Medicare Provider And Supplier Enrollment Policy Updates

Effective January 1, 2026, Medicare providers and suppliers will be subject to a swath of new policies related to enrollment with the Centers for Medicare & Medicaid Services (CMS). These new policies were included in the CY 2026 HHA PPS (Home Health Agency Prospective Payment System) final rule, which addresses a host of other policy changes related to DMEPOS suppliers, accrediting organizations, and home health agency matters. Please refer to our recent article on the expansion of the 36-month rule for changes in majority ownership to DMEPOS suppliers, which was also issued in the final rule.

Below we address portions of the CMS final rule, which makes several significant changes to Medicare enrollment and enforcement authority, including:

1. Expanding the reasons for which CMS can apply a retroactive effective date of a revocation.
2. Expanding the reasons for which it can apply a stay of enrollment.
3. Expanding its deactivation authority.
4. Verifying ownership and management information on enrollment applications.
5. Decreasing the time by which adverse legal actions must be reported.
6. Modifying and clarifying reasons it can deny, revoke, or deactivate a provider's or supplier's Medicare enrollment.

The text of the entire final rule can be accessed at this link.

Retroactive Revocations

CMS is changing when a revocation is deemed effective. The effective date of a revocation is currently 30 days after CMS or the CMS contractor mails notice of its determination to the provider; in other words, revocation is forward-looking. With this final rule, that will change depending on the type of deficiency. For example, if a provider submits false or misleading information on its enrollment application, the revocation would be effective on the date the application's certification statement was signed. Or, if a provider fails to timely report a change of ownership or other change of information (including reporting of adverse legal actions, or change, addition or deletion of a practice location), the revocation would be effective on the day after the date such information was supposed to be reported. Commentators observed that in some cases, circumstances outside the enrollee's control may cause them to be untimely in filing a change of information, including delays with state licensure or name changes with the IRS, and a retroactive revocation would be unfair where the enrollee made a good-faith effort to report on time. CMS responded with assurance that revocations are only taken after a thorough examination and deemed truly necessary after consideration of several factors, including how belated the reporting was and the materiality of the information reported. Nonetheless, CMS reiterated that it is and always has been an enrollee's responsibility to timely report changes of information.

Stays of Enrollment

CMS is also revising the reasons for which it can apply a stay of enrollment. A stay of enrollment is used to address non-compliance issues that do not warrant deactivation or revocation. CMS believes that the reasons for which a stay can be utilized should be expanded, such as where a provider fails to furnish complete information (or supporting documentation) on a revalidation or change of information application that is rejected.

Deactivation Authority

In an effort to prevent "unscrupulous parties" from accessing unused billing numbers, CMS is expanding its deactivation authority. Currently, CMS has the discretionary ability to deactivate a provider's Medicare enrollment if the provider has not billed for six consecutive months. Now, CMS is expanding its deactivation policy to providers enrolled via the Form CMS-855O who order, certify, and refer Medicare services and items if they have not been listed as the ordering, certifying, or referring individual on a Part A or B claim received in the previous 12 consecutive months. If deactivated, the provider will be eligible for reinstatement upon the submission of updated information.

Verifying Ownership and Management Information

CMS expressed concern that information reported on enrollment applications may not always be accurate, specifically with respect to ownership and management. Existing regulations require submission of documentation to substantiate several data points on the enrollment application, such as state licenses and the legal business name. CMS is finalizing its proposal to allow CMS to require submission of any other documentation needed to validate data on an enrollment application, including, but not limited to, documentation regarding ownership or management. CMS did not specify what type of documentation it may request, but is planning to instruct Medicare Administrative Contractors on what documentation to request and when.

Reporting Adverse Legal Actions

CMS is reducing the number of calendar days from 90 to 30 by which all providers and suppliers must report adverse legal actions imposed against them, their owners, managing employees or organizations, or corporate directors or officers. Previously, only certain enrollee types, such as DMEPOS suppliers and physicians/physician groups, were required to report within 30 calendar days.

Revocations and Denials

CMS currently has the authority to revoke a provider's enrollment for certain specified reasons to address program integrity vulnerabilities. In this final rule, CMS is using its authority to add new reasons and revise existing ones. For example, prior to this final rule, CMS has the authority to revoke an enrollment if an individual practitioner has a pattern of abusive prescribing. However, this authority is currently limited to the prescribing of Part B or D drugs. In this final rule, CMS is extending the authority to revoke to drugs prescribed under Part A, such as drugs administered as part of a covered inpatient stay in a hospital or skilled nursing facility.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.