CMS Program Integrity Changes Emphasize the Provider’s Burden to Ensure Compliance

The Centers for Medicare & Medicaid Services (CMS) of the U.S. Department of Health and Human Services (HHS) has a variety of investigation and enforcement tools available to protect federal health care dollars. Traditional compliance guidance has focused on the various CMS prepayment and postpayment audit programs or referral to the Office of Inspector General (OIG) or U.S. Department of Justice (DOJ) for potential enforcement under the False Claims Act or health care fraud laws, exclusion from payment in federal health care programs, or imposition of civil monetary penalties. During 2026 there has been increased use of (and attention to) two lesser-known enforcement tools: payment suspensions and revocation or denial of billing privileges.

Medicare and Medicaid payment suspensions and revocations received increased attention in the late spring when CMS suspended payments to hundreds of home health and hospice agencies and revoked the Medicare participation of hundreds of providers. This fall, CMS has emphasized a desire to utilize payment suspensions and finalized changes to the revocation regulations.

Payment Suspensions

CMS is permitted to suspend payment, in whole or in part, after consultation with OIG and/or DOJ, when it has determined that a credible allegation of fraud exists against a provider or supplier.¹ Upon receipt of the notice of payment suspension, the provider can submit a rebuttal that the payment suspension should not be imposed, either due to an absence of a credible allegation of fraud or existence of good cause to not suspend payments.² The grounds for suspension are reviewed every 180 days.

Because the payment suspension rules are designed to protect Medicare funds, there is broad discretion to CMS, making it difficult for a provider to get the payment suspension lifted until the investigation is complete. Especially for smaller providers, the absence of revenue during the payment suspension can have significant impact on the ability to continue operations.

In October, CMS Deputy Administrator Kimberly Brandt indicated a desire of CMS to quadruple payment suspensions over the next six months. Additionally, the calendar year 2027 Home Health Prospective Payment System (HH PPS) final rule further integrates payment suspension into the grounds for revocation.

Revocation or Denial

To receive payment for Medicare-covered items or services, a provider must be enrolled in the Medicare program.³ CMS can deny or revoke enrollment for a variety of reasons related to noncompliance with regulatory requirements.⁴ While denial or revocation of enrollment does not have the same relationship restrictions as exclusion, it nonetheless prevents the provider from receiving any payment from the Medicare program. The HH PPS final rule expanded the grounds for and impact of revocation of Medicare billing privileges for all provider and supplier types enrolled in Medicare, including:

New Grounds

1. All Revocation Grounds Retroactive: Under current regulations, many revocations take effect prospectively, generally 30 days after CMS or its contractor mails the notice of the revocation. Only certain revocation grounds apply retroactively to the date of noncompliance. CMS finalized a policy to make all revocation grounds retroactive. The purpose of this policy is to assist CMS in recovering monies paid to “non-compliant providers and help ensure taxpayer money is paid only to legitimate, compliant providers.”⁵
2. Provider Enrollment, Chain, and Ownership System Accuracy: The underlying duty to timely report enrollment changes (Section 424.535(a)(9)) isn’t new. What changed is the penalty for missing it: every category of unreported change now carries with it a penalty retroactive to the day after it was due to be reported.⁶ The rule confirms that the provider bears ultimate legal responsibility for the accuracy and completeness of all submitted enrollment data, and CMS declined to adopt a “due diligence” standard that might excuse inaccuracies involving clerical errors, third parties, or managing employees.
3. High-Risk Geographic Concentration: CMS may revoke enrollment if a provider is located in a geographic area with an “excessive” concentration of similar providers, which CMS treats as a fraud risk indicator.⁷ No fixed numeric threshold is defined, so this determination is inherently subjective and fact-specific.

Expanded Grounds

1. Failure to Document or Furnish Documentation: CMS can revoke a provider that fails to comply with the documentation retention and access requirements of Section 424.516(f).⁸ While the documentation retention and access requirements are not new, CMS has changed the effective date for revocation to the date on which CMS determines that the provider has not complied with the retention requirements or the day after the date by which the provider was required to give access.
2. Program / License Suspension or Termination: CMS could already deny / revoke based on a provider’s own suspended / revoked state license or Medicaid or other federal program suspension. This is now expanded to include similar suspensions / revocations involving the provider’s owners or managing employees / organizations, not just the provider itself.⁹
3. False or Misleading Information: Section 424.535(a)(4) has long allowed CMS to revoke enrollment if a provider certified false or misleading information “as true” on its enrollment application. CMS has now expanded this ground to reach false or misleading information submitted on or with any CMS or Medicare enrollment-related form or document – not just the core Form CMS-855 application.¹⁰ CMS specifically identified examples including:
   • Enrollment-related forms submitted to CMS contractors
   • Supporting documentation furnished alongside an enrollment-related form
   • The Form CMS-588
   • Opt-out affidavits
   • Letters establishing that an individual qualifies as an authorized or delegated official
   • Any other required or requested enrollment-related documentation
4. “Abusive Billing” Revocations: Under the existing regulation, Section 424.535(a)(8)(ii), CMS can revoke a provider’s enrollment for a “pattern or practice” of submitting noncompliant claims. Until now, CMS was required to weigh four specific factors before making that determination, such as the percentage of claims denied and the provider’s history (or lack thereof) of prior adverse actions. The final rule eliminates all four factors outright, along with the introductory language requiring CMS to consider them.¹¹

In issuing these changes, CMS repeatedly emphasized that “it has long been CMS policy that the enrolling or enrolled provider bears ultimate legal responsibility for the accuracy and thoroughness of all submitted data.”¹² Further, “preventing improper payments is a cornerstone of provider enrollment.”

What This Means for Providers

The changes implemented by CMS indicate a likely continued use of payment suspensions and revocations earlier in the investigation process than has been seen in the past. This further reinforces the need for providers to implement effective compliance programs and be proactive in compliance efforts:

• Review your provider enrollment file for accuracy and make any corrections needed. Implement a process to ensure the enrollment file is updated for changes in your organization, especially related to ownership or management control.
• The retroactive nature of a revocation now carries substantial overpayment liability reaching back to the date noncompliance began. Evaluate your services against Medicare coverage policies and current audit topics (TPE, RAC, CERT, and OIG all publish topics under review) to ensure documentation and coding are consistent with requirements. The length of time a compliance issue goes undetected directly increases financial exposure.
• Ensure complete medical record documentation is provided in response to an audit request. Do not limit production to the list in the request. Provide all records that are relevant to the provision of medical necessity for the service.

This client alert was drafted by Stacy Harper, Aspen Olson, and Amanda Wilert, attorneys in the Spencer Fane Overland Park, Tulsa, and Washington, D.C. offices. For more information, please visit www.spencerfane.com.

¹ _{42 C.F.R 405.371(a).}

² _{42 C.F.R. 405.374 and 405.371(b)}

³ _{42 C.F.R. 424.505.}

⁴ _{42 C.F.R. 424 530 and 424.535.}

⁵ _{See Calendar Year (CY) 2027 Home Health Prospective Payment System final rule – CMS 1844-F Fact Sheet.}

⁶ _{91 Fed. Reg. 72022, 72094-72095 (Nov. 9, 2026) (to be codified 42 C.F.R. § 424.535(g)(1)).}

⁷ _{91 Fed. Reg. 72022, 72102 (Nov. 9, 2026) (to be codified 42 C.F.R. § 424.535(a)(24)).}

⁸ _{91 Fed. Reg. 72022, 72095 (Nov. 9, 2026) (to be codified 42 C.F.R. § 424.535(a)(10).}

⁹ _{91 Fed. Reg. 72022, 72108 (Nov. 9, 2026) (to be codified 42 C.F.R. § 424.530(a)(14)).}

¹⁰ _{91 Fed. Reg. 72022, 72092 (Nov. 9, 2026) (to be codified 42 C.F.R. § 424.535(a)(4)).}

¹¹ _{91 Fed. Reg. 72022, 72091 (Nov. 9, 2026) (to be codified 42 C.F.R. § 424.535(a)(8)(ii)).}

¹² _{Calendar Year 2027 Home Health Prospective Payment System (HH PPS) Rate Update;}

_{Requirements for the HH Quality Reporting Program and the Expanded HH Value-Based}

_{Purchasing Model; Medicare Provider Enrollment, Durable Medical Equipment (DME),}

_{and DME, Prosthetics, Orthotics, and Supplies (DMEPOS) Policies, RIN 0938-AV80.}