CMS Turns Up The Heat With Sweeping New Enrollment Enforcement Tools In HH PPS Proposed Rule

Overview

The calendar year (CY) 2027 Home Health Prospective Payment System (HH PPS) proposed rule continues the Centers for Medicare & Medicaid Services’ (CMS’s) trend of pairing payment updates with increasingly aggressive and wide-sweeping Medicare program-integrity initiatives. The proposed rule includes significant provider and supplier enrollment proposals that would expand CMS’s authority to deny and revoke Medicare enrollments. The proposed rule was published in the Federal Register on July 6, 2026, and comments are due by 5:00 pm EDT on August 31, 2026. If you have questions about the proposed rule or would like assistance preparing and submitting comments to CMS, please contact a member of the McDermott Will & Schulte team.

Snapshot

CMS 2027 proposed rule: At-a-glance snapshot

Major changes. Broad impact. Know what matters to you.

Key proposed changes: Your quick map

Part 1

I. New grounds for revocations and denials of enrollment

The proposed rule would substantially strengthen and expand CMS’s provider enrollment enforcement toolkit through a series of proposed amendments to the Medicare enrollment regulations at 42 CFR § 424, including CMS’s denial and revocation authorities. CMS views the Medicare enrollment process as a critical program-integrity “gatekeeper” designed to ensure that only qualified providers and suppliers participate in Medicare and receive Medicare reimbursement.

Why it matters: For providers and suppliers, the proposed rule would significantly increase the compliance consequences associated with enrollment-related conduct and operational deficiencies, while for private equity sponsors and other investors, the proposed changes underscore the growing importance of enrollment diligence, governance, ownership oversight, and ongoing regulatory compliance as key components of transaction and platform risk management.

A. Expansion of existing revocation authorities

Abuse of billing privileges (42 CFR § 424.535(a)(8)(ii)). Although CMS already has authority to revoke a provider or supplier’s Medicare enrollment for a pattern or practice of submitting claims that fail to meet Medicare requirements, the proposed rule would make that authority considerably easier for CMS to implement. CMS proposes to eliminate the existing factors in § 424.535(a)(8)(ii)(A) – (D) that guide its abuse-of-billing analysis (including claim denial rates, prior adverse actions, and the nature of the billing noncompliance) on the grounds that those factors constrain CMS’s ability to address abusive billing behavior. CMS contends that these factors may inappropriately weigh against revocation where providers lack a history of adverse actions or maintain relatively low claim-denial rates despite engaging in recurring noncompliant billing. Importantly, CMS does not propose to eliminate the underlying requirement that a provider have a pattern or practice of submitting claims that fail to meet Medicare requirements. Rather, CMS proposes to remove the regulatory factors that currently guide that determination and retain broader discretion to assess whether a particular course of conduct constitutes abusive billing based on the facts and circumstances presented. CMS seeks broader discretion to determine when a pattern of noncompliant claims warrants revocation, even where a provider has no adverse enrollment history or only a small percentage of denied claims. CMS states that, depending on the facts and circumstances, a pattern or practice could potentially be established based on a finding that several claims failed to satisfy Medicare requirements, and emphasizes that it does not intend to create a minimum threshold for revocation or invoke the authority as a matter of course.

Why it matters: If finalized, the proposal could substantially expand CMS’s discretion in applying the abuse-of-billing revocation authority by eliminating the regulatory factors that currently guide the agency’s analysis, thereby making it easier for CMS to pursue revocation based on recurring billing deficiencies and heightening the importance of proactive claims auditing, revenue-cycle oversight, and billing compliance programs for providers, suppliers, and their investors.

False or misleading information (42 CFR § 424.535(a)(4)). The proposed rule would significantly expand CMS’s existing authority to revoke Medicare enrollment based on false or misleading information. Under the proposal, CMS would no longer limit this revocation authority to false information certified as “true” on a Medicare enrollment application submitted to obtain or maintain enrollment, such as a Form CMS-855 or Form CMS-20134 enrollment application. Instead, if finalized, CMS could revoke a provider or supplier based on false or misleading information contained in, or submitted in connection with, any CMS or Medicare enrollment-related form or supporting documentation, including materials furnished to CMS contractors. The proposed rule specifically identifies documents such as Form CMS-588 electronic funds transfer (EFT) authorizations, home health agency capitalization documentation, opt-out affidavits, and records submitted to substantiate authorized or delegated official status as falling within the expanded provision’s scope, but this list is not exhaustive. CMS explains that inaccurate information submitted through these materials may result in noncompliant providers being improperly enrolled in Medicare and may call into question a provider’s overall reliability and trustworthiness. CMS also proposes to eliminate the requirement that the information be submitted for the purpose of obtaining or maintaining Medicare enrollment, reasoning that the integrity of all enrollment-related information is critical to program administration. Accordingly, the proposal would apply regardless of whether the submission relates to an initial enrollment, revalidation, reactivation, voluntary termination, EFT update, or another enrollment-related transaction.

Why it matters: If finalized, the proposal would materially expand CMS’s discretion to pursue revocation actions based on inaccurate enrollment-related submissions. This proposal underscores the importance of robust internal controls, document review procedures, and governance processes surrounding all communications with CMS and its contractors, not merely formal enrollment applications. The proposal also would place increased responsibility on providers, suppliers, and their personnel to ensure that enrollment-related forms and supporting documentation are accurate when submitted, as inaccuracies in documents that historically may have received less scrutiny could now carry significantly greater enrollment consequences.

Extension of revocation (42 CFR § 424.535(i)). The proposed rule would expand CMS’s revocation authority by permitting CMS to revoke a provider or supplier’s other Medicare enrollments not only when one enrollment is revoked, but also when a separate enrollment application submitted by the same provider or supplier is denied under 42 CFR § 424.530(a). CMS views certain denial scenarios (such as applications involving false or misleading information or nonoperational locations) as reflecting on the provider or supplier as a whole rather than solely on the particular enrollment application at issue. Accordingly, CMS proposes to take action against the provider’s broader portfolio of Medicare enrollments where a denial demonstrates conduct that raises program integrity concerns in CMS’s view. CMS explains that, under the current framework, a provider whose new enrollment application is denied for serious compliance issues may nevertheless retain other existing Medicare enrollments, allowing the provider to continue participating in the program despite conduct that CMS believes calls into question the provider’s overall trustworthiness.

Why it matters: Although application of the authority would remain discretionary, and a denial would not automatically result in revocation of the provider’s existing enrollments, the proposal would increase the potential enterprise-wide consequences of enrollment deficiencies and could be particularly significant for entities that maintain many Medicare enrollments under common ownership or control. Further, denials for nonoperational status are often due to errors made by CMS contractors that are successfully appealed but, under the proposed rule, could put the provider’s other enrollments at risk. Unlike CMS’s proposed affiliation-related changes, this authority is directed at a provider’s own portfolio of Medicare enrollments rather than relationships among affiliated providers, suppliers, owners, or management personnel.

Claim submissions after revocation (42 CFR § 424.535(h)). CMS proposes to amend the post-revocation claims submission requirements by significantly reducing the amount of time that revoked providers and suppliers have to submit Medicare claims for items and services furnished before a revocation became effective. Currently, most revoked providers and suppliers must submit such claims within 60 calendar days of the revocation effective date, while home health agencies operate under a separate rule tied to the conclusion of the agency’s final payable episode of care. CMS proposes to shorten the filing window from 60 days to 15 days and, because many revocation authorities are proposed to carry retroactive effective dates, to measure the 15-day period from the date of the revocation notice letter rather than the revocation effective date. CMS states that revoked providers represent an elevated program-integrity risk and that reducing the claims-submission window will limit opportunities for fraudulent, improper, or otherwise noncompliant billing after revocation.

Why it matters: If finalized, the proposal would place additional pressure on providers, suppliers, and their billing vendors to quickly identify revocation actions, reconcile outstanding claims, and submit all permissible claims within a substantially compressed timeframe. Providers operating multiple Medicare enrollments may also need enhanced coordination among enrollment, compliance, and revenue-cycle personnel to ensure timely claims submission following a revocation action.

B. New revocation authorities

High-risk enrollments (proposed 42 CFR § 424.535(a)(24)). CMS proposes a new revocation authority that would permit revocation where CMS determines that a provider or supplier’s enrollment presents a high risk of fraud, waste, or abuse because the provider or supplier operates within a limited geographic area containing what CMS considers an excessive number of providers or suppliers. CMS cites examples involving numerous home health agencies and hospices operating from the same building, suite, or concentrated neighborhood and explains that such clustering may indicate elevated program-integrity concerns. CMS would not be required to establish actual fraud, waste, or abuse before revoking, and proposes not to adopt specific numerical thresholds, geographic limits, or mandatory evaluation factors. Instead, CMS seeks broad discretion to assess each situation based on its particular facts and perceived level of risk.

Why it matters: While CMS emphasizes that it does not intend to target legitimate providers solely because they operate in close proximity to others, the proposal would create additional scrutiny for providers and suppliers operating in densely concentrated markets or shared facilities, particularly in sectors that CMS views as vulnerable to fraud and abuse. Because the proposal relies heavily on CMS’s assessment of risk and does not establish objective geographic or numerical thresholds, it may also increase the likelihood of provider challenges, rebuttals, and appeals concerning whether a particular concentration of providers justifies enrollment action in a given case.

Certain misdemeanor convictions (proposed 42 CFR § 424.535(a)(16)). CMS also proposes to establish a new revocation ground for providers and suppliers who have been convicted, or whose owners, managing employees, officers, directors, or managing organizations have been convicted, within the preceding 10 years of a federal or state misdemeanor involving sexual assault or financial misconduct that CMS determines is detrimental to the best interests of the Medicare program or its beneficiaries. CMS explains that the proposal is intended to address conduct that may endanger beneficiaries or threaten the Medicare Trust Funds, and is substantially narrower than a broader misdemeanor-conviction proposal the agency considered in the CY 2024 Physician Fee Schedule proposed rule (88 Fed. Reg. 52,262 (Aug. 7, 2023)) but ultimately did not finalize after receiving stakeholder comments, as discussed in the CY 2024 Physician Fee Schedule final rule (88 Fed. Reg. 78,818 (Nov. 16, 2023)).

Why it matters: Although the proposal targets only certain categories of misdemeanor offenses, it would expand the types of criminal history that may affect Medicare enrollment. The proposal reinforce the need for diligence (both in the context of potential transactions and internally) regarding the backgrounds of key owners and management personnel, particularly in connection with acquisitions, platform investments, and other ownership transactions where the implicated personnel disclosed on enrollments may trigger this new authority.

C. Expansion of existing denial authorities

Debt (42 CFR § 424.530(a)(6)). CMS proposes to broaden its Medicare debt-based denial authority, which currently permits denial if the enrolling provider or owner has an existing Medicare debt or was previously the owner of a provider that had a Medicare debt when the latter provider’s enrollment was voluntarily terminated, involuntarily terminated, or revoked. The proposal would extend the provision beyond the enrolling provider and its owners to include managing employees, managing organizations, and individuals or entities that maintain a business or financial relationship with the provider. CMS explains that individuals other than owners often exercise significant influence over provider operations and may play a central role in the accumulation of Medicare debt or efforts to avoid repayment through new organizational structures. The proposal therefore reflects CMS’s growing focus on the substance of a party’s involvement with a provider rather than the formal label attached to that relationship.

Why it matters: If finalized, the proposal could increase diligence obligations with respect to management companies, affiliated organizations, and other parties that may have historical ties to providers with outstanding Medicare liabilities.

Payment suspension (42 CFR § 424.530(a)(7)). CMS similarly proposes to expand its payment suspension denial authority, whereby CMS may deny enrollment if the provider or any owning or managing employee or organization is under a Medicare or Medicaid payment suspension, to encompass individuals and entities having a business or financial relationship with the provider, rather than limiting the denial authority only to the provider and its owners or managers. Although CMS does not define the phrase “business or financial relationship” in the proposed rule, the agency explains that parties subject to payment suspensions may continue to influence provider operations through relationships other than formal ownership or management roles. CMS expresses concern that parties subject to Medicare or Medicaid payment suspensions may attempt to avoid the provision by restructuring ownership or management roles while continuing to influence provider operations. Accordingly, CMS proposes to focus more broadly on the existence of the relationship itself rather than the particular title or organizational role held by the individual or entity.

Why it matters: The proposal would give CMS additional flexibility to deny enrollment where suspended individuals or organizations remain connected to a provider through alternative business arrangements.

Program terminations and licensure actions (42 CFR § 424.530(a)(14)). CMS proposes two notable revisions to its ability to deny enrollment if the provider is currently terminated or suspended from participation in state or federal healthcare programs or the provider’s license is currently revoked or suspended in a state other than the state where the provider is enrolling. First, CMS would broaden the provision to include the provider’s owners, managing employees, and managing organizations. Second, the agency would extend the denial authority to licenses voluntarily surrendered in lieu of disciplinary action. CMS reasons that voluntary surrenders often reflect the same underlying concerns as suspensions or revocations and therefore present comparable risks to Medicare beneficiaries and the Medicare Trust Funds.

Why it matters: Together, these changes would further expand CMS’s ability to look beyond the enrolling entity itself and evaluate the compliance histories of the individuals and organizations involved in its operations.

False or misleading information (42 CFR § 424.530(a)(4)). Consistent with CMS’s proposed changes to the corresponding revocation authority in 42 CFR § 424.535(a)(4), CMS proposes to expand its enrollment denial authority to encompass false or misleading information submitted on or in connection with any CMS or Medicare enrollment-related form or supporting documentation.

Why it matters: The proposal would substantially broaden the universe of documents capable of supporting an enrollment denial and reinforces CMS’s expectation that all enrollment-related submissions – not merely formal enrollment applications – be complete and accurate.

D. New enrollment denial authorities

Misdemeanor convictions (proposed 42 CFR § 424.530(a)(16)). CMS proposes a new denial authority that would largely mirror proposed 42 CFR § 424.535(a)(16). Under the proposal, CMS could deny enrollment where the provider, supplier, owner, managing employee, managing organization, officer, or director has been convicted within the preceding 10 years of a federal or state misdemeanor involving sexual assault or financial misconduct that CMS determines is detrimental to the Medicare program or its beneficiaries. CMS also proposes to revise the definition of “final adverse action” in 42 CFR § 424.502 to include these misdemeanor convictions.

Why it matters: Although narrower than a similar proposal CMS considered in prior rulemaking, the proposal would further expand the types of criminal history that may affect Medicare enrollment and underscores the importance of diligence related to key owners and management personnel.

Revocation or denial in the same suite or office (proposed 42 CFR § 424.530(a)(19)). CMS proposes a new denial authority that would allow denial where an enrolling provider’s practice location is located in the same suite or office as a provider whose Medicare enrollment has been denied or revoked. CMS explains that shared locations have, in some instances, been associated with broader fraud schemes involving multiple related providers operating from the same office space. However, CMS emphasizes that sharing a suite or office, by itself, would not automatically result in a denial. CMS indicates that it would evaluate the particular facts and circumstances of the arrangement and would invoke the authority only where the shared location raises program-integrity concerns sufficient to justify denial.

Why it matters: While CMS emphasizes that the proposal is not intended to affect ordinary group-practice arrangements or automatically disqualify providers operating in shared facilities, the authority would provide CMS with another mechanism to scrutinize concentrated provider arrangements that it believes present heightened program-integrity risks.

Hospice Medical directors and administrators (proposed 42 CFR § 424.530(a)(20)). CMS proposes a new hospice-specific denial authority reflecting the agency’s continued concern regarding hospice fraud, governance, and operational oversight. Under the proposed rule, CMS may deny enrollment where a hospice’s medical director or administrator serves in comparable roles for multiple hospices or is located at such a distance from the hospice that CMS believes the individual cannot realistically perform required duties, or where the hospice medical director lacks an active physician license in the applicable state.

Why it matters: The proposal is noteworthy because it focuses not on ownership or billing conduct, but on leadership structure and operational oversight. CMS appears increasingly concerned that certain hospice leadership arrangements may indicate insufficient supervision, inadequate quality controls, or broader program-integrity concerns. As a result, hospice operators and investors may face greater scrutiny of staffing models, multi-facility leadership arrangements, and corporate governance structures when pursuing enrollment or acquisition activities.

Misuse of identity (proposed 42 CFR § 424.530(a)(21)). CMS also proposes a new denial authority allowing denial where a prospective provider or supplier attempts to enroll under another individual or entity’s identity. CMS cites recent instances involving stolen credentials, compromised identifiers, and fraudulent enrollment activity conducted without the knowledge of the affected physician or practitioner.

Why it matters: The proposal would give CMS an explicit enrollment-denial mechanism to address identity-based enrollment fraud and reflects the agency’s broader efforts to strengthen front-end enrollment screening and verification processes.

E. New change in ownership revocation and enrollment denial authorities (proposed 42 CFR §§ 424.530(a)(22) and 424.535(a)(25))

CMS proposes new enrollment denial and revocation authorities designed to strengthen enforcement of the Medicare “36-month rule” applicable to home health agencies; hospices; and durable medical equipment, prosthetic devices, prosthetics, orthotics, and supplies (DMEPOS) suppliers. Under 42 CFR § 424.550(b) (home health agencies and hospices) and 42 CFR § 424.551 (DMEPOS suppliers), a provider that undergoes a change in majority ownership (CIMO) within 36 months of its initial Medicare enrollment (or within 36 months of a prior CIMO) generally must enroll as a new provider, undergo a new state survey or accreditation process, and, in the case of home health agencies and hospices, receive a new provider agreement unless a regulatory exception applies. CMS explains that these requirements are intended both to permit comprehensive screening of new owners and to prevent “flipping” transactions in which a provider is enrolled and then rapidly sold in order to avoid the enrollment, survey, and accreditation processes applicable to new entrants.

According to CMS, the agency continues to encounter efforts to circumvent these requirements. CMS specifically cites situations in which ownership changes are not disclosed to Medicare and arrangements in which management agreements effectively transfer operational control of a provider before a later ownership transfer occurs once the 36-month period expires. More broadly, CMS appears concerned with arrangements that transfer practical control, operational authority, or the economic benefits of ownership before a formal CIMO occurs. As a result, transaction structures that rely on management agreements, transition services agreements, consulting arrangements, or similar mechanisms to bridge the period until the 36-month window expires may face increased scrutiny if CMS believes those arrangements effectively function as an early transfer of ownership or control. CMS views these arrangements as undermining the core purpose of the 36-month rule by allowing new owners to obtain control of Medicare-participating entities without undergoing the level of scrutiny CMS believes is necessary to protect beneficiaries and the Medicare Trust Funds. The proposal therefore suggests that CMS may focus less on the label attached to a particular agreement and more on the practical reality of who is directing, managing, and benefiting from the provider’s operations during the applicable 36-month period.

To address these concerns, CMS proposes new denial and revocation authorities that would permit CMS to deny or revoke enrollment where a home health agency, hospice, or DMEPOS supplier fails to comply with the applicable CIMO requirements. CMS also proposes a corresponding revocation effective-date provision under which the revocation would become effective on the date CMS or its contractor determines that the provider’s enrollment should be revoked.

Why it matters: From a transactional perspective, this proposal may be among the most significant enrollment changes in the proposed rule. The new authorities would give CMS an express mechanism to challenge ownership and control arrangements that it believes are structured to avoid the 36-month rule, including certain management, operational, and pre-closing governance arrangements. As a result, home health agency, hospice, and DMEPOS transactions occurring within the applicable 36-month period may warrant increased diligence regarding ownership history, management agreements, change-of-control provisions, and Medicare enrollment implications. For private equity sponsors, platform operators, and strategic acquirors, the proposal underscores CMS’s heightened scrutiny of ownership transitions and reinforces the importance of carefully structuring and documenting transactions involving Medicare-enrolled entities.

Part 2

II. Retroactive revocations and extended reenrollment bar

In addition to expanding the grounds under which CMS may deny or revoke Medicare enrollment, the proposed rule would significantly increase the practical consequences of such enforcement actions. CMS proposes both to broaden its authority to apply revocations retroactively under 42 CFR § 424.535(g) and to expand its ability to impose multi-year reapplication bars following enrollment denials under 42 CFR § 424.530(f).

Why it matters: Collectively, these proposals would enhance CMS’s ability to address perceived program-integrity risks by limiting future participation in Medicare and by potentially reaching back to recoup payments made during periods of noncompliance. For providers, suppliers, and their investors, the proposals may meaningfully increase repayment exposure, prolong the impact of adverse enrollment determinations, and elevate the importance of proactive enrollment compliance, diligence, and governance oversight.

A. Expansion and reorganization of retroactive revocation grounds (42 CFR § 424.535(g))

The proposed rule would significantly expand CMS’s ability to apply retroactive revocation effective dates by converting most remaining prospective revocation authorities into retroactive ones. CMS explains that providers and suppliers must continuously satisfy Medicare enrollment requirements under 42 CFR § 424 and maintains that Medicare should not pay for services furnished during periods of noncompliance. Accordingly, CMS proposes a comprehensive restructuring of 42 CFR § 424.535(g) and would generally tie revocation effective dates to the date that the underlying noncompliance, disqualifying event, or other triggering conduct occurred. Key proposed changes include:

Why it matters: If finalized, these changes could materially increase recoupment exposure by allowing CMS to retroactively invalidate billing privileges across a far broader range of revocation scenarios than under the current framework, and would provide CMS exclusive discretion in selecting a revocation effective date for many of these scenarios.

B. Reapplication bar (42 CFR § 424.530(f))

CMS proposes to substantially expand its authority to impose reapplication bars following Medicare enrollment denials. Under the current regulations, CMS may prohibit a provider or supplier from reapplying for Medicare enrollment for up to 10 years only when the enrollment application is denied under 42 CFR § 424.530(a)(4) based on false or misleading information submitted on or with the application. CMS proposes to revise 42 CFR § 424.530(f) to permit the imposition of a reapplication bar following any enrollment denial under 42 CFR § 424.530(a), thereby significantly broadening the range of circumstances in which an unsuccessful applicant could be prohibited from seeking Medicare enrollment for an extended period.

CMS explains that many denial grounds involve conduct raising program-integrity concerns comparable to, or greater than, the submission of false enrollment information. As examples, CMS cites applicants that are excluded from federal healthcare programs, have disqualifying felony convictions, operate from non-bona-fide practice locations, are subject to payment suspensions based on credible allegations of fraud, have been terminated from other federal healthcare programs, or attempt to reenroll under a different identity following a revocation. CMS expresses concern that absent a reapplication bar, providers denied for these reasons may repeatedly submit enrollment applications in an effort to gain Medicare participation despite significant compliance deficiencies or disqualifying conduct.

CMS also proposes to eliminate the existing factors in 42 CFR § 424.530(f)(2) that currently guide whether a reapplication bar should be imposed and how long it should last. According to CMS, those factors were designed specifically for denials involving false or misleading information and are not readily applicable across the full range of denial authorities in 42 CFR § 424.530(a). If finalized, the proposal would provide CMS with substantially greater discretion in determining whether to impose a reapplication bar and the appropriate duration of that bar, subject to the existing 10-year maximum.

Why it matters: CMS notes that reapplication bars under 42 CFR § 424.530(f) would remain discretionary and are distinct from the mandatory reenrollment bars that may accompany revocations under 42 CFR § 424.535(c). Nevertheless, when considered alongside the proposed rule’s expanded denial authorities, the proposal could materially increase the consequences of adverse enrollment determinations. For providers, suppliers, and their investors, the proposed change underscores the importance of comprehensive enrollment diligence, accurate enrollment submissions, and early identification of issues that could trigger a denial, as a denial may no longer represent a temporary setback but instead could result in a multi-year prohibition on Medicare participation.

Part 3

III. Additional provider enrollment and program integrity proposals

In addition to the proposed expansion of CMS’s denial and revocation authorities, the proposed rule contains numerous enrollment, disclosure, and operational reforms designed to provide CMS with greater visibility into provider ownership, management, affiliations, and business activities.

Why it matters: Although several of these proposals are framed as clarifications of existing policy, many would materially expand the information subject to Medicare scrutiny and could increase enrollment-related diligence, disclosure, governance, and compliance obligations for providers, suppliers, private equity sponsors, management companies, and other healthcare investors.

A. Preclusion list (42 CFR §§ 422.2 and 423.100)

CMS proposes to permit placement on the preclusion list based not only on felony convictions involving the provider or prescriber itself, but also on felony convictions involving the provider or prescriber’s owner, managing employee, managing organization, officer, or director. CMS explains that these individuals often exercise substantial influence over provider operations and already may serve as the basis for Medicare enrollment denials or revocations.

Why it matters: If finalized, the proposal would further align the Medicare Advantage and Part D preclusion framework with Medicare enrollment requirements and increase the importance of criminal-history diligence related to owners, executives, managers, and governing personnel. For healthcare transactions, the proposal underscores the need to assess not only the provider’s compliance history but also the backgrounds of individuals occupying key ownership and leadership roles.

B. Temporary moratoria (42 CFR § 424.570)

CMS proposes several revisions to the enrollment moratorium regulations designed to strengthen the agency’s ability to halt enrollments in sectors or geographic areas presenting heightened program-integrity concerns:

• Effective date. CMS proposes to clarify that a moratorium becomes effective on the date the notice is filed for public inspection with the Office of the Federal Register rather than the date the notice is formally published in the Federal Register. According to CMS, this change would prevent providers and suppliers from submitting applications during the gap between filing and publication in an effort to avoid the moratorium.
• Ownership changes. CMS also proposes to clarify that moratoria apply to ownership changes requiring a new enrollment, including certain CIMOs involving home health agencies, hospices, and DMEPOS suppliers.
• Expanded definition of “new” enrollments. CMS further proposes to clarify that moratoria apply to initial enrollments, ownership changes requiring a new enrollment, re-enrollment applications submitted after expiration of a reenrollment bar, reactivation applications under 42 CFR § 424.540, and applications submitted by providers that previously voluntarily terminated their Medicare enrollment. These changes may be particularly relevant to acquisition strategies involving deactivated providers, previously revoked providers, or entities operating within moratorium-affected sectors.

Why it matters: These changes would allow CMS to implement moratoria more quickly and with less advance warning by making them effective upon filing with the Office of the Federal Register. The proposal would also expand the types of enrollment activities subject to a moratorium, meaning that ownership changes, reactivations, reenrollments, and certain reentry strategies may be affected even when they would not traditionally be viewed as new enrollments.

C. Hospice reactivations (42 CFR § 424.540(b)(3))

CMS proposes to require hospices, similar to home health agencies, to undergo a state survey or accreditation process before reactivation following deactivation. CMS cites ongoing hospice program-integrity concerns and explains that additional scrutiny is necessary to confirm compliance with Medicare enrollment requirements and conditions of participation before billing privileges are restored.

Why it matters: For hospice operators and investors, the proposal may increase the time and resources required to restore deactivated enrollments and may introduce further uncertainly where contractors and accreditors use different processes to implement the changes and issue ultimate approvals necessary to reactivate.

D. Private equity companies and real estate investment trusts

Although CMS does not propose regulatory changes, it announces its intention to revise Forms CMS-855B, CMS-855S, and CMS-20134 to require suppliers to identify whether disclosed organizations are private equity companies (PECs) or real estate investment trusts (REITs).

Why it matters: The proposal is notable not because of its immediate operational impact, but because of CMS’s discussion surrounding it. CMS cites concerns about private-equity ownership across multiple healthcare sectors and expressly states its interest in obtaining additional information regarding PEC and REIT involvement throughout Medicare. While the form revisions would function primarily as disclosure requirements, they signal continuing regulatory interest in ownership structures, governance arrangements, and investor participation in Medicare providers and suppliers. When considered alongside CMS’s proposed expansion of the false-or-misleading-information denial and revocation authorities in 42 CFR §§ 424.530(a)(4) and 424.535(a)(4), the proposal may also increase the significance of accurate ownership disclosures. If CMS adopts the proposed enrollment-form revisions, a failure to accurately disclose PEC or REIT involvement could potentially be viewed as an inaccurate or misleading enrollment-related submission, with corresponding enrollment consequences. For private equity sponsors and platform operators, the proposal reinforces the importance of ownership transparency and suggests that CMS may continue expanding visibility into investor involvement across the healthcare industry.

E. Definition of “operational” (42 CFR § 424.502)

CMS proposes a substantial expansion of the definition of “operational,” explaining that the current definition may not adequately identify sham or non-bona-fide providers that technically satisfy existing requirements but nevertheless present program-integrity concerns. Key proposed additions include requirements that providers:

• Maintain locations that are accessible and free from safety hazards;
• Operate business hours sufficient to regularly serve patients;
• Maintain publicly available information that allows beneficiaries to locate the provider;
• Employ personnel who are appropriately qualified, licensed, or certified;
• Maintain adequate equipment, medications, and supplies;
• Possess sufficient administrative capabilities to submit valid Medicare claims; and
• Maintain written policies addressing patient care, patient safety, operations, administration, and recordkeeping.

CMS would also expressly reserve authority to consider additional information when determining whether a provider is operational.

Why it matters: The proposal may significantly expand the factual circumstances under which CMS can challenge a provider’s operational status and therefore may increase site-visit, enrollment, and diligence risks, particularly for multisite platforms and newly acquired operations.

F. Signage (proposed 42 CFR § 424.510(f))

CMS proposes to establish a new enrollment requirement requiring providers and suppliers to maintain visible signage displaying business hours. The proposal largely mirrors existing requirements applicable to DMEPOS suppliers and independent diagnostic testing facilities. CMS believes the requirement will assist beneficiaries and site-visit personnel in locating provider locations and verifying operational status. Exceptions would apply in certain circumstances, including providers furnishing services exclusively in patients’ homes, providers performing telehealth services from home, and certain shared-office arrangements.

Why it matters: Signage requirements, although facially innocuous, are an area ripe for foot faults during site visits that can lead to severe enrollment consequences, increased compliance costs, and costly appeals. Providers and suppliers would need to pay careful attention to both the content and placement of signage, as well as whether posted business hours, facility accessibility, and other site-visit observations are consistent with the provider’s enrollment records and operational practices.

G. Managing employees (42 CFR § 424.502)

CMS proposes to expand and clarify the definition of “managing employee” by specifically identifying additional clinical and operational personnel that generally should be disclosed when they satisfy the existing managerial-control standard. Examples include:

• Medical directors;
• Clinical directors;
• Departmental heads (e.g., a hospital’s chief of cardiology);
• Supervising physicians;
• Nursing directors; and
• Alternate administrators.

CMS views these individuals as frequently exercising significant operational influence over provider activities and therefore believes they should be disclosed in the same manner as traditional administrative leadership personnel.

Why it matters: For providers and investors, the proposal may expand disclosure requirements and increase the number of individuals whose backgrounds become relevant to enrollment diligence and ongoing compliance monitoring. The proposal also raises practical questions regarding the scope of the “managing employee” definition, particularly for larger healthcare organizations with many clinical leaders, departmental heads, service-line directors, and supervisory personnel. Although CMS states that disclosure would be required only when an individual satisfies the existing managerial-control standard, the proposed rule provides limited guidance regarding where that line would be drawn, potentially creating uncertainty regarding which clinical personnel must be disclosed on Medicare enrollment applications.

H. Corrective action plans, rebuttals, and appeals

CMS proposes several revisions to enrollment review and appeals processes.

• Corrective action plans (42 CFR § 405.809). CMS would codify its longstanding policy permitting corrective action plans for denials under 42 CFR § 424.530(a)(1), in addition to revocations under § 424.535(a)(1).
• Electronic notice. CMS proposes to permit enrollment determinations, reconsideration decisions, denials, revocations, and related notices to be delivered electronically by email in addition to traditional mail.
• Reactivation effective dates. CMS would also establish a rebuttal process for reactivation effective dates assigned under 42 CFR § 424.540 while maintaining that such determinations are not appealable initial determinations under 42 CFR 498.

Why it matters: While these proposals would not substantially expand CMS’s enrollment authority, they may materially affect how providers respond to enrollment actions once they occur. Email-based notice could accelerate deadlines and increase the risk that adverse determinations are missed if providers lack robust monitoring procedures. Likewise, providers disputing reactivation effective dates would receive a formal rebuttal pathway, but not full appeal rights, potentially limiting their ability to challenge reimbursement losses tied to delayed reactivation. For providers operating multiple enrollments or relying heavily on Medicare revenue, these proposed procedural changes reinforce the need for disciplined enrollment governance, centralized notice tracking, and prompt escalation of CMS correspondence.

I. Fingerprinting (42 CFR § 424.518(c))

CMS proposes a technical clarification specifying that individuals subject to fingerprint-based criminal background checks must utilize CMS’s designated fingerprinting contractor. CMS states that the change is intended to improve consistency and reduce uncertainty regarding fingerprinting procedures.

Why it matters: Requiring use of the designated fingerprinting contractor may increase the burden and time necessary for individuals to meet this requirement. Such delays and changes in processing may create additional compliance burdens and introduce delay into the enrollment process.

J. Affiliations (42 CFR §§ 424.502, 424.519, 424.530(a)(13), and 424.535(a)(19))

CMS proposes several significant revisions to its affiliation-disclosure framework that could substantially expand disclosure obligations and enrollment-related risk:

• Removal of the five-year lookback. CMS would eliminate the current five-year lookback period in 42 CFR § 424.519(b), requiring disclosure of qualifying affiliations regardless of when they occurred or ended.
• Expanded definition of “affiliation.” CMS proposes to add a sixth category of affiliation that would include marketing, business, fulfillment, financial, managerial, and beneficiary relationships not otherwise covered by the existing definition.
• Managing employees and organizations. CMS proposes to clarify that affiliations involving a provider’s owning or managing employees or managing organizations may independently support denial or revocation under 42 CFR §§ 424.530(a)(13) and 424.535(a)(19).

Why it matters: Among the various enrollment proposals in the proposed rule, the affiliation revisions may be the most significant. By removing the five-year limitation and substantially expanding the universe of disclosable relationships, CMS would broaden the circumstances under which historical ownership structures, management relationships, vendor arrangements, marketing agreements, and other business associations may become relevant to Medicare enrollment review. For providers, suppliers, and investors, the proposal would significantly increase the importance of understanding not only an organization’s current ownership and governance structure, but also its historical business relationships and those of its owners, officers, directors, and management personnel.

Conclusion

The proposed rule would expand CMS’s visibility into provider relationships and ownership structures, increase the consequences associated with enrollment deficiencies, and provide CMS with broader discretion to deny, revoke, and restrict Medicare participation. Healthcare providers, suppliers, private equity sponsors, management companies, and strategic acquirors should carefully review the proposed changes given their potential implications for compliance, diligence, governance, and transaction planning. Stakeholders should strongly consider submitting comments to CMS by August 31, 2026.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.