Medicare and Medicaid Programs; Calendar Year 2026 Home Health Prospective Payment System (HH PPS) Rate Update; Requirements for the HH Quality Reporting Program and the HH Value-Based Purchasing Expanded Model; Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Competitive Bidding Program Updates; DMEPOS Accreditation Requirements; Provider Enrollment; and Other Medicare and Medicaid Policies

1. Introduction a. Overview of DMEPOS Accreditation (1) DMEPOS Suppliers (A) Background and Program Integrity Concerns

Among the types of providers and suppliers that must enroll in Medicare to bill the Medicare program are DMEPOS suppliers. Such suppliers include, but are not limited to, the following:

Medical supply companies that exclusively furnish DME like wheelchairs, walkers, and canes.

Physicians and non-physician practitioners who provide DMEPOS to their own patients.

Home health agencies (HHAs) and hospitals that provide DMEPOS to their own patients

Oxygen and oxygen equipment suppliers.

Prosthetists and orthotists.

Pharmacies.

DMEPOS suppliers enroll in Medicare via the Form CMS-855S application (Medicare Enrollment Application--Durable Medical Equipment, Prosthetics, Orthotics and Supplies (DMEPOS); OMB Control No. 0938-1056). Per Sec. 424.57(b)(1)--and excluding locations it utilizes solely as warehouses or repair facilities--the supplier must separately enroll each physical location it uses to furnish Medicare- covered DMEPOS.

We explained at length in the proposed rule that DMEPOS suppliers have long presented to the Medicare program a very elevated risk of fraud, waste, and abuse. In recognizing this threat, CMS has established particularly stringent requirements that DMEPOS suppliers must meet to enroll and maintain enrollment in Medicare. To illustrate, DMEPOS suppliers under Sec. 424.518(c) are one of only six provider and supplier types that are subject to the highest and strictest level of screening during the enrollment process. (They were also one of only two types (the other being HHAs) that were originally assigned to the “high-risk” screening category when Sec. 424.518(c) was promulgated in 2011.) This screening includes: (1) a site visit; and (2) submission of fingerprints of the supplier's 5 percent or greater owners for a Federal Bureau of Investigation (FBI) criminal background check. There are additional regulatory provisions besides the basic provider enrollment requirements in subpart P of 42 CFR part 424 (Sec. Sec. 424.500 through 424.575) that DMEPOS suppliers must meet. With certain exceptions based on the type of DMEPOS supplier involved, these requirements include, but are not limited, to the following:

Compliance with the DMEPOS supplier standards outlined in Sec. 424.57(c).

Acquisition and maintenance of a surety bond consistent with Sec. 424.57(d).

Compliance with DMEPOS quality standards.

Accreditation by a CMS-approved DMEPOS accrediting organization.

Notwithstanding these and other DMEPOS program integrity efforts we have undertaken, serious concerns remain. We noted in the proposed rule that numerous Office of Inspector General (OIG) reports since 1998 have noted payment safeguard issues associated with DMEPOS suppliers. We specifically cited therein several recent OIG reports and alerts related to these matters.\48\ We also outlined a number of recent criminal convictions involving DMEPOS suppliers.\49\ Indeed, DMEPOS fraud, waste, and abuse is still a very significant problem, putting hundreds of

millions (even billions) of taxpayer dollars at risk and potentially resulting in patient harm, such as when beneficiaries use unnecessary or substandard items. The OIG reiterated the problem in 2024 when it stated: “Although CMS has a number of safeguards in place to prevent bad actors from billing DMEPOS in Medicare, fraudulent billing for DMEPOS continues to be a major concern. Recent cases demonstrate that DMEPOS continues to be a target of fraudulent billing and that new schemes have developed.” \50\

\48\ https://oig.hhs.gov/reports/all/2024/medicare-remains- vulnerable-to-fraud-waste-and-abuse-related-to-off-the-shelf- orthotic-braces-which-may-result-in-improper-payments-and-impact- the-health-of-enrollees/#:~:; https://oig.hhs.gov/reports/all/2025/medicare-improperly-paid-suppliers-for-intermittent-urinary-catheters/; https://oig.hhs.gov/fraud/consumer-alerts/consumer-alert-catheter-scam/.

\49\ 90 FR 29200-29201.

\50\ https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000867.asp.

(2) Quality Standards

Section 302(a)(1) of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 added section 1834(a)(20) of the Act. Section 1834(a)(20) of the Act requires the Secretary to establish and implement DMEPOS quality standards for suppliers of certain items. As authorized under section 1834(a)(20)(E) of the Act, CMS first established quality standards via sub-regulatory guidance in 2006 and has updated them as needed since then. Currently accessible at https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/DMEPOSQuality/DMEPOSQualBooklet-905709.html, these standards address matters such as the following:

Human resources, and information management.

Equipment and item delivery and set-up.

Patient and caregiver training and instruction.

Patient follow-up.

Two other sets of quality standards involve administration and finances. The administration standards require, among other things, that the supplier: (i) comply with all Medicare laws, regulations, and guidance; and (ii) implement business practices that prevent fraud, waste, and abuse. Part of this latter requirement involves the supplier using procedures and conduct that ensure its compliance with applicable laws and regulations, as well as assigning one or more company leaders to address compliance issues. The financial administration standards, meanwhile, state that the supplier must--

Use financial management practices that ensure accurate accounting and billing.

Keep accurate, complete, and current financial records that reflect cash- or accrual-based accounting practices.

Keep accounts that link equipment and items to the patient and manage patient service revenues and expenses regularly, including linking charges to patient equipment, supplies, and services with bills, receipts, and deposits.

These requirements make clear that the quality standards go beyond matters of direct patient care and equipment quality to include administrative. legal, and financial compliance as well as fraud, waste and abuse prevention. The standards as a whole are both extensive and detailed because we must confirm that the supplier is bona fide and legitimate. (3) Accreditation

Consistent with section 1834(a)(20)(F)(i) of the Act (and with certain exceptions), DMEPOS suppliers must be accredited by a CMS- approved accrediting organization (AO) to enroll in and bill Medicare. The main purpose of accreditation is to confirm that the supplier meets the DMEPOS quality standards. The accreditation process has been in effect since 2006.

Section 424.57(c)(24) states that all DMEPOS supplier locations (owned or subcontracted) must be separately accredited in order to enroll in and bill Medicare. However, section 1834(a)(20)(F) of the Act exempts certain individuals from the accreditation requirements unless the Secretary determines the quality standards specifically apply to them. These persons include, for example, physicians and opticians.

Per section 1834(a)(20)(B) of the Act, the Secretary designates and approves DMEPOS AOs, of which there presently are eight. To become or be retained or reapproved as an AO, the AO must meet the requirements of Sec. 424.58. As addressed in greater detail in the proposed rule and throughout section VI.B. of this final rule, these requirements include, but are not limited to, the following:

Completing the application process, which includes submitting detailed information about the AO's operations and procedures.

Undergoing various CMS reviews.

Furnishing ongoing data to CMS about its activities, such as its accreditation decisions, complaints received about suppliers, etc.

In general, DMEPOS suppliers may choose the AO it wishes to accredit them. In performing its DMEPOS accreditation activities--and contingent upon CMS approval--an AO has some discretion in the operational aspects of its review of a supplier's request for accreditation. One critical and common component of the review process is the AO's performance of an on-site survey of the supplier. Along with the AO's review of the information the supplier furnishes as part of its accreditation application, the survey enables the AO to examine first-hand the supplier's operations and credentials to help ascertain compliance with the quality standards. Per our sub-regulatory guidance, DMEPOS suppliers currently must be surveyed once every 3 years following initial accreditation. (4) Concerns About the Existing DMEPOS Accreditation Process

The proposed rule contained a substantial number of proposed additions and revisions to our current DMEPOS accreditation process. Aside from the overarching need to improve and strengthen said process, and as we explained in the proposed rule, there were several other reasons behind our proposals.

First, we have seen an increased number of reports of accredited suppliers not meeting the quality standards, which has raised questions as to the efficacy of some AO accreditation surveys and reviews. Second, given the previously noted AO discretion in various aspects of its DMEPOS accreditation processes, we are concerned that differences between the AOs in this regard could lead to inconsistencies in how the AOs make quality standard compliance determinations. Third, although surveys are typically part of the DMEPOS accreditation process, not every supplier receives one. This is particularly true for large chain suppliers with 25 or more separately enrolled locations (such as chain pharmacies). We see this as a potential vulnerability in our enforcement of the DMEPOS accreditation requirement. Fourth, while Sec. 424.58 outlines certain components of the DMEPOS accreditation process, it does not address other important topics that, in our view, should be outlined in regulation. We note that CMS regulations regarding the accreditation of certified providers, certified suppliers, and home infusion therapy suppliers (found in 42 CFR part 488) contain more extensive provisions than does Sec. 424.58; we believe some of the protections they afford the Medicare program in facilitating provider and supplier compliance should be duplicated in Sec. 424.58. Fifth, we have since 2006 neither reapproved any AOs nor undertaken a full reassessment of the performance and suitability of our

existing AOs. We believe both are now necessary--particularly considering this long passage of time--so we can ensure the DMEPOS accreditation program is functioning effectively.

A recent criminal case underscores our concerns. In March 2025 an individual pled guilty in Federal court (Southern District of Florida) to accepting cash bribes and self-dealing as part of a conspiracy to impede and obstruct the lawful functions of the U.S. Department of Health and Human Services (HHS) and CMS in their administration and oversight of the Medicare program.\51\ According to court documents, the person was a contractor for a DMEPOS AO and performed inspections of hundreds of DMEPOS suppliers for compliance with the quality standards. The individual--

\51\ https://www.justice.gov/usao-sdfl/pr/miami-inspector-pleads-guilty-scheme-obstruct-us-department-health-and-human-services.

Accepted cash bribes from numerous owners of DMEPOS suppliers to facilitate and expedite the accreditation process so these companies could enroll in and bill Medicare;

Along with the individual's immediate family, established DMEPOS companies in the names of family members to conceal the individual's own personal interest in the companies. The person then sold some of these companies to others, having increased their value as Medicare-enrolled DMEPOS suppliers; and

Directly or indirectly owned some of the suppliers the individual surveyed.\52\

\52\ Ibid.

Considering that this case, and perhaps other situations where unqualified suppliers were accredited, may have resulted in many millions of dollars in improper Medicare payments, we believe we must exercise much closer scrutiny over DMEPOS supplier accreditation in general and DMEPOS AOs in particular to prevent such instances from occurring.

Moreover, certain CMS concerns about provider and supplier accreditation are not limited to DMEPOS suppliers. In the February 15, 2024, Federal Register (89 FR 11996), we published a proposed rule titled “Medicare Program; Strengthening Oversight of Accrediting Organizations (AOs) and Preventing AO Conflict of Interest, and Related Provisions”. This proposed rule would update and supplement provisions in 42 CFR part 488 (hereafter simply part 488) to enhance CMS' oversight of certified provider and supplier AOs; examples of proposed enhancements included addressing conflicts of interest and establishing additional regulatory definitions and procedures for clarity and consistency. We proposed in the July 2, 2025, proposed rule to do likewise for DMEPOS accreditation by incorporating several provisions in the February 15, 2024, proposed rule into Sec. 424.58, though with modifications to accommodate the unique characteristics of DMEPOS accreditation. b. Legal Authorities

There are several discrete statutory authorities for our final provisions:

Section 1834(a)(20)(A) of the Act requires the Secretary to establish and implement quality standards for the suppliers of the items and services described in section 1834(a)(20)(D) of the Act to be applied by recognized independent accrediting organizations.

Notwithstanding section 1865(a) of the Act (regarding accreditation of providers and suppliers in general), section 1834(a)(20)(B) of the Act requires the Secretary to designate and approve one or more independent AOs for purposes of applying the quality standards referenced in section 1834(a)(20)(A) of the Act.

Section 1834(a)(20)(F)(i) of the Act (and with certain exceptions) requires the Secretary to mandate that suppliers of the items and services described in section 1834(a)(20)(D) of the Act submit to the Secretary evidence of accreditation by an AO designated under section 1834(a)(20)(B) of the Act.

Sections 1102 and 1871 of the Act provide general authority for the Secretary to prescribe regulations for the efficient administration of the Medicare program. 2. DMEPOS Accreditation Proposed Provisions

Given the extent of our proposed changes to Sec. 424.58, we proposed to entirely reorganize the current paragraph structure and designations. Except for current paragraph (a) or as otherwise noted, all finalized paragraph designations in Sec. 424.58 are labeled as new provisions even though the provision may already exist in current Sec. 424.58 under a different paragraph. We received over 350 timely pieces of correspondence on our proposed DMEPOS accreditation provisions. Many individual comments pertained to multiple topics discussed in this subsection VI.B.2. of this final rule. For this reason, all of the comments and responses--regardless of the regulatory provision they addressed--are contained in section VI.B.16. of this final rule. a. Definitions (New Sec. 424.58(b))

We proposed several new definitions in Sec. 424.58(b) to help clarify the regulatory provisions to which they relate.

First, we proposed to define “complaint” as an allegation from any party (and via any format) that one of the AO's accredited suppliers may be non-compliant with one or more quality standards or other applicable CMS requirement; the complaint need not involve actual or potential beneficiary harm. As part of the AO approval or reapproval process, current Sec. 424.58(b)(1)(ix) requires the AO to establish procedures for responding to and investigating complaints against its accredited suppliers. Existing Sec. 424.58(c)(1)(iii), meanwhile, requires the AO to monthly provide CMS with notice of such complaints. Given these requirements, we believed a clear definition of “complaint” is warranted.

Second, we proposed to define “immediate jeopardy” as a situation where the supplier's non-compliance with one or more quality standards or other applicable CMS requirement has caused, or is likely to cause, serious injury, harm, impairment, or death to a patient or to the health and safety of the general public. This definition was needed because AOs, under current paragraph Sec. 424.58(c)(4) thereof, must notify CMS within 2 calendar days of a supplier's deficiency that poses immediate jeopardy.

Third, we proposed to define “reasonable assurance” as meaning that an AO has demonstrated to CMS' satisfaction that--

Its accreditation program requirements meet or exceed the Medicare program requirements;

The suppliers the AO accredits meet or exceed Medicare requirements; and

The AO is compliant with all provisions of Sec. 424.58.

As discussed further in this section VI.B. of this proposed rule, we believe AOs should demonstrate that their accreditation programs comply with Sec. 424.58 and all other CMS requirements, hence the need for a reasonable assurance definition.

Fourth, we proposed to define “unannounced survey” as meaning:

A survey conducted without any prior notice of any type (through any means of communication or forum) to the supplier to be surveyed, such that the supplier does not expect the survey until the surveyors arrive; and

The AO schedules its surveys so that suppliers cannot predict when they will be performed.

This definition reflects our belief that it is critical for DMEPOS supplier surveys to be unannounced (as they currently are) so that a non-compliant supplier cannot use prior notice of a survey to remedy its deficiencies solely to pass the survey, after which it may resume its non-adherence. b. Initial Application for Approval of AO's Accreditation Program (New Sec. 424.58(c))

Existing Sec. 424.58(b) outlines the process by which an entity may apply or reapply to become an AO. While the processes for both are largely similar, we proposed to separate them into two paragraphs for ease of comprehension. Initial application procedures would be addressed in new paragraph (c) and reapproval application procedures in new paragraph (d).

Current Sec. 424.58(b)(1) outlines information that AOs must submit as part of the application process. We have neither revisited these data elements via rulemaking since 2006 nor, as already stated, reapproved or fully reassessed the AOs for many years. Given this lapse, we believe that requiring AOs to submit with their applications the additional data described in this subsection (B)(2)(b) would help us: (1) better ascertain the AO's qualifications; and (2) ensure that the AO will properly and competently perform its functions and remain in compliance with the requirements of Sec. 424.58. We accordingly proposed changes and enhancements to existing Sec. 424.58(b)(1), which would be redesignated as new paragraph (c)(1). (1) Reasonable Assurance Opening Statement (New Sec. 424.58(c)(1))

We proposed that the opening part of paragraph (c)(1) would state that an AO applying for approval of its DMEPOS accreditation program must furnish “all the following information and materials to demonstrate that the DMEPOS accreditation organization provides reasonable assurance (as defined in paragraph (b) of this section) regarding its program.” This language would emphasize that it would not be enough to merely submit the required information in paragraph (c)(1). Rather, the data must be sufficient to give CMS reasonable assurance. (2) Confirmation of Compliance (New 424.58(c)(1)(iii))

Existing Sec. 424.58(b)(1)(iii), which would become new Sec. 424.58(c)(1)(iii), starts with language that outlines the components of the AO's required explanation of its operational processes. We proposed to revise this provision to:

Require a detailed description of the organization's survey and other accreditation processes (not merely its operational processes) to confirm that the suppliers it accredits meet or exceed the DMEPOS quality standards and Medicare program requirements.

Re-designate the six elements of the required description of operational processes in current Sec. 424.58(b)(1)(iii) as new Sec. 424.58(c)(1)(iii)(A) through (F) in the same respective order they are listed in existing (b)(1)(iii).

Add new paragraph (c)(1)(iii)(G) to require the description to address how the AO determines whether to perform a survey in situations where it has the discretion to do so; this would have to include a suggested methodology for sampling locations for surveys under a single tax identification number or organization. This would help us understand the factors and criteria the AO will consider in its determination and, more importantly, whether it will exercise its discretion prudently. (3) Redesignation of Existing Data Submission Provisions (New Sec. 424.58(c)(1)(i), (ii), (iv), (v), (vi), and (vii)(A), (B), and (C))

Strictly for organizational purposes and without making any changes in content, we proposed to redesignate Sec. Sec. 424.58(b)(1)(i), (ii), and (iv) through (vii)(A) through (C) (which describe additional information the AO must furnish) as new Sec. Sec. 424.58(c)(1)(i), (ii), and (iv) through (vii)(A) through (C). (4) Conflicts of Interest, Consulting Services, and Number of Surveyors (New Sec. 424.58(c)(1)(vii)(D) and (E))

We proposed additional requirements in new Sec. 424.58(c)(1)(vii).

New paragraph (D) would require the AO to explain in detail its policies and procedures for avoiding conflicts of interest and the appearance thereof involving individuals who conduct surveys or participate in accreditation decisions. This information must include the organization's policies and procedures for all of the following:

The separation of its consulting services from its accreditation services.

Protecting the integrity of the DMEPOS AO's accreditation program (including the requirements of proposed Sec. 424.58(m) and (n) (discussed later in section VI.B. of this final rule)).

Preventing and handling potential or actual conflicts of interest that could arise from situations where a DMEPOS AO owner, surveyor, or employee has an interest in, or relationship with, a DMEPOS supplier to which the AO provides accreditation services. Such interests or relationships include, but are not limited, to the following:

++ Being employed as a DMEPOS AO surveyor.

++ Being employed by a DMEPOS supplier that is accredited by the DMEPOS AO.

++ Having an ownership, financial, or investment interest in a DMEPOS supplier that is accredited by the DMEPOS AO.

++ Serving as a director of (or trustee) for a DMEPOS supplier that is accredited by the DMEPOS AO.

++ Serving on a utilization review committee of a DMEPOS supplier that is accredited by the DMEPOS AO.

++ Accepting fees or payments from a DMEPOS supplier or group of DMEPOS suppliers that is/are accredited by the DMEPOS AO.

++ Accepting fees for personal services, contract services, referral services, or for furnishing supplies to a DMEPOS supplier that is accredited by the DMEPOS AO.

++ Providing consulting services to a DMEPOS supplier that the DMEPOS AO accredits.

++ Having any member of their immediate family engaged in any of the previously stated activities. The term “immediate family member” would be defined in proposed Sec. 424.58(b) as any person with whom the AO owner(s), surveyors or employees have a lineal or immediate familial or marital relationship, including a husband or wife; birth or adoptive parent, child, or sibling; stepparent, stepchild, stepbrother, or stepsister; father-in-law, mother-in-law, son-in-law, daughter-in- law, brother-in-law, or sister-in-law; grandparent or grandchild; and spouse of a grandparent or grandchild.

++ Engaging in any activities during the course of the survey of the DMEPOS supplier that would be or cause a conflict of interest.

For notifying CMS when a conflict of interest is discovered.

We also proposed to clarify in new paragraph Sec. 424.58(c)(1)(vii)(D)(5) that for purposes of said paragraph, a conflict of interest exists when a DMEPOS AO, the DMEPOS AO's successors, transferees, or assigns, the DMEPOS AO owner(s), surveyors, or employees, or the immediate family members of the DMEPOS AO owners(s), surveyors and employees have an employment, business, financial or other type of interest in or relationship with a DMEPOS supplier that the DMEPOS AO accredits.

As we explained in the proposed rule, DMEPOS AO avoidance of conflicts of interest is needed to help ensure the integrity and impartiality of its surveys

and accreditation decisions. We believe our proposed provisions regarding conflicts of interest and consulting would assist in this.

Also, in new Sec. 424.58(c)(1)(vii)(E) we proposed to require the AO to outline its policies and procedures for ensuring it always has an adequate number of surveyors. (5) AO Program Deficiencies (New Sec. 424.58(c)(1)(viii))

We proposed in new Sec. 424.58(c)(1)(viii) that the AO describe its processes for identifying and correcting deficiencies within its accreditation program. It is important for AOs to very frequently review their accreditation programs for vulnerabilities and weaknesses. Without this, AOs may perform their functions in a substandard manner, which could lead to inadequate scrutiny of suppliers, the accreditation and enrollment of unqualified suppliers, and, hence, improper payments. (6) Use of Data To Ensure Program Compliance (New Sec. 424.58(c)(1)(ix))

Existing paragraph (b)(1)(viii) requires the AO to describe its data management, analysis and reporting system for its surveys and accreditation decisions, including the kinds of reports, tables, and other displays generated by that system. We proposed to designate this paragraph as new (c)(1)(ix) and include an additional requirement (taken from Sec. 488.5(a)(11)(i)) that the description explain how the AO uses its data to ensure that its accreditation program adheres to Medicare program requirements. (7) Complaint Process (New Sec. 424.58(c)(1)(x))

Current Sec. 424.58(b)(1)(ix) requires the AO to explain its procedures for responding to and investigating complaints against its suppliers; this includes processes for coordinating with licensing bodies, ombudsman programs, the National Supplier Clearinghouse (NSC), and CMS. A robust AO process for handling complaints is important because it involves reviewing a supplier's possible violation of a quality standard or other applicable CMS requirement. An AO's failure to properly execute this function could lead to improper Medicare payments to a non-compliant supplier. However, we believed the data that existing Sec. 424.58(b)(1)(ix) requires is insufficient to help us to determine whether the AO would handle complaints thoroughly, consistently, and diligently. We thus proposed several changes to this paragraph, which would be designated as new Sec. 424.58(c)(1)(x).

First, we proposed to add procedures for closing out complaints as part of this information submission requirement.

Second, we proposed to change the NSC reference to the “applicable National Provider Enrollment contractor (NPEC)”. This is because the latter entities have replaced the NSC as CMS' DMEPOS enrollment contractors.

Third, new paragraphs Sec. 424.58(c)(1)(x)(A) and (B), respectively, would require submission of the following information:

The steps and research the AO will undertake in its review of the complaint.

How the AO determines whether, in accordance with a complaint, non-adherence to a quality standard or other applicable CMS requirement exists, including the data it considers in its review and when and how it would take action against the supplier. (8) Redesignation of Additional Data Submission Provisions (New Sec. 424.58(c)(1)(xi) Through (xv))

Existing Sec. 424.58(b)(1)(x) through (xiv) address other types of information the AO must submit, such as: (1) policies and procedures for notifying CMS of non-compliant suppliers; and (2) a list of the organization's currently accredited DMEPOS suppliers. With two exceptions, we did not propose to revise these paragraphs but only to re-designate them as new Sec. Sec. 424.58(c)(1)(xi) through (xv). The two exceptions are as follows:

In existing paragraph (xii)(B) (redesigned as new paragraph (xiii)(B)), we proposed to include each supplier's accreditation product codes as data the AO must submit with its initial or reapproval application.

In existing paragraph (xii)(C) (redesigned as new paragraph (xiii)(C)), we proposed that the AO must also list each supplier's accreditation effective date with its initial or reapproval application.

Both requirements would help ensure that CMS has sufficient information on each supplier's accreditation type and status.

Current Sec. 424.58(b)(1)(xv) requires the AO to agree that it will permit its surveyors to serve as witnesses if CMS takes an adverse action based on accreditation findings. We did not propose to designate this paragraph as new Sec. 424.58(c)(1)(xvi) because, as explained later in this final rule, we proposed to include it as part of the broader agreement the AO must sign per proposed new Sec. 424.58(c)(1)(xxiii). (9) Knowledge and Experience (New Sec. 424.58(c)(1)(xvi))

Section 488.1010(a)(4), which pertains to home infusion therapy supplier accreditation, requires AOs in their applications to furnish information that demonstrates their knowledge, expertise, and experience in home infusion therapy. We proposed a similar provision in new Sec. 424.58(c)(1)(xvi) regarding DMEPOS so we could better understand the AO's credentials and qualifications. (10) Review Timeliness (New Sec. 424.58(c)(xvii))

We proposed in new Sec. 424.58(c)(xvii) that the AO furnish information about its ability to conduct timely reviews of supplier accreditation applications. This requirement would help us determine whether the AO has adequate resources to handle the accreditation requests it receives. (11) Decision-Making Process (New Sec. 424.58(c)(1)(xviii))

Akin to Sec. 488.5(a)(13) concerning certified providers and suppliers, new Sec. 424.58(c)(1)(xviii) would require the AO to describe its decision-making process, including its policies and procedures for approving, denying, or terminating a DMEPOS supplier's accreditation status. This would also include an explanation of the reasons for which the AO will deny or terminate a supplier's accreditation. We believe this information would give us a more thorough understanding of how the AO will make its decisions. (12) Surveys (Sec. 424.58(c)(1)(xix))

We proposed in new Sec. 424.58(c)(1)(xix)(A) and (B) that the AO outline its policies and procedures for the following:

Determining whether and when a survey is performed (for example, the DMEPOS supplier is providing a new type of item). This must include the circumstances under which the AO will impose a corrective action plan (CAP) in lieu of performing a follow-up survey regarding a DMEPOS supplier deficiency.

Ensuring that all onsite surveys are unannounced, including preventing unannounced surveys from becoming known to the supplier beforehand.

Given the aforementioned importance of surveys in determining the supplier's compliance with the quality standards--and our earlier noted view that surveys should be unannounced--we believe Sec. 424.58(c)(1)(xix) is needed.

(13) CAPs (Sec. 424.58(c)(1)(xx))

In lieu of denying or terminating a supplier's accreditation for failing to meet the quality standards, an AO may apply a CAP to the supplier. In general, a CAP permits the supplier to attempt to remedy the problem(s) within a specified timeframe before the AO takes one of these two actions. Existing Sec. 424.58 only references CAPs in paragraph (c)(1)(i) thereof, whereby AOs must provide to CMS various survey-related information, which includes CAPs.

To enable us to gain a clearer understanding of the AOs' CAP processes, we proposed in new Sec. 424.58(c)(1)(xx) that the AO outline the policies and procedures via which it would apply a CAP to the supplier. This would include--

The specific circumstances under which the AO would apply a CAP as opposed to denying or terminating accreditation, and the reason(s) for why the AO believes a CAP in these situations would be more appropriate; and

How a CAP is developed, implemented, and enforced, including--

++ How the AO determines whether a CAP is acceptable;

++ The requirements of (and the timeframe and deadline for) the supplier's resumption of compliance;

++ How the AO ascertains whether the supplier has returned to and maintains compliance; and

++ The circumstances under which the AO will impose a CAP instead of performing a follow-up survey for a supplier deficiency. (14) Describing and Defining DMEPOS Supplier Deficiencies (New Sec. 424.58(c)(1)(xxi))

We proposed in new Sec. 424.58(c)(1)(xxi) that the AO would be required to explain--

What it considers to be a supplier deficiency and how it defines the term “deficiency”; and

Whether the AO has different levels of DMEPOS supplier deficiencies.

We are concerned that the meaning of “deficiency” and any AO- identified levels thereof may differ among AOs, resulting in inconsistent determinations. We thus believe we must understand the AO's policies regarding deficiency classifications. (15) Potentially Fraudulent Activity (New Sec. 424.58(c)(1)(xxii))

We proposed in new Sec. 424.58(c)(1)(xxii) that the AO would be required to describe its processes for: (1) detecting and addressing potential fraud, waste, and abuse by suppliers (including identifying the AO's definitions of the terms “fraud”, “waste”, and “abuse”); and (2) reporting this conduct to CMS, and, as applicable, law enforcement. While the AO's principal function under Sec. 424.58 is to perform the accreditation activities described therein, we do not believe the AO should disregard possible fraud, waste, or abuse by suppliers. (16) Agreement of Compliance (New Sec. 424.58(c)(1)(xxiii)) (a) Introduction

To ensure that we have the DMEPOS AO's binding commitment to adhere to all CMS requirements, we proposed in new Sec. 424.58(c)(1)(xxiii) that DMEPOS AOs must explicitly agree to certain conditions as part of the application process. (Some of Sec. 424.58(c)(1)(xxiii)'s requirements would refer to new paragraphs in Sec. 424.58 that will be addressed later in this section of this final rule.)

In the opening paragraph of new Sec. 424.58(c)(1)(xxiii), we proposed that the AO's chief executive officer (CEO) (or similar official with authority to commit the organization to adhere to Medicare laws and regulations) provide written acknowledgement that, as a condition of CMS' approval or continued approval of the AO's accreditation program, the AO agrees to adhere to the provisions in Sec. 424.58(c)(1)(xxiii). The acknowledgement, which the official must sign and date and which must be on the AO's letterhead, must list all the data elements in Sec. 424.58(c)(1)(xxiii) and contain the AO's agreement to comply therewith. (b) Data Submission Within 3 Business Days

We proposed in new Sec. 424.58(c)(1)(xxiii)(A)(1) and (2), respectively, that the AO must agree to provide CMS within 3 business days of the latter's request--

Any of the data described in Sec. 424.58(e)(1)(i) (which involves the AO's monthly submission of information to CMS); and

Any other information CMS deems necessary to facilitate its oversight of the AO's accreditation program.

Considering, again, our role as overseer of Medicare DMEPOS accreditation activities, we must be able to closely and constantly monitor AOs' activities via rapid access to critical information, hence the need for Sec. 424.58(c)(1)(xxiii)(A)(1) and (2). (c) Immediate Jeopardy Notifications

We previously noted that existing Sec. 424.58(c)(4) requires the AO to send written notice to CMS within 2 calendar days of identifying an accredited DMEPOS supplier's deficiency if the deficiency poses an immediate jeopardy situation; any adverse action the AO accordingly takes must also be identified. Given this provision's importance, we believe that the AO's specific agreement in proposed paragraph (c)(1)(xxiii)(B) to comply with this requirement (which would be designated as new Sec. 424.58(e)(1)(iii)) is warranted. (d) Notification of Change in AO Program

Current Sec. 424.58(c)(1)(v) requires an AO to notify CMS on a monthly basis of any proposed changes to its accreditation standards, requirements, or survey process. Such changes can significantly impact the AO's accreditation program and, in turn, our responsibility for the DMEPOS accreditation program as a whole. Accordingly, we proposed in new Sec. 424.58(c)(1)(xxiii)(C) that the AO must agree: (1) to furnish this notification to us in writing; and (2) that it will not implement such changes absent prior written notice of continued program approval from CMS consistent with Sec. 424.58(e)(2) (discussed later in this final rule). (e) Termination or Other Change in Supplier's Accreditation Status

As accreditation is a requirement for DMEPOS enrollment under Sec. 424.57(c)(24), CMS must know as quickly as possible when a supplier's accreditation is terminated, revoked, withdrawn, or amended so we can take similar action concerning the supplier's enrollment; a belated notice from the AO could result in improper payments to an unaccredited supplier. We thus proposed in new Sec. 424.58(c)(1)(xxiii)(D) that the AO must agree to provide this notification in writing to CMS within 3 business days of the AO's action. (f) CAP Information

Consistent with our previously mentioned rationale for proposed new Sec. 424.58(c)(1)(xx), we proposed in new Sec. 424.58(c)(1)(xxiii)(E) that the AO must agree to inform CMS of any decision to apply a CAP to a specific supplier within 10 calendar days of the decision. This must include--

The reason for the decision;

A detailed explanation and justification as to why the AO applied a CAP instead of, as applicable, denying

or terminating the supplier's accreditation; and

The details of the supplier's CAP. (g) Data for CMS Evaluation of Performance

Section 488.5(a)(11)(ii) requires a certified provider or supplier AO to agree to submit timely, accurate, and complete data to support CMS's evaluation of the AO's performance. Data to be submitted includes, but is not limited to, provider/supplier identifying information, survey schedules and findings, and notices of accreditation decisions; the AO must submit this information according to the instructions and timeframes CMS specifies. We believe a general, overarching agreement to furnish the scope and breadth of data addressed in Sec. 488.5(a)(11)(ii) is warranted so we can ensure that we have all information needed to execute our oversight functions. To this end, we proposed new Sec. 424.58(c)(1)(xxiii)(F) would duplicate the requirements of Sec. 488.5(a)(11)(ii) (with modest modifications specific to DMEPOS suppliers). (h) AO Implementation of CMS Changes

There are instances where CMS changes its DMEPOS accreditation program requirements. Current Sec. 424.58(c)(2) requires that within 30 calendar days of said change, the AO must submit to CMS: (i) an acknowledgment of CMS's notification of the change; (ii) a revised crosswalk reflecting the new requirements; and (iii) an explanation of how it will alter its standards to comply with CMS's new requirements within the timeframes that CMS specifies in the notification. As it is important for AOs to implement these changes timely and fully, we believe the AO should explicitly commit to do so. We therefore proposed in new Sec. 424.58(c)(1)(xxiii)(G) that the AO agree to adhere to the following:

Submission of the data required in Sec. 424.58(e)(7). (New paragraph (e)(7) would reflect current requirements in paragraph (c)(2).)

The proposed changes must be submitted to CMS within 30 calendar days of the date of CMS' written notice to the AO.

The AO must not implement its proposed corresponding changes without prior CMS approval. (i) Deficiencies

We previously noted that new Sec. 424.58(c)(1)(xxi) would require the AO to explain what it considers to be a DMEPOS supplier deficiency, how it defines the term, and whether it has different levels of deficiencies. However, and to facilitate consistency among the AOs, we believe CMS should retain the discretion to: (1) define the term deficiency; and (2) establish deficiency levels for use across all AO DMEPOS accreditation programs. Consequently, we proposed in new Sec. 424.58(c)(1)(xxiii)(H) that the AO agree to accept and adhere to any CMS-established deficiency definitions and levels and categories thereof. (j) Surveyors as Witnesses

Consistent with our aforementioned intention to move current Sec. 424.58(b)(1)(xv) to new Sec. 424.58(c)(1)(xxiii), we proposed that new Sec. 424.58(c)(1)(xxiii)(I) would require the AO to agree that its surveyors can serve as witnesses if CMS takes an adverse action against a supplier based on an accreditation finding. (k) Sampling

Though addressed in more detail later in this final rule, the concept of sampling involves the AO's use of a formula to determine which locations within a particular group should be surveyed. Consistent therewith, we proposed to require the AO's agreement in new Sec. 424.58(c)(1)(xxiii)(J) that if CMS permits the AO to perform surveys via a sampling process, the AO: (1) will submit to CMS its planned sampling methodology in detail; and (2) will not undertake sampling until CMS has approved the AO's methodology. (l) Patient Records

As part of its survey of a supplier, the AO must examine the supplier's patient medical records to confirm that the supplier is actually serving patients and that the items and services furnished to them are legitimate. For this reason, and as stated in sub-regulatory guidance, the reviewed patient medical records must not include: (1) mock files; (2) fictional patient records; (3) simulated documentation; and (4) templates.\53\ Actual records of the patients are required. Given this, we proposed in new Sec. 424.58(c)(1)(xxiii)(K) that the AO agree not to use these four types of records in its surveys. We also proposed to include duplicate patient records as a fifth category, meaning the reviewed records must be of the supplier's own patients and not those of another supplier; this is because the latter records do not reflect the items and services that the surveyed supplier itself is furnishing.

\53\ https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/DMEPOSQuality/DMEPOSQualBooklet-905709.html.

Although we have elected to address this topic via rulemaking in new Sec. 424.58(c)(1)(xxiii)(K), we emphasize that we retain the authority under section 1834(a)(20)(E) of the Act to establish, add, and modify DMEPOS quality standards via sub-regulatory guidance. (m) Costs of Ad-Hoc Surveys

As discussed further in the proposed rule and this final rule, we proposed in new Sec. 424.58(e)(8)(ii) that CMS may at any time direct the AO to perform a survey of any accredited supplier or a group thereof. We expressed concern in the proposed rule about potential delays in said surveys due to a potential disagreement between the AO and the supplier regarding which of them pays the cost of a CMS- directed survey. To help ensure that this cost issue is resolved well beforehand, we proposed in new Sec. 424.58(c)(1)(xxiii)(L) that the AO agree to have a binding written agreement with each supplier it accredits regarding whether the AO, the supplier, or both will assume the costs of the survey referenced in paragraph (e)(8)(ii). (n) Truthfulness and Accuracy

To ensure that the AO understands its obligation to submit accurate and complete data to CMS at all times, we proposed in new Sec. 424.58(c)(1)(xxiii)(M) that the AO agree to submit all required information to CMS both before and after approval of its accreditation program in a truthful, accurate, and complete manner. (o) Compliance With Sec. 424.58

While the components of the proposed Sec. 424.58(c)(1)(xxiii) attestation statement include fairly specific elements (for example, an attestation to utilize CMS's deficiency definition), we emphasize that adherence to all provisions in Sec. 424.58 is still required. We hence proposed in Sec. 424.58(c)(1)(xxiii)(N) that the AO in its statement be required to agree to comply with all of the requirements in Sec. 424.58 at all times; this would include agreeing to adhere to the policies, procedures, practices, and agreements it outlined under Sec. 424.58(c) as part of its initial or reapproval application and any changes thereto made with prior CMS approval. (17) Additional Information Needed and Withdrawal of Application (New Sec. 424.58(c)(2) and (c)(3))

We proposed two changes in new Sec. 424.58(c)(2) and (c)(3). First, notwithstanding the wide scope of data

to be furnished per Sec. 424.58(c)(1), CMS may need additional information to fully assess the AO's credentials. Thus, we proposed in new Sec. 424.58(c)(2) that if CMS determines that further data is necessary to make a determination on the AO's request for approval, we would notify the organization and afford it an opportunity to provide this data. Second, we proposed in new Sec. 424.58(c)(3) that an AO may withdraw its application for approval of its accreditation program at any time before CMS posts the notice described in Sec. 424.58(c)(6) (discussed later in this proposed rule). (18) Reasons for Denial

Section 424.530(a) lists 18 reasons for which CMS can deny provider or supplier enrollment applications, including those from DMEPOS suppliers. These provisions help prevent non-compliant and unqualified providers and suppliers--or those that present a program integrity risk--from being eligible to receive Medicare payments. While DMEPOS AOs, unlike DMEPOS suppliers, neither enroll in Medicare nor receive Medicare payments, they are responsible for ascertaining quality standard compliance for potentially hundreds of suppliers that may or do bill Medicare. We thus believe it is important to have clear reasons in Sec. 424.58 for which we can deny an AO's application for approval of its accreditation program. We must be able to protect the DMEPOS accreditation program from unqualified AOs. For reasons outlined in detail in the proposed rule, we proposed the following denial grounds in new paragraphs (c)(4)(i) through (viii), several of which duplicate those in Sec. 424.530(a):

Denial Reason 1--The AO has failed to comply with all application, data, and agreement submission requirements outlined in Sec. 424.58(c).

Denial Reason 2--The AO has failed to provide reasonable assurance (as defined in paragraph (b)).

Denial Reason 3--The current number of CMS-approved DMEPOS AOs is sufficient to ensure the continued administration of CMS' DMEPOS accreditation program.

Denial Reason 4--The AO's DMEPOS program was previously terminated, suspended, or placed on probation by CMS under, respectively, new Sec. 424.58(h), (i), or (j).

Denial Reason 5--The AO, or any owner (as defined in Sec. 424.502), managing employee (as defined in Sec. 424.502), governing body member, W-2 or contracted surveyor, or W-2 or contracted health care or administrative or management services personnel thereof--

++ Is OIG-excluded;

++ Is debarred, suspended, or otherwise excluded from participating in any Federal procurement or non-procurement activity; or

++ Within the preceding 10 years:

++ Was convicted of a Federal or State felony offense that CMS determines is detrimental to the best interests of the Medicare program and its beneficiaries;

++ Has had a Medicare enrollment revoked under Sec. 424.535;

++ Has had a license to provide health care suspended or revoked by any State licensing authority; or

++ Has been suspended or terminated from participating in a Federal or State health care program.

Denial Reason 6--The AO has submitted false or misleading information on its application in order to gain CMS approval or reapproval as a DMEPOS AO.

Denial Reason 7--The AO is non-compliant with any provision in Sec. 424.58.

Denial Reason 8--CMS otherwise determines that approval of the applicant as a DMEPOS AO would not be in the best interests of the Medicare program and its beneficiaries. (19) Notice of Approval/Denial, Public Notice, and Length of Approval (New Sec. 424.58(c)(5) Through (7))

Existing Sec. 424.58 does not address when and how an AO is notified of CMS' decision to approve or deny its application for approval of its accreditation program. To clarify these issues, we proposed several provisions, the rationales for each of which were outlined in the proposed rule (90 FR 29211-29212). Under Sec. 424.58(c)(5), CMS would send notice of its decision to the AO within 210 calendar days from the date CMS determines that the AO's application is complete. The notice would include: (i) the basis for the decision; (ii) if applicable, the effective date of approval; and (iii) if applicable, the length of the approval (not to exceed 6 years). Under proposed Sec. 424.58(c)(6), CMS would announce on its website its decision to approve or deny the application. The announcement would be posted within 210 calendar days from the date that CMS determines that the AO's application was complete. If the application is approved, the posting would also state the approval's effective date (no later than the notice's publication date) and length (6 years or less). In addition, Sec. 424.58(c)(7) would state that CMS may approve an accreditation program for any period up to a maximum of 6 years. 3. AO Reapproval Process (New Sec. 424.58(d))

New Sec. 424.58(d) would outline the procedures involving an AO's application for reapproval of its DMEPOS accreditation program. As earlier mentioned, and except as otherwise noted, these procedures would generally duplicate those for initial applications in terms of content and rationale.

We proposed in new Sec. 424.58(d)(1)(i) that except as stated in paragraph (d)(1)(ii), an approved DMEPOS AO that seeks to continue as such must apply for reapproval of accreditation at least 9 months before its current approval term expires. This would afford CMS--prior to the current approval's expiration--sufficient opportunity to: (1) review the application; (2) consider the AO's qualifications and past performance; and (3) render a decision. CMS would have the discretion, though, to grant the AO an additional 30 days to reapply.

We previously noted our concern that we have not reapproved any AO since the DMEPOS accreditation program's inception in 2006. Considering this nearly two-decade period, and as explained in the proposed rule, we believe it is imperative to commence a reapproval process for all current AOs as soon as possible after the effective date of any finalization of our proposals. Hence, we proposed in Sec. 424.58(d)(1)(ii) that CMS may require AOs to submit reapproval applications under paragraph (d) any time after January 1, 2026, which would be the effective date of our revisions to Sec. Sec. 424.57 and 424.58. The application would have to be submitted within 60 calendar days of CMS' submission request; if it is not, CMS terminates the AO's DMEPOS accreditation approval.

We proposed in new Sec. 424.58(d)(2) that as part of its reapproval application submission: (1) the AO would have to furnish all information and statements identified in Sec. 424.58(c)(1); and (2) CMS could request additional information under Sec. 424.58(c)(2).

We also proposed in new Sec. 424.58(d)(3) through (7) to duplicate our proposals in Sec. 424.58(c)(3) through (7), respectively. The same rationales would apply (for example, establishing clear reapproval application withdrawal procedures; giving CMS adequate time (a maximum of 210 days) to render its decision).