Medicare and Medicaid Programs; Calendar Year 2026 Home Health Prospective Payment System (HH PPS) Rate Update; Requirements for the HH Quality Reporting Program and the HH Value-Based Purchasing Expanded Model; Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Competitive Bidding Program Updates; DMEPOS Accreditation Requirements; Provider Enrollment; and Other Medicare and Medicaid Policies

1. Medicare Enrollment a. Background

Section 1866(j)(1)(A) of the Act requires the Secretary to establish a process for the enrollment of providers and suppliers into the Medicare program. The central purpose of the enrollment process is to help verify that providers and suppliers (hereafter collectively “providers” unless otherwise noted) seeking to bill Medicare for services and items furnished to Medicare beneficiaries meet all applicable Federal and State requirements to do so. The process assists in preventing unqualified and potentially fraudulent individuals and entities from entering and improperly billing Medicare. Since 2006, we have undertaken rulemaking efforts to outline our enrollment procedures. These regulations are generally codified in 42 CFR part 424, subpart P (currently Sec. Sec. 424.500 through 424.575 and hereafter occasionally referenced as subpart P). They address, among other things, requirements that providers must meet to obtain and maintain Medicare billing privileges.

As outlined in Sec. 424.510, one requirement is that the provider must submit to its assigned Medicare Administrative Contractor (MAC) the appropriate enrollment form, typically the Form CMS-855 (for example, the Form CMS-855A (OMB control number 0938-0685)). The Form CMS-855 collects important information about the provider. This includes, but is not limited to, general identifying information (for instance, legal business name), licensure and/or certification data, and practice locations. The application is used for various provider enrollment transactions, such as:

Initial enrollment--The provider is--(1) enrolling in Medicare for the first time; (2) enrolling in another Medicare contractor's jurisdiction; or (3) seeking to enroll in Medicare after having previously been enrolled:

Change of ownership--The provider is reporting a change in its ownership;

Revalidation--The provider is revalidating its Medicare enrollment information in accordance with Sec. 424.515. (DMEPOS) suppliers must revalidate their enrollment every 3 years; all other providers and suppliers must do so every 5 years.);

Reactivation--The provider is seeking to reactivate its Medicare billing privileges after it was deactivated under Sec. 424.540. (Deactivation, an important program integrity safeguard, means that the provider's or supplier's billing privileges are stopped for one or more of the reasons outlined in Sec. 424.540(a)(1) through (8) (for example, non-compliance with enrollment requirements). However, they can be restored (or “reactivated”) upon the submission of information required under Sec. 424.540).

Change of information--The provider is reporting a change in its existing enrollment information in accordance with Sec. 424.516.

After receiving the provider's initial enrollment application, CMS or the MAC reviews and confirms the information thereon and determines whether the provider meets all applicable Medicare requirements. We believe this screening process has greatly assisted CMS in executing its responsibility to prevent Medicare fraud, waste, and abuse by keeping unqualified providers out of the Medicare program.

As previously mentioned, over the years we have issued various final rules pertaining to provider enrollment.

These rules were intended not only to clarify or strengthen certain components of the enrollment process but also to enable us to take further action against providers: (1) engaging (or potentially engaging) in fraudulent or abusive behavior; (2) presenting a risk of harm to Medicare beneficiaries or the Medicare Trust Funds; or (3) that are otherwise unqualified to furnish Medicare services or items. Consistent with this, and as we discuss in this section VI.A.1.c of this final rule, we proposed and are finalizing several changes to our Medicare provider enrollment regulations.

(Section VI.A.2 of this final rule addresses our proposed and finalized change to one of our Medicaid provider enrollment provisions.) b. Legal Authorities

There are two principal categories of legal authorities for our proposed and finalized Medicare provider enrollment provisions--

Section 1866(j) of the Act furnishes specific authority regarding the enrollment process for providers and suppliers; and

Sections 1102 and 1871 of the Act provide general authority for the Secretary to prescribe regulations for the efficient administration of the Medicare program. c. Medicare Provider Enrollment Provisions

This section of this final rule discusses our proposals, outlines the comments we received and responses thereto, and identifies our final provisions. A number of the comments addressed multiple proposals and topics simultaneously, particularly with respect to revocations and stays of enrollment. We will thus include all the comments and responses received on the subjects in sections VI.A.1.c.(1).(a). through (c). of this rule within section VI.A.1.c.(1).(d). of this final rule. (1) Revocation and Denial Reasons, Revisions to Other Revocation Policies, Retroactive Revocations, and Stays of Enrollment (a) Revocations and Denials

Under Sec. 424.535(a), CMS may revoke a Medicare provider's enrollment for any of the reasons specified in that paragraph. These reasons include, for instance, the provider's: (i) failure to adhere to Medicare enrollment requirements; (ii) exclusion by the HHS Office of Inspector General (OIG); (iii) felony conviction within the previous 10 years; (iv) pattern of improper or abusive billing; and (v) termination by another Federal health care program. A revocation is designed to safeguard the Medicare program, the Trust Funds, and beneficiaries by removing (and preventing payment to) Medicare providers that have engaged in problematic or otherwise non-compliant behavior. When a provider is revoked, it is generally barred from reenrolling in Medicare for a period of 1 to 10 years. The length of this “reenrollment bar” is determined based upon the severity of the basis of the revocation.

CMS also has numerous reasons in Sec. 424.530(a) for which it can deny a provider's enrollment application, some of which duplicate our revocation grounds in Sec. 424.535(a) (for instance, OIG exclusion, felony conviction, termination by another federal health care program). The general rationale for a denial is akin to that for a revocation: to protect the Medicare program and its beneficiaries from potentially fraudulent or abusive activity.

We have previously finalized a number of regulations adding new revocation and denial reasons to subpart P to address particular program integrity vulnerabilities and types of provider conduct. We have also used rulemaking to refine other policies regarding revocations, such as the effective dates of certain revocations. Given our continuing obligation to establish effective payment safeguards, we proposed several additions and revisions to our revocation and denial policies in part 424 subpart P. (i) Authority To Prescribe Drugs (Sec. Sec. 424.535(a)(13)(ii) and 424.530(a)(11)(ii))

Sections 424.535(a)(13)(ii) and 424.530(a)(11)(ii) permit CMS to revoke or deny a physician's or eligible professional's enrollment if the licensing or administrative body for any state where the individual practices suspends or revokes the person's ability to prescribe drugs. We have received questions regarding the term “prescribe drugs”-- specifically, whether the state's prohibition: (1) must be for all drugs for Sec. 424.535(a)(13)(ii) or Sec. 424.530(a)(11)(ii) to potentially apply; or (2) need only apply to one drug. Our position has long been the latter, and we accordingly proposed to revise Sec. Sec. 424.535(a)(13)(ii) and 424.530(a)(11)(ii) to change “prescribe drugs” to “prescribe one or more drugs.” Given the seriousness of any state suspension or revocation action regarding an individual's prescribing authority, we believe a prohibition involving even one drug is sufficient to warrant revocation or denial if we deem it necessary to protect beneficiaries and the Trust Funds. (ii) Pattern or Practice of Prescribing (Sec. 424.535(a)(14))

We currently may revoke a physician's or practitioner's enrollment under Sec. 424.535(a)(14) if the individual has a pattern or practice of prescribing Part B or D drugs that is abusive, threatens the health and safety of Medicare beneficiaries, or fails to meet Medicare requirements. This authority aims to protect Medicare beneficiaries and the Trust Funds against harmful and non-compliant prescribing practices.

Drugs associated with services covered under Part A presently do not fall within the purview of Sec. 424.535(a)(14). This is of increasing concern to us. Although Part A does not cover many drugs that beneficiaries take at home or in outpatient facilities, it can cover drugs administered as part of an inpatient covered stay, such as at a hospital or a skilled nursing facility. We do not believe the important protections that Sec. 424.535(a)(14) affords must depend upon the setting in which the drugs were furnished. It is the abusive or non-compliant prescribing itself, rather than the beneficiary's location or inpatient or outpatient status, that is most critical for purposes of program integrity. Beneficiaries can be endangered by prescribing during inpatient stays no less than in other environments. We accordingly proposed to revise Sec. 424.535(a)(14) to change “Part B or D drugs” to “Medicare-covered drugs” to encompass Medicare Parts B, D, and now A. (iii) Abuse of Billing Privileges (Sec. 424.535(a)(8)(i))

Section 424.535(a)(8) permits revocation of enrollment if--

The provider or supplier submits a claim or claims for services that could not have been furnished to a specific individual on the date of service (Sec. 424.535(a)(8)(i)); or

CMS determines that the provider has a pattern or practice of submitting claims that fail to meet Medicare requirements (Sec. 424.535(a)(8)(ii)).

Paragraph (a)(8)(i) states that situations falling within its purview include but are limited to (and are enumerated as paragraphs (a)(8)(i)(A) through (C))--

The beneficiary is deceased;

The directing physician or beneficiary is not in the state or country when services were furnished; or

When the equipment necessary for testing is not present where the testing is stated to have occurred.

We have recently seen cases where providers and suppliers have submitted

claims for payment involving services or items that the beneficiary states were never furnished. While the “but are not limited to” caveat in paragraph (a)(8)(i) means that paragraphs (a)(8)(i)(A) through (C) are not exclusive, we believe the seriousness of the attestation cases we have seen and the potential fraud, waste, and abuse that has resulted therefrom warrant a specific mention of this situation in paragraph (a)(8)(i). We accordingly proposed to include it in new paragraph (a)(8)(i)(D). (b) Retroactive Revocations Bases

Section 424.535(g) addresses revocation effective dates. Paragraph (g)(1) states that except as described in paragraphs (g)(2) and (g)(3), a revocation becomes effective 30 days after CMS or the CMS contractor mails notice of its determination to the provider; the revocation is thus prospective. Paragraphs (g)(2)(i) through (viii) list eight situations where the revocation effective date is retroactive, generally meaning that the revocation becomes effective back to the date on which the provider's non-adherence to Medicare requirements commenced.

The purpose of paragraph (g)(2) is to prevent payment to a provider while it is out of compliance. Assume a provider's license is revoked by the state on September 1. CMS learns of this and sends a revocation notice to the provider on September 15. If we applied paragraph (g)(1)'s prospective “30 days after mailing” timeframe, the provider could bill and be paid for services furnished between September 1 and October 15 while unlicensed, resulting in potentially thousands of dollars in improper Medicare payments. Preventing improper payments is a cornerstone of provider enrollment, and we believe that retroactive revocation effective dates are crucial means of ensuring that taxpayer monies are paid only to legitimate, compliant providers. For this reason, we proposed several new grounds and effective dates for retroactive revocations. These will be designated as paragraphs (g)(2)(viii) through (xiv) (the requirement in current paragraph (g)(2)(viii) will be removed, as later explained) and are as follows:

For revocations based on a lapse in the IDTF's comprehensive liability insurance under Sec. 410.33(g)(6), the date the insurance lapsed.

For revocations based on the provider's or supplier's submission of false or misleading information on the enrollment application, the date the application's certification statement was signed.

For revocations based on the provider's or supplier's failure to timely report a change of ownership or adverse legal action, or a change, addition, or deletion of a practice location, the day after the date by which the provider or supplier was required to report the change, addition, or deletion.

For revocations based on the surrender of the provider's or supplier's Drug Enforcement Administration certificate of registration in response to a show cause order, the date the certificate was surrendered.

For revocations based on the State's suspension or revocation of the physician's or practitioner's ability to prescribe one or more drugs, the date of the suspension or revocation.

For revocations of any of the provider's or supplier's other enrollments under Sec. 424.535(i), the effective date of the revocation that triggered the revocation(s) of the other enrollment(s).

For revocations based on a DMEPOS supplier's non- compliance with a condition or standard in Sec. 424.57(b) or (c), respectively, the date on which the non-compliance began.

We proposed these particular grounds because, as we explained in the proposed rule, the revoked provider or supplier engaged in action or inaction resulting in non-compliance and/or otherwise concerning conduct. Regarding proposed paragraph (g)(2)(viii), lapsed IDTF liability insurance could have eliminated financial protection for beneficiaries negligently harmed by a test the IDTF performed. We believe such an insurance lapse and the risk it could have posed to patients warrants a retroactive revocation effective date. Moreover, because IDTF liability insurance is required per Sec. 410.33(g)(6), failure to maintain it means the IDTF is non-compliant with enrollment requirements; the supplier must therefore not receive payments for services furnished on or after the date the non-compliance commenced. Providing false or misleading data on the enrollment application, meanwhile, reflects in our view dishonest behavior that could have resulted in improper payments to the provider. To illustrate, assume an enrolled provider had failed to report one of its practice locations on its application, knowing that it was not a valid site. If the provider furnished services from that site, it could have received payments to which it was not entitled due to the location's non-compliance. We believe the severity of such conduct justifies a retroactive revocation.

The same concerns about potential improper payments were behind proposed new paragraph (g)(2)(x). As an example, if a provider moves its practice location without notifying CMS and the new location does not meet the definition of “operational” in Sec. 424.502, Medicare might have been paying for services while the provider was non- compliant with enrollment requirements. Accordingly, we believe this warrants application of the revocation retroactively to the date the non-compliance began as described in proposed paragraph (g)(2)(x). As for new paragraphs (g)(2)(xi) and (xii), meeting all applicable federal and state requirements is necessary for enrollment. If an individual is prescribing or dispensing drugs while non-compliant, we believe the risk this presented to beneficiaries after the loss of DEA or state authority justifies a revocation back to the date said loss occurred. With respect to proposed paragraph (g)(2)(xiii), we believe it would be inconsistent to apply one effective date to the triggering revocation and a different, later one to others, for the same individual or provider organization is involved in all these enrollments. Proposed paragraph (g)(2)(xiv), in our view, is appropriate because the supplier's non-compliance may have resulted in payments (on or after the date of non-compliance) to which the supplier was not entitled.

We previously noted our authority under Sec. 424.535(a)(8) to revoke a provider for the abusive billing situations described in paragraphs (a)(8)(i) and (ii). These situations are especially disconcerting with regard to the question of improper payments. If a provider is engaging in abusive billing, this, in our view, constitutes a direct threat to the integrity of the Medicare program. To allow a provider that was revoked for submitting claims for unfurnished services to continue billing Medicare for another 30 days would run entirely counter to our role as steward of the Trust Funds. Thus, we proposed to include the revocation bases in Sec. 424.535(a)(8) as grounds for retroactive applicability.

Under new paragraph (a)(8)(iii), the revocation effective date in paragraph (a)(8)(i) would be the earliest date of service on the claim or claims that is or are triggering the revocation. To illustrate, if CMS revokes the provider for submitting claims for non-furnished services with the claims' service dates of June 1, June 5, and June 10, the revocation date would be the earliest of them, or June 1. Considering the serious program integrity risks associated with such claims, we do not believe the

effective date must be the last claimed service date, for the risk commenced with the first claim's submission. The revocation effective date under paragraph (a)(8)(ii), meanwhile, would be the last date of service on the claims in question. The reason for the different effective dates is that while (a)(8)(i) requires only one claim submission, (a)(8)(ii) requires a pattern or practice, which cannot be established via a single claim. The last claim establishes the pattern or practice, hence the need to use the date thereon as the effective date.

To further accommodate new paragraph (a)(8)(iii), we proposed to add reference to it in the previously noted opening clause of Sec. 424.535(g)(1) as being excluded from application under paragraph (g)(1).

We also proposed several other technical changes involving retroactive revocations.

First, Sec. 405.800(b)(2) states that a revocation is effective 30 days after CMS or the CMS contractor mails notice of its determination to the provider or supplier, the only exceptions being the revocations referenced in current Sec. 424.535(g)(2)(i) through (iv), which are retroactive. Given our significant changes to Sec. 424.535(g)(2) over the years, we proposed to replace the current language of Sec. 405.800(b)(2) with a statement that a revocation's effective date is as specified in Sec. 424.535 (which would include Sec. 424.535(a)(8)(iii) and (g)).

Second, Sec. 424.57(e)(1) states that except as otherwise provided in Sec. 424.57, a DMEPOS supplier's revocation for violating Sec. 424.57(b) or (c) is effective 30 days after the entity is sent notice of the revocation, as specified in Sec. 405.874. Similar to our proposed revision to Sec. 405.800(b)(2), we proposed to modify Sec. 424.57(e)(1) to state that the revocation effective date would be as specified in Sec. 424.535.

Third, current Sec. 424.535(g)(2)(viii) outlines effective dates for revocations under Sec. 424.535(a)(23). Paragraphs Sec. 424.535(g)(2)(viii)(A) through (C) identify three situations where a retroactive effective date applies. Section 424.535(g)(2)(viii)(D), meanwhile, states that for all standard violations not addressed in paragraphs (A) through (C), the prospective effective date in paragraph (g)(1) applies if the effective date in paragraph (g)(3) does not. We proposed two changes involving Sec. 424.535(g)(2)(viii). One is that-- given proposed new Sec. 424.535(g)(2)(viii) through (xiv)--we proposed to redesignate existing Sec. 424.535(g)(2)(viii) as new Sec. 424.535(g)(2)(xv). The other proposed change involved replacing the reference to “paragraphs (A) and (C)” in current Sec. 424.535(g)(2)(viii)(D) (proposed new Sec. 424.535(g)(2)(xv)(D)) with “paragraph (g)(2)”. This is because we proposed to add certain standard violations to (g)(2) in paragraphs other than current (g)(2)(viii)(A), (B), and (C). (c) Revisions to Stay of Enrollment Authority (Sec. 424.541)

Along with revocations and deactivations, CMS has a third vehicle with which to prevent Medicare fraud, waste, and abuse as well as improper payments: a “stay of enrollment.” Under Sec. 424.541(a)(1) and (2), we can impose a stay against a provider if the provider:

Is non-compliant with at least one enrollment requirement in Title 42; and

Can remedy the non-compliance by submitting, as applicable to the situation, a Form CMS-855, Form CMS-20134, or Form CMS-588 change of information or revalidation application.

We established the stay of enrollment concept based largely on our concern that there were instances of provider non-compliance that did not necessarily warrant a measure as significant as a deactivation, much less a revocation. We believed that a more moderate CMS approach in addressing these cases would ease the burden on providers without hindering our obligation to protect the Trust Funds. To further explain the rationale behind stays of enrollment, we noted in the proposed rule several critical differences between stays and revocations and deactivations.

Length of Action--We previously noted that a revoked provider is subject to a reenrollment bar typically lasting between 1 to 10 years. Deactivations last until the provider has reactivated its billing privileges under Sec. 424.540; if no reactivation occurs, the deactivation remains effective indefinitely. An enrollment stay, however, lasts a maximum of 60 calendar days, during which period the provider remains enrolled in Medicare, unlike with a revocation. Described otherwise, a stay of enrollment represents a comparatively brief “pause” in the provider's enrollment that permits the provider to quickly resume compliance without the greater burdens associated with deactivations and revocations.

Payments--Section 424.541(a)(2)(ii)(A) states that claims submitted by the provider with dates of service within the stay period will be rejected. Yet under Sec. 424.541(a)(2)(ii)(B), these claims are eligible for payment (and may be resubmitted by the provider within applicable timeframes specified in Title 42) if--

++ CMS or its contractor determines that the provider or supplier has resumed compliance with all Medicare enrollment requirements in Title 42; and

++ The stay ends on or before the 60th day of the stay period.

This means that whereas revocations and deactivations prohibit payment for services or items furnished during the revocation or deactivation period with no possibility of retroactive payments, a stay of enrollment permits these payments if the requirements in Sec. 424.541(a)(2)(ii)(B) are met.

Mechanism for Resuming Compliance--A revoked or deactivated provider cannot re-enroll in Medicare (after the reenrollment bar expires) or reactivate its billing privileges until the applicable provider enrollment application process is complete, which can take considerable time. Under Sec. 424.541(a)(5), a stay can end on the date on which CMS or its contractor determines that the provider has resumed compliance with all Medicare enrollment requirements in Title 42. For purposes of Sec. 424.541(a)(5) only, we have interpreted the term “has resumed compliance” as meaning the provider has submitted the required application referenced in Sec. 424.541(a)(1)(ii) (for example, Form CMS-855 change of information). This means that a stay could end within a few days, allowing the provider to rapidly resume billing.

Considering the burden-reducing aspects of the stay concept, we proposed that its scope be expanded to cover other situations--one of which is where a provider submits a revalidation or change of information application that is rejected under Sec. 424.525(a)(1) or (2). Per these provisions, rejection is permissible if the provider does not furnish complete information on the application (or required supporting documentation under paragraph (a)(2)) within 30 calendar days of the date the Medicare contractor requested the missing or incomplete data or documentation. A deactivation often follows the rejection. Unlike cases where the provider did not submit the required revalidation or change of information at all, the provider in Sec. 424.525(a)(1) cases did submit the application, albeit incompletely. We believe it would be inconsistent to allow the more concerning action of application non-submission to be subject to a stay and have situations where the provider actually submitted the form to result in a deactivation. Therefore, we proposed to expand Sec. 424.541(a)(1)(i) to include instances where the provider's change of

information or revalidation application is rejected under Sec. 424.525(a)(1) or (2)).

In addition, current Sec. 424.541(a)(3) states that a stay of enrollment lasts no longer than 60 days from the postmark date of the notification letter, which is the effective date of the stay. We proposed two changes to this section. One was to delete existing Sec. 424.541(a)(3) and, in new Sec. 424.541(a)(3)(i), state that the effective date of a stay is, as applicable: (1) the date on which the provider's or supplier's non-compliance began; or (2) the date on which the provider's or supplier's change of information or revalidation application was rejected under Sec. 424.525. Considering our concerns about payments to providers when they are non-compliant, we no longer believe commencing the stay period upon the notification letter's postmark date is appropriate. The other was to propose in new Sec. 424.541(a)(3)(ii) that CMS may establish a stay of enrollment for any period up to a maximum of 60 days. This is consistent with current CMS practice, but we sought to make clearer that the CMS-assigned stay period need not be 60 days but can be any timeframe up to that point.

We previously noted the reference in Sec. 424.541(a)(2)(ii)(B) regarding claim submission eligibility, with Sec. 424.541(a)(2)(ii)(B)(2) referencing the end of the stay on or before the 60th day. We proposed to revise paragraph (a)(2)(ii)(B)(2) to replace the 60-day reference therein with the requirement that the stay must end on or before the expiration of the originally designated stay period. This would further clarify that the stay period can be less than 60 days. Meanwhile, Sec. 424.541(a)(5) states that a stay of enrollment ends on the date on which CMS or its contractor determines that the provider or supplier has resumed compliance with all Medicare enrollment requirements in Title 42 or the day after the 60-day stay period expires, whichever occurs first. Since, again, the stay period CMS has assigned may be less than 60 days, we proposed to change “60- day period” to “CMS-assigned stay period”. (d) Comments Received

We received the following comments on the provisions addressed in section VI.A.1.c.(1). of this final rule:

Comment: A number of commenters expressed concern about our reference to beneficiary attestations in proposed new Sec. 424.535(a)(8)(i)(D), believing this provision to be overly punitive. They stated that because of the potential for unintentional and innocuous misunderstandings and errors (as well as delays in mailing products and incorrect postal tracking), providers should be able to: (1) furnish input, documentation, and explanations to CMS; and (2) take corrective action before any revocation occurs. Some commenters added that attestations could contain unsubstantiated information given that patients may not understand or recall the items or services they received. Accordingly, the attestation alone should not be a basis for revocation without CMS performing a thorough investigation of the matter and assessing the accuracy of the attestation, with several commenters. Another commenter believed that CMS would use the provision to revoke massive numbers of providers and suppliers, with one commenter stating that stronger contractor oversight of providers would be a sounder approach.

Response: We appreciate these concerns but stress two things. First, this is not a new revocation ground; in fact, it has existed for many years. As indicated in the proposed rule and this final rule (and as correctly noted by a commenter), we currently have the authority to revoke a provider under Sec. 424.535(a)(8)(i) in the beneficiary attestation situations addressed in proposed Sec. 424.535(a)(8)(i)(D). We are merely adding a specific reference to situations in Sec. 424.535(a)(8)(i)(D) to reiterate our authority in this regard given the disconcerting increase in these scenarios. Second, and notwithstanding this authority, we do not revoke providers on this basis (or any other basis under Sec. 424.535(a)) as a matter of course. We only do so: (1) after a thorough investigation of the facts of the case; and (2) when it is truly warranted. Indeed, we fully recognize the impact of a revocation on a provider and do not take these measures lightly.

Concerning the commenters' apparent suggestion of an informal appeals process whereby documentation and an explanation could be furnished to CMS before a revocation occurs, we most respectfully disagree. Considering that we only undertake these revocations after a very careful and detailed analysis and when clearly warranted, we believe we must proceed with the revocation promptly to ensure that the Trust Funds are protected against further improper billing. We have always maintained that establishing an informal pre-revocation appeals process could encourage providers to disregard compliance with Medicare requirements until they are notified of the non-adherence, upon which they will remedy the issue and remain enrolled but then perhaps resume their prior behavior. In other words, allowing providers to always take corrective action and resume compliance before revocation gives them no incentive to remain adherent in the first place, which leaves the Medicare program at risk of billions of dollars in payments to non- compliant providers. We reiterate that with all revocations regardless of the reason, the provider has an opportunity to be heard via the appeals process in 42 CFR part 498.

Comment: Several commenters appeared to suggest that a stay of enrollment (rather than a revocation) be applied to situations involving proposed Sec. 424.535(a)(8)(i)(D).

Response: Although we were somewhat uncertain as to the context of the commenters' specific recommendation, we respectfully do not believe a stay of enrollment would be an adequate substitution for a revocation in a Sec. 424.535(a)(8)(i)(D) scenario. Stays are short-term measures designed to be a less serious action than a deactivation or revocation. As noted, we only undertake a revocation under Sec. 424.535(a)(8)(i) in exceptional cases due to the provider's concerning activity. Considering the seriousness of such behavior and the consequent need to protect the Trust Funds and beneficiaries for an extended period, we believe a revocation, rather than a stay, is the most appropriate CMS action.

Comment: Several commenters stated that Sec. 424.535(a)(8)(i)(D) appears to allow revocation based on a single beneficiary complaint or minor administrative error. Other commenters stated that Sec. 424.535(a)(8)(i)(D) scenarios should only result in revocation if there is a pattern of abuse, an intent to commit fraud, or a hindrance to patient care.

Response: We appreciate these comments. Section 424.535(a)(8)(i) scenarios have never required a pattern of conduct (unlike, for instance, Sec. 424.535(a)(8)(ii)), fraudulent intent, or patient care impact. On the other hand, Sec. 424.535(a)(8)(i) has never been intended to punish providers for small transgressions. Only in rare and exceptional circumstances have we ever revoked a provider under Sec. 424.535(a)(8)(i), and this will be the case for Sec. 424.535(a)(8)(i)(D). We recognize commenters' concerns and wish to assure stakeholders that we have no intention whatsoever of revoking legitimate providers under Sec. 424.535(a)(8)(i)(D) on spurious and unfair bases.

Comment: A commenter stated that a competitor's use of Sec. 424.535(a)(8)(i)(D) to generate false claims against the provider should itself mandate the competitor's revocation.

Response: We appreciate and will contemplate this suggestion as we continue our efforts to strengthen Medicare program integrity and the provider enrollment process.

Comment: Regarding Sec. 424.535(a)(8)(i)(D), a commenter sought clarification regarding: (1) how CMS will distinguish between potential fraud and a mere misunderstanding or delivery delay; (2) whether there is a formal appeals process to challenge such a finding; and (3) whether provider can continue operations during an investigation or will instead face immediate suspension of billing privileges.

Response: We thank the commenter for these comments and respond as follows. First, and as already stated, CMS will carefully investigate the facts in all potential Sec. 424.535(a)(8)(i)(D) situations. While we cannot address in detail the operational aspects of these investigations, we again assure providers that Sec. 424.535(a)(8)(i)(D) revocations will occur only when truly justified. Second, providers can appeal any Sec. 424.535(a)(8)(i) revocation under 42 CFR part 498. Third, if the commenter's use of “immediate suspension of billing privileges” refers to Medicare payment suspensions under 42 CFR 405.371, CMS cannot predict when the latter provision may or will be invoked. Nor can CMS advise the provider as to whether it can or should continue its full operations during a Sec. 424.535(a)(8)(i)(D) investigation; we believe this would be the provider's independent business decision. We can, though, state that if the provider is revoked after the investigation, it loses its Medicare billing privileges and the revocation will, per proposed Sec. 424.535(a)(8)(iii)(A), be retroactive to the earliest date of service on the claim or claims that is or are triggering the revocation.

Comment: A commenter stated that instead of an immediate revocation under Sec. 424.535(a)(8)(i), CMS could, while conducting an investigation, perform a pre-payment audit of the supplier's claims to ensure that CMS guidelines are being followed; this would facilitate continuity of patient care.

Response: We appreciate and may consider this suggestion as a possible action during our investigation.

Comment: A commenter supported our proposal to change the term “Part B or D drugs” in Sec. 424.535(a)(14) to “Medicare-covered drugs”.

Response: We appreciate the commenter's support.

Comment: A commenter supported our proposal to change the term “prescribe drugs” in Sec. Sec. 424.535(a)(13)(ii) and 424.530(a)(11)(ii) to “one or more drugs.”

Response: We appreciate the commenter's support.

Comment: A commenter opposed our proposed revision to Sec. 424.535(a)(13), stating that a provider on this basis could be revoked for isolated or unrelated state licensing issues without any educational opportunity or appeal.

Response: We appreciate this comment. While we are respectfully uncertain as to the type and timing of the educational opportunity to which the commenter refers, we reiterate that: (1) we always carefully examine the facts of the case before undertaking revocation action; and (2) providers can appeal a Sec. 424.535(a)(13) revocation per 42 CFR part 498.

Comment: A commenter stated that our expanded revocation reasons increase the likelihood of harsh penalties for minor or administrative errors.

Response: We respectfully disagree. We believe our revisions to Sec. 424.535(a)(8)(i), (a)(13), and (a)(14) are relatively minor; for example, the addition of Sec. 424.535(a)(8)(i)(D) is, as discussed, simply a reminder of our existing authority. We do not anticipate a significant increase in Sec. 424.535(a)(8)(i), (a)(13), and (a)(14) revocations stemming from our proposals, and we will continue to exercise great care and prudence in determining whether a revocation is warranted.

Comment: Several commenters supported our proposal to include certain application rejections within the scope of enrollment stays.

Response: We appreciate the commenters' support.

Comment: While favoring our proposed expansion of the stay of enrollment's applicability, several commenters requested that CMS to go further and require a stay in the situations described in Sec. 424.541 (and perhaps others) instead of giving the MACs discretion to impose a deactivation or revocation. A commenter stated that this would: (1) reduce burden on suppliers and better facilitate continued patient access to care; (2) reduce inconsistency among the MACs in these cases; (3) assist suppliers that are part of a group when their PTANs are deactivated upon the deactivation of the group's PTAN; and (4) allow payment for services performed. Other commenters recommended that CMS expand the reasons for which a stay can be imposed in lieu of many deactivation and revocation grounds (especially revocations with retroactive effective dates); the commenters stated that this would give suppliers time to correct the issue without the consequences of a revocation.

Response: We appreciate these comments. MACs generally do not have the discretion to choose whether to impose a stay, deactivation, or revocation. These actions are only imposed via CMS's direction (for instance, through Chapter 10 of CMS Publication 100-08 or specific CMS instruction to the MAC regarding a particular provider). Regarding the further expansion of stay of enrollment grounds, we thank the commenters' for their recommendation and may consider it for future rulemaking.

Comment: A commenter supported our stay of enrollment proposal but requested that CMS ensure the efficiency of the existing provider enrollment process regarding stays before adding additional grounds.

Response: We appreciate the commenter's support and are confident that the MACs can operationally accommodate our new stay of enrollment basis.

Comment: A commenter requested that CMS issue guidance to MACs requiring them to follow the stay of enrollment instructions in CMS Change Request (CR) 13449.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter stated that some providers that have a stay imposed against them do not receive a notification letter and therefore are: (1) unable to meet the 15-day rebuttal timeframe; and (2) uncertain as to the status of their enrollment when a claim is denied.

Response: Although we respectfully believe this comment is outside the scope of this final rule, we thank the commenter for bringing this to our attention as we continue to take steps to enhance the provider enrollment process.

Comment: Several commenters opposed the proposal to change the stay's effective date from the postmark date to the date the provider's: (1) non-compliance began; or (2) revalidation or change of information submission was rejected. They stated that this change would reduce the time the supplier has to research, address, and correct the issue causing the stay. A commenter added that: (1) our change would likely result in a stay that is more than 60 days, which would invalidate the stay of enrollment; and (2) a stay freezes

payment, meaning there is no need to back-date the stay.

Response: We appreciate the commenters' feedback and recognize the potential time reduction for remedial action by the provider. Yet we reiterate that using the postmark date permits the provider to receive payment for services furnished between the commencement of non- compliance (for example, the day after the date on which the revalidation application was due) and the postmark date. A core purpose of our provider enrollment proposals is to help halt payments to non- compliant providers, and we believe that having the postmark date as the stay effective date contradicts this. Also, this change would not result in a stay greater than 60 days because any 60-day long stay would begin on the non-compliance date. To illustrate, suppose a 60-day stay is imposed on a provider effective on the non-adherence date of April 1. The letter's postmark date is April 5. The stay would end on May 30, 60 days after the April 1 effective date. Regarding the final comment in the previous paragraph, we reemphasize most respectfully that the issue is not whether payment is frozen but whether the provider was entitled to payment in the first place; we believe the provider was not during the period between the date of non-compliance and the postmark date.

Comment: A commenter stated that a stay should only be applied when there is clear evidence of intent.

Response: We respectfully disagree. Even if a provider failed to timely submit a revalidation or change of information application for innocuous reasons, non-compliance still results and the provider is not entitled to payment absent the corrective measures permitted under Sec. 424.541.

Comment: Several commenters requested that CMS define “rejected” in the context of CMS' proposed stay of enrollment expansion (for example, whether it references the MAC's rejection of a revalidation application).

Response: The term “rejected” for purposes of 42 CFR part 424, subpart P (which includes Sec. 424.541) is defined in Sec. 424.502 and further described in Sec. 424.525.

Comment: A commenter: (1) supported our change from “60-day period” to “CMS assigned stay period”; and (2) questioned whether CMS' proposed clarification that a stay can be up to 60 days is intended to make Sec. 424.541 consistent with CMS CR 13449.

Response: We appreciate the commenter's support and note that our change is unrelated to CR 13449. It simply incorporates our existing position into Sec. 424.541.

Comment: Multiple commenters recommended that CMS fully implement the “state of enrollment” standard across all programs, including with respect to DMEPOS suppliers, to promote uniformity and fairness.

Response: We believe the commenters are referring to “stay of enrollment” rather than “state of enrollment.” While we are respectfully unclear as to the “programs” to which the commenter is referring, stays of enrollment can apply to all Medicare provider and supplier types, including DMEPOS suppliers.

Comment: Numerous commenters opposed the concept of retroactive revocations in general. Several commenter stated that CMS' existing and proposed grounds (as well as payment collection and any additions to the Medicaid termination database) should not be implemented in a particular case if an appeal is pending. A commenter stated that CMS' proposed reasons could result in unfair and unwarranted repayments to the Medicare program. Other commenters stated that retroactive revocations: (1) should only be invoked in cases of intentional or systemic provider fraud, waste, or abuse; and (2) could financially devastate providers.

Response: We appreciate the concerns expressed. Retroactive revocations are designed to recoup payments to which the provider was not entitled due to its non-compliance. That is, and potentially excluding situations under Sec. 424.541, once the provider is non- adherent to Medicare enrollment requirements, it cannot receive payment for services furnished beginning on or after the point the non- compliance began. Our allowance of prospective revocation dates for the grounds in proposed Sec. 424.535(g)(viii) through (xiv) has resulted in hundreds of millions of dollars in payments to non-compliant providers; we accordingly believe we have an obligation to the American taxpayers to stop this. Indeed, we estimated in the proposed rule that our proposed grounds would annually save nearly $2.2 billion in taxpayer monies.

Insofar as appeals, and most respectfully, we historically have not delayed implementing retroactive revocations or commencing collections while appeals are pending. As the appeals process takes some time, delayed implementation could result in many millions of dollars in continued payments to non-compliant providers as well as postponed repayment of monies to which Medicare and the taxpayers are entitled. Should the revocation be reversed on appeal, repayment of any collected monies can be facilitated. Concerning the final two comments, we respectfully reiterate that the core issue is payments to non-compliant providers regardless of whether fraud is involved; allowing prospective revocations in all-non fraud cases would, as it has, lead to additional billions of dollars to these providers. While we recognize the financial impact retroactive revocations can have on providers: (1) we again note that we only revoke providers when truly necessary; and (2) a provider's vigilant and constant compliance with Medicare enrollment requirements can help avoid revocations.

Comment: A commenter: (1) expressed doubt that CMS could determine precisely when a supplier fell out of compliance with Sec. 424.57(b) or (c); and (2) requested that CMS establish clear standards for when a retroactive revocation would apply.

Response: We thank the commenter for this feedback. As CMS always diligently and carefully reviews the facts and circumstances of all potential revocation cases before taking any action, we are confident we will be able to ascertain the point at which non-compliance commenced. As for the second comment, we are respectfully unclear as to the “standards” the commenter seeks. Our retroactive revocation grounds are detailed in Sec. 424.535(g)(2), and a number of our underlying revocation reasons in Sec. 424.535(a) contain factors that CMS considers in its revocation determinations.

Comment: Several commenters opposed retroactive revocations for non-compliance with a condition or standard in Sec. 424.57(b) or (c). A commenter stated that: (1) it could be difficult for CMS to determine the date of non-compliance (for purposes of establishing the effective date); and (2) a stay of enrollment would be a more suitable action considering that stays are designed to address non-compliance.

Response: While we appreciate the commenters' feedback, we reiterate our belief that CMS will be able to establish the proper effective date. As for the final comment, there are numerous levels of non-compliance, with some being significant enough to warrant revocation while others are not. Stays are intended to address the latter; they are generally limited to minor instances of non-compliance most typically involving failure to submit a revalidation or change of information application. In our view, violations of the DMEPOS conditions of payment and supplier standards are potentially more concerning than actions triggering a stay because they focus on supplier's

inherent ability to qualify as a DMEPOS supplier. If we applied a stay to all Sec. 424.57(b) or (c) violations, we believe suppliers would be less inclined to ensure constant adherence to the conditions and standards; they would know they could regain compliance at any time and be paid for services furnished during the stay. Given, too, that many of the supplier standards are designed to protect beneficiaries and prevent fraudulent activity, we believe retroactive revocations for Sec. 424.57(b) and (c) violations are warranted.

Comment: A commenter supported all of our proposed retroactive revocation bases except for that involving the submission of false or misleading information on the enrollment application. The commenter was concerned that this retroactive revocation ground could be based on a small or inadvertent error by the provider. The commenter requested that CMS tailor this basis to intentional misrepresentations; other commenters, too, stated that evidence of intent should be a prerequisite for CMS action. Another commenter stated that there should be exceptions to this practice, such as if the supplier misunderstood the question or data elements on the application.

Response: We appreciate the commenter's support. Regarding the retroactive revocation basis the commenters reference, revocations under Sec. 424.535(a)(4) are typically not imposed for minor, unintentional errors. Indeed, we take these actions infrequently and only when clearly appropriate. In light of the seriousness of falsifying information, we believe retroactive revocations are warranted in all of these cases.

Comment: Several commenters opposed retroactive revocations for failure to submit certain changes of information. A commenter stated that in change of ownership situations: (1) state licensure or IRS delays regarding name changes (or other circumstances outside the supplier's control) could delay the provider's report of the change to CMS; and (2) it could be difficult for a large entity to report a change to numerous MACs for all of its locations. A commenter stated that retroactive revocation in these types of situations would be unfair. The commenter added that retroactive revocations on this basis could discourage providers from reporting any change due to the harsh penalties. Other commenters stated that CMS should be flexible regarding the 30-day reporting period and account for situations and extenuating circumstances beyond the provider's control and use a “good-faith effort” standard.

Response: We thank the commenters for their feedback. As with all revocations, CMS under Sec. 424.535(a)(9) does not take action unless deemed truly necessary and only after a thorough examination of the circumstances of the case. This includes consideration of several factors outlined in Sec. 424.535(a)(9), such as the materiality of the data and, if reported, how belatedly. Nonetheless, while we recognize that not every potential Sec. 424.535(a)(9) case is the same: (1) it remains the provider's responsibility to timely report this information to us; and (2) numerous providers (including large entities enrolled with several MACs) do timely meet this requirement. The potential for revocation has not deterred the latter providers from fulfilling their reporting obligations, and we do not see this changing with a retroactive revocation application; in fact, we believe it will encourage providers to be more vigilant in their reporting responsibilities.

Comment: A commenter stated that providers cannot reasonably operate under the risk of losing payment for services already rendered in good faith, explaining that this would punish compliant providers and create fear and instability in the marketplace.

Response: We appreciate this concern but note that CMS has had retroactive revocation reasons in Sec. 424.535 for numerous years. During this period, and most respectfully, we have not seen widespread fear or instability in the provider community due to retroactive revocations. We again wish to assure providers that revocations (whether retroactive or not): (1) occur very infrequently when compared to the universe of well over 2 million Medicare-enrolled providers and suppliers; and (2) are not intended to harm or cause concern for legitimate providers but only to protect Medicare, the taxpayers, and the provider community at large from non-compliant ones.

Comment: Several commenters generally stated that: (1) technical or administrative errors should not lead to severe consequences for providers; (2) the increased number of revocations under our proposals could lead to a reduction of providers and suppliers in certain areas (including low billing practitioners) and thus harm or interrupt patient care; (3) CMS' proposed retroactive revocations are based on unwarranted reasons, are too broad, and lack guardrails.

Response: We appreciate these comments and note the following. First, and as previously indicated, we only revoke providers when justified and necessary under the circumstances; again, we recognize the significant consequences of revocations on providers and do not take action on merely spurious grounds. Second, we do not foresee a substantial increase in the number of revocations under our proposals. For instance, our addition of Sec. 424.535(a)(8)(i)(D) is merely a restatement of our existing authority under Sec. 424.535(a)(8)(i), not an expansion of it. Other revocation proposals, such as the change from Part B or D drugs to Medicare-covered drugs in Sec. 424.535(a)(13) and Sec. 424.530(a)(11) are, in our view, rather modest expansions intended to address specific vulnerabilities. Even if revocations were to increase, we have implemented many revocation reasons via rulemaking over the years and have not seen resulting access to care issues. Third, we detailed in the proposed rule and this final rule our rationales for our retroactive revocation bases; as we stated, we believe these grounds are warranted, specific, and necessary to prevent improper payments to non-compliant providers.

Comment: Existing Sec. Sec. 424.535(a)(4) and 424.530(a)(4) permit revocation or denial if the provider or supplier certified as “true” misleading or false information on the enrollment application to be enrolled or maintain enrollment in Medicare. Several commenters stated that before any Sec. 424.535(a)(4) revocation is imposed: (1) the provider should have an opportunity to research and respond to the matter, since the problem could be a minor, correctable omission; and (2) the case should be reported to the Supplier Audit & Compliance Unit (SACU), which the commenters stated presently handles these investigations. Another commenter stated that CMS should define “false or misleading” as used in Sec. 424.535(a)(4).

Response: We appreciate these comments. Respectfully, it was unclear whether they pertained to all Sec. 424.535(a)(4) revocations (regardless of whether they were retroactive) or were limited to retroactive revocations. In either case, we refer the commenters to our prior statements in this final rule regarding a pre-revocation quasi- appeals process and remedial action. If we were to require one in all potential Sec. 424.535(a)(4) situations, providers (especially fraudulent ones) might have little incentive to submit honest, accurate information since they could always correct it prior to any revocation.

Regarding investigations, CMS works closely with the National Provider

Enrollment Contractors (NEPCs) (which process DMEPOS supplier Form CMS- 855S enrollment applications (OMB Control No. 0938-1056)) in reviewing and investigating potential Sec. 424.535(a)(4) situations. As for the final comment, we most respectfully believe that the terms “false” and “misleading” have been plain on their face since the promulgation of Sec. 424.535(a)(4) years ago.

Comment: Several commenters expressed concern about Sec. 424.535(i), stating that CMS should only use this authority in egregious situations. A commenter stated that it would be unfair to revoke all locations of a large supplier (especially retroactively) based on, for example, a minor instance of non-compliance at one of its locations. Another commenter stated that each site should be examined on its own merits rather than directly tied to the enrollment status of the revoked provider unless systemic issues exist across the larger provider entity. An additional commenter stated that CMS should only revoke non-compliant locations rather than the provider's other ones, while another stated that the rule is unclear as to whether retroactive revocations would be applied to other supplier locations under the same TIN or to all supplier locations under a common ownership.

Response: We appreciate these comments. Section 424.535(i) has been effective since 2019. We have generally only invoked this provision in exceptional circumstances and not for minor matters. The overwhelming preponderance of our revocations under Sec. 424.535 have been limited to the non-compliant enrollment/location in question without affecting the provider's other enrollments. In fact, and as we stated in the September 10, 2019, final rule with comment period titled, “Medicare, Medicaid, and Children's Health Insurance Programs; Program Integrity Enhancements to the Provider Enrollment Process” (84 FR 47794), Sec. 424.535(i) is not an “all or nothing” provision. We do not automatically revoke all of the provider's other enrollments in Sec. [thinsp]424.535(i) situations. We instead apply and consider a series of factors outlined Sec. [thinsp]424.535(i) to each individual enrollment in determining whether that enrollment should be revoked, too.

Concerning the commenters' final comment, CMS can apply Sec. [thinsp]424.535(i) to any and all of a provider's enrollments-- including those under different names, numerical identifiers, or business identities.

Comment: Several commenters stated that fraudulent activity tends to be limited to a small number of parties and not the preponderance of providers (such as community-based suppliers). Accordingly, a commenter stated, revocation policies should not indiscriminately penalize all suppliers--potentially disrupting care to thousands of beneficiaries who rely on otherwise compliant suppliers.

Response: We appreciate this comment but stress that our revocation provisions would only impact non-compliant providers. They are not meant to penalize providers that adhere to Medicare enrollment requirements.

Comment: As a concluding, overarching general comment, numerous commenters believed CMS's proposals were overly punitive towards legitimate providers. They believe that the provisions lacked due process and failed to allow providers and suppliers to correct honest mistakes before CMS takes action, with: (1) a commenter contending that the proposals would not deter fraud; and (2) another commenter stating that certified providers and certified suppliers are allowed to correct standard and condition-level deficiencies. Commenters stated that revocations in general unfairly occur based on minor transgressions and financially devastate providers. These commenters added that even if the revocation is overturned on appeal, the provider may be unable to economically recover and the burden on Medicare contractors in processing these matters can be significant. Commenters further stressed that any sanctions should be commensurate with the violation. Another commenter stated that CMS should: (1) consider the proposals' unintended consequences and update them to ensure that they exclude bad actors; (2) consider the burdens faced by solo practitioners, small groups, or independent providers; and (3) apply enforcement discretion when the totality of facts surrounding scrutinized activity does not demonstrate an intent to commit fraud or abuse. Concerning this third comment, another commenter stated that retroactive revocations should not occur if the harm to the supplier outweighs the harm to the Medicare program.

Response: We appreciate these comments and again recognize the concerns expressed by many provider and supplier types (such as individual physicians, group practices, etc.). We reiterate our statements regarding: (1) our practice of only revoking providers when truly warranted and after careful investigation; (2) the need for CMS to take prompt action to prevent payments to non-compliant providers; and (3) the reasons for no existing pre-revocation appeals process. We believe due process rights are afforded by the appeals procedures in 42 CFR part 498 and that revocations have indeed helped stem fraud, waste, and abuse and kept problematic parties out of the Medicare program; this is a central purpose of our proposed revocation provisions. In addition, we note that stays of enrollments and deactivations have been utilized in situations where a revocation would be too severe an action or otherwise not commensurate with the violation.

Regarding the commenters' final two comments, we respectfully remind stakeholders that enforcement action cannot be limited to situations where fraud is (or was intended to be) involved. If we did place this limit, this would permit non-compliant suppliers to remain enrolled, with billions of dollars in continued payments thereto, so long as there is no fraud. As already noted, providers must always remain adherent to Medicare enrollment requirements, and they are not entitled to payment if they are non-compliant, even if no fraud is involved. In this same vein, any improper payment harms the Medicare program. While we understand the harm that providers can experience with a revocation and, as already stated, do not revoke providers unless clearly necessary, it is ultimately the provider's responsibility to ensure constant adherence to Medicare enrollment requirements. We have an obligation to place the interests of Medicare beneficiaries, the program at large, and the taxpayers at the highest level; it is with this principle in mind that we have undertaken our program integrity measures over the years.

After reviewing these comments, we are finalizing the proposals addressed in section VI.A.1.c.(1)(a) through (c) without modification. (2) New Deactivation Authority

Regulations regarding the provider enrollment concept of deactivation are addressed in Sec. 424.540. Deactivation means that the provider's or supplier's billing privileges are stopped but can be restored (or “reactivated”) upon the submission of information required under Sec. 424.540. One reason for which CMS can deactivate a provider or supplier is that the provider or supplier has not submitted any Medicare claims for 6 consecutive months. A core purpose of this provision is to prevent dishonest parties from: (1) deliberately obtaining multiple numbers so they could keep one `in reserve' [for future use] if their active billing number is subject to a payment suspension; and (2) obtaining information about

discontinued providers or suppliers and then, for example, using the Medicare billing number of a deceased physician Shutting down inactive billing numbers helps stem such activities. Indeed, deactivating the provider's billing number enables CMS to not only prevent it from being accessed by other parties but also confirm via the deactivation process whether the provider or supplier is in fact operational--specifically, whether the provider responds with a reactivation application.

The deactivation concept has only applied to Medicare billing privileges rather than the ordering, certifying, and referring of Medicare services and items. Yet improper ordering, certifying, or referring can pose significant risks to the Medicare program and its beneficiaries, and we have established a number of provider enrollment requirements to prevent this activity.

These include the following:

Under Sec. 424.507(a) and (b), physicians and practitioners who wish to order or certify certain Medicare services and items must either opt-out of Medicare (in accordance with 42 CFR part 405, subpart D) or enroll in Medicare. Even if the individual does not seek to bill Medicare and only wants to order or certify the services and items addressed in Sec. 424.507, the person must still enroll in Medicare by submitting a Form CMS-855O application (Medicare Enrollment Application--Registration for Eligible Ordering and Referring Physicians and Non-Physician Practitioners (OMB control number. 0938-1135)). This enables CMS to screen the person to ensure that all Medicare requirements are met, hence reducing the payment safeguard risk that an unvetted physician or practitioner intent on fraudulent or abusive conduct can order or certify these services or items.

Under Sec. 424.535(a)(21), CMS can revoke a physician's or eligible professional's enrollment if the individual has a pattern or practice of ordering, certifying, or referring Medicare Part A or B services or items that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements. This provision was established in response to instances of fraudulent or unnecessary ordering, certifying, and referring of Medicare services and items.

Under Sec. 424.542(a), a physician or other eligible professional who has had a felony conviction within the previous 10 years that CMS determines is detrimental to the best interests Medicare and its beneficiaries may not order, refer, or certify Medicare services or items. As with Sec. 424.535(a)(21), the aim of Sec. 424.542(a) is to prevent fraud, abuse, and beneficiary harm.

All the foregoing signifies that CMS takes improper and abusive ordering, referring, and certifying no less seriously than improper and abusive billing. The former can be as harmful to Medicare and its beneficiaries as the latter. For this reason, we do not believe that important program integrity safeguards such as deactivation must be limited to billing situations, and we accordingly proposed to address this topic in new Sec. 424.547.

In Sec. 424.547(a)(1)(i) and (ii), we proposed that CMS may deactivate a physician's or practitioner's ability to order, certify, or refer the Medicare services or items described in Sec. 424.507(a) and (b) if the individual--

Is enrolled via the Form CMS-855O application solely to order, certify, or refer Medicare services or items; and

Has not been listed as the ordering, certifying, or referring individual on a Medicare Part A or B claim received in the previous 12 consecutive months.

To distinguish deactivations of billing privileges from those of ordering, certifying, and referring capabilities, we proposed in new Sec. 424.547(a)(2) that for purposes of Sec. 424.547 only, the term “deactivate” means that the physician's or practitioner's ability to order, certify, or refer Medicare services or items has been stopped but can be restored upon the submission of updated information. In a similar vein, because the current definition of deactivation in Sec. 424.502 is limited to billing privileges, we proposed to add the following language to the beginning of this definition: “Except in the situations described in Sec. 424.547”.

We also proposed to duplicate several of Sec. 424.540's deactivation and reactivation procedures in new Sec. 424.547 as follows:

In Sec. 424.547(b)(1), we proposed that for a deactivated physician or practitioner to reactivate their ability to order, certify, or refer Medicare services and items, the individual must recertify that their enrollment information currently on file with Medicare is correct, furnish any missing information as appropriate, and be in compliance with all applicable enrollment requirements in Title 42.

In Sec. 424.547(b)(2), we proposed that notwithstanding Sec. 424.547(b)(1), CMS may, for any reason, require a deactivated physician or practitioner to, as a prerequisite for reactivating the ability to order, certify, or refer, submit a complete Form CMS-855O application.

In Sec. 424.547(c), we proposed that the effective date of a reactivation of the ability to order, certify, or refer Medicare services and items under Sec. 424.547 is the date on which the Medicare contractor received the individual's reactivation submission that was processed to approval.

In Sec. 424.547(d), we proposed to clarify that a physician or practitioner may not order, certify, or refer the Medicare services or items referenced in Sec. 424.507(a) and (b) while deactivated under Sec. 424.547.

We received the following comments on this proposal:

Comment: Several commenters expressed concern about the impact of our deactivation provision in proposed Sec. 424.547 on HHAs and hospices. The commenters stated that it could prevent HHAs and hospices from billing for claims when the ordering or certifying provider was deactivated for 12 months of non-certifying, especially if the individual only performs this function on a very infrequent basis and is unaware of the 12-month provision. Commenters recommended that CMS ensure that: (1) databases identifying eligible physicians/ practitioners for ordering/certifying purposes are updated; (2) use careful discretion in exercising this authority, with particular consideration for physicians employed by hospices; (3) perform targeted outreach to potentially impacted physicians (including notices thereto as they approach the 12-month period and allowing them to indicate whether they wish to remain active); (4) ensure that the reactivation process is efficient with minimal delays; and (5) furnish training to HHAs and hospices regarding the new requirement. Another commenter stated that CMS' provision could inadvertently impact physicians who treat Medicaid or Medicare Advantage patients and requested an exceptions process (or a more nuanced threshold) that allows providers to demonstrate active practice via means other than Part B billing. An additional commenter stated that non-billing is not indicative of fraudulent activity.

Response: We thank the commenters for their feedback. As we explained in the proposed rule and this final rule, this provision is intended to prevent unscrupulous parties from accessing unused billing numbers. This is the same motivation that triggered our promulgation of Sec. 424.540(a)(1) in 2006, which permitted a provider's deactivation for 12 consecutive months of non-billing (later revised to 6 months). While the final commenter is correct that non-billing is not necessarily indicative of fraudulent

behavior, the improper accessing of unused billing numbers can be.

As for the other comments, we understand the concerns expressed about our proposal. As we implement this requirement, we will: (1) consider the commenters' third and fifth recommendations; (2) ensure that appropriate databases are updated; and (3) maintain the efficiency of the reactivation process. Regarding the second recommendation, our deactivation authority under Sec. 424.540(a)(1) has always been discretionary, and the same will be true with Sec. 424.547; we will exercise our authority only after careful consideration and when deemed necessary. With respect to the comment regarding Medicaid and Medicare Advantage, Sec. 424.547's purview is limited to individuals: (1) enrolled via the Form CMS-855O solely to order, certify, and refer certain Medicare services and items; and (2) who do not themselves bill Medicare for services and items furnished. Being exclusively a Medicare fee-for-service provision of a rather restrictive scope, we do not believe it will have a significant impact on Medicaid and Medicare Advantage supplier enrollees. Given, moreover, the critical program integrity safeguards of this provision, we are respectfully unable to carve out regulatory exceptions to Sec. 424.547's application.

Comment: A commenter stated that our deactivation provision is contrary to CMS regulations because there is no requirement that hospice physicians or physician members of the interdisciplinary group (“IDG”) must order, certify, or refer for hospice services. The commenter recommended that CMS: (1) delay this proposal to give hospices time to prepare; or (2) exempt hospice providers from this provision or apply it only to providers in higher-risk areas.

Response: While we appreciate this comment, our proposal does not in and of itself require any individual to order, certify, or refer services for payment to be made; any such requirements are addressed in other CMS regulations. It instead involves the separate issue of a lack of ordering, certifying, and referring over a 12-month period by those enrolled via the Form CMS-855O and the consequent program integrity risk due to dormant provider numbers. Due to this risk, we must respectfully decline to delay this requirement or to exempt certain physicians or practitioners therefrom. Nonetheless, we note again that this provision is discretionary, and stakeholders should not assume that deactivation will always occur in Sec. 424.547 situations.

As a final point of clarification, we reiterate that Sec. 424.547 applies to all the services and items referenced Sec. 424.507. It is not limited to, for example, home health services.

Comment: A commenter believed our deactivation proposal could harm practitioners with low Medicare billing volumes but who deliver quality care, adding that any disruption in enrollment status could interrupt patient care.

Response: We thank the commenter for this feedback. However, our deactivation proposal involves ordering and certifying physicians and practitioners and not those who bill Medicare.

After reviewing these comments, we are finalizing this proposal without modification. (3) Liability for Furnished Information

As already mentioned, current Sec. Sec. 424.535(a)(4) and 424.530(a)(4) permit revocation or denial if the provider or supplier certified as “true” misleading or false information on the enrollment application to be enrolled or maintain enrollment in Medicare. We have encountered situations where a provider has another individual complete an enrollment application on the provider's behalf (for example, officer manager). The individual furnishes false or misleading information thereon, and the provider (or, if applicable, the provider's authorized official) signs the application. The provider then later states it was not responsible for the submitted false data because the other person, not the provider, had furnished it. This assertion is incorrect. Longstanding CMS policy is that the enrolling provider bears ultimate legal responsibility for the accuracy and thoroughness of all data on the application. The provider cannot transfer this responsibility to another party even if the latter completed the application. To emphasize this point, we proposed to add new paragraph (d)(10) to Sec. 424.510. Paragraph (d)(10) would state that all providers and suppliers are legally responsible for the accuracy, completeness, and truthfulness of all information they provide on or with their applications, regardless of whether another party completed the application.

We received the following comments on this proposal:

Comment: Several commenters supported our proposed revision to Sec. 424.510 emphasizing that providers and suppliers are legally responsible for the accuracy, completeness, and truthfulness of all information they provide on or with their applications, regardless of whether another party completed the application. A commenter stated that this is consistent with CMS' longstanding position on the matter.

Response: We appreciate the commenters' support.

Comment: Several commenters opposed our revision to Sec. 424.510(d)(1) regarding provider responsibility for submitted data. A commenter stated that it is unfair to shift legal liability to providers for all application information since providers often rely upon billing services and outside consultants. The commenter added that this puts small suppliers at risk of revocation for clerical errors they did not commit. Another commenter stated that providers must often rely upon third parties to accumulate data and that there are limits to the provider's ability to confirm the information's accuracy. The commenter noted that a provider should not be unduly penalized when: (1) a provider makes a good faith effort to accurately complete the application; and (2) the inaccuracy was the third party's fault.

Response: While we appreciate these comments, we respectfully do not believe our Sec. 424.510(d)(1) addition shifts liability to the provider, for the ultimate responsibility for submitting truthful and accurate information has always rested with the provider. The provider, in fact, attests to the accuracy of the submitted data via the Form CMS-855 certification statement. We recognize that some providers use third-parties for application preparation and information gathering purposes. This is the provider's independent business decision. Yet this decision comes with the possibility that data from the third-party may be inaccurate. Should the provider elect to assume this risk, it also assumes the responsibility for the data's correctness when submitting it to Medicare. Indeed, if we absolved these types of providers from all liability for inaccurate third-party data, the provider would have no motivation to confirm it is correct or, to avoid responsibility, would always have a third-party collect and furnish the information. As we have regularly stated in the past, incorrect enrollment data can result in inaccurate payments (and even fraud, waste, and abuse), and the provider--not a third-party--must ensure its correctness.

After reviewing these comments, we are finalizing this proposal without modification. (4) Submission of Documentation

One of the many critical functions of MACs is to validate the accuracy of the

information the provider furnishes on its enrollment application (for example, the provider states it is licensed, but the MAC finds that the license has expired). If submitted data is incorrect, the potential exists for improper payments to be paid to non-compliant or unqualified providers and suppliers. Although MACs can validate certain data via electronic means, verifying documentation from the provider is sometimes needed. Existing Sec. 424.510(d)(2)(ii), (iii)(A), and (iii)(B) state that each submitted provider enrollment application must include the following:

Documentation to identify the provider, such as proof of the legal business name, practice location, etc.

All applicable Federal and State licenses and certifications.

Documentation associated with regulatory and statutory requirements needed to establish a provider's eligibility to furnish Medicare covered items or services.

This and other documentation is also identified on the Form CMS-855 enrollment applications as materials the provider must submit with its application.

Notwithstanding the documents that providers must currently submit, we remain concerned about the MACs' ability to verify all information on the applications they receive. This is especially true regarding the provider's ownership and management. Consistent with sections 1124 and 1124A of the Act, providers must report this data on their enrollment applications. Inaccurate ownership and managerial information, like other reported data, could result in improper payments (for instance, a provider's owner is excluded by the OIG, meaning the provider is not entitled to Medicare payments). To strengthen our ability to validate ownership and managerial data--as well as other information that CMS or the MAC may be unable to verify through current means--we proposed in new Sec. 424.510(d)(2)(iii)(C) that CMS may require the submission of any other documentation needed to validate the data on the enrollment application; this includes, but is not limited to, documentation regarding the provider's ownership or management.

We received the following comments on this proposal:

Comment: Several commenters supported our change to Sec. 424.510 regarding CMS and MAC documentation requests. However, a commenter requested clear guidance (both sub-regulatory and via the contractors' requests to providers) on what documentation is required to better ensure consistency among the MACs. Another commenter requested grace periods or additional technical guidance for providers in Puerto Rico.

Response: We appreciate the commenters' support. We will instruct MACs on what documentation to request and when. Concerning the final comment, we are respectfully unclear as to the types of grace periods and technical guidance the commenter is requesting. We will ensure, though, that providers (regardless of their location) understand what documentation is or may be required.

After reviewing the comments, we are finalizing this proposal without modification. (5) Reassignment Effective Dates

In the provider enrollment context, and consistent with 42 CFR 424.80, reassignment of benefits refers to the scenario where an individual physician or non-physician practitioner has granted another Medicare-enrolled provider or supplier the right to receive payment for the physician's or non-physician practitioner's services. Existing Sec. 424.522(a) states that a reassignment is effective beginning 30 days before the Form CMS-855R (OMB control number 0938-1179) is submitted if all applicable requirements during that period were otherwise met. However, the Form CMS-855R has been discontinued. Reassignments are now facilitated via information furnished on the Form CMS-855I (OMB control number 0938-1355) and Form CMS-855B (OMB control number 0938-1377). Accordingly, we must revise Sec. 424.522(a) to reflect both the elimination of the Form CMS-855R and the need to establish a new reassignment effective date.

Under current Sec. 424.520(d)(1)(i) and (ii), the effective date of billing privileges for physicians and non-physician practitioners is the later of--

The date of filing of a Medicare enrollment application that a MAC subsequently approved; or

The date the individual first began furnishing services at a new practice location.

Notwithstanding Sec. 424.520(d)(1), physicians and non-physician practitioners under Sec. 424.521(a)(1) may retroactively bill for services when they have met all program requirements and services were provided at the practice location for up to--

30 days before their effective date if circumstances precluded enrollment in advance of providing services to Medicare beneficiaries; or

90 days before their effective date if a Presidentially declared disaster under the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. 5121 through 5206 (Stafford Act) precluded enrollment in advance of furnishing services to Medicare beneficiaries.

As reassignments are often initiated at the same time a physician or practitioner enrolls in Medicare via the Form CMS-855I, we believe the effective dates of the initial enrollment and the reassignment should be determined in the same manner. Hence, we proposed to modify Sec. 424.522(a) such that the reassignment's effective date and the ability to retroactively bill for services mirror the provisions in Sec. 424.520(d)(1) and 424.521(a)(1). New Sec. 424.522(a)(1) would state that the reassignment's effective date is the later of the two dates identified in Sec. 424.520(d)(1)(i) and (ii). New Sec. 424.522(a)(2) would state that retrospective billing in accordance with a reassignment is permissible if the circumstances in Sec. 424.521(a)(1) are applicable.

We received the following comment on this proposal:

Comment: A commenter requested that CMS increase the retroactive billing date to 60 days before their effective date instead of 30 days. The commenter stated that this would: (1) ensure that providers have sufficient time to balance administrative requirements for multiple enrollments and multiple providers; and (2) align with the maximum 60- day stay of enrollment period.

Response: We appreciate this commenter's request but most respectfully must decline it. If we pushed the date back to 60 days, we may be unable to determine whether the provider was compliant with enrollment requirements between the 31st and 60th days, which would be well before the provider submitted their enrollment application. Also, enrollment stays are very different from billing effective dates. The former effectively stops payment due to the provider's non-compliance, whereas the latter addresses the point from which a provider can begin billing. It is therefore unnecessary that their applicable timeframes match.

After reviewing this comment, we are finalizing our proposed provision without modification. (6) DMEPOS Liability Insurance

Section 424.57(c) outlines a number of standards that DMEPOS suppliers must meet to become or remained enrolled in Medicare. One the standard, codified in Sec. 424.57(c)(10), requires the supplier to have a comprehensive

liability insurance policy of at least $300,000 that covers the supplier's place of business, customers, and employees. We have seen instances where the insurance policy is signed by a supplier employee who did not appear to have the authority to act on the supplier's behalf. Considering the importance of the liability insurance requirement, we must ensure that the supplier, through its signature on the policy, is bound by its terms. Accordingly, we propose to modify Sec. 424.57(c)(10) such that an “authorized official” of the supplier (as that term is defined in Sec. 424.502) must sign the liability insurance policy.

We received the following comments on our proposal:

Comment: Several commenters opposed our proposal to require an authorized official to sign the comprehensive liability insurance policy. A commenter stated that the authorized official's signature on the enrollment application is sufficient since the insurance policy must be submitted as part of the application process. Another commenter stated that this requirement could be problematic for larger, multi- layered providers because the authorized official may not be the provider's CEO or president; that is, the authorized official might not be the same person responsible for maintaining the company's liability insurance. An additional commenter stated that instead of requiring an authorized official to sign the policy, CMS should permit an approved member of management with signature authority to do so. Another commenter stated that because some suppliers work with brokers on all insurance requirements, it may not be possible for them to comply with this requirement.

Response: We appreciate these comments and respond as follows.

First, and strictly and solely for purposes of this particular requirement, a supporting document is distinct from the Form CMS-855 application itself. A person's signature on one of these two documents does not, with respect to provider enrollment, automatically confer an authority to sign the other; for instance, an individual who currently signs the liability insurance policy may not qualify as an authorized official under Sec. 424.502. In light of the importance of the liability insurance policy, we must ensure that the individual(s) signing both documents have the authority to do so. We cannot presume that the authorized official's signature on the Form CMS-855 means the liability insurance policy signer was similarly authorized.

Second, the definition of “authorized official” does not require an individual to explicitly have the title of chief executive officer or president per se. The person must merely have the authority described in that definition. Moreover, a provider can have as many authorized officials as it wishes so long as the authorized official definition is met for each. (Indeed, larger providers often have multiple authorized officials.) This means that one authorized official could sign the Form CMS-855 and another the liability policy. They need not be the same person. We believe this will help suppliers comply with this requirement.

Third, we are most respectfully uncertain as to the third commenter's reference to “approved member of management with signature authority.” If the commenter is stating that any manager should be able to sign the liability policy, this would defeat the purpose of our requirement, since--unless the person is an authorized official--we have no means of knowing whether the person is truly authorized to sign policy and, possibly, who the person even is. By requiring an authorized official to sign the liability policy, we can identify the signer (since the person will be reported on the Form CMS-855) and thereby screen the individual as we do all other authorized officials.

Fourth, we appreciate the commenter's feedback regarding broker use. Yet we reiterate that the provider can have an indefinite number of authorized officials, meaning we believe the provider will be able to have at least of them sign the policy even if a broker is utilized.

After reviewing these comments, we are finalizing this proposal without modification. (7) Adverse Legal Actions

Consistent with Sec. 424.516(b) through (d), certain Medicare provider and supplier types, such as DMEPOS suppliers, must report any adverse actions (for example, felony convictions) imposed against them, their owners, managing employees or organizations, or corporate directors or officers within 30 calendar days of the action. However, other provider and supplier types have 90 days to report this information. To make these timeframes consistent and to ensure that we are alerted much sooner of the concerning actions, we proposed to revise Sec. 424.516(e)(1) to require all provider and suppliers, regardless of type, to report adverse legal actions to us within 30 days.

We received the following comments on this proposal:

Comment: Several commenters opposed our requirement for all providers and suppliers to report adverse action changes within 30 days, with one commenter stating that it may create compliance burdens without clear evidence of improved oversight outcomes.

Response: We appreciate these comments but believe our proposal will indeed strengthen program integrity and provider oversight. The shorter reporting timeframe will help notify CMS much sooner of provider activity that could pose a serious risk to the Medicare program. We also reiterate that certain other provider and supplier types have long been subject to a 30-day adverse action reporting requirement, yet we are unaware of any undue burden that has resulted therefrom. We believe the same will hold true with our expansion of Sec. 424.516(e)(1).

After reviewing these comments, we are finalizing this proposal without modification. (8) Certain Modifications to Provider Enrollment Paragraph References (Sec. Sec. 424.535(a)(23) and 424.530(a)(18)) and Enrollment Provisions (Sec. 424.205))

Under Sec. Sec. 424.535(a)(23) and 424.530(a)(18), CMS may revoke or deny a Medicare Diabetes Prevention Program (MDPP) supplier's enrollment if the supplier violates an enrollment condition or standard in Sec. 424.205(b) or (d). Since the promulgation of Sec. 424.205 in 2017: (1) Sec. Sec. 424.535(a)(23) and 424.530(a)(18) have been established; and (2) there have been revisions to the organizational structure of Sec. 424.205. To ensure that Sec. Sec. 424.535(a)(23), 424.530(a)(18), and 424.205 accurately reflect correct paragraph designations, we proposed changes to all three.

First, the MDPP enrollment standards are now in Sec. 424.205(c) rather than Sec. 424.205(d). We thus proposed that references to paragraph (d) would be changed to paragraph (c) in the following regulatory provisions:

Sec. 424.535(a)(23)(v).

Sec. 424.530(a)(18)(v).

Definition of “Coach eligibility end date” in Sec. 424.205(a) (reference to (d)(5) would change to (c)(5)).

Sec. 424.205(b)(4) (reference to (d)(5) would change to (c)(5)).

Sec. 424.205(b)(6).

Sec. 424.205(c)(3) (reference to (d)(5) would change to (c)(5)).

Sec. 424.205(c)(6) (reference to (d)(4) would change to (c)(4)).

Sec. 424.205(c)(8) (reference to (d)(8)(i) would change to (c)(8)(i)).

Sec. 424.205(c)(8)(ii) (references to (d)(8)(i)(B) and (d)(8)(i)(C) would change to (c)(8)(i)(B) and (c)(8)(i)(C), respectively).

Sec. 424.205(c)(10) (reference to (d)(8) would change to (c)(8)).

Sec. 424.205(c)(11)(iii).

Sec. 424.205(d)(2) (reference to (d)(5) would change to (c)(5)).

Sec. 424.205(g)(1)(ii).

Sec. 424.205(g)(1)(v)(A) (reference to (d)(3) would change to (c)(3)).

Second, the following references in Sec. 424.205 would be revised to reflect that section's present structure.

In paragraph (c)(3), (e)(1) would change to (d)(1).

In paragraph (c)(12), (g) would change to (f).

In paragraph (c)(15), (g) would change to (f).

In paragraph (d)(2), (e)(1) would change to (d)(1).

In paragraphs (g)(1)(i)(A) and (B), (h)(1)(i) would change to (g)(1)(i).

In paragraphs (g)(1)(ii)(A) and (B), (h)(1)(ii) would change to (g)(1)(ii).

In paragraphs (g)(1)(v)(B) and (B)(2), (h)(1)(v) would change to (g)(1)(v).

Third, current Sec. 424.205(g)(1)(i)(A) and (B) state that the MDPP supplier's failure to meet the conditions in paragraph (b) is considered an enrollment denial or revocation under, respectively, Sec. Sec. 424.530(a)(1) or 424.535(a)(1). Likewise, Sec. 424.205(g)(1)(ii)(A) and (B) state that a failure to meet the standards in paragraph (d) is considered a denial or revocation, under, respectively, Sec. Sec. 424.530(a)(1) or 424.535(a)(1). We proposed to add “or Sec. 424.530(a)(18)” after paragraph references to Sec. 424.530(a)(1) and “or Sec. 424.535(a)(23)” after references to Sec. 424.535(a)(1). This is because in these situations we can deny or revoke under either the (a)(1) provisions or (a)(18)/(23).

We received no comments on these proposed changes and are therefore finalizing them without modification. (9) Deactivation Reason Clarification

Section 424.550(b) addresses “change(s) in majority ownership” (CIMO) (as that term is defined in Sec. 424.502) involving home health agencies (HHA) and hospices. Unless an exception applies, an HHA or hospice undergoing a CIMO must enroll in Medicare as a new HHA or hospice and undergo a state survey or accreditation. Since, in this situation, the seller will be departing the Medicare program, Sec. 424.540(a)(8) permits CMS to deactivate the seller's billing privileges. However, Sec. 424.540(a)(8) currently only references sellers in an HHA CIMO and not those in a hospice CIMO. As a technical clarification, we thus proposed to include the latter within the scope of Sec. 424.540(a)(8).

We received no comments on this proposal and are thus finalizing it without change. 2. Medicaid and CHIP Enrollment and Termination

The Medicaid program (title XIX of the Act) is a joint Federal and State health care program that (as of October 2024) covers more than 72 million low-income individuals. States have considerable flexibility when administering their Medicaid programs within a broad Federal framework, and programs vary from State to State. The Children's Health Insurance Program (CHIP) (title XXI of the Act) is a joint Federal and State health care program that (as of October 2024) provides health care coverage to over 7 million children in families with incomes too high to qualify for Medicaid, but too low to afford private coverage.

In operating Medicaid and CHIP, and as required by sections 1902(a)(78) and 2107(e)(1)(D) of the Act, respectively, each State requires providers to enroll in order to furnish, order, prescribe, refer, or certify eligibility for Medicaid or CHIP items or services in that State.\47\ States may also establish their own provider enrollment requirements which must be met in addition to the applicable Federal provider enrollment requirements. Similar to Medicare provider enrollment, the purpose of the Medicaid and CHIP provider enrollment processes is to ensure that providers: (1) meet all Medicaid or CHIP requirements (and any other State-specific or Federal requirements); (2) are qualified to furnish, order, prescribe, refer, or certify Medicaid and CHIP services, items, and drugs; and (3) are eligible to receive payment, where applicable.

\47\ Section 1902(kk)(7) of the Act also requires physicians and other eligible professionals who order or refer Medicaid services and items to be enrolled in Medicaid. This requirement is made applicable to CHIP via section 2107(e)(1)(G) of the Act.

Different States may have different provider enrollment processes in operating their Medicaid and CHIP programs. However, all States must comply with Federal Medicaid and CHIP provider enrollment statutory and regulatory requirements, including those in part 455, subparts B and E. One requirement, outlined in section 1902(a)(39) of the Act (and applicable to CHIP in accordance with section 2107(e)(1)(C) of the Act) is that the State must deny or terminate a provider's Medicaid or CHIP enrollment if the provider is--

Terminated under the Medicare program, or the Medicaid program or CHIP of any other State; and

Currently included in the termination database under Sec. 455.417.

CMS established this termination database in accordance with sections 1902(kk)(8) and 1902(ll) of the Act. These two sections are summarized as follows:

Require the State to report the termination of a provider under Medicaid or CHIP to the Secretary within 30 days after the effective date of the termination. However, this reporting requirement is limited to terminations for reasons specified in Sec. 455.101, which, in turn, are restricted to terminations “for cause” (including, but not limited to, terminations for reasons relating to fraud, integrity, or quality);

Provide that within 30 days of receiving notification of a Medicaid or CHIP provider termination, the Secretary must review the termination and, if the Secretary determines appropriate, include the termination in any database or similar system developed under section 6401(b)(2) of the Affordable Care Act.

CMS has developed and currently operates a database in accordance with these statutory provisions. It contains information on Medicaid and CHIP terminations and Medicare revocations. It enables a State to: (1) review Medicaid and CHIP terminations in other States, as well as Medicare revocations; and (2) to deny enrollment under Sec. 455.416(c) or take its own termination action against a provider if the latter is also enrolled in the State.

The previously referenced provisions of section 1902(a)(39) are currently incorporated in Sec. 455.416(c), though with one inadvertent exception. Rather than stating that the provider--along with being in the termination database--must be terminated under the Medicare program or the Medicaid program or CHIP of any other State, Sec. 455.416(c) states that the provider's termination must be from Medicare and the Medicaid or CHIP program of any state. That is, the word “and” is between the references to Medicare and Medicaid when the word “or” should be there instead, consistent with the statutory language. To correct this issue and to ensure compliance with section 1902(a)(39), we proposing to change the aforementioned “and” reference to “or.”

We received no comments on this proposal and are thus finalizing it without change.

(3) Miscellaneous Comments

We also received the following comments in response to our provider enrollment proposals:

Comment: A commenter requested that CMS streamline its provider enrollment and revalidation processes to reduce administrative burden on compliant HHAs, adding that delays in enrollment can hinder patient care.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter requested that CMS facilitate a balanced appeals process that avoids harming patient care over minor administrative oversights.

Response: We appreciate this comment. However, because CMS did not propose provisions regarding its existing provider enrollment appeals process, we respectfully believe that this comment is outside the scope of this final rule.

Comment: Several commenters stated that CMS should increase the deactivation non-billing period in Sec. 424.540(a)(1) from 6 months to 12 months, contending that some providers do not bill for 6 or more months for legitimate reasons.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: Several commenters stated that CMS should: (1) work with MACs to establish clear and reasonable processing timeframes for provider enrollment and change of ownership applications, with transparent tracking of progress; and (2) require MACs to implement systems that prevent duplicate document requests and ensure that information already submitted is appropriately retained and applied to the pending file.

Response: We appreciate this comment but believe it is outside the scope of this proposed rule.

Comment: Concerned about inconsistency among the MACs, several commenters recommended that CMS ensure that providers have access to a MAC contact person who is responsible for holding enrollment analysts accountable for timely and accurate compliance with CMS requirements. Other commenters suggested that CMS: (1) hold MACs accountable for timeliness standards for application processing as well as prompt and accurate responses suppliers; (2) ensure more training of MAC representatives; and (3) establish a reporting escalation process to trigger oversight and accountability of the MACs related to timely processing, inconsistent performance, and unreasonable delays.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter stated that CMS must furnish clear guidance to any provider under a provisional period of enhanced oversight (for example, the timeline for review).

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter stated that with respect to the current enrollment process for larger DMEPOS suppliers, CMS should: (1) utilize a central point of contact at the supplier's corporate headquarters for documentation requests (and other requests) rather than contacting each individually enrolled site; and (2) assess the benefit of the existing site visit process.

Response: We appreciate the comment but believe it is outside the scope of this final rule. (4) Final Provisions

Consistent with the foregoing, we are finalizing all of our proposed provider enrollment provisions without modification.