What is the FDA Food Code?
The FDA Food Code is a model set of food safety standards. It is not law unless adopted by a state or local authority. Most states use it as a foundation but may customize it.
Restaurant Food Safety Regulations by State
Federal Food Code vs. State Discretion
For restaurant owners, one of the first things to understand about food safety regulations by state is that there is no single national rulebook enforced the same way everywhere. The federal government provides guidance, but states and local jurisdictions decide how those rules become law, how they are enforced, and which agency is responsible for inspections.
At the federal level, the FDA Food Code serves as the main reference point for retail food safety. The FDA updates the Food Code every four years to reflect current science, food-borne illness prevention practices, and operational standards. However, the Food Code itself is not automatically law. It is a model recommendation that states may adopt in full, adopt in part, or modify based on their own regulatory priorities.
The FDA Food Code as a Non-Binding Framework
The FDA Food Code gives states a structured foundation for rules covering -
- Food storage and preparation
- Cooking, cooling, and holding temperatures
- Employee hygiene and illness reporting
- Cleaning, sanitizing, and facility standards
For restaurant owners, this matters because following the federal Food Code alone does not always guarantee compliance. A state may add stricter requirements, delay adoption of newer provisions, or apply certain rules differently through local health departments.
"Adoption in Part" vs. "Adoption in Full"
States usually handle Food Code adoption in different ways -
1. Adoption in Full - The state adopts the FDA Food Code with limited changes. This creates closer alignment with federal recommendations.
2. Adoption in Part - The state adopts some provisions while modifying others. This is where restaurant owners may see differences in temperature rules, employee health requirements, inspection standards, or documentation expectations.
3. Customized State Code - Some states build their own food safety regulations using the FDA Food Code as a reference, but not as the exact legal standard.
For multi-location operators, this is especially important. A policy that works in one state may need to be adjusted in another.
Identifying the Primary Regulatory Authority
Restaurant owners must also know which agency regulates their location. Depending on the state, oversight may come from a Department of Health, Department of Agriculture, county health department, or city agency.
This affects inspections, permits, reporting requirements, and violation procedures. The safest approach is to verify the exact state and local authority for each restaurant location before building food safety SOPs.
Certified Food Protection Manager (CFPM) Mandates
A Certified Food Protection Manager (CFPM) is a core requirement in many states, but how that requirement is applied varies significantly. While the FDA Food Code recommends that every establishment have a certified manager, each state decides how strict that requirement becomes in practice.
For restaurant owners, this is where assumptions can create risk. A setup that is compliant in one state may fall short in another simply due to differences in certification rules, on-site presence requirements, or renewal expectations.
A CFPM is responsible for overseeing critical food safety practices, including -
- Monitoring cooking and holding temperatures
- Preventing cross-contamination
- Enforcing proper handwashing and glove use
- Managing cleaning and sanitation procedures
- Ensuring sick employees are excluded when required
In states with strict enforcement, the absence of a certified manager during an inspection can result in immediate violations - even if all other practices are correct.
State-Level Differences in CFPM Rules
CFPM requirements vary in four key ways, and specific states highlight these differences clearly -
1. Mandatory Certification Requirements
- California requires at least one CFPM per food facility, and most employees must also hold a Food Handler Card.
- Texas requires a CFPM for each establishment, with certification issued through an accredited program and registered with the state.
- In contrast, some states historically allowed more flexibility, though most have moved toward mandatory certification over time.
2. On-Site Presence During Operations
- Florida requires a certified manager but does not always require that person to be physically present during all hours of operation.
- New York City (local jurisdiction) requires a certified Food Protection Certificate holder to be on-site during all hours of operation.
- This distinction matters for shift scheduling and coverage planning.
3. Approved Certification Programs
- Most states accept national ANSI-accredited programs such as ServSafe or Always Food Safe.
- However, Illinois requires training programs to be approved by the state, even if they are nationally recognized.
- Some jurisdictions also require additional local exams or registration after passing a national certification.
4. Renewal and Expiration Cycles
- California typically requires CFPM certification renewal every five years.
- Texas also follows a five-year renewal cycle, but requires maintaining documentation on-site for inspections.
- Some local jurisdictions may require refresher training or additional documentation between renewal periods.
What This Means for Restaurant Owners
CFPM compliance is not just about getting certified - it is about maintaining coverage, documentation, and state-specific alignment. Restaurant owners should -
- Verify state and local certification requirements for each location
- Ensure certified managers are scheduled appropriately
- Track certification expiration dates and renewals
- Keep documentation easily accessible for inspections
For multi-state operators, CFPM compliance should be standardized internally but flexible enough to meet local requirements. Missing coverage during an inspection is one of the most avoidable violations, yet it remains a common issue when operators assume rules are consistent across states.
Elevate Food Safety, Simplify Compliance!
Experience Seamless Food Safety with Altametrics!
Personal Hygiene Standards
Personal hygiene rules are among the most visible - and most frequently cited - areas during health inspections. While the FDA Food Code provides clear guidance on handwashing and preventing bare-hand contact with ready-to-eat foods, states adopt and enforce these rules differently. For restaurant owners, this creates real operational differences in how teams are trained and monitored.
Bare-Hand Contact
One of the biggest variations is whether employees can touch ready-to-eat (RTE) food with bare hands.
- California enforces a strict no bare-hand contact rule for RTE foods. Employees must use gloves, deli tissue, or utensils at all times.
- New York State follows a similar strict approach, especially in urban jurisdictions like New York City, where enforcement is tight and violations are common if gloves are not used.
- Texas, however, allows bare-hand contact if the restaurant implements Alternative Highly Effective
Measures (AHEM). This can include -
- Strict handwashing protocols
- Written policies
- Additional employee training
- Monitoring procedures
For operators, this means a process that is compliant in Texas may be a violation in California.
Handwashing Requirements and Enforcement
Handwashing is universally required, but the specific expectations and enforcement intensity vary.
- Florida requires employees to wash hands before starting work, after handling raw food, after touching their face or body, and after any contamination risk. Inspectors often look for observable compliance during shifts, not just written policy.
- Illinois requires handwashing before putting on gloves, which is a common violation point when employees treat gloves as a substitute for hygiene.
- Washington State emphasizes frequent handwashing tied to specific actions, with strong enforcement around cross-contamination prevention in prep areas.
In practice, inspectors across states commonly check whether employees -
- Wash hands at the correct times
- Use proper technique (soap, duration, drying)
- Avoid substituting gloves for handwashing
Facility and Equipment Requirements
States also differ in what they require at handwashing stations -
- California requires dedicated hand sinks with clear access, proper signage, soap, and single-use towels at all times.
- New York City mandates visible "Employees Must Wash Hands" signage and can cite violations if signage is missing or obstructed.
- Texas requires accessible hand sinks but may allow more flexibility in layout depending on the facility type.
What This Means for Restaurant Owners
Personal hygiene compliance is highly visible and often quickly cited during inspections. Restaurant owners should -
- Train staff based on state-specific rules, not general assumptions
- Standardize glove use if operating across stricter states like California
- Reinforce handwashing as a required action - not a guideline
- Audit hand sink setup, signage, and accessibility regularly
Inconsistent hygiene practices are one of the fastest ways to trigger violations. Clear policies, reinforced training, and active supervision are the most effective ways to stay compliant across different state requirements.
Employee Health and Illness Exclusion Policies
Employee health policies are a critical part of food safety regulations by state, yet they are often misunderstood or inconsistently enforced at the restaurant level. While the FDA Food Code provides a clear framework for excluding or restricting ill employees, states vary in how strictly they apply these rules, what documentation is required, and how violations are handled during inspections.
For restaurant owners, this is not just a compliance issue - it is a direct risk to public health and business operations.
The "24-Hour Rule" and Symptom-Based Exclusion
Most states follow the FDA guideline commonly known as the "24-hour rule", which requires employees to be excluded from work until at least 24 hours after symptoms like vomiting or diarrhea have stopped.
- California enforces this rule strictly and expects managers to actively monitor and document employee illness.
- New York requires exclusion for similar symptoms and places strong emphasis on manager responsibility to prevent ill employees from working.
- Texas also follows the 24-hour standard but allows for return-to-work sooner if medical clearance is provided in certain situations.
Failure to follow this rule is one of the fastest ways to trigger a critical violation during an inspection.
Reporting Requirements for the Big 6 Pathogens
States also require reporting and stricter controls for specific food-borne illnesses, often referred to as the "Big 6," including -
- Norovirus
- Hepatitis A
- Salmonella Typhi
- Shigella
- Shiga toxin-producing E. coli
- Nontyphoidal Salmonella
Washington State requires managers to report confirmed cases of these illnesses to the local health department and restrict employees immediately. Illinois mandates clear procedures for handling reportable illnesses and may require additional documentation during inspections.
These reporting requirements are not optional and can involve coordination with public health authorities.
Written Policies and Employee Agreements
Many states require restaurants to formalize employee health policies -
- California requires employee health reporting agreements, where staff acknowledge their responsibility to report symptoms and diagnoses.
- New York City requires similar documentation and expects it to be available during inspections.
- Florida requires written policies and training but may vary in documentation expectations depending on the county.
Inspectors often ask to see -
- Signed employee health agreements
- Training records
- Written exclusion and return-to-work procedures
What This Means for Restaurant Owners
Employee health policies must be clearly defined, consistently enforced, and properly documented. Restaurant owners should -
- Implement a written illness reporting and exclusion policy
- Train employees on when and how to report symptoms
- Enforce the 24-hour rule or stricter state requirements
- Keep signed agreements and training records accessible
- Designate a manager responsible for monitoring compliance
Allowing a sick employee to work - even unintentionally - can lead to serious violations and potential outbreak liability. Strong policies, consistent enforcement, and proper documentation are essential to staying compliant across different state regulations.
Specialized Processing and HACCP Plan Requirements
Certain food preparation methods go beyond standard cooking and holding practices and trigger additional regulatory oversight at the state level. These processes - such as sous-vide cooking, curing, fermentation, and reduced oxygen packaging (ROP) - introduce higher food safety risks if not properly controlled. As a result, many states require a formal Hazard Analysis Critical Control Point (HACCP) plan before allowing these techniques.
For restaurant owners, this means innovation in the kitchen often comes with added compliance steps, approvals, and documentation requirements.
When a HACCP Plan Is Required
A HACCP plan is a written, process-specific document that identifies potential hazards and defines controls to prevent foodborne illness. States typically require HACCP plans for -
- Sous-vide cooking (reduced oxygen, precise temperature control)
- Curing meats (e.g., house-made bacon or charcuterie)
- Fermentation (e.g., kimchi, kombucha)
- Reduced Oxygen Packaging (ROP), including vacuum sealing
State requirements vary in how strictly these plans are enforced -
- California requires a HACCP plan and an approved variance for processes like sous-vide and ROP. Operators must submit documentation to the local health department before implementation.
- New York State requires a variance for specialized processing and expects detailed HACCP documentation, including monitoring logs and corrective actions.
- Texas also requires HACCP plans for ROP and sous-vide but may allow more flexibility depending on the local health authority's review process.
The Variance Approval Process
In most states, restaurants cannot simply start using specialized techniques. They must apply for a variance, which is official approval to deviate from standard food safety rules.
A typical variance application includes -
- A full HACCP plan
- Step-by-step process descriptions
- Temperature control procedures
- Monitoring and verification methods
- Corrective actions if something goes wrong
Approval timelines and requirements vary by jurisdiction, and operating without an approved variance can result in immediate violations.
Record-Keeping and Documentation Requirements
Once approved, restaurants must maintain ongoing records to demonstrate compliance -
- California requires detailed logs for ROP processes, including time, temperature, and labeling controls.
- Washington State emphasizes strict record-keeping and may review logs during inspections.
- Illinois requires documentation to be available on-site and aligned with the approved HACCP plan.
Inspectors often check whether records are -
- Complete and up to date
- Consistent with actual practices
- Properly stored and accessible
What This Means for Restaurant Owners
Specialized food processes can add value to a menu, but they also increase regulatory responsibility. Restaurant owners should -
- Confirm whether a HACCP plan is required before introducing new techniques
- Apply for variances where necessary
- Train staff on process-specific controls
- Maintain accurate, daily logs and documentation
- Regularly review compliance with approved procedures
Ignoring HACCP requirements is not a minor issue - it can lead to immediate shutdowns in some jurisdictions. The safest approach is to treat specialized processing as a controlled system, not just a culinary decision.
Create, Implement, and Execute Multiple Daily Checklists
Streamline Your Operations with Altametrics
Temperature Control and Time as a Public Health Control (TPHC)
Temperature control is one of the most strictly monitored areas of food safety regulations by state, but even here, states can differ in thresholds, documentation, and enforcement. While the FDA Food Code defines the general "danger zone" and safe holding practices, states may adjust how these rules are applied in real operations.
For restaurant owners, this means temperature compliance is not just about hitting a number - it's about meeting state-specific standards and documentation requirements.
State-Specific Temperature Standards
Most states follow the general FDA guidance -
- Cold holding at 41F (5C) or below
- Hot holding at 135F (57C) or above
However, enforcement and slight variations can still occur -
- California strictly enforces the 41F cold holding requirement and often cites violations quickly if temperatures drift above this threshold, even briefly.
- New York applies similar standards but places strong emphasis on continuous compliance during inspections, not just spot checks.
- Texas follows the same baseline temperatures but may allow limited flexibility during active food preparation if corrective action is immediate.
In practice, inspectors are not just checking temperatures - they are assessing how consistently those temperatures are maintained.
Time as a Public Health Control (TPHC)
Some states allow restaurants to use time instead of temperature to control food safety for certain foods. This is known as Time as a Public Health Control (TPHC).
- Florida allows TPHC but requires strict documentation, including -
1. Written procedures
2. Time tracking for when food is removed from temperature control
3. Discard times clearly labeled
- California also allows TPHC but requires prior approval and documented procedures.
- Washington State enforces clear labeling and tracking requirements and may review logs during inspections.
Without proper documentation, using time instead of temperature is considered a violation.
Thermometer Calibration and Monitoring
Another area where states differ is how often temperature-measuring devices must be checked and calibrated -
- Illinois expects thermometers to be accurate and calibrated regularly, especially in high-volume kitchens.
- Texas requires thermometers to be available and functional but may not specify a strict calibration schedule at the state level.
- California inspectors often verify both the presence and accuracy of thermometers during inspections.
Operators are expected to -
- Use calibrated food thermometers
- Monitor both internal food temperatures and ambient equipment temperatures
- Correct issues immediately when readings fall outside safe ranges
What This Means for Restaurant Owners
Temperature control violations are among the most common and most preventable. Restaurant owners should -
- Train staff on exact state-required temperature thresholds
- Implement routine temperature checks throughout each shift
- Use calibrated thermometers and document calibration where required
- Establish clear procedures if temperatures fall out of range
- Only use TPHC when properly approved and documented
Temperature control is not just a technical requirement - it is a daily discipline. Consistency, documentation, and quick corrective action are what separate compliant operations from those that repeatedly fail inspections.
Inspection Frequency and Public Grading Systems
How often your restaurant is inspected - and how those results are shared with the public - varies significantly under food safety regulations by state. While the FDA Food Code recommends a risk-based inspection model, each state (and often each local jurisdiction) determines inspection frequency, scoring systems, and public disclosure requirements.
For restaurant owners, this directly impacts operational pressure, reputation, and guest trust.
Risk-Based Inspection Scheduling
Most states use a risk-based system to determine how frequently a restaurant is inspected. Establishments are categorized based on factors like menu complexity, food handling processes, and volume.
- California uses a risk-based model where high-risk operations (e.g., full-service restaurants handling raw proteins) are typically inspected two to three times per year, while lower-risk operations may be inspected less frequently.
- Texas also follows a risk-based approach, but inspection frequency is often determined at the county level, leading to variation between jurisdictions.
- Florida conducts regular inspections through the Division of Hotels and Restaurants, with frequency influenced by risk level and compliance history.
A history of violations can increase inspection frequency, meaning poor performance leads to more oversight.
Grading Systems - How Results Are Communicated
States and cities differ in how inspection results are scored and shared with the public -
- New York City uses a letter grading system (A, B, C) that must be posted prominently at the entrance. This has a direct impact on customer perception and traffic.
- Los Angeles County (California) uses a numerical score (0-100) paired with a letter grade, also displayed publicly.
- Texas commonly uses numerical scoring systems, but public posting requirements vary by county.
- Some states use a Pass/Fail system, where details are only visible in inspection reports rather than posted signage.
For restaurant owners, grading systems turn inspections into a public-facing performance metric, not just a compliance checkpoint.
Online Disclosure and Transparency
Many states and local jurisdictions now require inspection results to be publicly accessible online -
- California counties often publish inspection reports on local health department websites.
- New York City provides detailed inspection histories online, including violations and corrective actions.
- Florida allows consumers to search inspection results through state-managed databases.
This means customers can review past violations before deciding where to eat.
What This Means for Restaurant Owners
Inspections are no longer just internal events - they directly influence your brand. Restaurant owners should -
- Understand how often inspections occur based on their risk category
- Train teams to maintain compliance daily, not just before inspections
- Monitor inspection scores and address violations immediately
- Prepare for public visibility of results, both in-store and online
In many markets, your inspection grade is part of your marketing whether you like it or not. Strong, consistent food safety performance protects not only compliance - but also customer trust and revenue.
Navigating Local vs. State Jurisdictions
Even when restaurant owners understand state-level food safety rules, another layer can create confusion- local jurisdiction authority. In many states, cities and counties have the power to adopt and enforce their own regulations, sometimes going beyond state requirements. This is often referred to as "home rule."
For restaurant owners, this means compliance is not always defined at the state level alone. Local ordinances, health departments, and enforcement practices can override or expand state rules.
Understanding "Home Rule" States
In home rule states, local governments can establish their own food safety standards, inspection processes, and enforcement policies.
- Illinois is a strong example. While the state provides a regulatory framework, the City of Chicago has its own health department with specific rules, inspection systems, and enforcement procedures that differ from other parts of the state.
- California operates with significant local control, where county health departments (e.g., Los Angeles County vs. Orange County) may differ in inspection frequency, documentation expectations, and enforcement intensity.
- Texas also allows local jurisdictions to influence enforcement, meaning requirements can vary between cities even within the same state.
For operators, this creates a critical reality -
- Two restaurants in the same state may be regulated differently depending on their city or county.
Overlapping Jurisdictions and Enforcement
Some restaurants may fall under multiple layers of oversight -
- State-level agencies
- County health departments
- City health departments
This can affect -
- Inspection scheduling
- Permit approvals
- Violation handling and appeals
- Documentation and reporting requirements
For example, a restaurant in Chicago must comply with both Illinois state rules and Chicago-specific regulations, including local inspection scoring and enforcement processes.
Permits, Fees, and Administrative Processes
Local jurisdictions often control -
- Permit applications and renewals
- Fee structures, which can vary widely by location
- Administrative hearings for violations and penalties
- New York City requires specific permits issued by the city health department, separate from broader state oversight.
- California counties may have different fee schedules and renewal timelines depending on location.
Failing to manage these local requirements can lead to delays, fines, or even temporary closures.
Staying Updated on Regulatory Changes
Because rules can change at both the state and local level, staying informed is critical.
Restaurant owners should -
- Monitor updates from local health departments
- Join state restaurant associations for regulatory alerts
- Review inspection feedback regularly for changes in enforcement trends
- Assign responsibility to a manager for compliance tracking
What This Means for Restaurant Owners
Navigating local vs. state jurisdictions requires a structured approach. Restaurant owners should -
- Identify all applicable regulatory bodies for each location
- Align SOPs with the strictest applicable standard
- Track permits, fees, and renewal deadlines by jurisdiction
- Prepare for differences in inspections and enforcement
Ignoring local rules is one of the most common compliance gaps. The most effective operators treat each location as its own regulatory environment, even when operating under the same brand.