performing the function.

Peer specialists. Section 397.311(31), F.S. defines a peer specialist by reference to at least two years in recovery, or two years of family or caregiver experience, and expressly excludes a qualified professional or a person otherwise certified under chapter 394 or 397. Rule 65D-30.0046(5)(a) requires that peer specialists providing Department-funded peer support services "be certified by a peer specialist credentialing organization that is recognized by the Department, or the peer specialists shall be working towards certification for up to one year." Section 397.417(3)(d), F.S. adds the condition the rule omits: the uncertified individual must be supervised by a qualified professional or by a certified peer specialist with at least two years of full-time experience at a licensed behavioral health organization.

Rule 65D-30.0046(5)(b) lists the eleven services a peer specialist may provide, and the fourth of them carries a double exclusion: "Facilitation of recovery group meetings, excluding twelve-step meetings and therapeutic or clinical group counseling sessions." A peer specialist may not run your in-house AA or NA meeting and may not run a clinical group. Put both exclusions in the job description. Note also that (5)(b) is permissive on its face, because it says peer specialists "may provide the following services," so the binding limit on non-qualified-professional work comes from 65D-30.0046(3) and from this carve-out, not from treating (5)(b) as a closed list.

Start with who must be screened, because over-screening is expensive and under-screening is a license problem. Rule 65D-30.004(4)(b)1. says only that "Providers shall ensure compliance with background screening in accordance with Section 397.4073, F.S." The statute names three classes. First, "All owners, directors, chief financial officers, and clinical supervisors of service providers are subject to level 2 background screening as provided under s. 408.809 and chapter 435" (s. 397.4073(1)(a)1.). Second, "All service provider personnel who have direct contact with children receiving services or with adults who are developmentally disabled receiving services" (s. 397.4073(1)(a)2.). Third, peer specialists with direct contact, screened under s. 397.417(4). Inmate substance abuse programs operated directly or under contract with the Department of Corrections are exempt from the first class.

One limit on that paragraph is worth knowing: s. 397.4073(1)(a) is written prospectively for individuals screened on or after July 1, 2022. In practice the five-year rescreen cycle at s. 408.809(2), F.S. should have caught anyone hired before then, but DCF's position on continuously employed pre-2022 personnel is not settled on the face of the statute. If you have staff who have never been screened under the current standard, confirm the position with your regional office rather than relying on the date.

That scoping means an adult-only provider whose counselors are not owners, directors, chief financial officers or clinical supervisors has no statutory level 2 mandate for them. A provider may still choose to screen everyone, because managing entity contracts, Medicaid and managed-care agreements, accreditation standards and its own policy can require it, and because misjudging whether a role involves the triggering direct contact is a license-level risk. Decide deliberately and write the decision down.

One rule-level screening mandate does sit outside 65D-30.004(4)(b). Rule 65D-30.0034(2) states flatly that "All owners shall be screened according to the level 2 screening requirements of Chapter 435, F.S.," and it makes a change in ownership of less than a majority interest a screening trigger in its own right: that change "only requires submittal of a Level 2 background check" rather than a new application, while "an acquisition of a majority of ownership shall require the submission of a new application for each site affected." Track ownership changes as screening events, not just as corporate paperwork.

One carve-out is worth knowing. Under s. 397.4073(1)(i), F.S., a physician licensed under chapter 458 or 459, or a nurse licensed under chapter 464, who underwent Department of Health screening at initial licensure or renewal and who holds an active and unencumbered license is not subject to screening under that section. The exemption fails the moment the license lapses or becomes encumbered, so the file needs dated license verification, not a one-time note.

The mechanics. Level 2 screening is "security background investigations as a condition of employment and continued employment," including statewide criminal history checks through FDLE and national criminal history records checks (s. 435.04(1)(a), F.S.). It also includes "a search of the sexual predator and sexual offender registries of any state in which the current or prospective employee resided during the immediate preceding 5 years," which is why a five-year address history is worth capturing at screening. The statute puts the multi-state registry search inside the investigation but does not say who supplies the address list, and it prescribes no employer residency record or form. Fingerprints "must be submitted electronically to the Department of Law Enforcement" (s. 435.04(1)(b)), so ink cards are not compliant. The employer must register with and initiate all checks through the Clearinghouse "before referring an employee or potential employee ... for electronic fingerprint submission" (s. 435.12(2)(d)), and must submit the information necessary for screening "within 5 working days after receiving it" (s. 435.05(1)(c)).

Disqualifying standards are wider than the chapter 435 list. Because s. 397.4073 imports screening "as provided under s. 408.809 and chapter 435," the expanded list at s. 408.809(4) also applies: "In addition to the offenses listed in s. 435.04, all persons required to undergo background screening pursuant to this part or authorizing statutes must not have an arrest awaiting final disposition for, must not have been found guilty of" a further set of offenses including Medicaid provider fraud, domestic violence, patient brokering, forgery, identity theft, racketeering and money laundering. Patient brokering is particularly relevant in the Florida substance use sector. Domestic violence is separately disqualifying under s. 435.04(3).

The paperwork that lands in the file. Every screened employee "must attest, subject to penalty of perjury, to meeting the requirements for qualifying for employment pursuant to this chapter and agreeing to inform the employer immediately if arrested for any of the disqualifying offenses" (s. 435.05(2), F.S.). For DCF providers this is operationalized by form CF 1649, Attestation of Good Moral Character (June 2025), which 65D-30.004(4)(b)3. requires at the initial screening and at every rescreening. Download the current edition from the incorporation-by-reference link rather than a saved copy. Separately, the provider as employer "must submit to the agency annually or at the time of license renewal, under penalty of perjury, a signed attestation attesting to compliance with the provisions of this chapter" (s. 435.05(3), F.S.). These are two different documents and readers conflate them.

Timing and consequences. An employer "may not hire, select, or otherwise allow an employee to have contact with any vulnerable person that would place the employee in a role that requires background screening until the screening process is completed and demonstrates the absence of any grounds for the denial or termination of employment" (s. 435.06(2)(a), F.S.). Read the second half. The bar does not lift when results land; it lifts when you have reviewed them. There is a narrow lawful exception: an employee may be hired for training and orientation purposes only before screening completes, but "the employee may not have direct contact with vulnerable persons" until it does (s. 435.06(2)(d)). "Vulnerable person" is a defined term meaning a minor or a vulnerable adult (s. 435.02(5), F.S.), so for an adult-only provider the restriction is narrower than a blanket no-client-contact rule. Evidence the restriction; do not merely understand it.

If disqualifying information appears, the employer "shall notify the employee in writing, stating the specific record that indicates noncompliance with the standards in this chapter. It is the responsibility of the affected employee to contest his or her disqualification or to request exemption from disqualification" (s. 435.06(1)). A generic letter does not meet "stating the specific record." That notice starts a 30-day clock: exemption requests "must submit the request within 30 days after being notified of the disqualification. The department shall grant or deny the request within 60 days after receipt of a complete application" (s. 397.4073(1)(f), F.S.). Where five years have elapsed since completion of confinement, supervision or nonmonetary court conditions for the most recent disqualifying offense, or three years for a certified peer specialist or one seeking certification, s. 397.4073(1)(g) permits the applicant to work with adults under supervision for up to 180 days or until DCF decides, whichever is earlier. That window is adults only.

The employer must terminate or reassign anyone found noncompliant: "The employer must terminate the employment of any of its personnel found to be in noncompliance with the minimum standards of this chapter or place the employee in a position for which background screening is not required" unless an exemption is granted (s. 435.06(2)(c)). Refusal to cooperate or to timely submit information, including fingerprints, requires disqualification or dismissal (s. 435.06(3)). Section 435.06(4) gives employers protection from reemployment assistance liability and damages claims for terminating on notice of a disqualifying conviction or arrest, but take your own counsel's advice on process.

Arrests trigger two parallel duties. Chapter 435 requires removal: "If an employer becomes aware that an employee has been arrested for a disqualifying offense, the employer must remove the employee from contact with any vulnerable person that places the employee in a role that requires background screening" (s. 435.06(2)(b)). Chapter 397 requires telling DCF. Failure to immediately remove such personnel "and notify the department within 2 days after such removal, excluding weekends and holidays" is a ground for license denial, suspension or revocation (s. 397.415(1)(d)5., F.S.).

Keeping the Clearinghouse roster honest. An employer of screened persons "must register with the clearinghouse and maintain the employment or affiliation status of all persons included in the clearinghouse" (s. 435.12(2)(c)), and since January 1, 2024 initial status and any status change must be reported within five business days. Terminations count. This is not administrative tidiness: DCF's Clearinghouse guidance states that renewal notifications fire at 60, 30 and 21 days before the employee's retained print (RP) expiration date, and only for employees listed on the Employee/Contractor Roster without an end date. A stale roster silences the early-warning system. Fingerprints must also be "Resubmitted for a Federal Bureau of Investigation national criminal history check every 5 years until such time as the fingerprints are retained by the Federal Bureau of Investigation" (s. 435.12(2)(a)3.). Which of the five-year dates fires first for a chapter 397 provider, how to read the retained print expiration date off the person profile, and what to do when that date has already passed are worked through in our Florida Level 2 rescreening guide.

And until a person's fingerprints are enrolled in the FBI's national retained print arrest notification program, a break in service of more than 90 days from a position that requires screening by a specified agency requires a new national screening on return (s. 435.12(2)(b) and (2)(b)1.). That opening limitation matters, because an enrolled person does not owe that rescreen. The Clearinghouse record for the person shows the retained-print status, so check it before you pay for a new screening. Per-diem and PRN staff who go dormant between census peaks are the staff most exposed to this rule, which is why a dated break-in-service log belongs in your process.

Start with the documentation standard, because a training that happened but cannot be shown in the five required fields is citable as if it never happened. Rule 65D-30.0046(1)(b) requires that "All required training activities shall be documented and accessible for Department review, including the date, duration, topic, name(s) of participants, and name(s) of the trainer or training organization." Build your training log columns to match those five fields exactly. The five elements must appear in the training documentation as a whole, so a vendor certificate that omits duration or the trainer's name has to be backed by a log entry that supplies them. A log stored only in a platform you cannot export on the day of inspection is not accessible.

At agency level, 65D-30.0046(1) requires a staff development plan and that "At least one (1) staff member with skill in developing staff training plans shall be assigned the responsibility of ensuring that staff development activities are implemented." The plan "must be reviewed at least annually through the quality assurance program and revised as needed" and "must be signed and dated" (65D-30.0046(1)(a)). An unsigned or undated plan is citable on its face.

Four notes on that table. The six-month heading at 65D-30.0046(1)(c) is overridden where a subparagraph sets its own deadline: nursing support training must be completed "prior to performing that function," and medication training "prior to implementing the supervision of self-administration." The verbal de-escalation requirement reaches direct care staff at providers licensed for every component except universal direct prevention services, and 65D-30.004(12) separately requires written policies naming the specific technique used plus proof to the Department that affected staff completed training in that technique; a generic de-escalation certificate that does not match your named technique is a visible mismatch. Medication training also requires that "Personnel responsible for training must certify by signed document or certificate the competency of unlicensed staff to supervise the self-administration of medication" (65D-30.0046(1)(h)), so attendance alone is not enough. And the rule does not say whether the 12 competency-based hours count toward the 10 general hours; it is silent, so document them separately. The last row is not part of the 65D-30.0046 scheme at all: 65D-30.0045(1)(a)5. requires "Education of staff in the importance of the grievance system and individual rights," which is distinct from the annual "rights of individuals served" topic at 65D-30.0046(1)(d)4. and carries no stated interval.

Two overdose duties also sit outside the training rule. Under 65D-30.004(22)(a), a provider of clinical treatment services must have a written overdose prevention plan and "All staff must have a working knowledge of the overdose prevention plan," which is a knowledge standard rather than a course. And if you keep an emergency overdose prevention kit, 65D-30.004(22)(b) requires "a plan to train staff in the prescribed use and the availability of the kit for use during all program hours of operation." Note that (22)(b) is not limited to clinical treatment services the way (22)(a) is, and that the words "during all program hours" attach to the kit's availability. Treating it as a trained-person-on-every-shift requirement is a conservative reading, not rule text.

Two provider-level duties sit behind the HIV/AIDS row. Rule 65D-30.004(10) requires the provider to meet the s. 381.0035 educational requirements and adds that "all infection prevention and control educational activities shall be documented," a documentation duty broader than the five-field training log. And 65D-30.0036(1)(f) makes "Confirmation of completion of basic HIV/AIDS education requirements pursuant to Section 381.0035, F.S." a renewal application item, so the aggregate completion record has to be producible at renewal, not just the individual certificates.

One useful allowance: under 65D-30.0046(1)(e), "In instances where an individual has received the requisite training as required in paragraphs (1)(c) and (d) during the year prior to employment by a provider, that individual will have met the training requirements." That applies only if the individual can produce documentation that the training was completed and that it was provided by a qualified person or organization. It credits the (1)(c) and (1)(d) requirements only. It does not credit the 12 competency-based hours at (1)(f) or the 12 prevention hours at (1)(g). If the new hire cannot produce it, retrain rather than attest. Note the tension with HIV/AIDS portability: s. 381.0035(1), F.S. imposes no time limit on the one-time course, while this rule paragraph credits prior training only from the year before employment. The safe course is to obtain the prior certificate and, if it is older than a year, run the two-hour course again inside the six-month window.

Rule 65D-30.0046(2) is short, and its documentation sentence asks for more than a sign-in sheet. Four sentences carry the whole obligation: a qualified professional supervises clinical services within the scope of their qualifications; all licensed and unlicensed staff are supervised by a clinical supervisor; "In the case of medical services, medical staff may provide supervision within the scope of their license," so a physician or APRN performing medical services is supervised through the medical line rather than by a non-medical clinical supervisor; and "The date, duration, and content of supervisory sessions shall be clearly documented for staff in each licensed component and made available for Department review."

Read that documentation sentence carefully. Three fields are mandatory, and content is one of them, so a sign-in sheet without content notes does not satisfy the rule. "In each licensed component" means a staff member working across two components needs documentation for each. Signatures are good practice but are not required by this sentence.

The rule sets no minimum supervision frequency. The only cadence language is that "Supervisors shall conduct regular reviews of work performed by subordinate employees." The practical advice is to set your own minimum in the personnel policies and then meet it, because a standard you wrote is a standard DCF will hold you to. The rule also lists permitted formats: clinical supervision may include supervisory participation in treatment planning meetings, staff meetings, observation of group sessions, and private feedback sessions with personnel. That list is illustrative, not a required menu.

An organizational chart or supervision agreement naming each person's clinical supervisor is sensible evidence, but it is not named in the rule. The document the rule actually requires is the session log.

Everything above applies chapter-wide. One chapter-wide staffing rule sits outside the component tables. Under 65D-30.004(15), a provider that houses males and females together within the same facility must provide separate sleeping arrangements and "must have at least one staff member present at all times," and a provider serving adults in the same facility as persons under 18 must "ensure individual safety with one-on-one supervision, separate bedrooms, and programming according to age." The same one-on-one supervision condition attaches to an admitted seventeen-year-old who turns 18 during treatment and is allowed to stay. These are coverage obligations on top of the awake-paid-staff rules below.

Before the caseload caps mean anything, note the assignment duty they cap. Under 65D-30.0043(3)(a), "A primary counselor shall be assigned to each individual placed in a component," and "This standard does not apply to detoxification and addictions receiving facilities." "Primary Counselor" is defined at 65D-30.002(56) as the provider's staff who has primary responsibility for delivering and coordinating clinical services for specific individuals in treatment, and "Counselor" at 65D-30.002(21) as a member of the clinical staff whose duties primarily consist of counseling, psycho-educational groups, psychosocial assessment and treatment planning. That is who the 50-individual outpatient caps bind.

Each service component then adds its own staffing and credential requirements on top, so a file review that passes the common standards can still fail on component-specific staffing rules.

Every rule number in this table is reachable from the Chapter 65D-30 home page linked in Sources.

Telehealth. If you deliver any service by telehealth, 65D-30.004(20)(a) requires written policies and procedures for it, and the licensure application must carry "detailed procedures outlining the equipment and implementation plan for services" plus written technical policies meeting the HIPAA privacy regulations and, where applicable, the 45 CFR 164.312 safeguards (65D-30.0036(1)(g)). Nothing in the chapter creates a separate telehealth credential or a telehealth-specific training course. The staff-side duty is that providers "must be able meet or exceed the prevailing standard of care" (65D-30.004(20)(b), quoted as printed) and that "All staff shall have a working knowledge of the substance use operating procedures" (65D-30.0036(1)(g)). Note the apparent drafting error at 65D-30.004(20)(a), which points to "subsection 65D-30.003(1)" for a telehealth description that subsection does not contain.

The countersignature rules also vary by component. The screening countersignature at 65D-30.0042(1) covers ten components including intervention but not aftercare or prevention. The psychosocial assessment countersignature at 65D-30.0042(2)(b)3. covers nine, excluding intervention and narrowing medication-assisted treatment to methadone. And the nursing physical screen rule applies only to addictions receiving facilities, detoxification and intensive inpatient: "The screen shall be completed by a L.P.N., R.N., A.P.R.N., or physician's assistant, or physician. When completed by a L.P.N., it shall be countersigned by a R.N., A.P.R.N. physician's assistant, or physician" (65D-30.0042(2)(a)1., quoted as printed).

Accreditation is not optional. For DCF-licensed providers delivering clinical treatment, accreditation is a condition of license renewal. Section 397.403(3), F.S. requires renewal applications to include "proof of application for accreditation for each licensed service component providing clinical treatment by an accrediting organization that is acceptable to the department for the first renewal, and proof of accreditation for any subsequent renewals," excluding inmate programs operated by or under exclusive contract with a jail or the Department of Corrections. Rule 65D-30.003(2)(a) states that accreditation is required for all clinical treatment services and for each location where services are offered, and that accreditation cannot be attained without a Department-issued license, so the sequence is license first. Rule 65D-30.003(2)(b) requires notice to DCF within 10 days of noncompliance with accrediting standards.

Your accreditor's personnel standards are therefore enforceable against you through that route. They are also in manuals that are not public. CARF surveys against the Behavioral Health Standards Manual, and the Joint Commission against the current comprehensive accreditation manual for behavioral health care; neither is published. The public materials both organizations circulate are partial, and CARF's public workbook is written for unaccredited providers participating in an accredited network rather than for a provider seeking its own accreditation, so we do not quote either here. What CARF does publish, and where its personnel standards sit in the 2026 manual, is in our CARF behavioral health personnel file guide. Pull your own current manual, and build one training curriculum as the union of its list and the 65D-30.0046(1)(d) list. Neither accreditor's topic list subsumes the 65D-30 annual list.

Managing entity contracts add their own clocks. Managing entities are the regional nonprofits DCF contracts with to administer its behavioral health funding. Broward Behavioral Health Coalition network providers must "adhere to applicable BBHC Credentialing Program requirements as detailed in the BBHC Credentialing Policy," a separate document incorporated into the contract by reference, and must give written notice within ten calendar days of staffing changes in named leadership roles. Southeast Florida Behavioral Health Network sets the same kind of notice at three calendar days, requires monthly reporting of clinical and therapeutic vacancies exceeding sixty days by the tenth of each month, and creates a genuine personnel-file item of its own: employees complete deaf and hard-of-hearing training, print the certificate, attach it to an Attestation of Understanding, and "maintain them in their personnel file." Both notice clauses close with a catch-all reaching "any individuals with similar functions," so a renamed role does not escape them. Against those, DCF's own clock for a new chief executive officer is 24 hours (65D-30.004(3)(c)). A provider in multiple networks is running three different clocks for one event.

All-employer paperwork. These are not DCF requirements and a licensing specialist will not cite them, but they belong in your onboarding workflow. Form I-9 section 1 must be completed by the employee "at the time of hire," and the employer must complete section 2 "within three business days of the hire," or both at hire where employment will last under three business days (8 CFR 274a.2(b)(1)(i)(A), (b)(1)(ii)(B), (b)(1)(iii)). Copying documents is optional, but "If such a copy or electronic image is made, it must either be retained with the Form I-9 or stored with the employee's records and be retrievable," and selective copying by national origin or citizenship status is a discrimination exposure. Storing I-9s separately from personnel files is standard practice, not law.

Florida adds its own layer: "An employer shall verify each new employee's employment eligibility within 3 business days after the first day that the new employee begins working for pay" and "must retain a copy of the documentation provided and any official verification generated, if applicable, for at least 3 years" (s. 448.095(2)(a), (2)(d), F.S.). A private employer with 25 or more employees must do that verification through E-Verify, not the Form I-9 alone: "Beginning on July 1, 2023, a private employer with 25 or more employees shall use the E-Verify system to verify a new employee's employment eligibility as required under paragraph (a)" (s. 448.095(2)(b)2., F.S.). If E-Verify is unavailable for the full 3 business days, the employer must fall back to the Form I-9 and document the outage (s. 448.095(2)(c)). The Florida duty is written in terms of employees filling permanent positions and does not reach independent contractors.

Where staff have occupational exposure to blood or other potentially infectious materials, the OSHA bloodborne pathogens standard applies to private-sector employers. Hepatitis B vaccination must be made available at no cost "after the employee has received the training required in paragraph (g)(2)(vii)(I) and within 10 working days of initial assignment," and a declining employee must sign the mandatory Appendix A statement. Training runs "At the time of initial assignment to tasks where occupational exposure may take place" and "At least annually thereafter," with annual training "provided within one year of their previous training." Note the file architecture consequence: the medical record must be "Kept confidential" and "Not disclosed or reported without the employee's express written consent to any person within or outside the workplace except as required by this section or as may be required by law," while training records are disclosable to employees and their representatives. The confidentiality bar is qualified, not absolute, so read the exception before you refuse a lawful demand. A single undifferentiated file containing hepatitis B status is still a defect on the face of the standard. Nothing in Chapter 65D-30 requires staff TB testing; the chapter's tuberculosis provisions are about individuals receiving services.

On confidentiality, part 2 programs must have "formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information" (42 CFR 2.16(a)), and vendors that receive patient records need a qualified service organization agreement rather than a personnel file. Where you are a HIPAA covered entity, "A covered entity must document that the training as described in paragraph (b)(2)(i) of this section has been provided" and must document sanctions applied, retained for six years (45 CFR 164.530(b)(2)(ii), (e)(2), (j)(2)). Finally, if you bill federal programs, OIG advises that "providers should check the LEIE prior to employing or contracting with persons and periodically check the LEIE to determine the exclusion status of current employees and contractors," and that screening each month best minimizes liability. OIG says plainly in the same document that providers are not required by statute or regulation to check the list; the exposure is civil monetary penalty liability, and a vendor that tells you monthly screening is legally mandated is overstating it. What the LEIE check involves, which lists sit alongside it and how to document each run are covered in our guide to OIG exclusion screening and the LEIE.

The inspection can happen at any time. Section 397.411(1)(a), F.S. provides that "An authorized agent of the department may conduct announced or unannounced inspections, at any time, of a licensed service provider to determine whether it is in compliance with statutory and regulatory requirements," and s. 397.411(1)(c) makes the license application itself full permission to enter and inspect at any time. For accredited providers, Rule 65D-30.0036(6) sets a three-year licensing inspection cadence and preserves the Department's right to inspect off-cycle where the accreditation report or corrective action plan is not submitted on request, where accreditation is not received or maintained, where a complaint investigation substantiates a licensing violation, or where the Department has concerns about health, safety or welfare. Accredited providers must also submit a copy of the accreditation survey report annually (65D-30.0036(7)). Practically, this means that in most years the person actually opening your personnel files is an accreditation surveyor, with DCF's full inspection arriving on the three-year cycle and at any time in between.

As a practice observation rather than a rule: DCF's published operating procedure, CFOP 155-31, dated September 14, 2006, says results "may be given to the provider during the inspection or no more than 30 working days following the inspection," and that the office informs the provider of compliance issues at the time of the inspection and sets a time period for resolution. That document predates the current rule and still refers to Districts rather than Regions, so use it only to understand why results may not arrive on the day. The operative deadlines are in the current rule, and one of them keys to the receipt date, which is why logging that date matters.

When deficiencies are cited, the Department classifies them by nature and by scope. "The scope shall be cited as isolated, patterned, or widespread. The department shall indicate the classification on the face of the notice of deficiencies" (s. 397.410(2), F.S.), and the classes themselves come from ss. 397.410(2) and 397.411(7), F.S. The fines follow: "A class I violation is subject to an administrative fine of $400 for an isolated deficiency, $600 for a patterned deficiency, and $800 for a widespread deficiency." Class II is $300, $500 and $700; Class III is $200, $400 and $600; and Class IV is a flat $100 whether isolated, patterned or widespread (65D-30.0038(1)(a)-(d)). The rule sets the fine ladder but does not define isolated, patterned or widespread, so there is no rule-stated file-count threshold. What it does mean is that per-file consistency matters more than any single file: one missing certificate is one thing, the same gap across ten files is another, and the multiplier runs up to three times for Class III.

There is real relief for documentation gaps, and a hard clock attached to it. "Administrative fines for Class III and IV violations will not be assessed if the violations are corrected within the time specified in the corrective action plan (CAP). When the violation is not corrected by the date specified in the CAP, the fine shall be assessed" (65D-30.0038(3)). That relief does not extend to Class I or Class II. To get it you must file on time: "The facility must submit a written CAP to the Department within seven calendar days from the date of receipt of the inspection. The CAP must be signed by the executive director or designee of the provider" (65D-30.0038(4)). Seven calendar days, not business days. The plan must identify the violation, the actions to correct each violation, the date by which it will be corrected, and the actions to prevent recurrence. Unless the Department directs or extends a different date, the correction date shall not exceed 30 days from the inspection completion date. A rejected CAP must be amended within five calendar days of the rejection notice, and failing to get an approvable CAP filed within 30 days of the inspection completion date is itself an unclassified violation.

One consequence sits outside the fine ladder entirely: "A license will not be renewed if a licensee has not paid all previously owed fines to the Department" (65D-30.0038(6)). Clear any outstanding balance before you file the renewal.

Unclassified violations carry a per-day fine. Under 65D-30.0038(2), "The amount of the administrative fine shall be $100 for each violation per day, beginning on the day the violation was identified by the Department. (a) Failure to submit required incident reports." Note where the clock starts: at identification, not at the missed deadline, so a late-discovered failure does not bank up months of retroactive penalty. The underlying duty is the 24-hour critical incident reporting requirement at 65D-30.004(17)(b), and four of the enumerated categories are staff-facing: employee arrest, employee misconduct, significant injury to staff, and "Death of an employee or visitor while on the grounds of the facility" (65D-30.004(17)(b)14.d.). The duty is not only to report. Rule 65D-30.004(17)(a) requires written policies and procedures for submitting critical incidents into the Department's statewide designated electronic system, which is a separate, citable document.

Two further consequences are worth putting in front of an executive director. Screening is a precondition of the license itself: "The department may not issue a regular license to any service provider that fails to provide proof that background screening information has been submitted in accordance with chapter 435" (s. 397.4073(1)(h), F.S.). And it is a third-degree felony for any person willfully, knowingly or intentionally to "Operate or attempt to operate as a service provider with personnel who are in noncompliance with the minimum standards contained in this chapter," or to inaccurately disclose or fail to disclose, in any application for licensure or voluntary or paid employment, any fact material to a person's qualifications (s. 397.4075(1) and (2), F.S.). The intent element matters; this is not strict liability for an expired credential. But it does move personnel-file hygiene out of the category of routine paperwork. The two deadlines with the least slack are the ones tied to leadership changes, which carry 24 hours to the regional office, and to onboarding, which stacks several dated deadlines into the first six to twelve months.

Chapter 65D-30 does not set a retention period for personnel records. The seven-year period at 65D-30.0041(2) is expressly for individual clinical records and should not be imported into the staff file. In practice your retention schedule is driven by federal clocks: Form I-9 for three years after the date of hire or one year after termination, whichever is later (8 CFR 274a.2(b)(2)(i)(A)); OSHA bloodborne training records for three years from the date of the training (29 CFR 1910.1030(h)(2)(ii)), and exposure medical records for duration of employment plus 30 years (29 CFR 1910.1030(h)(1)(iv)). That 30-year period runs through 29 CFR 1910.1020, which carries an exception for employees of less than one year whose records are given to them on termination, so check it before relying on a flat 30 years. HIPAA documentation runs for "six years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.530(j)(2)), and the Florida employment eligibility record for at least three years (s. 448.095(2)(d), F.S.). Do not let six years become a default purge date, and note that the HIPAA clock runs from last-in-effect, so a policy in force from 2019 to 2026 is kept until 2032.

Some documents must be segregated, and this is a real compliance point rather than housekeeping. OSHA requires that employee medical records, which include hepatitis B vaccination status and post-exposure evaluation results, be kept confidential and "Not disclosed or reported without the employee's express written consent to any person within or outside the workplace except as required by this section or as may be required by law," while training records must be produced to employees and their representatives on request. Note the closing exception: the bar is qualified, not absolute. A single undifferentiated personnel file holding vaccination status is nonetheless a defect. Screening results carry their own restriction: it is a third-degree felony for any person willfully, knowingly or intentionally to "Use or release any criminal or juvenile information obtained under this chapter for any purpose other than background checks of personnel for employment" (s. 397.4075(3), F.S.). Restrict who inside the organization can see criminal history, and do not circulate it in general HR correspondence. Keeping Forms I-9 in a separate binder is recommended practice, not law, but it is sound: the regulation permits storage with the employee's records, and the reason to segregate is to limit what an inspector sees, not because the rule demands it.

For everything else, organize by due date rather than by document type. The items that quietly lapse are the recurring ones with off-cadence clocks: the five-year rescreen, tracked from whichever of the last screening results date or the hire or contract date falls first; the biennial overdose prevention renewal; the annual two hours of verbal de-escalation; the annual performance appraisal; the CPR card's own expiry; each physician's DEA registration expiry, which 65D-30.0036(2)(a) requires you to renew before it lapses rather than at the next licensure renewal; the one-year certification deadline for a peer specialist or an out-of-state certified qualified professional; the medical director's twice-yearly quality assurance meeting; and the three-year Verification of Qualified Professional(s) resubmission that sits inside an annual renewal. DCF's own background screening FAQ tells providers plainly that "The results from the background screening and the Affidavit of Good Moral Conduct should be maintained in your personnel files," using its own name for the CF 1649 attestation. Take the hint about where these belong, and note the naming mismatch when you build your checklist so nobody goes looking for a form that does not exist under that title.

Two clocks decide whether your license renews on time, and neither one lives in a personnel file.

The first is the filing window. Under 65D-30.0036(1), "Applications for renewal submitted less than 60, but more than 30 calendar days, prior to the expiration of the regular license, will be processed," and "Late fees will be applied to all renewal applications submitted after 60 days." If the application is not received before the license expires, it "will be returned to the applicant, including any fees." The rule states no dollar amount. A separate rule does set one, but for a different trigger: a renewal applicant that misses the Department's application-completeness deadlines "shall be assessed an additional fee equal to the late fee provided for in Section 397.407(3), F.S., $100 per licensed component for each specific location" (65D-30.0037(1)(a)). Confirm the amount that applies to your filing against the current fee schedule on the edition of CF-MH 4024 you are using.

The second clock is money already owed. "A license will not be renewed if a licensee has not paid all previously owed fines to the Department" (65D-30.0038(6)). Clear any outstanding balance before you file.

The renewal application also demands personnel documents that never surface in a routine staff file review, so a provider whose files pass a per-person check can still reach the filing date without them.

1. Competency and ability information for the applicant, chief executive officer, chief financial officers and clinical supervisors, "including education, previous employment history, and list of references" (65D-30.0036(1)(c)). Under (2)(a), "only new applicants or where there is a change in chief executive officer, chief financial officers, or clinical supervisors shall submit this information with the application." Replacing a clinical supervisor or a CFO therefore switches this packet back on.
2. "Confirmation of completion of basic HIV/AIDS education requirements pursuant to Section 381.0035, F.S., for renewal applications" (65D-30.0036(1)(f)). This is an aggregate completion record, not the individual certificates sitting in each file.
3. "The Drug Enforcement Administration registration for all physicians" (65D-30.0036(1)(h)).
4. If you deliver any service by telehealth, "detailed procedures outlining the equipment and implementation plan for services," plus technical written policies that comply with the HIPAA privacy regulations and, where applicable, the technical safeguards at 45 CFR 164.312 (65D-30.0036(1)(g)).

One further duty runs between renewals. "Documents attached to the application, including items listed in paragraphs (1)(a)-(h) that expire during the licensure period shall be renewed by the provider prior to the expiration date" (65D-30.0036(2)(a)). A DEA registration or an insurance certificate that lapses mid-period is not something you fix at the next renewal. All of those documents "shall be made available for review at the provider facility."