Crushing and Flexing: CMS Proposes to Expand Its Discretion to Deny and Revoke Medicare Enrollment
The Centers for Medicare & Medicaid Services (CMS) issued a proposed rule (Proposed Rule) on July 6 that would expand its authority over Medicare enrollment denials and revocations applicable to all providers and suppliers (Providers). CMS’s proposed expansion of Medicare enrollment denial and revocation authorities is consistent with the Trump administration's broader strategy of preventing improper payments before they occur.
Currently, CMS’s revocation authority allows it to revoke enrollment prospectively following notice to the Provider. Following revocation, the Provider is no longer allowed to bill Medicare. CMS’s proposal would not only make the revocation date retroactive to the date of alleged noncompliance (or other triggering event) but would also allow CMS to claw back payments to the retroactive revocation date. CMS estimates approximately $82 million in annual savings from this proposal, clearly indicating that CMS views it as a high-impact program integrity measure.
CMS’s proposal is also notable because, if finalized, it would give CMS greater flexibility to address suspected fraud without considering criteria that might otherwise constrain its actions. For example:
- CMS currently has the authority to revoke enrollment for abuse of billing privileges. CMS must determine that the Provider has a pattern or practice of submitting claims that fail to meet Medicare requirements by considering several factors, including the Provider’s percentage of denied claims and history of final adverse actions. CMS proposes to set aside these factors, reasoning that a Provider may abuse billing privileges even if it has no history of adverse actions or submission of claims that Medicare regularly denies.
- CMS seeks a broad new authority to revoke a Provider’s enrollment if the enrollment presents a high risk of fraud, waste, or abuse because the Provider is located within a limited geographic area with an excessive number of Providers. “Limited geographic area” and “excessive number” would have their plain meanings, and CMS would not impose fixed distances to determine geographic area or a set number of Providers to determine how many are “excessive.” Further, no actual finding of fraud, waste, or abuse is needed; revocations would be based on an assessed risk rather than on whether Providers actually engage in fraud. CMS recognizes that several existing revocation grounds require consideration of specified factors, but it does not propose similar safeguards here because it seeks discretion to act across varied factual circumstances.
Several provisions place the onus on Providers to vet key personnel within their organizations and individuals or entities with whom they have business or financial relationships for Medicare debt, Medicare or Medicaid payment suspensions, or state or federal program licensure suspensions or terminations. CMS can already deny enrollment if the enrolling Provider or its owner carries Medicare debt, for instance. One CMS proposal would expand denial grounds to the Provider’s managing employees, managing organizations, and individuals or entities with any form of business or financial relationship with the Provider.
Finally, the Proposed Rule reflects a desire for CMS’s revocation actions to have broad consequences. For example, under CMS's current authority, if a Provider has five Medicare enrollments, and CMS revokes one of them, CMS may also revoke the Provider's remaining four enrollments. The Proposed Rule would go even further: if the same Provider applied for a sixth enrollment, and CMS denied that application, CMS could revoke all five of the Provider's existing enrollments based solely on that denial.
We anticipate comments on the Proposed Rule, which are due August 31, will address the following areas of potential concern:
- Ambiguity regarding effective retroactive revocation dates and how far back in time Medicare payments may be clawed back
- Constraints around certain of the unfettered discretionary authorities CMS proposes to grant itself in furtherance of combating fraud
- The burden the Proposed Rule places on Providers to monitor employees, individuals or entities with whom the Provider has business or financial relationships, and nearby Providers to avoid becoming ensnared by denial, revocation, or payment-suspension actions aimed at interconnected networks of allegedly conspiring Providers
- The sweeping effects of certain proposals
See the table below for a summary of CMS’s proposed changes and relevant takeaways for industry.
| Regulation | Modification or Addition to Existing Rule | Summary of Proposed Changes | Takeaways |
|---|---|---|---|
| Abuse of Billing Privileges 42 CFR § 424.535(a)(8)(ii) (Revocation) | Modification | CMS currently must weigh four factors before finding that a Provider has a pattern or practice of submitting noncompliant Medicare claims: the percentage of denied claims, the Provider’s history of final adverse actions, the type and facts of the noncompliance, and other relevant information. CMS would remove all four factors. Per CMS, Providers need not exhibit a history of adverse action or submit claims with a high rate of denial for abuse to occur. CMS provides a general rationale for removing all four factors, arguing that the current framework constrains its ability to address varied billing-abuse scenarios, but provides no specific rationale for removing (C) (the type of and facts surrounding billing noncompliance) or (D) (any other information regarding Provider’s specific circumstances that CMS deems relevant). | CMS would increase its flexibility to revoke enrollment for alleged billing privilege abuses even if the Provider (1) lacks a history of adverse actions supporting a “pattern or practice” of abusive billing and (2) submits claims CMS largely allows. |
| False or Misleading Information 42 CFR §§ 424.535(a)(4) and 42 CFR §§ 424.530(a)(4) (Revocation and Denial) | Modification | This provision allows CMS to revoke enrollment if a Provider certifies as “true” misleading or false information on its Medicare enrollment application. CMS would expand this provision to any document on or associated with any CMS or Medicare enrollment-related form, such as an Electronic Funds Transfer Authorization Agreement. The submission need not be intended to gain or maintain Medicare enrollment nor certified as “true.” | CMS clarifies its focus on the submission of truthful information, regardless of certification and document type. |
| Extension of Revocation 42 CFR § 424.535(i) (Revocation) | Modification | Currently, if a Provider’s enrollment is revoked under § 424.535(a), CMS may also revoke any and all of a Provider’s other Medicare enrollments. CMS would expand this authority so that it could also revoke a Provider’s other enrollments when one of the Provider’s enrollments is instead denied under § 424.530. | CMS could revoke a Provider’s other enrollments if it denies a new enrollment under § 424.530(a). CMS will exercise discretion and may not exercise this authority each time it denies an enrollment. |
| Retroactive Revocation Effective Dates 42 CFR § 424.535(g) | Modification | Currently, a revocation under § 424.535(g)(1) generally takes effect prospectively, 30 days after CMS mails notice of its determination, except for the grounds already listed as retroactive in § 424.535(g)(2). CMS would make all remaining revocation grounds under § 424.535(a) retroactive, using a ground-specific effective date that may be the date noncompliance began or another event-specific date. | CMS can claw back Medicare payments to the applicable retroactive date upon which revocation took effect, which may be the start of noncompliance or another event-specific date depending on the ground(s) for revocation. |
| Post-Revocation Claim Submission 42 CFR § 424.535(h) | Modification | The timeframe to submit claims for items and services furnished before the revocation effective date is shortened from 60 days to 15 calendar days from the date of the revocation letter. | Revoked Providers will have a short window to submit outstanding claims or risk loss of reimbursement. |
| High-Risk Enrollments Based on Geographic Concentration 42 CFR § 424.535(a)(24) (Revocation) | Addition | CMS could revoke a Provider’s enrollment if it deems the enrollment as presenting a high risk of fraud, waste, or abuse due to location within a limited geographic area that has an excessive number of Providers. | CMS assures that it would not use this authority to revoke good-faith Providers; however, CMS bucks the idea of drawing any guardrails around its authority to exercise this new authority in order to preserve its flexibility. |
| Certain Misdemeanor Convictions 42 CFR §§ 424.530(a)(16) and 424.535(a)(16) (Revocation and Denial) | Addition | CMS would deny or revoke Medicare enrollment if the Provider or any owner, managing employee or organization, officer, or director was convicted of a federal or state misdemeanor related to sexual assault or financial misconduct in the past 10 years that CMS deems detrimental to the best interests of Medicare. | CMS can revoke or deny enrollment based on misdemeanor convictions for sexual assault or financial misconduct if CMS deems the conviction detrimental to the best interests of the Medicare program and its beneficiaries. What is “detrimental” to Medicare seems entirely within CMS’s discretion, but the triggering offenses draw reasonable guardrails around this proposed authority. |
| Affiliation Provisions and Scope 42 CFR §§ 424.530(a)(13) and 424.535(a)(19) (Revocation and Denial) | Modification | Currently, initially enrolling or revalidating Providers must disclose affiliations the Provider had, within the previous 5 years, with currently or formerly enrolled Medicare, Medicaid, or Children’s Health Insurance Program (CHIP) Providers that had a disclosable event. Disclosable events include uncollected Medicare, Medicaid, or CHIP debt, a federal health care program payment suspension, an OIG exclusion, or a Medicare, Medicaid, or CHIP enrollment denial, revocation, termination, or similar adverse action. CMS would revise this provision to apply to affiliations regardless of how long ago they occurred or ended and extend to owning or managing employees or organizations of the Provider. | The affiliation-based enrollment risk would extend beyond the Provider entity to its key personnel, and back in time indefinitely (rather than affiliations within the last 5 years). |
| CIMO Non-Compliance 42 CFR §§ 424.535(a)(25) and 424.530(a)(22) (Revocation and Denial) | Addition | CMS would revoke HHA, hospice, and durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers’ enrollment if they fail to comply with 42 CFR § 424.550(b) (prohibitions on the sale or transfer of billing privileges) and 42 CFR § 424.551 (DMEPOS supplier changes in majority ownership). | CMS wants tighter control over screening and vetting Provider owners and prevention of “flipping,” where an enrolled Provider sells to another Provider who does not newly enroll or undergo a survey/accreditation. CMS is also wary of Providers using management agreements in lieu of a formal sale to transfer all authority to the new Provider with intent for the new Provider to purchase the entity after the 36-month period (applicable via 424.550(b) and 424.551) expires. |
| Debt 42 CFR § 424.530(a)(6) (Denial) | Modification | CMS can already deny enrollment if the enrolling Provider or its owner carries Medicare debt. CMS would expand denial grounds to managing employees, managing organizations, and individuals or entities with any form of business or financial relationship with the Provider. | Providers must vet key personnel and individuals and entities with whom they have a financial or business relationship for Medicare debt. |
| Payment Suspension 42 CFR § 424.530(a)(7) (Denial) | Modification | CMS can already deny enrollment if the Provider or its owner, managing employee, or managing organization is currently under a Medicare or Medicaid payment suspension. CMS would also deny enrollment if any individuals or entities with any form of business or financial relationship with the Provider are under payment suspension. | Providers must vet individuals and entities with whom they have a financial or business relationship to ensure none is subject to payment suspensions. |
| Program Terminations/ Suspensions 42 CFR § 424.530(a)(14) (Denial) | Modification | CMS can already deny enrollment if the Provider is currently terminated, suspended, or otherwise barred from participation in a state Medicaid program or any other federal health care program, or if the Provider’s license is currently revoked or suspended in another state. CMS would extend this authority to the Provider’s owners, managing employees, and managing organizations and would include licenses voluntarily surrendered in lieu of further disciplinary action. | Providers must monitor enrollment and licensure status for owners, managing employees, and managing organizations across all states, including for voluntary license surrender to avoid further discipline. |
| Revocation or Denial in the Same Suite 42 CFR § 424.530(a)(19) (Denial) | Addition | A Provider whose practice location is in the same suite or office as another denied or revoked Provider could also receive a denial. | Providers must determine whether other Providers who share the same suite or office space have had Medicare enrollment denied or revoked. This denial ground is based on shared office space, while the similar revocation ground proposed at 424.535(a)(24) focuses on the concentration of Providers in a certain area. |
| Hospice Medical Directors and Administrators 42 CFR § 424.530(a)(20) (Denial) | Addition | CMS would deny enrollment if (1) the hospice’s medical director or administrator is the medical director or administrator of multiple other hospices or is located at such a distance that they cannot realistically perform job functions, or (2) the medical director does not have an active physician medical license in the state. | These authorities address recurring program integrity issues with hospices observed by CMS: poor quality of care, fraud schemes, inappropriate billing, limited transparency, a payment system that incentivizes minimization of services, kickbacks to certifying physicians, and rapid growth in the number of new hospices. |
| Misuse of Identity 42 CFR § 424.530(a)(21) (Denial) | Addition | CMS would deny enrollment if the prospective provider or supplier is attempting to enroll under another party’s identity. | This addition addresses instances where a party steals the identity of another and enrolls under those stolen credentials. |
| Reapplication Bar 42 CFR § 424.530(f) | Modification | Currently, CMS can bar a denied Medicare enrollee from reapplying for 10 years if the enrollee submits false or misleading information on or with (or omitted information from) its application to gain enrollment in Medicare. This proposal would permit a reapplication bar of up to 10 years for any denial reason. CMS need not consider existing factors (materiality of information in question, evidence of intent, or history of adverse actions or suspensions) when determining whether to apply this bar. | Providers must treat enrollment submissions with extreme care, as CMS could deny for any existing, modified, or additional 424.530 grounds, then prevent the Provider from re-applying for a period of 10 years. CMS would exercise discretion in applying this bar; not every denial will trigger it. |
Authors
Karen Lovitch
Member / Chair, Health Law Practice & Chair, Health Care Enforcement Defense Practice
Karen advises industry clients on regulatory, transactional, operational, and enforcement matters. She has deep experience handling FCA investigations and qui tam litigation for laboratories and diagnostics companies.
Jane T. Haviland
Associate
Jane Haviland's practice focuses primarily on health care enforcement defense. Jane defends laboratories, physicians, and other clients facing government investigations and whistleblower complaints regarding alleged violations of the federal False Claims Act, the federal anti-kickback statute, the Stark law, and similar state laws.