After years of working inside 245D and HCBS programs, we keep running into the same handful of gaps. None of them are exotic. Most come down to a program that grew faster than its record-keeping did, and a compliance process that lives in one person's head instead of a system everyone can rely on.
Minnesota DHS paused new 245D licenses starting January 1, 2026, after identifying widespread fraud and billing irregularities across Medicaid-funded programs. That kind of scrutiny rarely stays contained to new applicants. Existing license holders are already seeing closer file reviews and less patience for gaps that used to draw a warning.
Here are the ten risks we see most often, and what tends to fix them for good.
Service notes that don't match the authorization
A note describes an activity that goes beyond, or falls short of, what a person's authorization actually allows. Reviewers cross-reference notes against the coordinated service and support plan and the authorization on file, and a mismatch reads as an unauthorized service or a billing problem. It's one of the fastest ways a routine file review turns into a bigger conversation. A monthly check comparing a sample of notes against authorizations catches this before a surveyor does.
Incident reports that miss the 24-hour window
245D requires notifying a person's legal representative or emergency contact, along with their case manager, within 24 hours of an incident. Late notifications, or notifications with no clear record of when they happened, get flagged almost every time. The fix is building the notification step directly into the incident workflow, so it happens as part of the process rather than something a staff member has to remember after the fact.
Required policies that haven't been touched since licensing
245D requires specific policies at the time of application: drug and alcohol prohibition, vulnerable adult maltreatment reporting, maltreatment of minors reporting, emergency use of manual restraint, grievances, service suspension and termination, and universal precautions. Many programs write these once and never revisit them, even as DHS guidance shifts. Putting an annual review on the calendar, tied to a specific person's job description, keeps this from slipping.
Internal reviews that don't ask the right questions
After an incident, 245D requires an internal review that evaluates whether policies were followed, whether those policies were adequate, whether staff need more training, whether the event matches a past pattern, and whether corrective action is needed. Programs often document that a review happened without actually answering those five questions on paper. A review template that forces each question onto the page closes this gap.
Corrective action plans that exist on paper only
A corrective action plan has to be implemented within 30 days of the internal review being completed. Reviewers ask for evidence, not just the plan itself. Attaching a deadline and a named owner to every line item is the difference between a plan that gets carried out and one that gets filed away.
Support plans that don't keep up with a person's changing needs
When someone's needs shift, their coordinated service and support plan addendum needs to shift with them. Stale plans are one of the more common findings, because the disconnect only shows up when a reviewer reads a file closely enough to notice the plan describes a person who no longer quite matches it.
Training records that show attendance, not competency
A sign-in sheet proves someone was in the room. It doesn't prove they can perform the skill. Reviewers are increasingly asking for evidence of competency, not just a record of who showed up to a training session.
Records that live in different places depending on who you ask
When services are provided in a licensed facility, records need to be maintained at that facility. Otherwise, they belong at the program office. Multi-site programs often give inconsistent answers about where a specific file actually lives, which turns a simple record request into a scramble during a review.
Missing documentation of legal authority
Power of attorney, guardianship, or conservatorship documentation is supposed to be in the service recipient's record. It's an easy detail to overlook, and it's specifically called out in Minnesota's record requirements, which makes it a common and avoidable finding.
Signature and date gaps
Notes signed days after a service was delivered, or dated in a way that doesn't line up with when the entry was actually made, raise questions about accuracy even when the underlying care was fine. Same-day documentation habits solve this before it becomes a pattern a reviewer notices.
What this adds up to
Individually, none of these risks are catastrophic. Together, they're what turns a routine license review into a corrective action plan, or a corrective action plan into a longer conversation with DHS. The providers who stay ahead of this aren't the ones with the most staff. They're the ones with a documentation system built so gaps surface before a reviewer finds them, not after.