Proposed CMS Regulation Enhances Scrutiny on Medicare Providers

CMS is proposing a major expansion of its Medicare enrollment enforcement authority, raising the possibility that billing mistakes, reporting oversights, and inaccurate enrollment records could carry far greater financial and operational consequences.

Published in the Federal Register on July 6, 2026, the provider enrollment provisions appear within the Calendar Year 2027 Home Health Prospective Payment System proposed rule. Despite that placement, the most consequential enrollment changes would extend well beyond home health and apply broadly across Medicare provider and supplier types.

CMS describes the proposal as an effort to remove noncompliant participants, recover improper payments, and protect beneficiaries and taxpayers from fraud, waste, and abuse. The agency estimates that its proposed program integrity changes could produce approximately $82 million in annual government savings.

For providers, suppliers, health plans, agencies, compliance professionals, and organizations serving Medicare clients, the practical concern is not limited to deliberate fraud. The proposal could also raise the stakes for ordinary administrative failures, including late enrollment updates, incomplete documentation, inaccurate ownership information, billing errors, and poorly controlled submissions to Medicare contractors.

Why This Proposal Deserves Industry Attention

Medicare enrollment is sometimes viewed as a credentialing function that sits apart from billing, clinical operations, contracting, and insurance administration. This proposal makes that separation increasingly difficult to maintain.

A provider cannot bill Medicare without active billing privileges. When those privileges are revoked, the consequences can extend into reimbursement, overpayment liability, managed care participation, network relationships, financing arrangements, acquisitions, and the provider’s ability to continue serving Medicare beneficiaries.

The proposed changes would give CMS more discretion when deciding whether an enrollment problem justifies denial or revocation. They would also make many adverse actions retroactive, potentially turning a compliance problem into a demand for repayment covering services already delivered.

“These proposals would give CMS stronger tools to protect Medicare beneficiaries and taxpayer dollars from fraud, waste, and abuse.”

That objective is understandable. Fraudulent providers can harm patients, divert public funds, and create unfair competition for legitimate organizations. The challenge will be ensuring that enforcement tools aimed at intentional abuse do not produce disproportionate outcomes for providers that make correctable administrative mistakes.

Retroactive Revocation Could Create a Much Larger Financial Exposure

One of the most significant proposals involves the effective date of a Medicare enrollment revocation.

Under current rules, many revocations generally take effect 30 days after CMS or a Medicare contractor mails the notice. Certain revocations can already be retroactive, including actions connected to felony convictions, license suspensions, license revocations, and some false enrollment certifications.

CMS is now proposing to make every revocation retroactive to the date associated with the underlying noncompliance or disqualifying conduct. Depending on the reason for the action, that date could precede the revocation notice by weeks, months, or potentially longer.

Consider a provider that fails to report an enrollment change by the applicable deadline. If CMS later revokes the provider’s billing privileges and makes the revocation effective immediately after that missed deadline, payments received after the retroactive date could be treated as overpayments.

The provider would then face two problems at once. It could lose the ability to receive future Medicare payments while also confronting repayment demands for claims previously believed to be valid.

That possibility makes enrollment reporting deadlines more than administrative checkpoints. They may become financial risk dates that require the same monitoring and escalation procedures organizations use for licensing, claims, cybersecurity, and contractual obligations.

Billing Errors Could More Easily Become Enrollment Problems

CMS may currently revoke billing privileges when a provider or supplier demonstrates a pattern or practice of submitting claims that do not meet Medicare requirements. Existing regulations identify factors CMS may consider when evaluating whether the billing conduct is abusive.

The proposal would remove those listed factors. CMS says greater flexibility is needed to evaluate the full range of circumstances that may arise in program integrity cases.

CMS has indicated that a pattern or practice could potentially be established by finding that several claims failed to comply with Medicare requirements. The proposal does not provide a precise numerical threshold or a detailed standard separating routine claims errors from enrollment-level abuse.

That uncertainty matters because Medicare claims can be denied for many reasons, including coding discrepancies, documentation deficiencies, medical necessity determinations, missing signatures, incorrect modifiers, coverage limitations, or conflicting contractor interpretations.

A claims denial does not necessarily establish fraud. Under a broader enforcement framework, however, repeated noncompliant claims could invite scrutiny not only of the claims themselves but also of the organization’s continued eligibility to participate in Medicare.

Providers may need stronger systems for identifying repeated denials, connecting claims trends to enrollment risk, and escalating patterns before they attract regulatory attention.

False or Misleading Information Would Be Defined More Broadly

The proposed rule would also expand CMS’s authority to revoke enrollment based on false or misleading information.

Current regulations focus largely on information certified as true in connection with obtaining or maintaining Medicare enrollment. CMS proposes extending the standard to false or misleading information submitted on or associated with any Medicare enrollment-related form or documentation.

The broader language could cover materials sent to Medicare administrative contractors and information that was not formally certified as true. It would also remove the requirement that the information be submitted specifically for the purpose of gaining or maintaining enrollment.

This makes document control especially important. Information supplied in response to a contractor request, ownership inquiry, revalidation notice, corrective action process, or supporting-document submission could potentially affect enrollment status.

Organizations should not assume that an informal-looking request carries limited consequences. Any enrollment-related response may need to be reviewed for accuracy, consistency, completeness, and alignment with previously submitted records.

The Proposal Adds New Grounds for Denial and Revocation

CMS is not simply revising existing standards. The agency is proposing several new circumstances in which it could deny or revoke Medicare enrollment.

Some provisions would apply broadly, while others would primarily affect home health agencies, hospices, and suppliers of durable medical equipment, prosthetics, orthotics, and supplies.

Geographic Concentration

CMS could revoke a provider or supplier located within a limited geographic area if the area has an excessive concentration of providers or suppliers that CMS believes creates a high risk of fraud, waste, or abuse.

The nearby organizations would not necessarily need to offer the same service. The proposal also does not appear to require CMS to establish that the provider facing revocation personally committed fraud.

This could introduce a new form of location risk. Providers considering an expansion, acquisition, satellite office, or relocation may need to examine not only market demand and competition but also the program integrity profile CMS associates with the surrounding area.

Shared Office Space

CMS proposes allowing enrollment denial when an applicant shares a suite or office with a provider or supplier whose Medicare enrollment has been denied or revoked.

That provision could affect medical office buildings, shared clinical spaces, incubator arrangements, coworking facilities, management-service structures, and providers that sublease space from unrelated organizations.

Before signing a lease, organizations may need greater visibility into who occupies the same suite, how addresses are represented in enrollment records, and whether another occupant has experienced an adverse Medicare action.

Misdemeanor Convictions

CMS could deny or revoke enrollment based on certain federal or state misdemeanor convictions involving sexual assault or financial misconduct within the previous 10 years.

The provision could extend beyond the enrolling entity to certain owners, officers, directors, managing employees, and managing organizations. This reinforces the importance of background reviews and ongoing disclosure procedures for people in leadership and control positions.

Identity and Ownership Concerns

The proposal includes a new denial ground for attempts to enroll under another party’s identity. It also expands enforcement connected to ownership, management, financial relationships, licensing actions, healthcare program terminations, and payment suspensions.

These changes could make organizational charts, ownership disclosures, management contracts, lending relationships, and affiliated entities more relevant to enrollment decisions.

Reapplication Bars Could Follow Any Enrollment Denial

CMS currently has authority to impose a reapplication bar of up to 10 years in certain cases involving false or misleading information submitted with an enrollment application.

Under the proposal, CMS could impose a reapplication bar following an enrollment denial for any reason. That means an organization denied because of an operational, ownership, location, disclosure, or procedural issue could potentially be prohibited from submitting another application for years.

A denial would therefore carry consequences beyond the immediate application. It could affect long-term market entry, expansion plans, acquisition strategies, investor expectations, and the organization’s ability to serve Medicare patients.

Providers preparing new applications should treat the process as a major regulatory event rather than a routine form submission.

Claims Submission Time Could Shrink After Revocation

The proposal would also reduce the period for submitting certain claims after a revocation notice from 60 days to 15 calendar days.

A shorter deadline could create immediate operational pressure. Billing teams may need to identify all unsubmitted claims, verify dates of service, complete documentation, resolve coding questions, and transmit eligible claims within a narrow window.

Organizations without a documented revocation-response procedure could lose reimbursement simply because information does not reach the correct teams quickly enough.

Enrollment notices should therefore be routed immediately to compliance, legal, finance, billing, credentialing, executive leadership, and any outside billing or revenue-cycle partners.

Why Insurance Organizations Should Pay Attention

The direct regulatory burden falls primarily on Medicare providers and suppliers, but the effects can move throughout the insurance ecosystem.

Medicare Advantage organizations and other health plans depend on accurate provider enrollment, credentialing, network records, and claims information. A retroactive revocation may create questions about network status, prior payments, member communications, continuity of care, directory accuracy, and contractual remedies.

Insurance agencies serving healthcare businesses may also see changes in client risk. Compliance failures can produce regulatory investigations, repayment demands, defense expenses, lost revenue, and operational disruption. Those exposures may touch professional liability, directors and officers liability, employment practices, cyber coverage, crime coverage, billing errors, regulatory defense provisions, and other specialized policies.

Carriers underwriting healthcare organizations may need to understand how applicants maintain Medicare enrollment records, monitor reporting deadlines, validate ownership information, audit claims denials, and respond to contractor correspondence.

A provider’s compliance controls may increasingly influence not only its Medicare status but also its broader risk profile.

Practical Steps Providers Can Take Now

The regulation remains proposed, and its requirements may change before a final rule is issued. Even so, the proposal offers a useful roadmap of the areas CMS considers important.

• Audit enrollment records: Compare PECOS data, CMS forms, licenses, addresses, ownership records, and contractor submissions.
• Track reporting deadlines: Assign ownership and escalation procedures for every required enrollment update.
• Review denial patterns: Investigate repeated noncompliant claims before they become an enrollment concern.
• Control contractor responses: Require compliance review before submitting enrollment-related documentation or explanations.
• Examine business relationships: Evaluate owners, managers, lenders, affiliates, landlords, and shared-space arrangements.
• Prepare a response plan: Establish procedures for revocation notices, appeals, claims submission, repayment analysis, and communications.

Providers should also test whether important notices reach the correct people. A revocation letter received at an outdated address or routed to an inactive employee could consume a meaningful portion of a 15-day claims deadline before leadership becomes aware of the problem.

Good Intentions May Not Cure Weak Controls

CMS has indicated that expanded enforcement authority would be used when warranted by the facts and circumstances rather than as a routine response to every mistake. That assurance may provide some comfort, but it does not eliminate uncertainty.

Once regulations grant broad discretion, providers may have difficulty predicting which errors CMS will view as harmless, correctable, misleading, abusive, or serious enough to justify revocation.

“Only qualified providers and suppliers participate in Medicare while preserving access to high-quality care.”

The best protection is not simply proof that an organization meant well. It is a documented compliance system showing that enrollment information is verified, deadlines are monitored, claims problems are investigated, and inaccuracies are corrected promptly.

That distinction will matter if CMS begins evaluating a larger range of conduct without the limiting factors contained in current regulations.

The Appeals Process May Become More Complicated

Expanded discretion could also make enrollment disputes harder to resolve. Providers challenging a denial or revocation generally need to address the factual and regulatory basis identified by CMS or its contractor.

When standards are broad, organizations may have less certainty about what evidence will demonstrate compliance or persuade CMS that revocation is disproportionate.

Retroactive effective dates add another layer of urgency because reimbursement exposure may continue growing while the provider pursues administrative review.

Providers should preserve copies of every enrollment submission, supporting document, delivery confirmation, contractor communication, internal approval, and corrective action. A complete record can become essential when reconstructing what was submitted, when it was submitted, and why the organization believed the information was accurate.

What to Watch Before the Rule Is Finalized

Comments on the proposed rule are due by August 31, 2026. Healthcare organizations and industry groups will likely focus on the breadth of CMS’s discretion, the absence of clear thresholds, the treatment of unintentional mistakes, and the potential financial consequences of universal retroactive revocation.

Stakeholders should watch whether CMS adds safeguards such as materiality standards, corrective-action opportunities, clearer definitions, minimum claims thresholds, intent requirements, or limits on how far a revocation may reach backward.

It will also be important to see whether CMS clarifies how geographic concentration will be measured, how organizations can evaluate shared-location risk, and what relationships qualify as sufficiently connected to support denial or revocation.

Until those questions are answered, providers should assume that Medicare enrollment information will receive greater scrutiny and that errors once treated as administrative may carry operational, financial, and insurance consequences.

A Compliance Issue With Enterprise-Level Consequences

The proposed rule reflects a broader federal shift from recovering improper payments after they occur toward preventing questionable providers and claims from entering the Medicare system in the first place.

That approach can strengthen program integrity, but it also places more responsibility on legitimate organizations to maintain accurate records, investigate billing trends, understand affiliated-party risks, and respond quickly when problems arise.

For Medicare providers, enrollment can no longer be treated as paperwork handled only during initial credentialing or periodic revalidation. It is an ongoing operational obligation tied directly to revenue, regulatory standing, and business continuity.

For agencies and carriers, the proposal creates an opportunity to ask better questions about healthcare clients’ enrollment controls, claims oversight, regulatory response plans, and financial resilience. Those conversations may prove increasingly valuable as CMS moves toward stronger enforcement and potentially more severe consequences for noncompliance.