More Than a Billing Requirement: CMS Turns Medicare Enrollment into a Program-Integrity Tool

Key Updates

• CMS has proposed a significant expansion of its Medicare provider enrollment and program-integrity authorities through the Calendar Year 2027 Home Health Prospective Payment System proposed rule (HH PPS)¹ and the Calendar Year 2027 Hospital Outpatient Prospective Payment System proposed rule (OPPS).²
• The proposals would significantly expand CMS’s denial and revocation authority for program-integrity risks involving provider ownership and management, criminal and administrative actions, payment suspensions, business and financial relationships and shared locations. The OPPS proposed rule would also codify and implement statutory enrollment and provider-based attestation requirements for certain off-campus hospital outpatient departments.

Why It Matters

• Taken together, the proposals reflect a broader shift in CMS’s approach to Medicare enrollment, treating enrollment information not merely as an administrative prerequisite to billing Medicare but as a program-integrity tool to strengthen the agency’s gatekeeping function and help prevent unqualified or potentially fraudulent individuals and entities from enrolling in and improperly billing Medicare.
• If finalized, enrollment deficiencies historically treated as administrative could carry broader implications for billing privileges, repayment exposure and future participation in Medicare.

Next Steps

• Providers and suppliers should consider reviewing their Medicare enrollment processes now, paying particular attention to enrollment data, enrollment-change reporting procedures, management disclosures, transaction diligence and practice-location compliance. Hospitals should also take inventory of off-campus HOPDs.
• Organizations should coordinate enrollment and revenue-cycle functions with legal, compliance, enrollment, operations and billing personnel.

Proposed Provider Enrollment Changes Applicable to All Medicare Provider and Supplier Types

In the HH PPS, the Centers for Medicare & Medicaid Services (CMS) proposes several changes to 42 C.F.R. Part 424, subpart P, which addresses the requirements providers must meet to obtain and maintain Medicare billing privileges, several of which are discussed below.

1. Retroactive Revocations

CMS is proposing to significantly expand its authority to revoke Medicare enrollments for providers and suppliers that fail to meet program requirements. Currently, certain Medicare enrollment revocations take effect prospectively, 30 days after CMS mails the revocation notice to the affected provider. Under the proposed regulations, CMS would apply all revocation grounds retroactively, generally to the date the underlying conduct, noncompliance or other circumstances giving rise to the revocation first occurred. The proposed retroactive effective dates could apply in circumstances such as:

• Failure to timely report enrollment changes. If a provider fails to timely report required changes in enrollment information, such as the addition of a new managing employee or corporate officer, the revocation would be effective the day after the applicable reporting deadline.
• Billing from a noncompliant location. If a provider bills for items or services from a location that it knew or should have known did not satisfy Medicare enrollment requirements, the revocation could be effective as early as the date of the first claim associated with that location.

The proposal could significantly increase providers’ repayment exposure, as Medicare payments received between the retroactive revocation date and the date the provider receives notice of the revocation may be subject to recoupment. In practical terms, an enrollment defect that goes unnoticed until CMS takes action could create a retrospective period of repayment exposure dating back to the underlying noncompliance. This would allow CMS to recover Medicare payments made during periods of noncompliance and help ensure taxpayer funds are paid only to legitimate providers.

2. Expanded Grounds for Denial and Revocation

Under current law, CMS has the authority to revoke or deny a Medicare provider’s enrollment in certain circumstances to protect the Medicare program and its beneficiaries from potentially fraudulent or abusive activity. CMS is proposing several changes to existing revocation and denial authorities to address program integrity risks and problematic provider conduct. The proposed expansions include:

• Abuse of billing privileges. Eliminating the four factors CMS has historically considered when determining whether a provider has abused its billing privileges, giving CMS greater flexibility and discretion to find a pattern or practice of submitting claims that do not meet Medicare requirements.
• False or misleading information. Expanding the revocation grounds to encompass false or misleading information submitted in connection with any required or requested enrollment-related documentation—not just Form CMS-855—regardless of whether the information was formally certified on an enrollment application.
• Other Medicare enrollments. Authorizing CMS to revoke a provider’s other Medicare enrollments when one enrollment is denied, preventing individuals or entities whose enrollment is denied based on inappropriate conduct from continuing that conduct through other Medicare enrollments.
• Owners, managing employees and other affiliated parties. Expanding existing denial grounds to encompass managing employees, managing organizations and individuals or entities with other business or financial relationships with the provider when those parties: (1) owe Medicare debt; (2) are subject to a Medicare or Medicaid payment suspension; (3) are terminated, suspended or otherwise barred from participation in a state Medicaid program or other federal health care program; (4) have a provider license in another state that is currently revoked or suspended; or (5) have submitted false or misleading information in connection with Medicare enrollment.

Overall, the proposed changes would significantly broaden CMS’s existing revocation and denial authority, giving the agency greater discretion to address program integrity concerns based on a provider’s billing practices, enrollment information, other Medicare enrollments and relationships with owners, managers and other affiliated parties.

3. New Grounds for Revocation and Denial

CMS is proposing additional denial and revocation grounds aimed at strengthening program integrity and addressing high-risk enrollments. The proposed new grounds include:

• High risk enrollment. A new revocation ground when a provider’s enrollment presents a high risk of fraud, waste or abuse based on its location in a limited geographic area with an unusually high concentration of providers, such as when multiple certified providers of the same type operate from a single building. The proposal would give CMS broad discretion to determine what constitutes a high-risk provider enrollment. Notably, this proposal could create enrollment risk based on a provider’s location and the concentration of other providers in the area, even absent separate misconduct by the provider.
• Same practice location. A new denial ground when a provider has its practice location in the same suite or office as another provider whose Medicare enrollment was revoked or denied.
• Misuse of identity. A new denial ground when a provider knowingly sells or allows another individual or entity to use its billing number (except for valid reassignments or changes of ownership).
• Misdemeanor conviction. A new denial and revocation ground when a provider has a federal or state misdemeanor conviction within the last 10 years related to sexual assault or financial misconduct.

By creating these new grounds for denial and revocation, CMS is strengthening its program-integrity toolkit to identify and address known and emerging risks within the Medicare program.

4. Additional Impacts for Providers

CMS is proposing additional changes to further limit possible fraudulent, improper or other non compliant activities by providers. First, CMS proposes to reduce the period for submitting outstanding claims following revocation from 60 days to 15 calendar days from the date of the revocation letter for certain services furnished before the revocation effective date. Thus, providers will need to move quickly to submit outstanding claims for items or services furnished before the revocation effective date.

Second, CMS proposes to expand its authority to impose a reapplication bar of up to 10 years following any denial, not just in limited circumstances. The bar would remain discretionary, and CMS acknowledges that minor deficiencies may not warrant such a sanction. Ultimately, these proposed changes would further require providers to coordinate quickly among enrollment, legal, compliance and revenue-cycle teams upon notice of a revocation or denial.

Special Rules for Hospices, HHAs and DMEPOS Suppliers

Hospices, home health agencies (HHAs) and durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) providers may face additional enrollment scrutiny under the HH PPS. CMS is proposing stronger enforcement of the 36-month change-in-majority-ownership (CIMO) rules. Under the current rules, if a provider undergoes a CIMO within 36 months of its initial enrollment or most recent CIMO, the provider generally must re-enroll in Medicare and undergo a new survey or accreditation, subject to applicable regulatory exceptions. However, CMS has identified efforts to circumvent this rule through providers failing to notify CMS of an ownership change or through the use of interim management agreements (or similar agreements) to effectively transfer operational control of the provider, absent a formal sales agreement, while waiting out the 36-month restriction. To deter efforts to circumvent the 36-month rule, CMS is proposing new revocation and denial grounds for providers that fail to comply with the CIMO re-enrollment requirements. Providers that have historically relied on interim management agreements to bridge the gap will have to carefully evaluate whether this approach remains viable under the more restrictive proposed regulatory framework.

In addition, CMS proposes new hospice-specific denial grounds to address significant program integrity concerns involving hospice operators. Under the proposed rule, CMS could deny a hospice’s enrollment when its medical director or administrator serves multiple hospice locations or practices at locations that are such a distance from the enrolling hospice that they cannot realistically perform all required administrative functions or when the hospice’s medical director lacks an active medical license in the state where the hospice operates.

Off-Campus Hospital Outpatient Departments Face a New Enrollment and Attestation Regime

As discussed in a previous client alert available here, Section 6225 of the Consolidated Appropriations Act, 2026 establishes a new Medicare payment condition for applicable off-campus hospital outpatient departments (HOPDs) beginning Jan. 1, 2028. To continue receiving Medicare payment, the statute requires each affected department to obtain and bill under a separate NPI and requires the main provider to submit provider-based attestations. The CY 2027 OPPS proposed rule would codify and implement these statutory requirements.

This represents a significant change because provider-based attestation historically has not operated as a universal recurring payment condition for all applicable off-campus departments. Pursuant to Section 6225, beginning Jan. 1, 2028, an applicable off-campus HOPD would have to obtain and bill under an NPI separate from the main provider’s NPI. The main provider also would have to satisfy the applicable provider-based attestation requirements. Under the proposed rules, the main provider would be required to submit an initial provider-based attestation for each applicable off-campus department within the two-year period before furnishing services. A subsequent attestation would have to be submitted within a period not exceeding five years thereafter. The statutory framework, as implemented through the proposed rules, would therefore establish an ongoing re-attestation cycle rather than a one-time enrollment event and Medicare payment would be conditioned on compliance.

What Providers Should Do

Providers and suppliers should consider reviewing their Medicare enrollment processes now, with particular attention to:

• Auditing CMS-855 and PECOS data. Confirm legal names, ownership, managing employees and organizations, practice locations, banking and correspondence information, licenses, adverse-action disclosures and other enrollment data.
• Reviewing enrollment-change reporting procedures. Because CMS proposes tying certain retroactive revocations to the date an enrollment change should have been reported, organizations should have reliable processes for identifying reportable events and escalating them to the enrollment team promptly.
• Reevaluating management disclosures. Determine whether clinical leaders—including medical directors, clinical directors, department heads, supervising physicians and nursing directors—satisfy the managing-employee definition and are appropriately disclosed.
• Integrating enrollment diligence into transactions. Transactions involving HHAs, hospices and DMEPOS suppliers should include analysis of the 36-month CIMO rules, while acquisitions more generally should evaluate ownership, management, location and adverse enrollment history. Given the proposed expansion of denial and revocation grounds, diligence also should consider relevant Medicare debts, suspensions, terminations, licensure actions and enrollment history associated with owners, managers and other parties whose conduct could affect the provider’s enrollment.
• Reviewing practice-location compliance. Confirm that every location associated with a Medicare enrollment is operational, accurately reported and satisfies applicable enrollment requirements.
• For hospitals, taking inventory of off-campus HOPDs now. Hospitals should identify potentially affected departments; map each location to its current NPI, CCN and PECOS information; determine whether a separate NPI will be required; and assess the department’s provider-based documentation.
• Coordinating enrollment and revenue-cycle functions. The proposed 15-day post-revocation claims deadline and the payment consequences associated with off-campus HOPD enrollment make rapid communication between legal, compliance, enrollment, operations and billing personnel increasingly important.

The principal compliance lesson is therefore broader than any individual proposed provision. Medicare enrollment data is becoming an increasingly important component of CMS’s program-integrity infrastructure. Providers that historically have treated enrollment primarily as an administrative function should consider whether their governance structures adequately account for the financial and regulatory consequences that could follow from inaccurate, inconsistent or untimely enrollment information, including whether enrollment, legal, compliance, transactional, operational and revenue-cycle functions are appropriately coordinated.

To discuss how these proposed enrollment changes may affect your business and steps you can take to prepare, please contact Stephen Angelette, Mary Tobin, Kathy Schaeffer, Joshua McCann, Adrienne Testa, Mary Canavan, a member of the Licensure, Enrollment & Certification team or your preferred Polsinelli attorney.