Medicare and Medicaid Programs; Calendar Year 2026 Home Health Prospective Payment System (HH PPS) Rate Update; Requirements for the HH Quality Reporting Program and the HH Value-Based Purchasing Expanded Model; Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Competitive Bidding Program Updates; DMEPOS Accreditation Requirements; Provider Enrollment; and Other Medicare and Medicaid Policies

Existing Sec. 424.58(c)(1) through (6) outline activities an approved AO must undertake on an ongoing basis. These functions, some of which have already been referenced, are as follows:

Monthly submission of data concerning the AO's activities (such as copies of surveys; notice of accreditation decisions and complaints received; information about actions taken against suppliers, etc.).

Submission of the acknowledgment, cross walk, and explanation in response to a change in CMS requirements.

Allowing the AOs' surveyors to serve as witnesses if CMS takes an adverse action against a supplier based on an accreditation determination.

Notification to CMS within 2 calendar days of a supplier's immediate jeopardy deficiency.

Within 10 calendar days of receiving CMS notice that CMS intends to withdraw the AO's approval, provide written notice of the withdrawal to all the AO's accredited DMEPOS suppliers.

Annually furnish CMS-specified summary information regarding the prior year's accreditation activities and trends.

We proposed to include these requirements within new Sec. 424.58(e) but to also make certain changes and additions to them. a. Submission of Monthly Information, Requested Information, and Immediate Jeopardy Deficiencies (New Sec. 424.58(e)(1))

There are five categories of data in current Sec. 424.58(c)(1)(i) through (v) that the AO must furnish on a monthly basis. We proposed several revisions thereto.

First, in the opening paragraph of (c)(1) (which we are redesignating as new paragraph (e)(1)(i)), we proposed for purposes of clarity to change the reference “on a monthly basis” to “no later than the last day of each month.”

Second, existing paragraph (c)(1)(i) requires monthly submission of copies of all accreditation surveys, together with any survey-related information that CMS may require (including CAPs and summaries of findings with respect to unmet CMS requirements). We proposed that paragraph (c)(1)(i) would become new paragraph (e)(1)(i)(A), with the parenthetical in the previous sentence regarding CAPs and summaries constituting new paragraph (e)(1)(i)(A)(1). In new Sec. 424.58(e)(1)(i)(A)(2), and for the same reason behind proposed new Sec. 424.58(c)(1)(iii)(G), we proposed that the required data must include the instances in which the AO had the discretion to perform a survey but elected not to, including the reason(s) behind the AO's decision.

Third, we proposed to delete the requirement in current Sec. 424.58(c)(1)(iii) of monthly notice to CMS regarding complaints. This is because we proposed in new Sec. 424.58(e)(3)--as discussed later in this final rule--a separate process and timeframe for the AO's submission of complaint data to CMS.

Fourth, we proposed to add new paragraph (e)(1)(i)(C) that would require monthly notice of resolved deficiencies. As already mentioned, any DMEPOS supplier deficiency is of concern to us since it involves non-compliance with the quality standards or other applicable CMS requirement. Hence, we believe CMS should be made aware of them.

We did not propose to change the general content of existing paragraphs (c)(1)(ii) and (iv) regarding the monthly reporting of accreditation decisions and adverse actions. These two provisions, with slight technical modifications, would serve as new paragraphs (e)(1)(i)(B) and (D).

Current Sec. 424.58(c)(1)(v) requires the AO to report proposed changes to its accreditation standards or requirements or survey process on a monthly basis. It also states that CMS may withdraw its approval of the AO's accreditation program if the AO implements these changes without prior CMS approval. We proposed to delete this requirement because, as discussed later in this final rule, the question of AO process and standard changes is addressed more thoroughly in new Sec. 424.58(e)(2).

In new Sec. 424.58(e)(1)(ii), and for the same reasons behind proposed Sec. 424.58(c)(1)(xxiii)(A), we proposed that--

CMS may at any time request the AO to submit any of the information described in new paragraph (e)(1)(i) or any other data CMS deems necessary to facilitate its oversight of the AO's accreditation program; and

The AO must furnish this data to CMS within 3 business days of the request.

We also previously discussed current Sec. 424.58(c)(4) and its 2- day notification requirement regarding immediate jeopardy deficiencies. We proposed to retain this requirement as part of new Sec. 424.58(e)(1)(iii). b. AO Standard or Requirement Changes (New Sec. 424.58(e)(2))

As mentioned earlier, existing Sec. 424.58(c)(1)(v) requires the AO each month to notify CMS of any proposed changes to its accreditation standards, requirements, or survey process; the AO cannot implement the change without prior CMS approval. While we did not propose to revise the basic requirements of Sec. 424.58(c)(1)(v), we believe that additional safeguards are needed so that we: (1) become aware of planned changes sooner than we presently do; (2) have enough information to fully understand the breath of the revision; and (3) have the authority to either authorize or prohibit the AO's proposed revision. Therefore, we proposed several changes to Sec. 424.58(c)(1)(v), which would become new Sec. 424.58(e)(2).

First, we proposed in the opening paragraph of Sec. 424.58(e)(2) to incorporate the existing notice requirement in current Sec. 424.58(c)(1)(v) with two additions. One would require the notice to be written; this is current practice, but we wish to include this in regulation. To address questions from AOs regarding Sec. 424.58(c)(1)(v)'s scope, the other addition would state that Sec. 424.58(e)(2)'s scope includes the addition, modification, or removal of a DMEPOS product service category to the list of categories for which the AO accredits DMEPOS suppliers.

Second, we proposed in new Sec. 424.58(e)(2)(i) that the notice must:

Be submitted at least 60 calendar days before the proposed change's intended effective date;

Contain a detailed explanation of the revisions and the rationale for them; and

Include a detailed crosswalk (in table format) containing the exact language of the AO's revised accreditation requirements and the applicable Medicare requirements for each.

In new Sec. 424.58(e)(2)(ii), we proposed that CMS would furnish the AO written approval or disapproval of the proposed change within 30 calendar days of the effective date of the revision.

In new Sec. 424.58(e)(2)(iii), and to emphasize to AOs the need for prior CMS acquiescence, we proposed to largely restate our existing position in Sec. 424.58(c)(1)(v) that CMS may terminate or suspend its approval of the AO if the AO implements the change before or without CMS approval. c. Complaints (New Sec. 424.58(e)(3))

We previously noted that existing Sec. 424.58(c)(1)(iii) requires the AO to provide monthly notice to CMS of all complaints involving suppliers. As with certain other information falling under current Sec. 424.58(c)(1), we are concerned that only requiring the reporting of complaints on a monthly basis could leave us unaware for weeks of allegations of suppliers' non-compliance

with the quality standards or other applicable CMS requirement. Again, considering our obligation to safeguard the Trust Funds against improper payments and to protect beneficiaries, we believe complaint data should be furnished to us more frequently. We accordingly proposed the following requirements in new Sec. 424.58(e)(3).

In paragraphs (e)(3)(i)(A) through (C) and (3)(ii), we proposed that upon receipt of a complaint, the AO must--

Provide written notice of the complaint to CMS no later than 5 calendar days after receipt;

In accordance with its existing policies and procedures described in paragraph (c)(1)(x), perform an initial review of the complaint to determine whether, based on the complaint and any other data, the supplier may be non-adherent to one or more quality standards or other applicable CMS requirement; and

Within 21 days after receiving the complaint, conduct a survey of the supplier if the initial review determines that such non- compliance may exist.

No more than 10 calendar days after completing the action in paragraph (e)(3)(i)(B) or (C) (as applicable), give CMS written notice of the result of the initial review or, as applicable, the survey. (The notice must also inform CMS of any action the AO took or intends to take regarding the supplier, such as a termination of accreditation or imposition of a CAP.)

These requirements would help ensure that: (1) we receive the complaint expeditiously; (2) it is thoroughly investigated; and (3) we are aware of the result. d. CAPs (New Sec. 424.58(e)(4))

We proposed in Sec. 424.58(e)(4) that the AO must give CMS written notice of any decision to apply a CAP to a particular supplier no later than 10 calendar days after its decision. The notice must include--

The reason for the decision;

A detailed explanation and justification as to why the AO imposed a CAP instead of, as applicable, denying or terminating the supplier's accreditation; and

The terms of the supplier's CAP (for example, deadline for compliance, the AO's plans for enforcement and ensuring compliance).

This would help us ascertain the AO's: (1) compliance with its CAP policies contained in its application for CMS approval or reapproval; and (2) judgment in imposing CAPs instead of denying or terminating accreditation. e. Accreditation Denials and Terminations (New Sec. 424.58(e)(5))

We proposed in new Sec. 424.58(e)(5)(i) that the AO must give CMS written notice of any decision to deny, terminate, revoke, withdraw, or amend a supplier's accreditation within 5 calendar days of the decision; the notice must identify the reason for the AO's determination. Without our expeditious knowledge of such actions, an unaccredited and unqualified supplier might remain enrolled for a considerable period, possibly resulting in improper payments and beneficiary harm. Also, and as we explained in the proposed rule, this information could help CMS detect potentially systemic issues and trends among suppliers.

We recognize the relative independence that AOs must retain in their operations and particularly their accreditation decision-making, Nonetheless, there are several situations where we believe we must require that the AO take action because of the serious program integrity risk the situation entails. Thus, we proposed in new paragraphs (e)(5)(ii)(A)(1) through (5) that notwithstanding any other provision in Sec. 424.58, an AO must deny or terminate a supplier's accreditation if--

The supplier fails to meet the licensure requirements in Sec. 424.57(c)(1)(ii);

The supplier is not operational (as that term is defined in Sec. 424.502);

The supplier's location fails to meet the accessibility requirements in Sec. 424.57(c)(7)(i)(B);

The supplier's Medicare enrollment is revoked due to non- compliance with one or more DMEPOS quality standards and the reenrollment bar under Sec. 424.535(c) has not expired; or

Directed by CMS.

To ensure that the AO carries out a CMS-directed accreditation denial or termination, we further proposed in new paragraph (e)(5)(ii)(B) that the AO must: (1) deny or terminate the supplier's accreditation within 3 business days after receiving written notice from CMS to do so; and (2) provide CMS written notice that it has taken this action within 5 business days of receiving the written direction from CMS. f. Annual Summary of Data and CMS Changes (New Sec. 424.58(e)(6) and (7))

Existing Sec. 424.58(c)(6) requires the AO to annually furnish summary data specified by CMS that relates to the past year's accreditation activities and trends. Although we did not propose to change this requirement, we did propose to designate it as new Sec. 424.58(e)(6).

We previously noted that as part of the AO statement that proposed Sec. 424.58(c)(1)(xxiii) would require, the AO per Sec. 424.58(c)(1)(xxiii)(G) must--in response to CMS notification of a change in the quality standards, survey process, or other requirement-- furnish CMS with corresponding changes in the AO's requirements. We proposed in new Sec. 424.58(e)(7) to outline the required timeframe and content of this data submission.

The opening paragraph of Sec. 424.58(e)(7)(i) would: (1) include the requirement in proposed Sec. 424.58(c)(1)(xxiii)(G); (2) state that the AO's submission of concomitant revisions is to ensure continued comparability with the quality standards, survey process, and other requirements; and (3) require the AO to report its proposed changes to CMS no later than 30 days after receiving CMS' written notice. In addition, new paragraphs (e)(7)(i)(A) through (C) would include the data submission elements and formats required in existing Sec. 424.58(c)(2), specifically--

An acknowledgment of CMS's notification of the change;

A revised crosswalk reflecting the new requirements; and

An explanation of how the AO will modify its standards to conform to CMS's new requirements within the timeframes outlined in the notice it received from CMS.

In new Sec. 424.58(e)(7)(ii), we proposed to state that the AO cannot implement its proposed corresponding revisions without CMS approval. This requirement would help CMS ensure that the AO understands and accurately implements CMS' revisions. g. Performance of Surveys (New Sec. 424.58(e)(8))

As we explained in the proposed rule, not every supplier receives an accreditation survey. For instance, CMS currently permits AOs to undertake sampling for large supplier chain surveys. Factors an AO considers in determining which chain locations are surveyed include: (1) the supplier's physical location (for instance, whether it is in a high-fraud area); and (2) the types of products the supplier furnishes.

We have received information that various DMEPOS suppliers that were not surveyed were later found to be non-compliant with the quality standards. We emphasized throughout section VI.B. of the proposed rule CMS' obligation to prevent improper Medicare payments and to protect beneficiaries. By permitting AOs to forgo surveys in

certain instances, we risk the potential for patient harm and for millions of Medicare dollars to be paid to non-compliant suppliers. Believing that we must revisit the current process and establish stricter and broader requirements regarding the performance of surveys, we proposed the following requirements in new Sec. 424.58(e)(8).

Proposed opening paragraph (e)(8) and paragraph (e)(8)(i)(A) would state that except as otherwise directed or permitted in writing by CMS (for instance, allowing sampling), the AO must perform a survey of all supplier locations for which the supplier seeks accreditation or reaccreditation with the AO. (This includes, but is not limited to, accreditations: (1) for a new item type the supplier has not previously furnished; or (2) as required under 42 CFR 424.551, discussed later in this final rule.) Per our concerns about non-surveyed suppliers, we believe the blanket survey requirement in paragraph (e)(8)(i)(A) is necessary. Nevertheless, we also recognize that isolated and limited instances of sampling or other survey exemptions could be warranted. While we were unable to specify or predict in the proposed rule what those instances may be and do not commit to allowing survey exceptions in this final rule, we believe our administration of the DMEPOS accreditation program requires that we have the flexibility to address particular circumstances as they arise.

New paragraph (e)(8)(i)(B) would require the AO to perform all surveys as unannounced surveys. While the caveat in proposed opening paragraph of (e)(8)(i) would permit us to waive this requirement in certain situations, we do not anticipate doing so given the previously noted importance of preventing prior notice to the supplier.

In new paragraph (e)(8)(i)(C), we proposed that the AO cannot accredit the supplier location before: (1) the survey is conducted; and (2) the AO deems the supplier compliant with the quality standards. Our concern is that if we permitted accreditation (and then enrollment) prior to the survey and it is later determined that the supplier does not meet the quality standards, many thousands of dollars in improper payments to the supplier could have resulted.

We also proposed in new paragraph (e)(8)(ii) that CMS may, at any time, direct the AO to perform a survey of an accredited supplier or a group thereof. We do not believe surveys should be restricted to initial accreditation and reaccreditation situations, especially considering the aforementioned 3-year time gap between them. Suppliers must at all times be compliant with the quality standards and not merely upon initial accreditation and reaccreditation. To help verify that such adherence is always maintained, we believe we need discretion to direct an AO to conduct a survey at any time. Having to wait until reaccreditation to resurvey the supplier could lead in the interim to improper payments to a supplier that has fallen out of adherence to the quality standards.

We further proposed in new paragraph (e)(8)(iii) that when performing a survey, the AO must also confirm that the supplier is licensed in accordance with Sec. 424.57(c). We believe most AOs perform this task during the survey, but we proposed to require this in regulation considering the importance of the supplier's compliance with State (and not only Federal) laws. h. Surveyor Witnesses (New Sec. 424.58(e)(9))

We have cited current requirements in Sec. 424.58(c)(3) that the AO allow its surveyors to serve as witnesses if CMS undertakes an adverse action against a supplier in response to an accreditation finding. Consistent with our reorganization of Sec. 424.58, we proposed to designate this requirement without change as new paragraph Sec. 424.58(e)(9). i. Entrance of Data Into System (New Sec. 424.58(e)(10))

Notwithstanding our proposed additional reporting requirements, we outlined our concerns in the proposed rule about our ability to access accreditation and survey data immediately. There could be instances where we need prompt information about a particular supplier in real- time and cannot wait for the AO to send it to us. Thus, we proposed in new Sec. 424.58(e)(10) that if directed by CMS, the AO must enter accreditation, survey, product code, and other data into a CMS- designated system. This system, to which CMS and the NPECs would have access, would enable us to review accreditation data at any time. To preserve our operational flexibility, we did not detail in the proposed rule either the specific system involved or the timing, content, and extent of the data entry. We may even later determine that the data entry is unnecessary if an alternative means of accessing this information in real-time is established. The implementation of Sec. 424.58(e)(10) is thus contingent upon CMS determining that the entry is needed, hence the “if directed” caveat at the beginning of paragraph (e)(10). j. Adverse Actions (New Sec. 424.58(e)(11))

As previously noted, we proposed under new Sec. 424.58(c)(4)(v) that CMS could deny an AO's application for approval or reapproval of its accreditation program if the AO, or any AO owner, managing employee, governing body member, surveyor, or health care or administrative or management services personnel, has any of the adverse actions specified in Sec. 424.58(c)(4)(v). Consistent therewith, we proposed in new Sec. 424.58(e)(11) to duplicate this denial reason as a general prohibition against such relationships on an ongoing basis, not simply as part of the AO's application determination. We believe this change would further underscore the importance of ensuring that parties associated with the AO do not pose program integrity risks. 5. Continuing Federal Oversight of AOs (New Sec. 424.58(f))

Existing Sec. 424.58(d) outlines procedures for our ongoing review of AOs. While we intend to retain some of the provisions of this section, which would become new Sec. 424.58(f), we proposed changes to parts of its contents and structure to improve clarity and strengthen our oversight.

The opening paragraph of current Sec. 424.58(d) states that the paragraph establishes specific criteria and procedures for continuing oversight and for withdrawing approval of a CMS-approved DMEPOS AO. We proposed to revise this to state that CMS evaluates the performance of each CMS-approved DMEPOS accreditation program on an ongoing basis; means of monitoring include, but are not limited to, the reviews identified in proposed paragraph (f). We believe this new language would clarify that CMS' oversight procedures are not restricted to those in paragraph (f). We further proposed that existing Sec. 424.58(d) regarding terminations of AOs be in proposed new paragraph (h). Hence, the designation of Sec. 424.58(d) as new Sec. 424.58(f) will not include these paragraphs or any other reference to AO terminations. a. Equivalency Reviews (New Sec. 424.58(f)(1))

As described in current Sec. 424.58(d), an equivalency review involves our comparison of the AO's standards (and the AO's application and enforcement thereof) to CMS requirements and processes. Paragraphs (d)(1)(i) through (iii) outline the following instances in which CMS may perform this review: (i) CMS imposes new requirements or changes in its survey process; (ii) the

AO proposes new standards or changes in its survey process; or (iii) the AO's term of accreditation expires. We believe that retaining these three paragraphs in new paragraph (f)(1) would imply that we can only perform equivalency reviews in these three situations, which is not our intention. For reasons already noted, we must be able to constantly monitor the AO's operations--even if none of the three previous scenarios apply--and equivalency reviews are an important means of doing so. Consequently, we proposed in new paragraph (f)(1) that we may perform an equivalency review at any time; the contingencies in existing (d)(1)(i) through (iii) would not be included in paragraph (f)(1). b. Validation Survey of Suppliers (New Sec. 424.58(f)(2))

Another means of validating the AO's accreditation processes is to review the AO's survey procedures. Addressed in the opening paragraph of existing Sec. 424.58(d)(2), this can involve CMS or its designated survey team--

Performing a survey of an accredited DMEPOS supplier;

Examining the results of the AO's survey of a supplier; or

Observing an AO's survey of a supplier onsite.

After the review, CMS identifies whether (as stated in current Sec. 424.58(d)(2)(i) through (iii)), the review indicates the following:

At least a 10 percent disparity between the AO's and CMS' respective survey findings for non-immediate jeopardy standards.

Any disparity between the AO's and CMS' respective survey findings for standards constituting immediate jeopardy.

Regardless of the disparity rate, there are widespread and systemic problems in the AO's processes such that accreditation by the AO no longer provides CMS with adequate assurance that suppliers meet or exceed Medicare requirements.

Additional provisions regarding CMS' performance of a supplier survey (as a means of ascertaining the AO's performance) are addressed in existing Sec. 424.58(b)(2). Specifically, the latter states that CMS performs supplier surveys on a representative sample basis or in response to substantial allegations of non-compliance.

We proposed several modifications to the foregoing provisions to both consolidate and streamline our requirements and to enhance our ability to perform the aforementioned reviews.

First, we proposed to incorporate all provisions regarding validation surveys within new Sec. 424.58(f)(2) rather than continue to have them split between Sec. 424.58(b)(2) and (d). We believe this would facilitate clarity and consistency.

Second, we proposed in new paragraph (f)(2)(i) that CMS may survey suppliers to validate the AO's survey process. Such surveys can be comprehensive or focus on certain standards or requirements. We noted in the proposed rule that paragraph (f)(2)(i) would not include the three survey situations in the opening paragraph of existing Sec. 424.58(d)(2), the provisions in Sec. 424.58(d)(2)(i) through (iii), or references to sample bases and substantial allegations of non- compliance in Sec. 424.58(b)(2). This is because we believe that paragraphs (b)(2) and (d)(2), as currently written, could be erroneously read as restricting our flexibility to: (1) conduct supplier surveys; and (2) reach conclusions that indicate problems with the AO's accreditation program. It is crucial, in our view, to have much wider latitude in assessing an AO's performance and to take action as needed.

Third, existing Sec. 424.58(b)(3) through (6) state, respectively, that--

If CMS discovers that the supplier is non-adherent to the quality standards, CMS may revoke the supplier's billing number or require the AO to perform a subsequent full survey at the AO's expense;

A supplier selected for a validation survey must authorize: (1) the survey to occur; and (2) the CMS survey team to monitor the correction of any deficiencies found during the survey;

If the selected supplier does not comply with the existing authorization requirements of paragraph (b)(4), it does not meet the quality standards and may have its supplier billing number revoked; and

If the survey finds that the supplier is non-compliant with one or more quality standards, the supplier no longer meets the quality standards and may have its supplier billing number revoked.

Except for changing “supplier billing number” to “enrollment” (the latter being the more accurate term), we did not propose revisions to these requirements, which we would designate as new Sec. 424.58(f)(2)(ii), (iii), (iv), and (v). c. Deficiencies (Sec. 424.58(f)(3))

As part of the proposed statement under new Sec. 424.58(c)(1)(xxiii), new paragraph (H) thereof would require the AO to agree to accept and adhere to any CMS-established deficiency definition as well as levels and categories of deficiencies. To reiterate CMS' discretion in both this regard as well with respect to CMS' authority to establish quality standards under section 1834(a)(20) of the Act, we proposed in new Sec. 424.58(f)(3)(i) that CMS may--

Define the term “deficiency”;

Establish levels and categories of deficiencies; and

Revise the quality standards.

New Sec. 424.58(f)(3)(ii) would require the AO in its accreditation activities to apply and adhere to: (1) any CMS- established definition of deficiency and categories and levels thereof; and (2) all CMS-established quality standards. d. Additional Reviews (Sec. 424.58(f)(4))

We proposed in new Sec. 424.58(f)(4)(i)(A) to expand upon the reviews addressed in new Sec. 424.58(f)(1) and (2) and permit CMS--at any time and for any reason--to conduct a review of the AO's processes or performance to--

Validate the AO's representations to CMS (for example, its statements in new paragraph (c)(1)(xxiii)); or

Assess the AO's adherence to its own policies and procedures, the provisions of Sec. 424.58, and all other CMS requirements.

We also proposed in new Sec. 424.58(f)(4)(i)(B) that the scope, length, and timing of the review would lie within CMS' discretion. Furthermore, evidence of the AO's potential non-compliance with any of the policies and requirements addressed in new Sec. 424.58(f)(4)(i)(A) is not required for CMS to perform a review.

In new Sec. 424.58(f)(4)(ii)(A) through (H), we proposed to list some of the types of reviews that CMS may perform either collectively or individually. Paragraphs (f)(4)(ii)(A) and (B) would respectively reference the reviews in new Sec. 424.58(f)(1) and (2). Paragraphs (f)(4)(ii)(C) and (D) would reflect two of the previously mentioned reviews in existing Sec. 424.58(d)(2): examining the results of an AO's surveys of suppliers and observing onsite an AO's survey of a supplier. Proposed new paragraphs (f)(4)(ii)(E) through (H) would address the following reviews of the AO's onsite operations, similar to those for certified providers and certified suppliers in 42 CFR 488.8(h):

Conducting onsite inspections of the AO's operations and offices.

Requesting and reviewing documents.

Interviewing AO personnel.

Observing AO internal meetings concerning the accreditation process.

We explained in the proposed rule that these proposals in new Sec. 424.58(f)(4) are necessary to give us

greater flexibility and more means with which to examine the AO's performance. Indeed, current Sec. 424.58 only references equivalency reviews, supplier surveys, and the AO's periodic submission of data as vehicles via which we can perform this task. We must be able to tailor the format, timing, and scope of our reviews to address particular circumstances. 6. Terminations of CMS-Approved AO Accreditation Programs (New Sec. 424.58(g) and (h)) a. Voluntary Terminations

Sections 488.5(c)(2), 488.8(g)(2), and 488.1045(a) outline procedures via which an AO can voluntarily terminate its existing CMS- approved certified provider/supplier or home infusion therapy supplier accreditation program. To ensure that DMEPOS AOs follow a specific, uniform process for doing so and, more importantly, that CMS is given adequate notice thereof, we proposed to establish similar procedures in new Sec. 424.58(g).

In paragraph (g)(1), we proposed that an AO may voluntarily terminate its CMS-approved DMEPOS accreditation program at any time. In doing so, the AO per paragraphs (g)(1)(i) and (ii), respectively, must--

Inform CMS of its decision no less than 120 calendar days before the termination effective date; and

Provide written notice at least 90 days before the termination effective date to each of its accredited suppliers but not before notifying CMS of its decision under the previous bullet. The notice to each supplier must--

++ Describe the provisions in proposed new paragraph (g)(2) (discussed shortly) concerning the expiration dates of the supplier's accreditation with the terminating AO; and

++ Inform the supplier that any lapse in its accreditation (including between the date its existing accreditation with the terminating AO expires and the effective date of its accreditation with a different AO) will result in the revocation of its enrollment under Sec. 424.535.

In new paragraph (g)(2), we proposed that unless the supplier is otherwise determined to be non-adherent to the quality standards or other accreditation requirements, the supplier's accreditation with the terminating AO remains effective until the earliest of: (1) the expiration of its current term of accreditation with the terminating AO; and (2) the effective date of its accreditation with a different CMS-approved AO. We do not believe a supplier's accreditation should be correspondingly and automatically terminated when an AO voluntarily terminates its DMEPOS accreditation program. The AO's decision, in our view, is separate and distinct from the question of whether the supplier still complies with the quality standards and all other accreditation requirements. So long as the supplier remains compliant therewith, its accreditation should typically remain intact until one of the two aforementioned contingencies occurs. b. Involuntary Terminations (1) Reasons

Current Sec. 424.58(d)(4)(i) and (ii) list two reasons for which CMS can terminate its approval of an AO's DMEPOS accreditation program:

Accreditation by the AO no longer adequately ensures that its suppliers comply with the quality standards, and that failure to meet these requirements could: (i) jeopardize the health or safety of Medicare beneficiaries; and (ii) constitute a significant hazard to public health; or

The AO has not met its obligations regarding initial application or reapproval application procedures.

We believe these termination reasons may be too limited. For example, existing Sec. 424.58(d)(4)(i) can only apply if the failure could jeopardize beneficiaries or public health. We do not believe these two events should be the sole grounds for termination. If the program does not ensure that suppliers meet the quality standards-- which is the principal reason for the DMEPOS accreditation program in the first place--that alone is of great concern because it could result in improper payments. Put otherwise, the issue is not only beneficiary safety (critical though that matter is) but also protection of the Trust Funds. With respect to Sec. 424.58(d)(4)(ii), the AO's obligations are not restricted to those involving the initial and reapproval application processes. They instead are constant throughout the entirety of the AO's period of CMS approval and require the AO's ongoing compliance with Sec. 424.58. We maintain that our involuntary termination reasons should be much broader so as to address the previous situations and to ensure we have the ability to safeguard the Medicare program.

We thus proposed the following provisions in new Sec. 424.58(h).

In new paragraphs (h)(1)(i)(A) through (D), and for reasons explained in detail in the proposed rule, we proposed that we may terminate our approval of an AO's accreditation program if CMS determines that--

The AO no longer demonstrates reasonable assurance (as defined in paragraph (b));

The continued approval of the AO's accreditation program poses an immediate jeopardy to the patients of the entities accredited under that program or otherwise constitutes a hazard to the public health;

The AO is non-adherent to any provision of Sec. 424.58. This includes, but is not limited to, situations where the AO has failed to comply with--

++ A term or condition of a statement or agreement in Sec. 424.58(c)(1)(xxiii); or

++ A policy, procedure, or practice it outlined under paragraph Sec. 424.58(c) as part of its initial or reapproval application or CMS-approved change thereto under Sec. 424.58(e)(2) or (e)(7); or

A pattern or practice exists of the AO's accredited suppliers being revoked under Sec. 424.535(a) for failing to adhere to the quality standards.

We proposed in new Sec. 424.58(h)(1)(ii) that CMS could terminate its approval of the AO's accreditation program effective on the date of the termination notification letter to the AO (described in proposed new paragraph (h)(2)) or any date thereafter. Considering, as already stated, the risks to the Trust Funds and Medicare beneficiaries that AO non-compliance could lead to (such as continued substandard services offered by non-compliant suppliers), we believe that having to wait 30 days, 60 days, or longer before the termination is effective could result in considerable improper payments and possible patient harm. Although we are including an “or any date thereafter” caveat to Sec. 424.58(h)(1)(ii) to account for situations where a slightly later date might be warranted, we believe these will be rare. (2) Processes

To assist stakeholders in understanding the consequences of a termination, we proposed in new Sec. 424.58(h)(2) through (5) to outline operational procedures for terminating an AO's approval and to address the consequent impact on suppliers; some of these provisions are akin to those in Sec. Sec. 488.1030(f), 488.8(e), and 488.1045(b).

We proposed in new Sec. 424.58(h)(2) that CMS would give written notice to the AO of its termination decision. The notice must include the reason for and effective date of the termination. We proposed in new Sec. 424.58(h)(3) (and as with AO initial application submissions) that CMS would announce its decision (and the effective date

thereof) on its website. This would help ensure the public is made aware of the termination as quickly as possible, something that may prove challenging if publication in the Federal Register were required.

So affected suppliers receive individualized notice beyond the CMS website announcement, we proposed in new Sec. 424.58(h)(4) that the terminated AO must give written notice of the termination and its implications to each of its accredited suppliers within 30 calendar days after the CMS website announcement. The notice to each supplier would have to--

Explain the provisions in Sec. 424.58(h)(6) concerning the expiration dates of the supplier's accreditation with the terminated AO; and

Inform the supplier that any lapse in its accreditation (including between the date its existing accreditation with the terminated AO expires and the effective date of its accreditation with a different AO) results in its enrollment being revoked under Sec. 424.535.

We also proposed the following in new Sec. 424.58(h)(5) and (6)(i)(A) through (C):

The terminated AO must work collaboratively with CMS to direct its accredited suppliers to the remaining CMS-approved AOs within a reasonable period of time.

Unless the supplier is otherwise determined to be non- adherent to the quality standards or other accreditation requirement, the supplier's accreditation with the terminated AO remains effective until the earliest of--

++ The expiration of its current term of accreditation with the terminated AO;

++ The effective date of its accreditation with a different CMS- approved AO; or

++ A date specified by CMS based on the circumstances of the termination of the AO's approval.

We believe new paragraphs (h)(4), (5), and (6)(i) would ease suppliers' transition to a new AO by: (1) explaining the implications of the termination; (2) facilitating CMS-AO collaboration; and (3) emphasizing that the supplier's accreditation does not automatically end with the AO's departure. Yet paragraph (h)(4) and the required letter would stress to the supplier that there can be no gaps in its accreditation. This may require the supplier to promptly seek accreditation with another AO before its current accreditation expires.

Should CMS specify a particular accreditation end-date per proposed paragraph (h)(6)(i), CMS under new paragraph (h)(6)(ii) would notify the affected supplier in writing thereof and identify the deadline by which the supplier must be reaccredited by a different AO.

We also proposed in new Sec. 424.58(h)(7) that the terminated AO must refund to a supplier all payments the latter made to the AO in accordance with the supplier's request for accreditation or reaccreditation but before the AO notified the supplier of its final determination regarding the supplier's request. We do not believe an AO whose approval has been terminated should be able to keep the monies the supplier paid it when the requested service--accreditation or reaccreditation--was not fully rendered (that is, the final decision was not made). Fundamental fairness to the supplier requires, in our view, the refund of these payments. 7. AO Suspensions and Probations (New Sec. 424.58(i) and (j))

Termination is presently the only remedy available to CMS under Sec. 424.58 to address AO performance issues. Although we proposed in Sec. 424.58(h)(1) to expand the grounds for which termination can apply, we recognize the seriousness of a termination and would generally only take this step in exceptional circumstances. Yet under current Sec. 424.58, this could leave the non-compliance unresolved because of our lack of other, perhaps more suitable remedies. In other words, we do not believe AO non-compliance should only be addressable by an all-or-nothing, termination-or-no termination approach. Having multiple available remedies would allow us to correspond our action to the relative severity of each case. a. Suspension

We proposed in new Sec. 424.58(i) to have the ability to suspend an AO's accreditation program. Under paragraphs (i)(1)(i) and (ii), suspension could occur if we determine that the AO no longer demonstrates reasonable assurance (as defined in paragraph (b)) or is non-compliant with any provision of Sec. 424.58. The non-compliance can include, but is not limited to, situations where the AO has failed to--

Comply with a term or condition of a statement or agreement in Sec. 424.58(c)(1)(xxiii); or

Adhere to a policy, procedure, or practice it outlined under Sec. 424.58(c) as part of its initial or reapproval application or a CMS-approved change thereto under Sec. 424.58(e)(2) or (e)(7).

We also proposed that CMS may suspend the AO's accreditation program if there is a pattern or practice of the AO's accredited suppliers being revoked under Sec. 424.535 for failing to comply with the quality standards.

These grounds are also applicable to terminations but are sufficiently broad to enable us to apply a lesser sanction if the circumstances warrant. (For example, the Sec. 424.58 non-compliance may not be significant enough to, in our view, justify a termination).

We proposed in new Sec. 424.58(i)(2) to outline a suspension's components. Paragraph (i)(2)(i) would state that except as otherwise specified or permitted by CMS, the AO could not conduct any DMEPOS accreditation activities while suspended. We believe the opening caveat is necessary should we need the AO, despite its suspension, to perform certain functions, such as completing an ongoing survey. Proposed paragraph (i)(2)(ii), meanwhile, would state that--

CMS determines the length of the suspension, which would be a maximum of 1 year; and

Upon the expiration of the suspension period, CMS either lifts the suspension or terminates the AO's approval in accordance with proposed paragraph (h).

Aside from the maximum 1-year period, we do not believe a fixed suspension length should be established in regulation. Since every situation will differ, we must have the discretion to tailor the suspension length to the specific facts of the case. We believe a 1- year maximum is appropriate because if the AO cannot rectify the non- compliance within such an extensive timeframe, this indicates systemic issues that can warrant termination.

For the same reasons behind proposed paragraph (h)(2) regarding terminations, we proposed in new paragraph (i)(2)(iii) that CMS may suspend the AO's program effective the date of the suspension notification letter described in paragraph (i)(3) or any date thereafter.

We proposed in new paragraph (i)(3) that CMS would send written notice of the suspension decision to the AO. The notice would include the reason(s) for, the effective date of, the length of, and the terms of the suspension (for instance, application of a CAP; whether the AO may perform certain functions during the suspension; etc.), as well as the steps the AO must take to have the suspension lifted. To confirm that the AO received the notice, we proposed in new paragraph (i)(3)(ii) that the AO must notify CMS of this in writing within 3 calendar days of receipt.

In new paragraph (i)(3)(iii), we proposed that no later than 3 calendar days after our receipt of the acknowledgement in paragraph (i)(3)(ii),

CMS would post on its website a notice of the suspension.

We proposed in new paragraph (i)(4) to address the status of the suspended AO's accredited suppliers. Akin to supplier statuses with AO voluntary and involuntary terminations, we proposed in new paragraphs (i)(4)(i)(A) through (C) that if the AO's accreditation program is suspended, the accreditation status of its suppliers remains effective through the length of the suspension unless--

The supplier's current term of accreditation with the suspended AO expires during the suspension;

The supplier is otherwise determined to be non-adherent to the quality standards or other accreditation requirement; or

CMS specifies a different accreditation termination date based on the circumstances of the suspension of the AO's accreditation program.

We proposed in new paragraph (i)(4)(ii)(A) that if paragraph (i)(4)(i)(A) applies, the supplier must be reaccredited by: (1) its AO if the AO's suspension has been lifted; or (2) a different CMS-approved AO. We proposed in new paragraph (i)(4)(ii)(B) that if paragraph (i)(4)(i)(C) applies, CMS notifies the affected supplier in writing of the deadline by which the supplier must be reaccredited. In new paragraph (i)(4)(iii), we would reiterate that any lapse in the supplier's accreditation may result in the revocation of the supplier's enrollment.

We proposed in new paragraph (i)(5) to address the circumstances under which a suspension is lifted and the processes associated therewith. In paragraphs (i)(5)(i)(A) through (C), CMS would lift a suspension if all of the following are met:

The reasons for it no longer exist.

The AO demonstrates reasonable assurance (as defined in paragraph (b)).

The AO is in compliance with all provisions of Sec. 424.58.

We believe that even if the specific issue that led to the suspension has been corrected, it is possible that other instances of non-compliance exist, hence the need for paragraphs (i)(5)(i)(B) and (C).

For the same reasons behind proposed paragraphs (i)(3)(i) through (iii), we proposed in new paragraph (i)(5)(ii) that if the suspension is lifted, CMS would--

Send the AO written notice that the suspension has been lifted;

Require the AO to notify CMS in writing of its receipt of the notice within 3 calendar days of such receipt; and

No later than 3 calendar days after receipt of the AO's acknowledgement, publish on its website a notice of the lifting of the AO's suspension.

We proposed in new paragraph (i)(6) to duplicate proposed paragraph (h)(7) regarding refunds. We note that the suspension would not be lifted before all required refunds to suppliers under paragraph (i)(6) have been paid.

We proposed in new paragraph (i)(7) that nothing in paragraph (i) would prohibit CMS from suspending an AO's accreditation program more than once. This would help preserve our flexibility to take the most appropriate action to address AO non-compliance; for example, a second suspension may be more appropriate than a suspension followed by a termination several years later. b. Probation

To further enhance our ability to address AO non-compliance in a manner proportional to the degree thereof, we proposed to establish a process in new Sec. 424.58(j) for placing an AO's accreditation program on probation in lieu of a termination or suspension.

In paragraph (j)(1), we proposed to have the discretion to place an AO's DMEPOS accreditation program on probation and require its successful completion of a CAP in the following instances--

CMS determines that the DMEPOS accrediting organization no longer demonstrates reasonable assurance (as defined in paragraph (b) of this section).

CMS determines that the AO is non-compliant with any provision of Sec. 424.58. This could include the aforementioned terms, conditions, procedures, etc., described in proposed new paragraphs (h)(1)(i)(C) and (i)(1)(ii).

CMS determines that there is a pattern or practice of the AO's accredited suppliers being revoked under Sec. 424.535 for not complying with the quality standards.

The suspension period for the AO under paragraph (i) has expired and CMS determines that a subsequent probationary period and associated CAP are warranted.

In paragraph (j)(2)(i), we proposed that CMS would give the AO written notice of its decision to place it on probation. The notice would include--

The reason(s) for CMS' decision;

The length of the probationary period, which would not exceed 1 year;

The CAP's terms;

The requirements and deadline for achieving compliance; and

An explanation of how CMS would monitor the AO's efforts to resume adherence under the CAP (for example, performing reviews under paragraph (f)).

We proposed in new paragraph (j)(2)(ii) that except as otherwise prescribed in the CAP, the AO could continue its accreditation activities as normal.

We proposed in new paragraph (j)(3)(i) that when the probationary period concludes, CMS would notify the AO in writing of--

Whether the AO is in compliance with all requirements of Sec. 424.58;

The reason for the determination in the previous bullet; and

The consequences of the determination (for example, termination or suspension of accreditation, successful completion of and cessation of the probationary period and CAP).

We proposed in new paragraph (j)(3)(ii) that we may send this notice, terminate the probationary period, and end the CAP prior to the end of designated probationary period if we determine that the AO is again compliant, for this would eliminate the continued need for the probation and CAP. 8. CMS Discretion, Change in Non-Compliance Actions (New Sec. 424.58(k))

To confirm CMS' discretion to determine which action should be imposed against an AO and, if circumstances warrant, to escalate a currently imposed action to a more significant one, we proposed the following in new Sec. 424.58(k). First, we proposed in new paragraph (k)(1) that CMS could impose an action in Sec. 424.58(h), (i), or (j) instead of another such action in paragraph (h), (i), or (j) if the same ground(s) for either exists. Second, Sec. 424.58(k)(2) would state that CMS could terminate--

An AO's probation (either before or in accordance with the probationary period's original expiration date) and impose a suspension or termination if a ground for either of the latter actions exists; or

An AO's suspension (either before or in accordance with the suspension's original expiration date) and impose a termination if a basis for termination exists. 9. Reconsiderations and Rebuttals (New Sec. 424.58(l)) a. Denials and Involuntary Terminations

Current Sec. 424.58(e)(1) outlines the reasons for which an AO may file a written request for reconsideration of a CMS determination that the AO does not provide reasonable assurance that the suppliers it has accredited meet the quality standards. The procedures of the

reconsideration process are outlined in existing Sec. 424.58(e)(2) through (9). We proposed to remove all these reconsideration provisions from Sec. 424.58 and, in new Sec. 424.58(l) instead utilize the reconsideration processes in 42 CFR part 498 for denied and involuntarily terminated AOs. This would afford AOs the same robust appeal rights that exist for providers and suppliers whose enrollments are denied or revoked under Sec. 424.530 or Sec. 424.535.

In addition, Sec. 498.3(b) lists situations in which CMS makes an initial determination. We proposed to add new paragraphs (b)(21) and (22) to Sec. 498.3. The former would include denials under paragraph (c)(4) or (d)(4). The latter would include involuntary terminations under paragraph (h)(1). We also proposed to state in new Sec. 424.58(l)(1) that the AO could request a reconsideration under part 498 of any of these three initial determinations. b. Suspensions and Probationary Periods

As explained in the proposed rule, we believe a rebuttal process would be more appropriate than a reconsideration process for AOs whose accreditation programs have been suspended or placed on probation. It is shorter and more expedited but still affords the affected AO an opportunity to be heard.

We proposed in new paragraph (l)(2) to outline the procedures via which a DMEPOS AO may rebut a CMS suspension or probation decision. These procedures duplicate the existing rebuttal process in Sec. 424.546 for deactivations.

We proposed in new paragraph (1)(2)(i)(A) that if an AO receives notice from CMS that its DMEPOS accreditation program has been suspended or placed on probation, the AO has 15 calendar days from the date of such notice to submit a rebuttal to CMS.

We proposed in new paragraph (l)(2)(i)(B) that CMS may, at its discretion, extend the 15-day time-period referenced in paragraph (l)(2)(i)(A).

We proposed in new paragraph (l)(2)(ii)(A) through (D) that any rebuttal must--

Be in writing;

Identify the facts or issues about which the AO disagrees with CMS' determination, including the reasons for disagreement;

Include all documentation the AO wants CMS to consider in its review of its determination; and

Be submitted in the form of a letter that is signed and dated by the AO's CEO (or similar official with authority to commit the organization to adhere to Medicare laws and regulations) or a legal representative (as defined in 42 CFR 498.10). We also proposed the provisions from Sec. 424.546(b)(4) regarding legal representatives (for example, a required statement that the representative has the authority to represent the AO).

We proposed in new paragraph (l)(2)(iii) that the AO's failure to submit a timely and compliant rebuttal would constitute a waiver of all rebuttal rights under paragraph (l)(2).

We proposed in paragraph (l)(2)(iv) that upon receipt of a timely and compliant AO rebuttal, CMS reviews it to determine whether the imposition of the suspension or probation was proper.

We proposed in new paragraph (l)(2)(v) that CMS would not be required to delay the imposition of the suspension or probation pending the completion of CMS' review of the rebuttal.

Finally, we proposed in new paragraph (1)(2)(vi) that a CMS determination made under paragraph (l)(2) would not be an initial determination under Sec. 498.3(b) and therefore not appealable. 10. Consulting (New Sec. 424.58(m))

As previously mentioned, CMS issued a February 15, 2024, proposed rule addressing several topics regarding certified provider/supplier accreditation. One such subject was consulting services provided by AOs, their consulting divisions, or separate business entities to Medicare-participating health care facilities. An example of consulting services that proposed rule cited involves an AO's review of facility standards and promised early intervention and action through simulation of a real survey, such as a mock survey with comprehensive written reports of findings. This situation is of particular concern to us. The purpose of the DMEPOS accreditation survey is to objectively assess the supplier's compliance with the DMEPOS quality standards without the AO's prior aid in helping the supplier achieve such compliance. That is, the supplier should be able to adhere to the quality standards on its own merits. We believe it would be a conflict of interest if the AO had effectively “coached” the supplier on how to pass the survey that the AO later performed. In addition, the AO might be reluctant to find non-compliance on the survey--even though such non-compliance exists-- because this could reflect poorly on the AO's pre-survey assistance. Either situation could lead to an unqualified DMEPOS supplier becoming accredited and enrolled. For this reason, we believe that certain protections against this activity are warranted and thus propose the following provisions.

We proposed in new Sec. 424.58(m)(1) to define the terms “consulting” and “consulting services” for purposes of proposed paragraph (m). The terms would mean those services furnished by a DMEPOS AO (or by its consulting division or separate business entity (such as a company or corporation) that furnishes such services) for the review of a DMEPOS supplier's standards, processes, policies, and functions for compliance with the AO's standards, the DMEPOS quality standards, or other Medicare requirements through simulation of a real survey, such as a mock survey, with comprehensive written reports of findings and early intervention and action to correct deficiencies prior to an actual accreditation survey. Importantly, we noted in the proposed rule that this definition would not be restricted to consulting that is fee-based.

We proposed in new paragraphs (m)(2)(i) through (iii) that, except as provided in proposed Sec. 424.58(m)(3), an AO or its consulting division or separate business entity (such as a company or corporation that provides consulting) may not provide consulting services in the following instances:

To any new supplier before the completion of the initial accreditation survey, meaning the first accreditation survey of a supplier that has not previously received accreditation services from that AO. If a supplier is later voluntarily or involuntarily terminated from that AO's services and thereafter retains the services of that same AO or a new one, the first survey of that supplier by the same or new AO would be considered an initial accreditation survey.

To a supplier the AO accredits within 6 months prior to the supplier's next scheduled re-accreditation survey. A re- accreditation survey would be any subsequent accreditation survey the AO performs after the initial survey.

To a supplier to which the AO furnishes accreditation services, in response to a complaint the AO receives concerning that supplier.

In paragraphs (m)(3)(i) through (iv), we proposed the following four situations where an AO, its consulting division, or separate business entity may provide consulting services to the suppliers it accredits.

The first is during the 6-month period after an initial or re- accreditation survey is performed. The second is when CMS or its contractor receives and

investigates complaints about an AO's accredited supplier where an immediate jeopardy deficiency or basis for revocation of enrollment under Sec. 424.535 is identified. However, the consulting may occur only after the investigation is completed and can only address those issues identified in the investigation. The third and fourth are: (1) consulting services provided to suppliers that the AO does not accredit at the time the services are furnished; and (2) general education the AO furnishes about its accreditation program.

To help us confirm the AO's compliance with paragraph (m), we proposed in paragraph (m)(4) that the AO must furnish to CMS upon CMS' request and with each initial and reapproval application under paragraphs (c) and (d) of this section, a report containing the following information:

Whether the AO or an associated consulting division or company the AO has established furnishes consulting services.

The names, National Provider Identifiers, and addresses of all suppliers to which the AO or its associated consulting division or company has furnished consulting services during the prior 6-month timeframe.

The dates such services were provided to each supplier.

Whether the AO has ever furnished, or is currently furnishing, accreditation services to any supplier identified in the report.

For each supplier listed in the report, the dates of: (1) its most recent accreditation survey; and (2) the next re-accreditation survey due to be performed.

A description of the consulting services provided to each supplier in the aforementioned report.

In paragraph (m)(5)(i), we proposed that the DMEPOS AO, its consulting division, or separate business entity must have and comply with the following written consulting policies and procedures. At a minimum, these policies and procedures must include the following:

The AO's consulting services must be furnished by a separate division of the AO or separate business entity (such as a company or corporation) that is separate from the AO's accreditation division.

The AO's consulting division or separate business entity must maintain separate staff from that of the AO's accreditation divisions to ensure that--

++ The consulting division personnel do not conduct the AO's accreditation division functions; and

++ The AO's accreditation division staff do not conduct consulting division functions.

An AO's accreditation staff and surveyors are prohibited from marketing the AO's consulting services to the AO's accreditation clients.

To help verify the AO's compliance with paragraph (m), we also proposed in new paragraph (m)(5)(ii) that an AO that provides consulting services must submit its written consulting firewall policies and procedures to CMS by a date specified by CMS and with each application for initial approval or reapproval. 11. Other Relationships Involving Potential Conflicts of Interest (New Sec. 424.58(n)) a. AO/Supplier Relationships (New Sec. 424.58(n)(1))

To further preserve objectivity in AO surveys, we proposed in new Sec. 424.58(n) to expand upon the situations described in paragraph (m) to include relationships between AO officials and the suppliers the AO accredits.

In paragraph (n)(1)(i), we proposed that if an AO owner, surveyor or employee (currently or within the previous 2 years) had an interest in or relationship with (as described in proposed Sec. 424.58(c)(1)(vii)(D)(3)) a DMEPOS supplier accredited by the AO, the AO owner, surveyor, or employee would not be permitted to--

Participate in the survey of that DMEPOS supplier;

Have input into the results of the survey and accreditation for that DMEPOS supplier;

Have involvement with the pre-or post-survey activities for that DMEPOS supplier; or

Have contact with or access to the records for the survey and accreditation of that DMEPOS supplier.

We believe these prohibitions would help reduce the risk that an AO owner, surveyor, or employee will improperly influence the DMEPOS supplier's survey and accreditation.

We proposed in revised Sec. 424.58(b) to define “immediate family member” to help explain some of the conflict-of-interest affiliations that fall within Sec. 424.58(c)(1)(vii)(D). So as to tie this definition to proposed (n)(1), we proposed in new paragraph (n)(1)(ii) that, for purposes of new paragraph (n)(1), the term “immediate family member” would have the same meaning as that in paragraph (b).

Per proposed Sec. 424.58(c) and (d), the conflict-of-interest information described in Sec. 424.58(c)(1)(vii)(D) would have to be furnished with the DMEPOS AO's initial and reapproval applications. Given this data's importance and the need to always avoid conflicts-of- interest, however, we also proposed in new paragraph (n)(1)(iii) that CMS may request any and all of this information at any time outside of the initial approval and reapproval processes.

To help the public better understand the relationship between the current final rule and the February 15, 2024, proposed rule, we have prepared the following table. It identifies three sets of our final provisions that, to varying degrees, duplicate certain provisions in the February 15, 2024, proposed rule but contains several notable differences. BILLING CODE 4120-01-P

[GRAPHIC] [TIFF OMITTED] TR02DE25.050

BILLING CODE 4120-01-C b. NPEC/AO Relationships (New Sec. 424.58(n)(2))

NPECs (of which there are two nationwide) process DMEPOS Form CMS- 855S enrollment applications. This involves, for example, (1) verifying the data the supplier furnished on or with the application; (2) performing a site visit; and (3) ensuring the supplier meets all Medicare requirements. The latter includes confirming that the supplier is accredited per Sec. 424.58.

None of our current DMEPOS AOs are NPECs or parents or subsidiaries thereof. Yet we remain concerned about the potential for conflicts-of- interest

between AOs and CMS contractors. We believe that any CMS contractor with any oversight responsibility of DMEPOS suppliers could also present conflict-of-interest issues. These could include, but would not be limited to, Durable Medical Equipment Medicare Administrative Contractors (DME MACs), which process DMEPOS claims, and contractors that perform site visits of DMEPOS suppliers. To illustrate, suppose a DMEPOS site visit contractor (SVC) is also a DMEPOS AO. The entity performed a survey of, and accredited, DMEPOS Supplier X. In its role as an SVC, it conducted a site visit of X 3 months later. Although X did not appear meet the definition of “operational” in Sec. 424.502, the entity might be reluctant to make this finding because it could cast doubts on the thoroughness of its AO survey 3 months earlier. This could result in the supplier becoming enrolled and receiving payments while non-operational.

To avoid such conflict-of-interest situations and to help facilitate the impartiality of DMEPOS AO accreditation decisions, we proposed in new Sec. 424.58(n)(2) that an entity may not serve as a CMS-approved DMEPOS AO if it is currently a CMS contractor--or an owner or subsidiary thereof (regardless of the ownership percentage involved)--with any oversight responsibility of DMEPOS suppliers. We also solicited comment on whether this prohibition should extend to situations where, similar to paragraph (n)(1), there are familial relationships between owners and employees of DMEPOS AOs and the CMS contractor--for instance, whether an organization should be prohibited from being a DMEPOS AO if it has owners or employees who are immediate family members of NPEC owners or employees. 12. AO Changes of Ownership (New Sec. 424.58(o))

Section 488.5(f) contains detailed procedures for when an AO undergoes a change of ownership (as that term is defined in Sec. 489.18(a)(1) through (3)). We thus proposed in new Sec. 424.58(o) that DMEPOS AO changes of ownership would be governed by Sec. 488.5(f). 13. Requirement for Suppliers To Be Accredited (Revisions to Sec. 424.57)

As already noted, Sec. 424.57 primarily addresses conditions of payment and supplier standards that suppliers must meet to enroll in and bill Medicare. Yet it also addresses accreditation requirements for DMEPOS suppliers; specifically, Sec. 424.57(c)(22) states that these suppliers and all of their locations must be accredited by a CMS- approved AO to receive and retain a supplier billing number. Given our proposed strengthening of the DMEPOS accreditation program requirements in Sec. 424.58, we believe corresponding enhancements to Sec. 424.57 are necessary. a. Temporary Accreditation and Requirement of Survey (Sec. 424.57(c)(23))

The second sentence of 424.57(c)(23) states that the AO may accredit a new supplier location for three months after it is operational without requiring a new site visit. We proposed to remove this sentence from Sec. 424.57(c)(23) because it contradicts proposed Sec. 424.58(e)(8)(i)(A) and (C). Consistent with what we previously explained in this final rule, allowing a supplier to become accredited for 3 months without the important vetting of a survey and the AO's review of the survey results presents a serious risk of beneficiary harm and improper Medicare payments, which we must prevent. b. Accreditation Frequency (Sec. 424.57(c)(22) and (24)) (1) Structural Change

Section 424.57(c)(24) states that all DMEPOS supplier locations, whether owned or subcontracted, must meet the quality standards and be separately accredited in order to bill Medicare. As this requirement mirrors that in Sec. 424.57(c)(22) to some extent, we proposed to move the current language in Sec. 424.57(c)(24) to Sec. 424.57(c)(22). Revised Sec. 424.57(c)(22) would state the following:

All DMEPOS suppliers and all of their locations (whether owned or subcontracted) must meet the quality standards and be separately accredited to enroll in and bill Medicare.

The accreditation must indicate the products and services for which the supplier is accredited in order for the supplier to receive payment for those products and services. (This language is in current Sec. 424.57(c)(22).)

An accredited supplier's enrollment may be denied or revoked if CMS determines that it is non-compliant with the quality standards. (This language is currently in Sec. 424.57(c)(24).) (2) Accreditation Periods (Revised Sec. 424.57(c)(24))

While neither Sec. 424.57 nor Sec. 424.58 address the frequency with which surveys must be performed or how often a supplier must be reaccredited, we have issued sub-regulatory guidance stating that DMEPOS suppliers must undergo an unannounced survey once every 3 years following initial accreditation. Yet we reiterate that perhaps no other provider or supplier type over the decades has been the subject of CMS' provider enrollment program integrity efforts more than DMEPOS suppliers. For this and other reasons outlined in the proposed rule, we are concerned that performing DMEPOS supplier surveys only once every 3 years provides inadequate protection for the Medicare program. Again, non-compliant suppliers can endanger the Trust Funds as well as beneficiaries, and we believe the best means of ensuring suppliers' quality standard adherence is through closer and more frequent monitoring of suppliers. In our view, the longer a DMEPOS supplier goes without the scrutiny of a survey and reaccreditation, the greater the chances the supplier will fall out of compliance with the quality standards during this period. We also believe that more frequent surveys and reaccreditations will spur suppliers to maintain consistent adherence to the quality standards, for they will know their next survey would be much sooner than every 3 years.

To address what we believe is this very serious vulnerability, we proposed in revised Sec. 424.57(c)(24) that DMEPOS suppliers must be surveyed and reaccredited at least once every 12 months. We recognize that this could prove burdensome for DMEPOS suppliers, but we again emphasize the importance of protecting the Trust Funds and the health and safety of Medicare beneficiaries.

In our later discussion of this particular proposal, the public comments we received on it, and our responses to these comments, we will occasionally refer to this as an “annual” requirement (for example, “annual reaccreditation” or “annual survey”) for ease of reading. Yet we reiterate that Sec. 424.57(c)(24) would require surveys and reaccreditations to occur “at least” every 12 months, rather than “every 12 months”. The distinction is critical. Suppliers should not assume that AOs must or will wait until exactly 12 months after the supplier's previous survey to perform the present survey. To illustrate, suppose Supplier X's reaccreditation survey occurs on June 1, 2027. X should not automatically presume that the next reaccreditation survey will take place on or even around June 1, 2028. The survey could in fact occur many weeks before that. Furthermore, we remind stakeholders of our proposal to perform ad-hoc surveys at any time and for any reason. In short, suppliers must always remain fully prepared to be surveyed and should not base the timing of its compliance with the quality standards on when it predicts the next survey will occur.

Compliance is constantly required and is always subject to unannounced assessment by the AOs. c. Changes in Majority Ownership and the “36-Month Rule”

Existing Sec. 424.550(b)(1) states if an HHA or hospice undergoes a change in majority ownership (occasionally referenced as a “CIMO”) by sale within 36 months after the effective date of the HHA's or hospice's initial enrollment in Medicare or within 36 months after the HHA's or hospice's most recent CIMO, the provider agreement and Medicare billing privileges do not convey to the HHA's or hospice's new owner. Instead, the prospective provider/owner of the HHA or hospice must: (1) enroll in Medicare as a new (initial) HHA or hospice; and (2) obtain a state survey or an accreditation from an approved accreditation organization. (This is sometimes referenced as the “36- month rule”). As defined in 42 CFR 424.502, a CIMO occurs when a party acquires more than a 50 percent direct ownership interest in an HHA or hospice during the 36 months following the HHA's or hospice's initial enrollment or most recent CIMO. CIMOs can include an acquisition of majority ownership through the cumulative effect of asset sales, stock transfers, consolidations, or mergers.

There were two principal reasons for the establishment of Sec. 424.550(b)(1). First, there was a trend in the HHA community whereby an HHA applied for Medicare certification, underwent a survey, and became enrolled in Medicare, but then was immediately sold. This practice enabled a purchaser of an HHA from the broker to enter Medicare with no survey, which, in turn, sometimes led that owner to soon sell the business to another party, again without a survey. This mechanism, in short, was used to circumvent the survey process. Second, we were more broadly concerned about the lack of scrutiny of new owners as a whole, If an HHA undergoes a change of ownership, CMS generally does not perform a survey pursuant thereto. CMS consequently has no sure way of knowing whether the HHA, under its new ownership and management, is compliant with the HHA CoPs. Unless CMS can make this determination, there is a risk that the newly purchased HHA, without having been appropriately vetted, will bill for services when it is out of compliance with the CoPs. We had the same concerns regarding hospices, and in 2023 accordingly added hospices to Sec. 424.550(b)(1)'s purview.

We have already addressed in detail the long-standing program integrity risks in the DMEPOS supplier community Enhancing this dilemma is the fact that when a DMEPOS supplier ownership change crosses the 50 percent threshold, the AO typically does not perform a survey to assess compliance with the quality standards. Therefore, we cannot determine whether the DMEPOS supplier under its new majority ownership will be committed to adhering to all Medicare requirements and to protecting beneficiaries. There have been a significant number of such DMEPOS supplier ownership changes over the years, many of which have occurred within 36 months of initial enrollment or the supplier's most recent CIMO--sometimes, in fact, within only a few months of initial enrollment or the previous sale. We believe we must ensure that DMEPOS suppliers under their new ownership receive the same level of scrutiny that initially enrolling DMEPOS suppliers do.

We accordingly proposed in new Sec. 424.551 to mirror the provisions of existing Sec. 424.550(b)(1) such that a DMEPOS supplier undergoing a CIMO must enroll as a new DMEPOS supplier and be newly accredited and surveyed under Sec. 424.58. We also proposed to do the following:

Duplicate Sec. 424.502's definition of change in majority ownership within Sec. 424.551 (though slightly tailored to apply to DMEPOS suppliers).

Revise Sec. 424.540(a)(8) to state that CMS can deactivate the enrollment of a seller of a DMEPOS supplier if the supplier undergoes a CIMO in accordance with Sec. 424.551. (As noted in section VI.A. of the proposed rule, Sec. 424.540(a)(8) currently includes HHAs, and we are proposing to include hospices therein, too).

Add new paragraph (h) to Sec. 424.57 to emphasize that a DMEPOS supplier must comply with the provisions of Sec. 424.551 if it undergoes a CIMO.

We noted in the proposed rule that Sec. 424.550(b)(2) contains several exceptions to the 36-month rule. Specifically, even if an HHA or hospice undergoes a CIMO, the requirement in Sec. 424.550(b)(1) that the HHA or hospice enroll as a new HHA or hospice and undergo a survey or accreditation does not apply if any of the following four exceptions (outlined in Sec. 424.550(b)(1)) are implicated:

The HHA or hospice submitted 2 consecutive years of full cost reports since initial enrollment or the last CIMO, whichever is later.

An HHA's or hospice's parent company is undergoing an internal corporate restructuring, such as a merger or consolidation.

The owners of an existing HHA or hospice are changing the HHA's or hospice's existing business structure (for example, from a corporation to a partnership (general or limited)), and the owners remain the same.

An individual owner of an HHA or hospice has died.

We originally promulgated these exceptions because the HHA community had expressed concerns that the 36-month rule could inhibit bona fide HHA ownership transactions; for example, prospective new owners may not wish to have to enroll as a new HHA and will therefore decline to purchase the entity. We believed that our exceptions struck a solid balance between the need for more scrutiny of new owners via the survey process while not inadvertently obstructing legitimate transactions involving legitimate parties. Accordingly, we proposed to duplicate existing Sec. 424.550(b)(2)(ii) through (iv) as exceptions within proposed new Sec. 424.551, though current Sec. 424.550(b)(2)(i) would not be mirrored because DMEPOS suppliers do not submit cost reports. 14. Solicitation of Comments

We solicited comments from AOs, DMEPOS suppliers, and other stakeholders regarding our DMEPOS accreditation proposals. We were particularly interested in receiving comments on the following:

The amount and types of additional information that AOs would have to submit with their initial and reapproval applications per new Sec. 424.58(c) and (d). For instance--

++ Whether there is data we proposed to collect that is unnecessary, superfluous, or duplicative of other requested information; and

++ Whether there is information that should be submitted beyond what we are proposed to require.

Whether there are any grounds beyond those proposed at Sec. 424.58(e)(5) for which the AO should be required to deny or terminate a supplier's accreditation and, if so, what those grounds were.

The requirement in proposed Sec. 424.58(e)(8)(i) that, except as otherwise directed or permitted by CMS, the AO perform a survey of all suppliers seeking accreditation or reaccreditation with the AO.

Whether there were any grounds beyond those listed in Sec. 424.58(h), (i), and (j) for which CMS should be able to terminate, suspend, or place on probation the AO's accreditation

program and, if so, what those grounds were.

Whether DMEPOS suppliers should be surveyed and reaccredited under Sec. 424.57(c)(24) less frequently than the timeframe described therein and, if so, what the survey and reaccreditation timeframe should be. 15. Costs and Savings

The collection of information and regulatory impact analysis sections of the proposed rule addressed the net cost burden associated with our DMEPOS accreditation provisions. We projected that it would exceed $128 million annually. We understand the financial impact this could have on the DMEPOS community. However, we note that we anticipate over $660 million in annual savings to the Medicare Trust Funds and the taxpayers due primarily to the removal of non-compliant DMEPOS suppliers from the Medicare program. Of no less importance, we believe that more frequent surveys, ad-hoc surveys, and stricter requirements for AOs will encourage DMEPOS suppliers and AOs to be much more vigilant in maintaining and verifying compliance with the quality standards. To illustrate, with ad-hoc surveys, a DMEPOS supplier will not know whether or when it will be selected for such a survey, meaning that the supplier could believe that it is compelled to never allow itself to fall out of compliance with the quality standards, even for an extremely brief period. With the quality standards being designed in large part to protect beneficiaries, we believe that greater compliance therewith will reduce risks to patients' health safety from, for example, substandard DMEPOS items, inadequate equipment instructions, and poor customer service.

Hence, we concluded that notwithstanding the burden associated with these requirements, the saving of potentially billions of taxpayer dollars and the preservation of beneficiary safety justify it. 16. Comments Received a. Annual Surveys and Reaccreditations (Revised Sec. 424.57(c)(24))

Comment: Many commenters opposed our annual survey and reaccreditation proposal. These commenters believe that this would impose significant operational, administrative, and financial burdens on DMEPOS suppliers due primarily to: (1) more frequent accreditation fees; (2) more reaccreditation paperwork; and (3) having to devote more staff time and resources to surveys and reaccreditations and the supplier's preparations for them. Numerous commenters stated that these burdens could be especially difficult for smaller and community-based DMEPOS suppliers, some of which are financially struggling, operate on small profit margins and, with our proposal, could be compelled to close. These commenters added that while larger supplier organizations have the financial and personnel resources to handle annual reaccreditations, smaller companies do not. This could mean that the DMEPOS industry might eventually be limited to large supplier organizations as smaller suppliers drop out or no longer take Medicare; many patients would be unable to purchase these supplies out-of-pocket. With fewer suppliers, the commenters concluded: (1) patient choice and access to care would be restricted; and (2) longer patient wait times could result because the remaining suppliers would have to service more patients.

Response: We appreciate these comments and understand the concerns expressed. We recognized in the proposed rule the financial impact our requirements could have on suppliers. Yet we note several things.

First, as already noted, the proposed rule calculated an annual savings to the Medicare program via this requirement of more than $660 million. We believe these savings will benefit all Americans, including DMEPOS suppliers, by helping to limit inappropriate payments to non- compliant suppliers. While we acknowledge the potential direct financial burden on otherwise compliant DMEPOS suppliers, we believe these suppliers will accrue indirect benefits via: (1) savings to the Trust Funds; and (2) the Medicare revocation of suppliers that are not as committed to adhering to the quality standards as compliant suppliers are. Indeed, we received comments from the latter group of suppliers expressing frustration that fraudulent and non-compliant suppliers are harming the DMEPOS arena. We fully concur, and we believe their removal from Medicare--which, in our view, our annual reaccreditation requirement will help facilitate via the closer analysis of supplier operations--will assist in addressing said frustrations.

Second, and in a similar though broader vein, we have an obligation to the American people at large to ensure the accurate spending of taxpayer dollars for Medicare services and items. If a DMEPOS supplier is non-compliant with the quality standards--which, we emphasize, can only be ascertained via a survey and accreditation--Americans' tax monies are threatened if payment is made to a supplier that is not qualified to participate in Medicare. We must do everything possible to fulfill our role as the financial steward of the Medicare program. Given this, the greater the frequency of surveys, the better we can ensure that taxpayer dollars are not improperly paid.

Third, in January 2, 2009, Federal Register (74 FR 166), we published a final rule in the titled “Medicare Program; Surety Bond Requirement for Suppliers of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS)”. This final rule required non-exempt suppliers to acquire and maintain a surety bond in the amount of at least $50,000 as a condition of enrollment. The preamble of the January 2009 final rule noted that commenters had expressed concern about the monetary impact of the bond requirement on small businesses, specifically the bond's annual cost (74 FR 171). They believed that many of these suppliers would have to depart the Medicare program due to an inability to sustain the bond's costs. However, we did not experience such an exodus, and the vast preponderance of small suppliers were able to purchase and maintain the bond. We also did not see from our surety bond requirement: (1) larger suppliers taking over the DMEPOS arena from smaller suppliers; or (2) patient access to care problems. Accordingly, based on this past experience, we believe smaller suppliers will generally be able to afford annual reaccreditations to the extent they did with bonds, with no material decrease in their overall participation in Medicare or in beneficiary access to care.

In sum, although we understand commenters' concerns about revised Sec. 424.57(c)(24), we reiterate our responsibility to safeguard the expenditure of Americans' tax dollars for Medicare services and items. Failing to ensure that DMEPOS suppliers are always adherent to the quality standards (rather than merely compliant once every 3 years) is directly antithetical to this.

Comment: Multiple commenters stated that CMS should offset the financial burden of additional fees, surveys, etc., with increased reimbursement to DMEPOS suppliers; this would lessen the monetary impact of our proposal. Without said raise in reimbursement, the commenters stated, CMS should not finalize this provision.

Response: We most respectfully disagree. We certainly understand the commenters' concerns, but we are unable to make our program integrity efforts dependent upon whether the

affected providers or suppliers receive an offsetting increase in reimbursement, for such increase may not be possible regardless. To illustrate, assume there have been numerous payment safeguard problems involving Provider Type X, whereby millions of dollars have been paid to fraudulent providers. We believe a particular initiative, though imposing some burden on providers of Type X, could significantly alleviate this fraud. Under the commenters' suggestion, we could not undertake this initiative unless Type X providers receive additional payments. Since higher reimbursement might not occur, Type X fraud would continue unbated and place tens or even hundreds of millions of dollars at risk. CMS' payment safeguard efforts across the board would be obstructed if they had to be tied to a concomitant rise in provider/ supplier payments.

Comment: Several commenters believed that revised Sec. 424.57(c)(24) was unnecessary because DMEPOS suppliers already undergo extensive screening and review, such as via: (1) accreditation every 3 years; (2) enrollment site visits; (3) enrollment criminal background checks of the supplier's owners; and (4) the surety bond process. They added that the current 3-year cycle already adequately ensures supplier compliance and protects beneficiaries.

Response: As we explained at length in the proposed rule and this final rule, these and other screening mechanisms--important and beneficial though they have been--have not by themselves adequately halted DMEPOS supplier non-compliance or the problem of payments to such suppliers. More is needed, and we believe increasingly frequent examinations of quality standard compliance could assist in this regard.

Comment: Numerous commenters stated the current 3-year cycle is sufficient because it strikes a good balance between the need for oversight of suppliers and the importance of reducing supplier burden and enabling suppliers to focus on patient care and business sustainability.

Response: We respectfully disagree that the existing 3-year timeframe is adequate. We noted in the proposed rule and this final rule that some suppliers fall out of compliance with the quality standards during this very lengthy period and remain non-compliant for an extended timeframe. As an example, suppose Supplier Y, a high-volume biller, no longer complies with the quality standards beginning 6 months after its most recent accreditation. With a 3-year cycle, millions of Medicare dollars might be paid to a supplier that was non- compliant for up to 2.5 years (until its next reaccreditation). Under an annual cycle, though, the non-adherence could have been detected much sooner, thus saving considerable taxpayer monies. Furthermore, we reiterate that the quality standards are designed to protect the health and well-being of beneficiaries by ensuring that the supplier meets strict guidelines involving product safety and consumer services. With the possibility that a supplier's non-adherence to the quality standards could result in beneficiary harm, there might be a greater chance for such harm the longer the period of non-compliance. Yet this risk would be minimized with more frequent surveys. Accordingly, for purposes of both patient safety and program integrity, we believe revised Sec. 424.57(c)(24) is needed.

Comment: Several commenters stated that more paperwork and administrative burden does not correlate to increased quality of care, adding that said burden would divert supplier time and resources from patient care. They further stated that: (1) a sizable portion of DMEPOS suppliers' daily functions involve paperwork, documentation, etc., which cuts into their available time to spend on beneficiary care; (2) some suppliers are already short-staffed, with employees having to perform multiple roles and being unable to take on additional burden. They believed that revised Sec. 424.57(a)(24) would exacerbate these issues, particularly since some suppliers cannot afford to hire additional staff. Other commenters stated that suppliers that can afford to hire personnel would undoubtedly have to do so to accommodate our requirement, hence costing the supplier additional funds that the supplier could otherwise use to invest in and improve its business.

Response: We appreciate and understand these concerns. Yet we most respectfully believe that DMEPOS suppliers should not view the requirement strictly as increased paperwork but instead as a means of protecting patients and taxpayer dollars, both of which can benefit DMEPOS suppliers. For instance, when an accreditation organization finds a supplier non-compliant with the quality standards and the supplier is accordingly revoked from the Medicare program, this helps protect the tax dollars of DMEPOS suppliers and their personnel no less than those of other Americans. Moreover, while again recognizing the additional burden of revised Sec. 424.57(c)(24), we stress that this provision would only require a survey and reaccreditation at least once every 12 months and would not involve, for example, a tri-annual burden. Even acknowledging the time and effort a supplier may expend in preparing for and undergoing more frequent surveys, we do not believe it would be so extensive as to materially impact (from a time perspective) the supplier's patient care or other services over the course of a given year.

Comment: Numerous commenters expressed concern that AOs will increase their fees to cover the additional costs associated with having to perform more surveys (for example, hotel and travel costs).

Response: Although we respectfully cannot predict this requirement's impact on AOs' per-supplier fees, it is possible that they may increase. It is also possible, though, that they will not change because the AOs' costs may be covered by the greater number of fees that DMEPOS suppliers will pay under revised Sec. 424.57(c)(24).

Comment: Several commenters stated that revised Sec. 424.57(c)(24) would be inconsistent with the 3-year survey cycle for hospitals, HHAs, and certain other providers. Since hospitals and HHAs have a 3-year cycle, DMEPOS suppliers should, too.

Response: We respectfully disagree. All provider and supplier types are different, including with respect to the program integrity risks they pose. Simply because a particular provider type has a certain survey cycle does not mean all other provider and supplier types must have the same. We noted in the proposed rule and this final rule the very serious and longstanding payment safeguard issues involving DMEPOS suppliers. Thus, we believe it is appropriate to tailor the DMEPOS survey cycle to the risk these suppliers present, hence the proposed shorter period.

Comment: A number of commenters requested that CMS permit sampling as a standard practice, especially for State-licensed and chain pharmacies. Several commenters recommended using criteria such as size, geographic locations, product codes, and past accreditation performances. Another commenter recommended that CMS establish a uniform sampling approach that all AOs must follow. An additional commenter stated that CMS should explicitly permit sampling via rulemaking and not have CMS personnel making sampling decisions.

Response: We appreciate this feedback. As we indicated in the proposed rule, we cannot commit to permitting sampling due to the need to ensure that all DMEPOS suppliers

(regardless of sub-type) are compliant with the quality standards. However, we also recognized that there could be isolated instances where it might be warranted, hence our proposal in Sec. 424.58(c)(1)(iii)(G) to have AOs discuss their suggested sampling methodology. Whether we will allow sampling at a later time will depend on circumstances, but we will attempt to ensure consistency and take into account several factors (potentially, for instance, geographic locations) should it be permitted. Regarding the final commenter's feedback, we reiterate our role in preserving the Trust Funds from inappropriate payments and safeguarding patient safety. Therefore, we must have the discretion to identify if or when sampling should be undertaken.

Comment: A commenter expressed concern about the impact on smaller suppliers and stated that some of the fraud and non-compliance examples cited in the proposed rule seem limited to larger suppliers with extensive billing events and do not involve small businesses. Other commenters stated that revised Sec. 424.57(c)(24) should be restricted to larger suppliers (perhaps those with at least 10 locations), since they are financially the best equipped to absorb the extra costs. A commenter contended that our proposed requirement seems to be one-size- fits-all in nature, treats all suppliers the same, and ignores resource disparities between large and small suppliers. The commenter stated that: (1) some small, minority-owned businesses do not have compliance teams or legal departments; and (2) a uniform approach harms small, local suppliers in underserved communities.

Response: Although we appreciate the commenters' concerns, neither the examples in the proposed rule nor the other cases we have seen are limited to larger suppliers. Indeed, non-compliance with the quality standards can occur with smaller suppliers as frequently as with larger ones. Accordingly, we cannot restrict our requirement to large supplier organizations.

Comment: A commenter stated that many of the fraud and abuse examples in the proposed rule were for new suppliers located in high- risk areas.

Response: We respectfully disagree. Some cases: (1) were in states not traditionally considered to pose very high risks of fraud; and (2) involved suppliers that had been enrolled in Medicare for some time. DMEPOS non-compliance can occur in any area of the country and involve suppliers enrolled for any length of time.

Comment: Numerous commenters expressed uncertainty as to how accreditating organizations will secure the staff and resources to perform the new surveys and reaccreditations. Several commenters stated that because the AOs would now have to perform so many surveys and employ numerous additional surveyors, the AOs might: (1) hire whatever staff they can--including unqualified surveyors--to cover the additional surveys and reaccreditations; and (2) conduct rushed and substandard surveys to ensure it can perform the extra work under this requirement, which, in turn, could harm the integrity of the survey process. They added that the current 3-year cycle gives AOs adequate time to perform thorough surveys and reaccreditation reviews. A commenter stated that the AOs would be unable to acquire enough staff to perform the surveys. Other commenters contended that AO survey delays that currently exist due to lack of staff would only get worse with an annual survey requirement. Too, a commenter stated that CMS has not demonstrated how the AOs would expand their infrastructure to meet demand without impairing survey quality or causing accreditation delays. Additional commenters did not believe the AOs would have the resources to perform annual surveys and reaccreditations.

Response: We appreciate these comments. CMS is not positioned to publicly outline in minute detail how each AO will expand their operations to carry out this requirement; we believe this is a matter largely internal to the AOs. Nonetheless, and as a general view, we are confident that the AOs will have the ability to perform more frequent surveys and reaccreditations in a timely and thorough manner for two principal reasons. First, we believe the additional fees the AOs will receive will enable them to hire additional surveyors and other personnel to implement and effectively carry out revised Sec. 424.57(c)(24); in other words, the increased income from fees will cover the increased workload. Second, the significant enhancement of our oversight of AOs--both initially and on an ongoing basis--will allow us to closely review and monitor AOs to ensure they have the capacity to timely and satisfactorily conduct these activities with qualified personnel. Should significant delays occur or survey quality decreases, though, we will work to alleviate these issues.

Comment: Several commenters stated that if revised Sec. 424.57(c)(24) overwhelms the AOs' operations and leads to survey delays, some suppliers may be forced to suspend operations until the survey is performed, which could harm patient access to care.

Response: For reasons stated in our prior response, we believe the AOs will be able to effectively and timely handle the required surveys and reaccreditations; this will reduce the potential for temporary cessations of supplier operations.

Comment: A commenter stated that our proposed requirement appears to stem from the recent fraud activity of large DMEPOS suppliers--not small suppliers--established during the pandemic that were not required to go through the normal verification process. The commenter questioned which DMEPOS AOs were responsible for accrediting those suppliers recently found guilty of fraud and whether there was a common denominator involved.

Response: While we are not in a position to publicly identify AOs that may have accredited fraudulent suppliers, we stress two things. First, and as previously stated, the disconcerting DMEPOS supplier activities we have seen are not restricted to large suppliers but also involve smaller suppliers; these cases, furthermore, did not necessarily result from relaxed verification procedures during the pandemic. Second, our proposals stem predominantly from concerns about suppliers not meeting the quality standards--irrespective of whether any fraud is involved. We have already emphasized that non-compliance with the quality standards can lead to: (1) hundreds of millions of dollars in improper payments; and (2) beneficiary harm.

Comment: A number of commenters stated that revised Sec. 424.57(c)(24) could be especially difficult on suppliers with multiple locations, since each site would be impacted (for example, accreditation fees paid for each location); large chain pharmacies, in particular, might have to pay tens of thousands of dollars in fees to have all of their sites surveyed.

Response: We thank the stakeholders for these comments but reiterate that Sec. 424.57(c)(24) requires all DMEPOS locations to meet the quality standards and be separately accredited in order to bill Medicare. There is no exception for suppliers with multiple locations, meaning, in our view, that the cycle for such suppliers should mirror that for single-site suppliers. Furthermore, our obligation to protect the Trust Funds and beneficiaries from non- compliant suppliers is the same regardless of the supplier's organizational status. While we understand the commenters' concerns, we also note that larger supplier organizations will likely have a

greater financial capacity to bear the costs of an annual survey for their various locations.

Comment: Several commenters stated that annual surveys of all locations of national suppliers is redundant and unnecessary because these suppliers already operate under standard national policies and procedures.

Response: Although we appreciate this comment, individual sites of nationwide suppliers can lose compliance with the quality standards no differently than other supplier subtypes, even if the national organization has centralized and uniform policies and procedures.

Comment: Numerous commenters stated that revised Sec. 424.57(c)(24) would not stop fraud or improve patient outcomes or safety, and there is no data to suggest it would. Several commenters stated that surveys are not intended to assess adherence to the False Claims Act, the Anti-Kickback Statute, other anti-fraud federal laws, or Medicare billing requirements. Other commenters contended that it appears CMS is attempting to turn AOs and their staffs into legal experts, law enforcement officials, anti-fraud investigative entities, and billing specialists. Another commenter stated that nefarious individuals will simply seek new and different means of continuing their fraudulent conduct notwithstanding revised Sec. 424.57(c)(24); this could even include finding gaps within the annual accreditation process itself. Several commenters stated that there is no evidence that accredited orthotic and prosthetic facilities have committed fraud.

These and other commenters contended that there are more effective means for CMS to combat DMEPOS supplier fraud, waste, and abuse than revised Sec. 424.57(c)(24). Among the commenters' suggestions were: (1) data analytics; (2) focusing on billing claims; (3) random audits; (4) digital compliance; (5) enhanced reporting; (6) increased and unannounced site visits; (7) concentrating on higher-volume billers or higher-risk suppliers (for example, those under foreign ownership); (8) more severe penalties for supplier fraud; (9) requiring that DMEPOS suppliers have compliance programs; (10) increased use of pre-payment and post-payment audits; (11) taking action against suppliers with a history of beneficiary complaints; (12) requiring increased document submission requirements by suppliers (for example, copies of policies and equipment records, photos, etc.); (13) requiring AOs to report all suspected fraud to CMS for investigation; (14) requiring annual document submissions, attestations, and provider enrollment revalidation; (15) greater beneficiary participation in CMS' program integrity efforts; (16) requiring suppliers to maintain and submit logs of annual fraud, waste, and abuse training completions and to submit a full documentation packet to their AO, with annual updates limited to any changes in policies or procedures; (17) virtual surveys (rather than in-person) and virtual review of patient and personnel files; (18) interviewing supplier staff; and (19) increased supplier education and training.

Response: We respectfully believe there may be a misunderstanding regarding the purpose of our proposal. It is true that we cited numerous instances of DMEPOS fraud in the proposed rule to highlight the persistent program integrity problems involving this supplier type. In addition: (1) several quality standards at least indirectly touch upon the issue of fraud (for example, having practices to prevent fraud, waste, and abuse and to ensure accurate billing); and (2) we proposed that AOs establish policies for detecting and addressing potential fraud, waste, and abuse. Yet as we indicated in the proposed rule, the core aim of this requirement is to better ensure suppliers' consistent compliance with the quality standards, which would, in turn, reduce inappropriate payments to non-adherent suppliers and help protect beneficiaries. In other words, the issue is non-compliance as a whole, regardless of whether this non-compliance also rose to the level of knowing fraudulent conduct. The AOs are not (and have never been) expected to actively investigate the supplier's operations for fraudulent conduct beyond what they might ordinarily uncover during the standard survey processes they have historically used. Indeed, we recognize that the AOs are not fraud examiners and note that we have instead primarily used a number of the commenters' suggested program integrity measures (as well as others) to detect fraud; this includes, for instance, enhanced focus on certain high-risk DMEPOS supplier types and geographic areas. Notwithstanding all of this, though, it is possible that an AO could uncover a supplier's potential fraud, waste, and abuse during a particular survey (for example, while reviewing patient records), perhaps even as part of a larger fraud scheme.

We hope the foregoing clarifies for stakeholders the principal goal of this requirement.

Comment: Several commenters stated that our proposal is merely: (1) a sudden reaction to a few problematic parties in the DMEPOS supplier and AO communities; and (2) an attempt to compensate for the failures of CMS' contractors, auditors, oversight systems, etc., to halt improper DMEPOS activity. They urged CMS to correct these issues instead of burdening DMEPOS suppliers and the AOs.

Response: We respectfully disagree with these comments. We reiterate that the purpose of accreditation is to confirm quality standard compliance and not to detect fraud; these are two entirely separate activities that do not necessarily overlap. Accordingly, we are not using tightened accreditation standards as a substitute for any lack of anti-fraud enforcement success; indeed, we have worked extremely hard over the years via many vehicles to stem DMEPOS supplier fraud. In addition, while we were determined to take prompt action to address issues in the DMEPOS accreditation arena and facilitate quality standard compliance, this does not mean it was devised without any forethought or careful consideration. We diligently examined the potential benefits and drawbacks of more frequent accreditations and, after lengthy consideration, determined that this was the soundest approach.

Comment: A commenter stated that CMS should ensure that outreach and training regarding these requirements are available in Spanish; this should include technical assistance to suppliers in Puerto Rico.

Response: We appreciate this comment and intend to undertake educational efforts regarding this requirement towards DMEPOS suppliers throughout the United States and its territories.

Comment: Commenters stated that many suppliers have always remained fully adherent to the quality standards as evidenced by their successful surveys and reaccreditations. They believed that our proposal would only harm these suppliers, and that it is unfair to punish them for the actions of a few unscrupulous suppliers.

Response: We thank the commenters for their views. We certainly understand that there are numerous DMEPOS suppliers that have routinely passed their surveys every 3 years. However, absent a survey and reaccreditation, we have no means of confirming whether a DMEPOS supplier has fallen out of quality standard compliance at some point during this lengthy period; in addition, merely because a DMEPOS supplier passed its previous surveys does not automatically mean that it will remain compliant with the quality standards for another 3 years. As we

explained in the proposed rule and this final rule, non-compliance for any period of time can lead to millions of dollars in inappropriate payments and the potential for patient harm. This is a particular concern regarding DMEPOS suppliers given, as already noted, the high program integrity risk this supplier type has historically posed in comparison to other provider and supplier types. While we appreciate DMEPOS suppliers' concerns about burden, we again stress our obligation to beneficiaries and the taxpayers to ensure that DMEPOS suppliers are constantly adherent to all Medicare requirements, hence the need for our provisions. Too, and as noted previously, the prevention of potentially billions of dollars in inappropriate payments and the protection of beneficiaries benefits all Americans, including DMEPOS suppliers and their personnel.

Comment: Several commenters stated that the accreditation process is designed to determine compliance with the quality standards and is not a regulatory compliance process.

Response: The commenters are correct regarding the accreditation process's central purpose of verifying quality standard adherence. However, it is a regulatory compliance process as well because quality standard adherence is required per regulations at Sec. 424.57(c)(22).

Comment: Numerous commenters expressed particular concern about the impact this requirement could have on: (1) rural suppliers; (2) underserved areas; and (3) suppliers that furnish very specialized services and items and, consequently, may be the only supplier within a wide geographic region. The commenters stated that if these suppliers were forced to close due to the burden of revised Sec. 424.57(c)(24), many beneficiaries could be left without any reasonably proximate access to services and items. Several commenters added more generally that some communities have only one supplier, which could be compelled to cease operations under our proposal.

Response: We respectfully do not anticipate a material reduction in the number of DMEPOS suppliers--whether rural or urban, in underserved regions, etc.--resulting from the additional costs of revised Sec. 424.57(c)(24). In implementing provider enrollment-related initiatives over many years that imposed costs on DMEPOS suppliers (for instance, surety bonds, fingerprint-based criminal background checks, stringent enrollment requirements, etc.), we did not see access to care problems arising for DMEPOS beneficiaries. We believe the same will occur under our proposal, though we will closely observe this matter during and after the implementation of our requirement.

Comment: A commenter stated that, for multi-location supplier organizations, patients serviced by a particular location could lose access to care if said site fails the survey.

Response: We appreciate this comment but reiterate that all DMEPOS suppliers must meet the quality standards to enroll in and bill Medicare, even if this unfortunately means a particular location may be found non-compliant and revoked from Medicare, thus potentially removing a beneficiary's preferred supplier site. While, as stated, we will monitor the implementation of our requirement for any resulting patient access issues, we do not expect them to occur. We note that over the years we have revoked DMEPOS suppliers without beneficiaries losing the ability to obtain care from other suppliers.

Comment: A commenter questioned the need for more frequent surveys and reaccreditations when, according to the commenter, CMS does not effectively utilize the information that AOs already furnish to CMS.

Response: We respectfully disagree. We indeed review the data the AOs provide to us; in fact, this assisted us in the development of our proposals. We also do not believe that our examination of AO-submitted information is related to the matter of accreditation frequency. The latter should not be predicated on the former; for reasons already stated, we must enhance the AOs' oversight of DMEPOS suppliers irrespective of the level of our review of AO data.

Comment: Several commenters stated that the current 3-year cycle allows: (1) DMEPOS owners, practitioners, technicians, and billing staff to learn and improve over an extended period; and (2) DMEPOS owners to build their business based on auditor observations, which would help ensure compliance with DMEPOS requirements. Another commenter stated that the value of the accreditation process is when it is consultative in nature.

Response: We sincerely thank the stakeholders for this feedback but disagree for two reasons. First, while the survey process can help suppliers better understand the quality standards and improve supplier performance, surveys for purposes of our DMEPOS accreditation program are not principally intended to serve as educational mechanisms. They instead are designed to verify the supplier's compliance with the quality standards. Most respectfully, we are unable to tailor aspects of its accreditation requirement (for example, contents of the supplier standards, length of the reaccreditation cycle) to accommodate suppliers' wishes for guidance from AOs. It is ultimately the supplier's responsibility to familiarize itself with the quality standards and the means of complying therewith. Second, even if one acknowledges the potential educational aspects of a survey, we believe that annual surveys would provide more frequent guidance to suppliers than would surveys occurring every 3 years.

Comment: Multiple commenters requested that CMS exempt suppliers of post-mastectomy services from revised Sec. 424.57(c)(24). The commenters stated that these suppliers often service large geographic areas because there are few suppliers. The costs of additional surveys and accreditations, the commenter stated, could force these suppliers to shut down, leaving beneficiaries unable to access these services. Another commenter urged retention of the 3-year cycle for lymphedema specialties.

Response: We appreciate the commenters' concerns but respectfully are unable to exempt such suppliers or, for that matter, other types of DMEPOS suppliers. Quality standard non-compliance, which our requirement seeks to halt, can occur among any and all supplier types, and exempting certain types could lead to non-adherent suppliers receiving millions of dollars in inappropriate payments or to patient harm. We also restate our view that we do not foresee an exodus of suppliers (including suppliers of post-mastectomy services) from the Medicare program due to our requirement.

Comment: Several commenters did not believe that our proposal would make suppliers more apt to be compliant with the quality standards because: (1) many suppliers constantly strive to ensure adherence thereto; and (2) the current 3-year timeframe already gives suppliers an incentive to remain compliant.

Response: We respectfully disagree. We believe DMEPOS suppliers may be more inclined to constantly comply with the quality standards if their next survey and reaccreditation will occur much sooner than every 3 years--a critical consideration in light of DMEPOS suppliers' uniquely heightened program integrity risk. Mirroring a prior example we have cited, a DMEPOS supplier that passed a survey on June 1, 2026, might believe it is unnecessary to retain compliance with the quality standards for the next 2 or 2.5 years, knowing it could wait to

remedy its non-adherence until immediately before its next survey at the 3-year mark. More frequent surveys will give suppliers much less time and opportunity to become or remain non-compliant.

Comment: Many commenters suggested that instead of revised Sec. 424.57(c)(24), CMS should base the frequency of surveys on the general and historical performance of suppliers and the risk the supplier poses. To illustrate, suppliers that have had difficulty meeting the quality standards should be reviewed more frequently, while those that routinely pass surveys (or show consistent improvement on surveys) should be reviewed less frequently or, as present, every 3 years. A commenter suggested that if a supplier passes its surveys in 3-4 consecutive cycles, another re-survey should not be required for another 5 years. Other commenters suggested an approach that required new suppliers to undergo surveys and reaccreditations in their first 3 years of enrollment; if the supplier passed these, a 3-year cycle would apply.

While supporting a more risk-based survey approach (rather than an across-the-board requirement), another commenter stated that CMS should focus especially on the billing patterns of new suppliers, with another commenter recommending that the number of complaints against the supplier be a consideration in survey frequency. Other commenters suggested exempting pharmacies (particularly state licensed ones or those involving immediate time-sensitive pharmacy DMEPOS codes, such as nebulizers) or lower-risk suppliers from revised Sec. 424.57(c)(24). Additional commenters that supported a risk-based approach recommended that CMS consider factors such as the supplier's: (1) past level of compliance or non-compliance; (2) governance structure; (3) financial wherewithal and billing revenue; (4) location; (5) subtype (and the relative program integrity risk of that subtype); (6) number of employees; and (7) recent history of immediate jeopardy deficiencies, if any. Another commenter recommended that the purview of Sec. 424.57(c)(24) be limited to suppliers with a material failure to comply with billing, enrollment, and accreditation requirements, with materiality being determined by factors such as, but not limited to. continued non-compliance with fraud, waste, and abuse-related requirements.

Response: We sincerely appreciate all of these suggestions. Yet we reemphasize that passage of a survey--or even multiple consecutive surveys--does not guarantee that a supplier is or will remain compliant for the entirety of each of their 3-year cycles. Too, although some suppliers may pose less risk than others, the former can still lose compliance with the quality standards for a lengthy period, placing taxpayer dollars at serious risk. In our view, only via more frequent surveys can CMS better confirm that there are no lapses in the supplier's compliance and that DMEPOS beneficiaries are protected.

Comment: A commenter stated that the burden of our requirement on AOs may become so significant that they no longer accredit DMEPOS suppliers, thus possibly compelling smaller suppliers to seek accreditation from larger or remaining organizations at a higher cost.

Response: We appreciate this concern but believe that: (1) the additional fees these organizations would receive would alleviate the burden on them; and (2) these entities would seek to continue their roles in the CMS DMEPOS accreditation program.

Comment: A commenter suggested that in lieu of revised Sec. 424.57(c)(24), CMS should focus on operational and compliance issues among the AOs.

Response: We agree that the latter is critical, hence our proposed revisions to Sec. 424.58 to enhance our oversight of AOs. Yet we do not see this as an “either/or” situation where we must choose between more frequent reaccreditation and AO oversight. They are not mutually exclusive, and both can and should be pursued for reasons described in the proposed rule and this final rule.

Comment: A commenter stated that there is no indication that DMEPOS suppliers are failing to meet the quality standards in a greater proportion than other providers and suppliers that are subject to a 3- year reaccreditation cycle.

Response: We appreciate this comment. However, as indicated previously and further discussed in this final rule, DMEPOS suppliers are entirely different from certified providers and certified suppliers in terms of, among many other things: (1) the types of services furnished; (2) requirements and standards that must be met; (3) extent of state oversight and regulation; and (4) qualifications of personnel. We cite two examples:

Various certified provider/supplier types (such as hospitals and skilled nursing facilities (SNFs)) tend to be subject to substantially stricter state requirements than DMEPOS suppliers. In fact, some states do not even license certain suppliers of DMEPOS.

Notwithstanding DMEPOS suppliers' provision of medical equipment, there is no requirement in Sec. 424.57 that the supplier have medical professionals on staff. Individuals with little if any medical knowledge can open and operate a DMEPOS supplier. Certified providers such as hospices and SNFs, on the other hand, are required to have medical directors and other qualified personnel.

With, in many cases, less state oversight of DMEPOS suppliers and the relative ease of starting up a supplier when compared to certified providers/suppliers, DMEPOS accreditation is a uniquely critical means of protecting Medicare beneficiaries--particularly so given the aforementioned lack of required medical personnel; indeed, the lack of health care background of some suppliers could make them especially susceptible to quality standard violations. When combined with the almost unprecedented program integrity risk that DMEPOS suppliers present, the respective accreditation processes of DMEPOS suppliers and certified providers/suppliers must be different. This means that rates of certified provider/supplier compliance cannot dictate the frequency or requirements of DMEPOS supplier accreditation. The aforementioned DMEPOS supplier characteristics necessitate, in our view, more frequent surveys and reaccreditations;

Comment: Several commenters stated that large chain (and other) pharmacies should be exempt from revised Sec. 424.57(c)(24) because: (1) the overwhelming preponderance of pharmacies are compliant with the quality standards and there is no evidence to indicate otherwise; and (2) pharmacies are already very heavily regulated at the federal and state level. They noted that CMS has exempted these suppliers from surveys in the past. A commenter suggested that for national providers with 25 or more locations, a sample of no more than 33 percent of locations surveyed every 3 years is appropriate if they have been inspected by either a state agency or Medicaid agency. Another commenter stated that none of the examples of criminal activity identified in the proposed rule involved pharmacies. An additional commenter stated that our proposal could lead to a dramatic reduction in the number of pharmacies, resulting in reduced beneficiary access to care.

Response: We sincerely appreciate these comments and reiterate that there could be limited instances where sampling would be warranted. As previously explained, though, a supplier can lose compliance with the quality standards irrespective of their subtype, historical extent of adherence, and degree of regulation. Consequently, and

as with other DMEPOS supplier types that have made similar requests, we most respectfully must decline to establish an across-the-board exemption from Sec. 424.57(c)(24) for pharmacies.

Comment: A commenter stated that CMS should establish a recovery- focused accreditation pathway recognizing the unique operational requirements of suppliers serving patients with substance use disorders, mental health conditions, or complex rehabilitation needs.

Response: While we sincerely appreciate this feedback, we are most respectfully uncertain as to the commenter's recommendation. If, as it appears, the commenter is requesting an exception from revised Sec. 424.57(c)(24) for DMEPOS suppliers serving the indicated beneficiaries, we refer the commenter to our prior explanations of the need for revised Sec. 424.57(c)(24). We believe these reasons apply here, too.

Comment: A commenter stated that CMS should adopt the position that DMEPOS suppliers will not be penalized if their AO is unable to conduct an annual survey and reaccreditation through no fault of the supplier.

Response: We thank the commenter for this suggestion and fully appreciate the views expressed. Respectfully, though, we cannot in this rule establish such a broad, blanket, and absolute exemption in every case regardless of the facts of the particular situation. This is because each situation may have slightly different circumstances that, in our view, warrant individual consideration on our part. Nonetheless, and as with other aspects of our proposal, we will very closely monitor its implementation and take action as needed to address issues that arise.

Comment: A commenter recommended that in lieu of revised Sec. 424.57(c)(24), CMS should establish a short form or checklist whereby a supplier can report any material changes to its business.

Response: While we appreciate this suggestion, a checklist would not be an adequate substitute for an on-site survey. Given the tremendous importance of the quality standards in helping to ensure that the supplier is legitimate, we believe that a thorough, comprehensive review by an independent organization--rather than relying solely upon the supplier's checklist assertions--is the best means of ensuring compliance.

Comment: A commenter stated that CMS appears to be placing the burden on AOs to ensure program integrity and compliance instead of performing this function itself. The commenter added that this is unfair given that CMS' performance of surveys and site visits is often delayed; the AOs, the commenter stated, should not be compelled to perform CMS functions in this regard.

Response: We respectfully disagree that CMS is effectively delegating its DMEPOS payment safeguard activities to the AOs. On-site verification of suppliers' compliance with the quality standards via the survey process has always been an AO function, not a CMS one; indeed, section 1834(e)(20)(F)(i) of the Act is clear that DMEPOS suppliers must be accredited by an independent organization to participate in Medicare. CMS is therefore not passing any such role to the AOs because CMS has never had this role. Rather, the core change involves the frequency of surveys and reaccreditations, which we believe should be consistent with revised Sec. 424.57(c)(24) for reasons already described. We will continue to perform all other DMEPOS program integrity and anti-fraud activities.

Comment: Several commenters expressed concern about the proposal's potentially disproportionate burden on orthotic and prosthetic (O & P) suppliers. A comment er stated that these are often small practices serving rural or underserved areas that already meet rigorous accreditation standards. Citing various data, the commenter stated that: (1) the proposed change would impose $6.2 to 9.3 million in addition to direct accreditation costs on O & P suppliers before factoring in indirect costs (for example, lost clinical time); and (2) improper payments and relative risks for O & P suppliers are comparatively low compared to other DMEPOS supplier types, a position that other stakeholders shared. Moreover, the commenter stated that these suppliers pose less of a risk than hospitals but that the latter have a 3-year cycle while O & P suppliers would have to undergo much more frequent reaccreditations. The commenter concluded that: (1) the burden of this requirement on O & P suppliers could exceed the potential net savings; and (2) O & P suppliers should be exempt from revised Sec. 424.57(c)(24). Sharing the previously discussed views regarding O & P suppliers, another commenter stated that CMS should track all fraud, waste, and abuse within the DMEPOS community by sub- supplier type and then publish the results.

Response: We thank the commenters for this feedback. However, for reasons similar to our aforementioned position regarding a blanket exemption for pharmacies and other DMEPOS supplier subtypes, we must respectfully decline to adopt an O & P supplier exemption as well. We also reiterate that while certain DMEPOS supplier sub-types might present less program integrity risk than others, the risk for the DMEPOS supplier type as a whole is (and has always been) very high. Hence, as we have with other DMEPOS payment safeguard initiatives, we believe we must view the DMEPOS supplier type in its entirety within the context of accreditation requirements.

Comment: Several commenters suggested that instead of more frequent surveys for all suppliers, CMS should retain the 3-year period but make greater use of ad-hoc surveys, with a commenter stating that the latter should focus on certain quality standards rather than all of them; the commenter believed this would reduce the burden on suppliers and the AOs.

Response: We appreciate these recommendations. We concur that greater use of ad-hoc surveys could prove beneficial in certain circumstances (for example, the AO or CMS receives information that a supplier has lost adherence to the quality standards). Yet we do not believe these surveys would be an adequate substitute for revised Sec. 424.57(c)(24), which would facilitate stricter and more frequent oversight of DMEPOS suppliers.

In terms of the scope of ad-hoc surveys, we respectfully cannot commit to having all surveys be partial in nature, for there may be circumstances where a full survey addressing all quality standards is necessary.

Comment: Several commenters suggested that if CMS believes the current 3-year cycle is too lengthy, it should change it to every 2 years, rather than annually (or, perhaps, 2 years for low-risk suppliers),

Response: We appreciate this suggestion. Again, though, we believe an annual timeframe (instead of every 2 years) will be more effective in halting inappropriate payments and protecting the quality and safety of services and items provided to beneficiaries due to the greater frequency of AO reviews.

Comment: Several commenters stated that to avoid our proposed requirement, some multi-location DMEPOS suppliers might transition their sites from servicing locations to warehouses, repair centers, or call centers that do not require accreditation. They might also consolidate their locations so as to limit the number of surveys the DMEPOS organization must undergo. This could decrease beneficiary access to services and potentially result in program integrity issues due to the lack of a survey. Another commenter expressed concern that if suppliers elected to

depart Medicare due to our proposal, this could impact Medicaid services because many states require a valid Medicare Provider Transaction Access Number (PTAN) for Medicaid participation.

Response: We thank the commenters for this feedback. We cannot exclude the possibility that some DMEPOS suppliers may: (1) transition their sites as the commenters noted; or (2) depart Medicare. Yet we also cannot allow this prospect to deter us from undertaking critical program integrity and quality of care measures such as annual surveys and reaccreditations. Moreover, and as previously stated, we respectfully do not anticipate significant numbers of suppliers exiting Medicare or beneficiaries having access to care problems; we further do not believe large numbers of suppliers will transition to entities that do not require accreditation as DMEPOS suppliers. Still, we recognize the importance of these issues and will carefully monitor our enhanced requirements to ensure that patient access to care remains sufficient.

Comment: A commenter stated that the implementation of our proposal would place a large burden on CMS employees, which appears to contradict the aim of streamlining regulatory agencies.

Response: While we appreciate this feedback, accreditation surveys are performed by the AOs, not CMS or Medicare NPEC staff. To the extent that our requirement would increase CMS or NPEC workload, CMS and the NPECs will be able to accommodate this.

Comment: Several commenters stated that instead of our proposal, CMS should establish a formal process that allows NPECs and AOs to promptly share information when there is suspicion of fraud, waste or abuse. Other commenters recommended closer collaboration with the NPECs, DME MACs, AOs, and other stakeholders on fraud, waste, and abuse matters.

Response: CMS regularly coordinates with the NPECs on fraud, waste, and abuse matters, and we believe our updates to Sec. 424.58 will strengthen communication with the AOs on such issues, too. Again, though, the purpose of accreditation is to validate quality standard adherence, which is not necessarily the same thing as fraud detection. For this reason, we respectfully cannot adopt the commenter's suggestion (appreciated though it is) in lieu of revised Sec. 424.57(c)(24).

Comment: Although urging the retention of the 3-year cycle, numerous commenters requested that CMS delay enforcement of revised Sec. 424.57(c)(24). A commenter requested that this requirement be grandfathered in; this would give the AOs and suppliers time to incrementally implement the annual survey and reaccreditation process over the next 2 years. An additional commenter stated that because CMS must have a clear plan for implementing this requirement, CMS should postpone implementation until: (1) the AOs demonstrate the capacity to do the required activities without compromising the quality of the surveys; and (2) CMS has implemented mechanisms to ensure consistent training and surveyor knowledge across all AOs. Another commenter requested a delay: (1) for at least 12 months; and (2) until support systems and robust technical assistance are ready and a transition grace period has been provided.

Response: We sincerely appreciate these recommendations but do not believe these requirements can be postponed. As noted, the problem of inappropriate payments and the potential for patient harm is very real, and we must implement these requirements as soon as possible, hence the January 1, 2026, effective date. b. Temporary Accreditation (Sec. 424.57(c)(23))

Comment: Numerous commenters expressed concern that our proposal to eliminate temporary accreditation would prevent new locations from operating until a survey is performed--and said survey could be delayed due to the AOs' need to perform many other surveys. This could, they contended, decrease or delay beneficiaries' access to and continuity of care, impair the supplier's financial situation, and prevent the supplier's expansion of its operations via the establishment of new locations; some commenters stated that this could be particularly problematic for beneficiaries in underserved areas. Another commenter stated that our proposed change could also delay the enrollment process, since the site could not be enrolled until the survey is performed. An additional commenter stated that the current temporary accreditation allowance enables suppliers to hire staff, obtain equipment, and establish proper workflows before an accreditation review. Removing this allowance would require suppliers to undergo a survey before they were ready, increasing the likelihood of non- compliance. Another commenter stated that the 90-day allowance should be retained for newly-enrolling O & P suppliers.

Response: We appreciate the commenters' concerns. We recognize that removal of this provision could delay the ability of certain locations to enroll in and bill Medicare. However, we reiterate that a supplier must meet the quality standards and be accredited before it can become Medicare-enrolled. We have no way of knowing whether the quality standards are met unless a survey is performed. It is very possible that the 90-day temporary accreditation provision over the years has resulted in many millions of dollars in inappropriate payments because the supplier--despite its temporary accreditation--did not, in fact, meet the quality standards. We do not believe accreditation is appropriate without confirmation via a detailed and thorough on-site inspection of quality standard adherence. We have an obligation to the American people to ensure that Medicare dollars are only paid to demonstrably compliant DMEPOS suppliers.

We also do not believe this change will cause access to care issues. As stated, there are roughly 75,000 enrolled DMEPOS suppliers. Given this substantial number, we are unaware of beneficiaries experiencing significant difficulty securing DMEPOS due to a lack of suppliers. Too, this revision will in no way prevent new locations from enrolling in areas where there may be a need for an additional site. It will merely delay enrollment until we are certain that the supplier meets all qualifications.

Comment: Several commenters stated that the current 90-day provision strikes a sound balance between quality oversight and timely access to care and should be retained.

Response: For reasons outlined in our previous response, we most respectfully disagree with these commenters. We believe the current provision, rather than ensuring quality oversight, does the exact opposite. It permits accreditation (albeit temporary) without any review as to whether the quality standards are met. Considering the historical payment safeguard risks that DMEPOS suppliers have posed, the maximum feasible oversight is necessary; the 90-day accreditation provision is directly contrary to this.

Comment: A commenter indicated that temporary accreditation should remain available for suppliers being acquired by an entity that is already accredited.

Response: Although we appreciate this recommendation, merely because an accredited and enrolled supplier is purchasing an existing supplier does not guarantee that the latter under its new

ownership is or will be compliant with the quality standards. As stated, each supplier site must be separately accredited, enrolled, and adherent to the quality standards. Most respectfully, the accreditation of one supplier (in the commenter's scenario, the purchasing supplier) cannot be used to influence the degree to which another supplier (the purchased supplier) is reviewed for quality standard compliance.

Comment: Several commenters stated that temporary accreditation should remain available for supplier organizations with a history of compliance.

Response: We appreciate this request but refer the commenters to our previous response. Again, we most respectfully believe that each location must be assessed on its own credentials regardless of any prior compliance of the controlling organization at large.

Comment: A commenter stated: (1) how CMS defines a “new” location in the context of the removal of the temporary accreditation provision (for example, whether it includes location updates); and (2) why CMS believes that a supplier that is compliant in one location will not be compliant at another one. Concerning the former, the commenter stated that it should not apply to location updates. If CMS nevertheless chooses to apply it in this manner, the commenter urged that: (1) CMS exclude suppliers that are in good standing at their other location; and (2) CMS require AOs to complete the new location survey within 20 days of the supplier's request. The commenter further suggested that the temporary accreditation allowance only apply to new suppliers that have no other locations.

Response: Strictly for purposes of temporary accreditation, a “new” location is one that is, simply put, newly established and newly opening. Depending on the circumstances, this could include situations where a supplier is closing operations at one location and moving them to a new site.

We are respectfully unclear as to the term “location updates.” If the commenter is referencing the scenario at the end of the previous paragraph, we note two things. First, if the location shift involves the establishment of a new location, the new site must independently meet the quality standards. It cannot rely upon its compliance at the prior site. Second, considering the volume of their other DMEPOS accreditation responsibilities (for example, performing additional reaccreditation surveys and complaint surveys), we do not believe the AOs should be required to survey the site within 20 days.

Comment: A commenter recommended that if CMS removes the temporary accreditation allowance, surveys should occur 6 months after the approval, so: (1) services and records are available to review; and (2) compliance can be better assessed.

Response: While we are most respectfully uncertain as to the commenter's specific suggestion and its context, the comment appears to describe a variation of the existing temporary accreditation allowance. For reasons we have previously cited, the site cannot be approved and enrolled until the survey is performed and the location becomes accredited. c. Unannounced Surveys

Comment: Several commenters stated that unannounced site surveys: (1) unnecessarily waste surveyor resources; (2) unduly strain the supplier's staff and resources, perhaps making accreditation-related activities a year-round process for supplier; (3) do not protect consumers; and (4) particularly harm smaller DMEPOS suppliers attempting to expand their business. They added that scheduled surveys could equally achieve CMS' goals.

Response: We note two things. First, unannounced DMEPOS supplier surveys are and have been common. Accordingly, our proposal would not necessarily constitute a new requirement or a dramatic change from present practice. Second, we reemphasize our obligation to protect beneficiaries and the Trust Funds by ensuring that DMEPOS suppliers are compliant with the quality standards. Given this, and as explained in the proposed rule and this final rule, we believe DMEPOS supplier surveys should be unannounced so that a non-compliant supplier cannot use prior notice of a survey to remedy its deficiencies solely to pass the survey (after which it may resume its non-adherence). In this context, we also believe that unannounced surveys will encourage suppliers to remain compliant on a consistent basis since they will not know when surveyors may arrive. (We note that the aforementioned February 15, 2024, proposed rule also recognized the importance of unannounced surveys for certified providers and certified suppliers.)

Regarding the commenters' specific assertions, we respectfully disagree that unannounced surveys waste surveyor resources, fail to protect consumers, or unduly strain supplier staff and resources, especially those of smaller suppliers. In the first case, we in fact believe it preserves surveyor resources. This is because it helps ensure that the surveyor's review is an accurate assessment of the supplier's compliance, rather than one where an otherwise non-adherent supplier can, upon advance notice of the survey, temporarily become compliant to pass the survey and then restart its prior non-compliance. For this reason, we also believe that unannounced surveys would better protect beneficiaries and the taxpayers from non-compliant suppliers. As for supplier resources, we emphasize that while suppliers would be surveyed considerably more frequently under our requirement, reaccreditation would still only be as prescribed under revised Sec. 424.57(c)(24). It would not be an ongoing, constant, year-long process. We accordingly but respectfully maintain that while a burden would be involved, it would not be so significant, frequent, or time-consuming as to strain the resources of large or small suppliers to a material degree.

Comment: Numerous commenters stated that unannounced DMEPOS surveys would not align with all business models, particularly those operating across multiple offices or serving specialized patient populations. Some expressed concern that a supplier with a very small staff but several sites would lose their accreditation if: (1) critical staff on a particular day were at one location (Location X); (2) surveyors appeared unannounced at another site (Location Y); and (3) they were unable to perform the survey due to lack of available supplier personnel. The problem of the unavailability of supplier personnel could also occur, other commenters noted, when said individuals visit and furnish items to patients in their homes, if they serve patients strictly on an appointment-only basis, or they furnish mobile services in rural areas. These commenters stated that CMS must be flexible with unannounced surveys, adding that unannounced surveys do not allow the surveyor to confirm whether the supplier will have staff on-site when the surveyor arrives.

Response: We reiterate the importance of unannounced surveys and intend to finalize this proposal. Yet we acknowledge that DMEPOS supplier types vary with respect to the services and items they furnish and their business operations; as the commenters note, certain suppliers may, for instance, do frequent home visits. Accordingly, we will closely follow this issue as we implement this requirement, though we reiterate that unannounced surveys presently do occur.

Comment: Multiple commenters stated that if surveyors appeared unannounced at a supplier location, the location's staff might be in the middle of treating a patient (for example, fitting an orthotic). This would interrupt and perhaps terminate the patient's service that day and be embarrassing for the supplier. It also could require the rescheduling of that patient's appointments as well as others scheduled for that day, hence further delaying patient care.

Response: Although we understand and appreciate that a beneficiary's service could be interrupted or postponed due to an unannounced survey, we reemphasize our overriding obligation to tens of millions of Medicare beneficiaries to ensure that the suppliers they use are compliant with the qualified standards, which, again, can be best confirmed via unannounced surveys.

Comment: Several commenters stated that unannounced surveys could greatly restrict the supplier's flexibility to, for instance, perform public/community health fairs or meetings, since supplier staff must always be on-site in case surveyors appear unexpectedly. This could be particularly challenging if only one or two employees are typically tasked with working with surveyors during an on-site review; these individuals would have to constantly remain at the location, further restricting staff flexibility. Other commenters stated that staff unavailability due to vacations and “black-out” dates could incorrectly give unannounced surveyors a negative impression of the supplier's operations. They added that if the survey cannot be performed, the supplier may have to pay another fee and go through the survey and reaccreditation process all over again, further increasing supplier costs; too, some suppliers will lack the financial means to hire more staff to ensure that personnel is always on-site.

Response: We appreciate these concerns but again stress that revised Sec. 424.57(c)(24) would only require surveys and reaccreditations at least once every 12 months. It would not be a year- round extended burden. Thus, we respectfully believe that unannounced surveys would not substantially impair a supplier's ability to perform outreach or other activities.

Comment: A number of commenters suggested exceptions to the unannounced survey requirement for situations such as, but not limited to, extreme weather, public health emergencies, and similarly atypical situations. A commenter stated that unannounced surveys should be limited to problematic suppliers. Others recommended that CMS ensure that suppliers receive advance notice of a forthcoming survey, with a commenter suggesting a 2-week notice and another recommending 3 days. Additional stakeholders suggested: (1) 24-hour advance notice for suppliers that are appointment-only or that mostly furnish services in patients' homes; and (2) a 2-week `window' for a survey that allows `black out dates' for religious holidays or other reasons such as jury duty. Commenters also stated that CMS should establish a different method of ensuring supplier compliance.

Response: We appreciate these recommendations but believe, for reasons already noted, that unannounced surveys are the best means of ensuring quality standard compliance.

Comment: A commenter stated that an unannounced survey would not necessarily weed out “bad actors.”

Response: While we appreciate this comment, we believe that unannounced surveys would be more effective than announced surveys in detecting non-compliant suppliers because, again, said suppliers would have no time to attempt to restore compliance before the survey.

Comment: A commenter: (1) questioned how AOs should conduct unannounced surveys for O & P suppliers that are appointment only; and (2) recommended that AOs be permitted to contact the supplier on the morning of the survey or the prior business day or, as an alternative, exclude “by appointment only” suppliers from the unannounced survey requirement.

Response: We most respectfully must decline the commenter's recommendation regarding prior notice for reasons already outlined. Concerning the first comment, we expect that suppliers would likely make themselves and their staff available within a reasonable period of time if they were not already onsite. d. AO Requirements and Related Provisions in Sec. Sec. 424.57 and 424.58

Comment: A commenter generally supported the proposed rule's efforts to achieve greater consistency with certain provisions in 42 CFR part 488. Yet the commenter emphasized that DMEPOS suppliers differ significantly from institutional providers, nothing that many operate without fixed facilities, clinical personnel, or centralized infrastructure. As such, the commenter stated that certain part 488 procedures may require adaptation to reflect the operational realities of the DMEPOS sector.

Response: We appreciate the commenter's support and agree with the thoughts expressed. As previously discussed, DMEPOS suppliers and DMEPOS accreditation are very different from certified providers, certified suppliers, and the accreditation thereof. Accordingly, it is not possible to incorporate many aspects of existing part 488 certified provider/supplier accreditation procedures into Sec. 424.58.

Comment: Several commenters opposed aspects of our conflict of interest and consulting provisions. Multiple commenters stated that CMS should not restrict an AO from providing education and training at any time before the organization's initial survey and during the 6-month period prior to each organization's reaccreditation survey; they explained that this is when education is most needed and that such training can be invaluable.

Response: We thank the commenters for this feedback. However, we remain very concerned about the potential for partiality in DMEPOS accreditation surveys. As we explained in the proposed rule and this final rule, these surveys are meant to objectively ascertain the supplier's adherence to the quality standards. We believe that the surveying AO's prior aid (or “coaching”) in helping the supplier achieve such compliance is antithetical to this. The supplier must always meet the quality standards on its own merits. We believe our proposed conflict of interest provisions will assist in ensuring impartial surveys.

Comment: A commenter opposed requiring a review of patient records instead of mock records, adding that it is unclear which patient records would be reviewed.

Response: We thank the commenter for this comment. Yet as we explained in the proposed rule and this final rule, we have seen instances where multiple suppliers within a larger organization have similar patient records. In our view, records of other suppliers' patients should not be considered in the survey; this is because they do not reflect the items and services that the surveyed supplier itself is furnishing. More basically, the review of patient of records is already part of an AO's process for assessing quality standard compliance; for this reason, we respectfully do not believe additional guidance on this topic is needed.

Comment: While agreeing that consulting could create a conflict of interest, a commenter believed our definition of “consulting” was too broad and seems to limit an AO's ability to answer a supplier's questions. Another

commenter stated that our conflict of interest and consulting provisions should: (1) have a narrower, more targeted approach that preserves access to experienced AO personal and surveyors; and (2) clarify the distinction between educational and consulting services. Regarding the latter, another commenter stated that supplier education (for instance, workshops, workbooks, webinars, conferences, and other tools) is critical in the months before a survey and strengthens compliance. The types of education an AO offers also helps distinguish one AO from another; restricting the provision of education diminishes such competition. Also, AOs are well-positioned to furnish supplier education, and the commenter added that education and consulting are different concepts. The commenter, as well as several others, urged that the former be permitted, with a commenter adding that prohibiting education could require the supplier to hire a non-AO consultant, which the supplier may not be able to afford.

Response: We appreciate these comments. While we recognize the AOs' expertise and the value of supplier education, we reiterate that the concept of AO survey impartiality is imperative. As noted in the previous response, we believe our provisions in proposed Sec. 424.58(m) and (n) will be important means of ensuring this. Should the AOs seek elucidation on the scope of these provisions (for instance, whether forms of education fall within Sec. 424.58(m) and (n)), we will consider issuing guidance.

Comment: Stating that the SOM contains guidance and instructions to state survey agencies and AOs for conducting certified provider/ supplier surveys and certifications, a commenter expressed concern that the proposed rule: (1) did not reference the SOM in Sec. 424.58; and (2) contains provisions that conflict with the SOM or otherwise disregard certain SOM procedures. Another commenter stated that Sec. 424.58(e)(3)(A), (B), and (C) do not align with procedures in Chapter 5 of the SOM or those for any other deemed program. The commenter noted that Chapter 5 reads in part: “All the procedures in this chapter are followed when complaints and reported incidents, including referrals from public entities, involve Medicare-certified providers/suppliers, Medicaid-certified providers/suppliers, or CLIA-certified laboratories.” The commenter thus contended that CMS should: (1) adopt the Chapter 5 complaint procedures and definitions in lieu of the process in proposed Sec. 424.58(e)(3)(A), (B), and (C) so that all AOs handle complaints consistently; and (2) permit administrative reviews/ offsite investigations instead of surveys for Non-IJ Medium and No-IJ Low situations, which would expedite the investigation and resolution.

Response: We appreciate this feedback but refer the commenters to our previous responses regarding the distinction between DMEPOS suppliers and certified providers/suppliers. We further emphasize that the SOM has never applied to DMEPOS suppliers or their accreditation. We believe it is more important to establish accreditation procedures that are best suited to address the unique characteristics and risks of DMEPOS suppliers than to mirror procedures (such as onsite surveys for Non-IJ Medium and No-IJ Low situations) in guidance that, again, is inapplicable to said suppliers.

Comment: A commenter noted proposed Sec. 424.58(c)(1)(xxiii)(D), which would require an AO to notify CMS within 3 business days of the revocation or revision of a supplier's accreditation status). The commenter stated that this provision should be changed to read: “The accrediting organization must agree to provide this notification in writing to CMS of the accrediting organization's action to revoke or revise the accreditation status of a supplier within 30 days allowing for an appeal, a review of presented materials, and a decision.” The commenter explained that state agencies and AOs permit providers and suppliers to appeal a decision and indicated that CMS should only require the notification previously discussed after the appeal has been completed. For the same reason, the commenter recommended that the 5 calendar-day reported period in Sec. 424.58(e)(5)(i) be revised to reflect the suggested change to Sec. 424.58(c)(1)(xxiii)(D); another commenter recommended changing the 5-calendar day period to 5 business days.

Response: We appreciate this comment but respectfully disagree with the suggested changes. The appeals process is a different issue than that of reporting data to CMS about a supplier's status. Considering the rule's emphasis on enhanced CMS oversight of the AOs, the overall DMEPOS accreditation process, and DMEPOS suppliers, we believe we must receive prompt notification of an accreditation revocation, revision, denial, etc., all the while recognizing that the AO action might be reversed on appeal.

Comment: Several commenters requested that the 2-calendar-day timeframe for notifying CMS of an immediate jeopardy situation be changed to 2 business days.

Response: We agree with this suggestion and have incorporated it into our final regulatory text.

Comment: A commenter stated that the term “law enforcement” in Sec. 424.58(c)(1)(xxii) should be changed to “the Office of Inspector General.”

Response: We must respectfully decline this recommendation because there are other law enforcement bodies besides the OIG that might be involved in assessing allegations of fraud, waste, and abuse.

Comment: A commenter questioned whether the 10-day period in Sec. 424.58(c)(1)(xxiii)(E) for notifying CMS of CAPs begins on the date when the AO makes its determination to apply a CAP or the date on which the AO requests the CAP.

Response: Section 424.58(c)(1)(xxiii)(E) requires the notification to be made within 10 days of the AO's decision, which, for purposes of this paragraph, we equate to the date the determination is made.

Comment: A commenter questioned whether the AO should send proposed changes to its accreditation standards, requirements, or survey process only when there is a change.

Response: We are respectfully unclear as to the commenter's query. If the commenter is asking for clarification regarding when and how the aforementioned changes must be reported to CMS, we address this in proposed Sec. 424.58(e)(2).

Comment: A commenter requested that CMS change the term “corrective action plan” in Sec. 424.58 to “plan of correction” to better align with the terminology in part 488 and the SOM.

Response: We appreciate this request. Yet we wish to retain “corrective action plan” because we have used this term for many years in the DMEPOS accreditation arena.

Comment: Several commenters expressed concern regarding the requirement in Sec. 424.58(c)(1)(xxiii)(D) that the AO notify CMS within 3 business days of any decision to terminate, revoke, withdraw or amend a particular supplier's accreditation status. The commenters suggested that we change the reporting timeframe to 10 business days or longer.

Response: We appreciate this suggestion but must respectfully decline to accept it. If an AO terminates a supplier's accreditation, the supplier is out of compliance with Sec. 424.57(c)(22) and its enrollment should be revoked. If we extended the reporting period from 3 business days to 10 business days, this could result in 7 additional days of

inappropriate payments to a non-compliant supplier. Therefore, we must be made aware of such AO actions as promptly as possible.

Comment: With respect to our proposal in new Sec. 424.58(i)(4) that affected suppliers must be notified of their AO's suspension and the status of their existing accreditation, several commenters suggested that the accreditations of such suppliers remain effective: (1) for 1 year; (2) until their next scheduled reaccreditation; or (3) until the AO's suspension is lifted. A commenter stated that it could be difficult for another AO to immediately reaccredit the supplier, noting that said AO may not have: (1) a relationship with the supplier, which could complicate communication; and (2) adequate experience in accrediting suppliers that furnish the specific types of items that the supplier does. Other commenters stated that CMS should: (1) stipulate a minimum timeframe for suppliers to reconcile with a new AO if their current one is revoked; and (2) grant extensions to suppliers who are forced to switch accreditation organizations due to delays outside of their control.

Response: We appreciate these comments, which appear to generally recommend that the supplier's accreditation remain in effect for a period following the AO's suspension and not be immediately terminated upon said suspension. If this is indeed the commenters' suggestion, we refer them to proposed Sec. 424.58(i)(4) wherein we stated that, with certain exceptions, the supplier's accreditation would remain effective through the length of the suspension. Although we recognize the commenter's concern about having to obtain accreditation from a different AO, we reiterate our obligation to protect the Trust Funds and beneficiaries through, in part, ensuring that the AOs are performing effectively. We most respectfully believe this must take precedence. Concerning the final set of comments, we respectfully are uncertain as to the commenters' meaning of “reconcile” and “delays outside of their control” in the context of our proposal. Regardless, we believe that proposed Sec. 424.58(i)(4) gives DMEPOS suppliers enough time to be accredited by another AO if that is required under paragraph (i)(3).

Comment: Several commenters opposed proposed new Sec. 424.58(e)(3). They stated that the 21-day period identified therein may not be appropriate or feasible in all circumstances. They added that the reporting timeframes should account for the complaint's materiality and seriousness. Additional commenters contended that not all complaints are of the same importance or urgency, with some too immaterial to report to CMS lest the AO and CMS burden for disclosing and reviewing these complaints become overwhelming. A commenter recommended that CMS, in partnership with the AOs, establish a tiered response level to complaints.

Response: We thank the commenters for this feedback. Considering the historically high program integrity risk that DMEPOS suppliers have posed and our aforementioned need for much greater oversight of the DMEPOS accreditation program, we believe that complaints should: (1) be carefully reviewed and reported to us regardless of materiality; and (2) promptly result in a survey if the review concludes that non- compliance may exist. Survey delays in the second instance could lead to thousands of dollars in additional payments to non-adherent suppliers. Still, we recognize the commenters concerns about the relative importance of certain complaints and will keep this in mind as we implement Sec. 424.58(e)(3).

Comment: Multiple commenters stated that CMS should: (1) send notices of actions against AOs via email; and (2) have all AO probation, suspension, and termination notices publicly available on the CMS website.

Response: We appreciate these suggestions. All AO suspensions and terminations will indeed be posted our CMS website. Probations will not because, as previously stated, an AO on probation would normally be able to continue its activities without interruption. Regarding the first recommendation, we are respectfully unclear whether the commenter is referencing a CMS email notification to all suppliers. If the commenter is, we respectfully believe the CMS website posting constitutes sufficient notice. However, we may in the future consider supplemental notification measures if deemed appropriate.

Comment: Regarding the AO data reporting requirements in Sec. 424.58, a commenter stated that CMS should ensure that: (1) the timeframes are reasonable and feasible; and (2) it shares data and feedback with the AOs as well (perhaps establishing a data exchange process between CMS, the AOs, and the NPECs). The commenter also suggested that CMS establish a working group and closer CMS collaboration with AOs to develop and facilitate clear guidelines, performance standards, and best practices.

Response: We appreciate these recommendations. We believe the proposed timeframes are indeed reasonable and feasible, and, as previously noted, we regularly meet and exchange information with the AOs and NPECs on various matters. We anticipate even more frequent communications and close collaboration with the AOs as we implement our accreditation proposals.

Comment: A commenter questioned whether the surveys and reviews addressed in 424.58(f)(2) and (f)(4) would be announced or scheduled.

Response: We thank the commenter for this query, a matter on which CMS will issue guidance to the AOs during the implementation of our DMEPOS accreditation provisions.

Comment: A commenter stated that our proposed consulting requirements in Sec. 424.58(m)(4)(i), (ii), (iii), and (iv) could be impossible to meet for two reasons. First, firewalls prevent this information from being shared, and the AO's education area does not possess this data. (For example, the list of attendees is not shared between the educational division and the accreditation division.) The commenter stated that this requirement would force the two separate divisions to share provider information that is prohibited, hence removing the integrity of the separation because the accrediting division should never know which suppliers have received education. Second, these provisions require unobtainable information, such as the names and billing numbers of all suppliers that receive fee-based consulting or general education from the AO.

Response: For reasons already discussed in the proposed rule and this final rule, we believe our conflict-of-interest provisions are necessary. However, we appreciate the commenter's concerns and will monitor these matters during and after these provisions' implementation.

Comment: A commenter stated that “lookback surveys” addressed in proposed Sec. 424.58(f)(2), are not a reliable or meaningful method of validation. The commenter stated that conditions within the supplier's operations are likely to change after an accreditation survey (for example, implementing corrective action). Given this different environment, it could be difficult to draw accurate conclusions about the original survey's findings. Sharing this commenter's views, other commenters recommended a direct observation model instead of “look- behind surveys.”

Response: Although we appreciate these comments, these surveys have been included within Sec. 424.58 since 2006. We continue to believe they can

be beneficial since they enable CMS itself to perform a survey.

Comment: Regarding proposed Sec. 424.58(c)(1)(xxii), a commenter recommended that CMS define the terms “fraud”, “waste”, and “abuse”.

Response: We appreciate this comment. However, we respectfully believe that for purposes of Sec. 424.58(c)(1)(xxii), the meanings of these three terms are plain on their face.

Comment: A commenter questioned whether Sec. 424.58(e)(1)(i) was intended to establish a new monthly reporting requirement.

Response: AOs are presently required to submit data to CMS each month per existing Sec. 424.58(c)(1). Section 424.58(e)(1)(i) merely modifies the types of information to be reported. From that standpoint, therefore, it does not create a new reporting requirement.

Comment: A commenter expressed concern regarding CMS' reapplication procedures in Sec. 424.58(c) and (d), that: (1) CMS was requiring AOs to reapply annually; (2) reapplication could create instability among the AOs, hence creating a vulnerability that unscrupulous parties would exploit; and (3) the proposed rule lacked clear criteria/scoring metrics for evaluating AOs and a clear process for appealing.

Response: We appreciate the commenters' views and note the following. First, we did not propose to require annual AO reapprovals. Second, we do not see our reapproval proposals as risking AO instability or creating loopholes. We instead believe they will strengthen the accreditation process by enabling CMS to ensure that its AOs are fully qualified. Third, we are not positioned to outline in this final rule an extensive, detailed scoring system for our reapproval application assessments because: (1) we did not propose one; and (2) we must have the flexibility to make our application assessments based on each AO's individual and unique credentials. Fourth, we outlined reasons in Sec. Sec. 424.58(c) and (d) for which, after our application review, we can deny AO reapproval, and we also explained the AO's appeal rights.

Comment: While supporting our proposal that AOs must review complaints against accredited facilities thoroughly, consistently, and diligently, a commenter raised two matters. First, the commenter requested that CMS specify the term “other applicable CMS requirements” in its “complaint” definition in Sec. 424.58(b). Second, the commenter requested that CMS amend this definition to exclude a complaint against a supplier related to customer service on a non-DMEPOS item or matter (for example, the price of a particular medication was too high).

Response: We appreciate these comments. We will furnish clarification regarding the “other applicable CMS requirement” language prior to the implementation of our requirements. Regarding the second comment, we do not believe the suggested amendment is necessary; this is because non-DMEPOS issues are unrelated to the quality standards and thus would not fall within our revised “complaint” definition.

Comment: Several commenters questioned whether the AO's authorized official attestation in Sec. 424.58(c)(1)(xxiii) must be submitted annually or only with initial and reapproval applications. Another commenter questioned whether the attestation's provision regarding patient records is a one-time requirement or will be on a cycle.

Response: We thank the commenters for these queries. The attestation (which references the use of patient records) need only be furnished when submitting an initial application or reapproval application under, respectively, Sec. 424.58(c) and (d). However, the agreements contained therein remain in effect so long as the organization is a DMEPOS AO.

Comment: A commenter supported the requirement that an AO's application define “deficiency.” Yet the commenter also urged CMS and the AOs to be more visible about this definition (and all levels thereof) to help suppliers understand the term's meaning and scope. Another commenter recommended that CMS define the term “deficiency” (and levels thereof) in future rulemaking to ensure consistency among the AOs. Another commenter suggested that in defining “deficiency” and striving for more consistent AO determinations, CMS should adopt the same language and process it utilizes for the ambulatory surgical center (ASC) accreditations process explained in 42 CFR 488.26 and the SOM. An additional commenter suggested that CMS adopt the same definition of “deficiency” (and its levels) that exists in Sec. 488.705.

Response: We appreciate the first commenter's support and will, as needed, issue guidance regarding this definition. We may consider defining “deficiency” in future rulemaking, but we believe at this time that we must have the flexibility to do so via sub-regulatory guidance. This would enable us to receive detailed and ongoing feedback from the AOs on this definition as well as on setting deficiency levels; it is for these reasons that we also must respectfully decline the suggestions of the final two commenters.

Comment: Concerning Sec. 424.58(e)(10), a commenter requested that CMS to identify the system into which the AO would have to enter data.

Response: CMS has not determined whether this will be a requirement or, if it is, what system will be involved. CMS would notify the AOs ahead of time should this guidance be adopted, as well as the relevant system.

Comment: Several commenters supported our conflict of interest (COI) and consulting proposals, stating that robust COI procedures for AOs were necessary.

Response: We appreciate the commenters' support.

Comment: A commenter stated that CMS should not have the complete discretion to define “deficiency” but should instead seek feedback from experts at the AOs, suppliers, and associations. The commenter added that any proposed updates to the quality standards should first be reviewed by these same experts.

Response: Although, as previously indicated, CMS intends to define “deficiency”, we recognize the expertise of the DMEPOS AOs, which is partly why AOs in their initial and reapproval applications would be required to define this term as well as identify deficiency levels. We believe this feedback would assist us in formulating an appropriate definition.

While we appreciate the stakeholder's comment regarding the quality standards, we believe it is outside the scope of this final rule.

Comment: A commenter stated, regarding proposed Sec. 424.58(e)(8)(i)(A), that requiring a survey is unnecessary for codes that do not need additional licensing or qualified personnel. (For example, an accredited supplier furnishes basic DME like a walker and wants to add canes and crutches.) More limited means of review would be equally effective.

Response: While we appreciate this comment: (1) the quality standards must be met irrespective of whether the new codes require additional licensing or qualified personnel; and (2) a survey would be the most effective means of determining quality standard compliance.

Comment: A commenter stated that AO reapproval should be for a maximum of 6 years to mirror current approval standards for home health and hospice.

Response: We concur with the commenter and note that this is what we proposed in Sec. 424.58(d).

Comment: A commenter expressed concern with respect to CAPs about the volume of CAP data that must be reported (which the commenter stated goes beyond what AOs must report for other Medicare providers and suppliers). The commenter questioned whether CMS would have the capacity to review all the CAPs the AOs submitted and sought our assurance that CMS would use all the data submitted. The commenter further contended that our CAP submission requirements: (1) could incentivize AOs to avoid CAPs and the need to report them (and the burden involved in doing so) for minor deficiencies; and (2) would place an excessive burden on AOs that properly use CAPs, thus punishing their diligence. Another commenter stated that CMS appears to be: (1) requesting that AOs defend each CAP they apply; (2) asserting that CAPs should focus on minor deficiencies; and (3) assuming that accreditation denials and CAPs are mutually exclusive (with the commenter stating that CAPs can be useful in enhancing compliance). This commenter stated that CMS should identify in rulemaking any deficiencies it believes are so serious that they should not be resolved via a CAP. An additional commenter, meanwhile, stated that CMS should define the term “corrective action plan”.

Response: We thank the commenters for this feedback and respond as follows:

First, and as with complaints, we believe CAPs should be reported to us, considering the very high payment safeguard risk that DMEPOS suppliers have presented and our consequent need for significantly greater oversight of the DMEPOS accreditation program and the AOs. CMS will have the capacity to review all CAPs submitted.

Second, while we again acknowledge the AO burden involved, we reiterate our previous statements that certified provider/supplier accreditation is different from DMEPOS supplier accreditation; consequently, the policies for the latter cannot be dictated by the former. We also emphasize that the CAP reporting requirement is not intended to punish AOs, to have AOs defend every CAP, or to focus on minor deficiencies. It is to help us exercise closer monitoring of DMEPOS accreditation, the importance of which we have already discussed.

Third, CMS recognizes the distinction between CAPs and accreditation denials, and our proposals are not designed to blur it or to greatly restrict the AOs' ability to impose a CAP.

Fourth, we did not propose to: (1) identify which deficiencies should result in a CAP; or (2) define “corrective action plan.” We will, though, consider these matters as we implement our proposed requirements and, if need be, formulate guidance.

Comment: A commenter supported our 36-month rule proposal in new Sec. 424.551, though recommended that the 36-month clock not be triggered when a multi-location supplier sells one or more of its sites. Another commenter stated that with respect to the exception concerning parent company restructurings, CMS should expand the interpretation of “parent” to include any entity that is a wholly- owned direct or indirect owner of the DMEPOS supplier.

Response: We thank the commenters for their feedback. As each DMEPOS supplier must individually enroll as a separate supplier and meet all CMS requirements, we respectfully do not believe an exception should be given to sites within multi-location entities. (We note that no such exemption exists for HHAs and hospices under Sec. 424.550(b).) Regarding parent companies, CMS will consider issuing guidance to clarify this term.

Comment: Several commenters expressed concern that: (1) there are too few AOs for certain types of DMEPOS suppliers (such as those providing mastectomy and lymphedema services); (2) the removal of one or more AOs could be harmful to the accreditation process; and (3) the metrics that CMS will use to take action against an AO (and what those actions might be) are unclear.

Response: We appreciate these comments. We will likely require existing AOs to undergo the reapproval process very soon after the final rule's publication. We cannot predict the number of AOs that: (1) will remain after this process is completed; or (2) may be added in the future (if any) to accredit different types of suppliers. We can, though, assure the commenter that all such reviews of AOs will be comprehensive and thorough. Insofar as removals of (and CMS action against) AOs, we outline the grounds for such action in proposed Sec. 424.58(h), (i), and (j). While we recognize the commenter's concern that an AO's removal could be harmful to DMEPOS accreditation, we most respectfully believe the opposite. To ensure the integrity of the accreditation process, we must confirm that the AOs are performing their DMEPOS accreditation activities effectively, competently, and consistent with CMS requirements; if an AO is not, we believe it could be more harmful to DMEPOS accreditation to retain that AO than to remove it.

Comment: Several commenters expressed concern about proposed Sec. 424.58(e)(5)(ii), under which CMS could direct an AO to deny or terminate a supplier's accreditation. They believed this provision: (1) could impact the supplier's involvement with state licensing bodies and non-Medicare plans that require or rely upon the supplier's accreditation; (2) appears to be a punitive enforcement tool; and (3) could unfairly revoke accreditation for minor matters, such as non- compliance with merely one quality standard. The commenter recommended that CMS limit its enforcement mechanisms to enrollment revocation and payment suspensions; should CMS finalize this proposal, the commenter urged a robust appeals process, during which any termination would be stayed. Another commenter stated that the proposed provision could reduce the AO's independence and lead to arbitrary CMS decisions if CMS is unaware of the full circumstances of the supplier's case.

Response: We thank the commenters for sharing their concerns. We stress that any such CMS direction would occur extremely rarely (if ever) and only in the most exigent of circumstances, in part because we do not wish to hinder the AO's independence. It would not be used as a punitive enforcement mechanism for minor matters, or in instances where CMS did not have a complete understanding of the facts of the case. The supplier's appeal rights regarding the accreditation (and whether the denial or termination would be stayed) would be consistent with the AO's existing procedures.

Comment: Concerning our proposed definition of “immediate family member”, a commenter stated that: (1) U.S. federal government standard practice does not restrict immediate family members from working in different facets of the government or as a contractor to the government; and (2) the conflict of interest process restricts said family members from participating in any activities with each other (for example, program decision-making or outcome reviews that involve both parties). The commenter thus concluded that employment in either organization itself does not reflect a conflict of interest. The commenter recommended that CMS: (1) align the DMEPOS conflict of interest requirements with those in the SOM; (2) clarify if the proposed provisions preclude an AO surveyor from consulting outside of their AO position with a DMEPOS supplier; and (3) clarify whether a surveyor could disclose their consulting relationship to the AO, so the individual is not assigned to survey that specific

supplier. If our definition is finalized, the commenter stated that CMS should provide AOs with standardized conflict of interest disclosure forms or questionnaires that outlines the scenarios and relationships that CMS considers problematic.

Response: We appreciate the stakeholder's comments. We respectfully do not believe that the first two scenarios the commenter mentions are applicable to the conflict-of-interest situation addressed in the proposed rule. The latter is narrower and focuses on AO consulting practices. Also, our proposed “immediate family member” definition and conflict of interest requirements are similar to those in the aforementioned February 15, 2024, proposed rule.

Comment: Several commenters stated that CMS must provide definitions and guidance to the AOs on CAPs and deficiencies before implementing its proposed changes regarding potential disciplinary action against AOs for survey finding disparities

Response: We thank the stakeholders for these comments. For reasons previously stated, we must respectfully decline to delay the implementation of our provisions (or to make their commencement dependent upon the previously discussed definitions and guidance being issued). Nonetheless, we expect to issue the commenters' requested sub- regulatory guidance to the AOs as promptly as possible.

Comment: Regarding our proposal that AOs must submit conflict of interest data to CMS at any time outside the initial approval and reapproval processes, a commenter urged CMS to provide a reasonable timeframe for AOs to assemble and organize data requested.

Response: We agree and will do so when making such requests.

Comment: Several commenters opposed our proposed 36-month rule expansion to include DMEPOS suppliers. Multiple commenters stated that CMS has not demonstrated that: (1) DMEPOS suppliers are establishing new businesses and then selling them after accreditation; or (2) requiring the new owner to reenroll could prevent fraud, waste, and abuse. Another commenter stated that the delays involved in reenrolling as a new supplier (as well as becoming accredited again) could prove very burdensome and delay patient care. The commenter added that there is already a process for notifying CMS of a change in majority ownership. The commenter recommended that CMS withdraw the 36-month proposal and instead impose stricter requirements on the new supplier, such as annual accreditations. An additional commenter stated that with the requirement to obtain a new accreditation as well as the need for suppliers to alert other health care plans of both the change in ownership and the accreditation change, this could delay the processing of the changes by said plans. Another commenter stated that this provision would essentially shut down the supplier's operations for a period of time, potentially harming patient access.

Response: We appreciate these comments and respond as follows. First, we noted in the proposed rule that we indeed have seen situations where suppliers were sold after accreditation. Second, the reenrollment/reaccreditation requirement is less geared towards preventing fraud, waste, and abuse (though this is always a critical consideration in our DMEPOS program integrity efforts) and more towards confirming that the supplier's new ownership is fully committed to quality standard compliance. Third, while we recognize the burden involved and the potential for delays in application processing and patient care, we reiterate the need to ensure that taxpayer dollars are only paid to compliant suppliers. We further do not believe patient access to care will be harmed given: (1) the vast number of other DMEPOS suppliers from which beneficiaries can receive services and items; and (2) that we have not seen HHA and hospice patient access issues resulting from Sec. 424.550(b).

Comment: Multiple commenters stated that the proposed 36-month rule expansion is impractical because DMEPOS suppliers cannot provide services to beneficiaries without a PTAN. Another commenter suggested that instead of a new survey and reaccreditation, the new owner's credentials could be examined via other means (for example, through staff interviews).

Response: We appreciate these comments. We respectfully disagree with the first assertion. Akin to our robust and longstanding provider enrollment requirements, our DMEPOS accreditation provisions are intended to ensure that the supplier meets the quality standards before enrolling and receiving a PTAN. If an unvetted supplier was enrolled with a PTAN and began billing prior to any enrollment or accreditation reviews, millions of dollars in improper payments could ensue. Insofar as the second assertion, we already carefully screen new provider and supplier owners via the enrollment process. Section 424.551 as finalized will involve a more thorough analysis of the new owner's commitment to quality standard compliance.

Comment: A commenter questioned whether the reviews identified in Sec. 424.58(f)(4)(i)(A), would be announced or scheduled.

Response: We appreciate this comment. We will issue guidance on this matter upon the implementation of our accreditation requirements.

Comment: With respect to existing Sec. 424.58(b)(3) (proposed as redesignated Sec. 424.58(f)(2)(ii)), several commenters believed that AOs should not be held responsible for future non-compliance by a supplier. They stated that no other enforcement entity, licensing board, etc., is responsible for future provider/supplier performance. A commenter contended that if a supplier becomes non-compliant and a survey is needed, it should be at the supplier's expense and not the AO's.

Response: After reviewing these comments, we have decided not to finalize this provision at this time. We may reconsider this issue in future rulemaking. Proposed Sec. 424.58(f)(2)(iii), (iv), and (v) will be finalized and redesignated as Sec. 424.58(f)(2)(ii), (iii), and (iv).

Comment: A commenter stated that to alleviate burden on CMS staff in reviewing AO reports, CMS should only require AOs to maintain documentation and supply it to CMS upon request when a supplier is under review.

Response: We respectfully disagree. To ensure proper oversight of the DMEPOS accreditation program, we believe we must have regular and detailed information from the AOs, which we are confident that CMS staff will have the capacity to review.

Comment: A commenter suggested that CMS integrate PECOS and the National Plan and Provider Enumeration System into AO reviews of suppliers to ensure real-time verification of supplier compliance.

Response: We appreciate this recommendation but believe it is outside the scope of this final rule. e. General/Miscellaneous Comments

Comment: Several commenters supported our proposed DMEPOS accreditation provisions. A commenter stated that these proposals strengthen oversight and patient access, with another stating that CMS is rightly concerned that some AOs may be accrediting suppliers that do not meet the quality standards. An additional commenter stated that there have been significant instances of DMEPOS fraud in recent and past years, increasing expenditures for the Medicare program

and beneficiaries. The commenter believed our changes, including revised Sec. 424.57(c)(24), would: (1) help ensure that AOs serve their expected role; (2) give CMS additional tools to ensure the integrity of the Medicare DMEPOS benefit and to protect the interests of beneficiaries and taxpayers; (3) address vulnerabilities that CMS has identified; (4) increase the utility of AOs and accreditation for Medicare; and (5) improve consistency among the AOs. Another commenter agreed that there should be repercussions for AOs that are underperforming or that use unscrupulous individuals to perform inspections. Too, a commenter expressed support for our revisions to Sec. 424.57(c)(22). An additional commenter supported unannounced and more frequent surveys.

Response: We appreciate the commenters' support.

Comment: A commenter stated that the cost of “rolling out” these proposed changes would be better spent in increasing reimbursement to DMEPOS suppliers.

Response: While we appreciate the commenter's feedback, we have articulated the reasons for our proposals and most respectfully maintain that they are necessary irrespective of existing or future levels of supplier reimbursement.

Comment: A commenter stated that a supplier's accreditation should not be terminated or revoked until the appeals process has expired.

Response: Though we appreciate this comment, we did not propose provisions pertaining to the: (1) appeals process for terminations or revocations of DMEPOS supplier accreditations; or (2) the effective dates of such actions. We thus believe this comment is outside the scope of this final rule.

Comment: A commenter stated that: (1) our proposed requirements would disincentivize companies from entering the DMEPOS field; and (2) Medicare should instead create a program that rewards people who enter said field.

Response: We thank the commenter for this feedback. We cannot exclude the possibility that our accreditation requirements may make certain prospective suppliers more reluctant to enroll in Medicare. As indicated previously, though, we have implemented DMEPOS supplier enrollment requirements in prior years (for instance, surety bonds, high-risk screening, etc.). These did not end the enrollment of new DMEPOS suppliers into the program. To the contrary, we regularly enroll new suppliers, including over 1,500 within a recent 12-month period; thus, while a reduction in new suppliers is possible, we do not believe it will be substantial, based on our past experience. In addition, although we sincerely appreciate the services that compliant DMEPOS suppliers furnish, we most respectfully cannot tailor our DMEPOS payment safeguard measures to ensure that DMEPOS suppliers: (1) can enroll in significant numbers; and (2) be rewarded for their entry (as the commenter appears to recommend). They must instead be geared towards protecting the quality of DMEPOS services as well as the Trust Funds, the taxpayers, and beneficiaries, particularly given the program integrity problems that DMEPOS suppliers have long presented.

Comment: Several commenters stated that instead of proceeding with its DMEPOS accreditation proposals, CMS should engage with stakeholders (such as hospice-based suppliers) to develop a framework that balances: (1) the need for supplier accountability; and (2) the importance of ensuring patient access to care and limiting supplier burden.

Response: CMS regularly interacts with DMEPOS suppliers, DMEPOS representatives, the AOs, and other stakeholders on a wide variety of DMEPOS enrollment and accreditation matters. These communications help CMS remain abreast of any issues within the supplier community, and we keep these in mind when developing DMEPOS enrollment or accreditation- related initiatives. In developing our accreditation proposals, we remained cognizant of the potential burden on suppliers but concluded that our obligation to prevent improper payments to non-compliant suppliers and to protect beneficiaries warrants annual surveys and reaccreditations. Although, as previously explained, we do not anticipate access to care problems arising from this requirement, we will monitor the matter as our requirements are implemented.

Comment: A commenter recommended that CMS: (1) further examine Stark Laws; and (2) revise rules regarding physician prescribing of DMEPOS and the fitting of the physician's patients at the physician's practice location.

Response: We appreciate this comment but believe it is outside the scope of this rule.

Comment: A commenter stated that AOs do not consistently: (1) verify whether each supplier site has its own NPI, PTAN, surety bond, and Medicare enrollment; and (2) hold suppliers accountable for meeting all DMEPOS quality standards. The commenter stated that along with ensuring consistency in the AOs' accreditation process, CMS should require AOs to confirm that each DMEPOS location has its own NPI, PTAN, surety bond, and enrollment record as part of the accreditation process. The commenter added that CMS should enhance training and oversight of AOs to ensure consistent enforcement of all DMEPOS supplier and quality standards.

Response: We appreciate and will contemplate these recommendations as we continue our efforts to strengthen our oversight of the DMEPOS accreditation program and the AOs.

Comment: Several commenters stated that instead of our DMEPOS accreditation proposals, CMS should focus on investigating: (1) companies that improperly obtain Medicare beneficiary information; (2) physician and physical therapy offices that prescribe and provide orthopedic devices: (3) DMEPOS dealers that solicit by television, radio, or telephone; and (4) aggressive telemarketing and patient targeting (for which, a commenter stated, CMS could establish a centralized CMS-managed watchlist to report suspected marketing-related fraud).

Response: We appreciate these comments. CMS has undertaken many DMEPOS program integrity measures over the years. For instance, we strive to protect DMEPOS beneficiary data and work closely with law enforcement in cases where such data has been improperly obtained; we take the security of beneficiary information and the inappropriate access thereof with great seriousness. However, we respectfully do not believe that our program integrity actions in this and other areas requires us to eschew other necessary initiatives, such as strengthening the DMEPOS accreditation process. That is, program integrity is a wide-ranging effort encompassing many components addressing many areas, and merely because one measure is taken does not mean we must disregard addressing other vulnerabilities. While safeguarding beneficiary data and preventing improper payments via more frequent surveys are two distinct matters, both are needed.

Comment: A commenter requested several changes in how AOs conduct surveys. First, if the supplier does not furnish rental items, the AO should not require the supplier to produce a rental policy. Second, the AO should not require the supplier to post an emergency exit map on the supplier's wall if the local fire inspector does not require it and the supplier passed its annual fire inspection. Third, AOs should permit financial and employee

information to be submitted via fax or email rather than on demand at a site inspection. Fourth, AOs should have to complete surveys within 45 calendar days of the supplier's paperwork submission; this would better enable supplier staff to perform other activities since they will not need to wait indefinitely for the survey's performance.

Response: We respectfully believe that the commenters' first three requests are outside the scope of this final rule. As for the fourth, we did not propose a general timeframe by which AOs must complete all surveys and, given the extent of their other DMEPOS accreditation responsibilities, do not at this time believe one should be established.

Comment: Several commenters stated that the best option for combating fraud, waste, and abuse in the O & P field would be to implement: (1) section 427 of the Benefits Improvement and Protection Act of 2000; and (2) elements of the “Medicare Orthotics and Prosthetics Patient-Centered Care Act” bills before the Congress, S. 2329 and H.R. 4475.

Response: We appreciate these suggestions but believe they are outside the scope of this final rule.

Comment: A commenter stated that CMS' requirement that DMEPOS suppliers have in-office hours is outdated.

Response: We respectfully disagree. Consistent with Sec. 424.510, all provider and supplier locations (including DMEPOS supplier sites) must be “operational” as defined in Sec. 424.502. Per this definition, the practice must be “open to the public for the purpose of providing health care related services.” This requirement has been effective for many years, helps confirm the DMEPOS location is legitimate, and is no less necessary than before.

Comment: A commenter stated that AOs should not go beyond verification of the quality standards or supplier standards in their reviews. To guard against such situations, improve AO consistency, and prevent arbitrary findings, the commenter suggested that CMS require AOs to: (1) map each survey element to the specific standard it intends to verify; (2) publish the minimum evidence of compliance expected for each element; (3) reserve termination for core, non-remediable violations (fraud, licensure, phantom locations); (4) use CAPs for remediable issues like signage, hours, or maintenance documentation; (5) ensure that surveyors meet published minimum qualifications, including continuing education); (6) publish surveyor qualification and training standards so suppliers have visibility into the process; and (7) align reviewer expertise with subject matters (for instance, clinical reviewers for clinical standards, operations reviewers for facility/administrative checks).

Response: We appreciate these comments. Elements of the comments regarding the survey process will, as deemed appropriate, be taken into consideration for future sub-regulatory guidance.

Comment: A commenter stated that DMEPOS suppliers are still recovering from the economic effects of the pandemic, inflation, shipping delays, and workforce shortages. The commenter stated that implementing our DMEPOS provisions without transition support would be unsustainable and risk forcing suppliers--especially those in rural or underserved areas--out of the Medicare program.

Response: We appreciate this comment. While we respectfully are uncertain as to the type of support the commenter is referencing, we plan to conduct extensive outreach and provide guidance to DMEPOS suppliers. We believe this will help them understand and transition to our new requirements.

Comment: While supporting the strengthening of the DMEPOS accreditation program, a commenter expressed concern that some of the AO-specific proposals--such as mandatory preapproval for AO procedural changes, expanded data submission requirements, and undefined deficiency categories--could inadvertently delay accreditation processes and hinder responsiveness to urgent patient needs. The commenter: (1) stated that clear requirements for AOs (for example, defined timelines and streamlined documentation requirements) would help preserve accountability and efficiency; and (2) urged CMS to work collaboratively with AOs and suppliers to refine these proposals, so they enhance quality without compromising suppliers' ability to serve patients effectively.

Response: We appreciate these comments. We respectfully believe our proposed requirements: (1) are necessary, adequately detailed, and clear on their face; and (2) will not lead to material delays or patient access to care problems. Although, except as otherwise noted in this final rule, we do not believe our proposals require revisions, we will, as already stated, monitor their implementation and address any issues that arise.

Comment: A commenter questioned whether CMS could pay suppliers' accreditation fees or set the amount of AO fees.

Response: While we appreciate this request, DMEPOS AO fees have always been paid by suppliers (including certified providers and certified suppliers). Too, since the AOs are independent entities, they have the discretion to establish their own fee amounts.

Comment: A commenter stated that CMS should work with the OIG to update DMEPOS supplier corporate compliance guidance.

Response: We appreciate this suggestion but believe it is outside the scope of this final rule.

Comment: A commenter stated that if an AO disregards the quality standards during a survey and instead focuses on other regulations, the supplier should be able to report the AO to CMS.

Response: We appreciate this suggestion and will take it under advisement as we continue our efforts to strengthen CMS' DMEPOS accreditation program.

Comment: A commenter recommended that CMS tailor its accreditation oversight activities and regulatory provisions to those in part 488 regarding home infusion therapy suppliers.

Response: Though we appreciate this recommendation, we reemphasize that all provider and supplier types are different and that accreditation processes for one type may be unsuitable for another. It is more important that we establish DMEPOS accreditation requirements that address the specific characteristics of DMEPOS than to ensure that they match all those of another provider or supplier type. Nonetheless, and as previously noted, we considered the procedures outlined 42 CFR part 488 in developing our revisions to Sec. 424.58.

Comment: A commenter contended that some DMEPOS suppliers do not obtain their own NPI, surety bond, or accreditation for each practice location. Instead, they often submit claims using the NPI and PTAN of the supplier's main office or other supplier locations. The commenter stated that this: (1) undermines CMS's goal of ensuring that each location is independently accountable and compliant with Medicare standards; and (2) should result in stronger penalties against suppliers that submit claims using credentials from other locations.

Response: While we respectfully believe this comment is outside the scope of this rule, we appreciate the commenter's concerns and will take them under advisement.

Comment: Regarding proposed Sec. 424.58(e)(8), a commenter: (1) requested that CMS define “all supplier locations” (for instance, whether it include service locations only, warehouses, etc.); and (2) questioned whether this change eliminates the 90-day extension of accreditation for a new location added to an already accredited supplier organization.

Response: For purposes of Sec. 424.58(e)(8), the term “all supplier locations” means locations for which: (1) the supplier seeks accreditation or reaccreditation with the AO; and (2) the AO is required to perform a survey under Sec. Sec. 424.57 or 424.58. As noted previously, we are removing the 90-day temporary accreditation allowance from Sec. 424.57(c)(23).

Comment: A commenter supported our proposals to reduce inconsistencies between certain AOs.

Response: We appreciate the commenter's support.

Comment: A commenter specifically recommended that accreditation standards cover: (1) software change management; (2) security baselines; (3) incident/recall procedures that incorporate Unique Device Identifiers; and (4) verification that electronic user instructions provided to beneficiaries are accessible.

Response: We appreciate this comment. However, as we did not address revisions to the quality standards in the proposed rule, we believe the comment is outside the scope of this final rule.

Comment: To enhance insight into the proposed rule's DMEPOS provisions, a commenter requested that CMS share DMEPOS data on issues such as targeted states, supplier newness, accreditation organizations, supplier size, multi locations, poor survey outcomes, etc.

Response: We appreciate this suggestion. While we are respectfully uncertain as to context and extent of the requested data, we note that CMS regularly posts DMEPOS accreditation-related information and guidance at https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers/durable-medical-equipment-prosthetics-orthotics-supplies-dmepos). We will continue to do so as we implement our requirements.

Comment: A commenter stated that O & P suppliers should: (1) be certified by two particular AOs specified by the commenter; and (2) have its personnel meet certain education requirements. The commenter believed, in part, that this could prevent call centers from fraudulently billing Medicare.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter stated that CMS did not furnish evidence that: (1) DMEPOS AOs are failing in their functions; (2) the current system lacks safeguards against DMEPOS AO conflicts of interest, quality lapses, or improper supplier accreditation; (3) there are widespread deficiencies among existing AOs; and (4) current AO vetting and oversight practices are inadequate. The commenter added that our revisions to Sec. 424.58 (and our other provisions) did not account for patient access and supplier burden (including in rural or underserved areas). The commenter accordingly urged CMS to withdraw its changes to Sec. 424.58 and engage with stakeholders to identify targeted, evidence-based improvements that might be needed.

Response: We appreciate these comments but respectfully disagree. We indeed have seen deficiencies among the AOs, and, as previously explained, Sec. 424.58 contains numerous gaps that we believe hinder our AO oversight. (For example, there are no provisions regarding conflicts of interest.) We also discussed in the proposed rule: (1) the matter of patient access; and (2) the estimated supplier burden in the collection of information and regulatory impact analysis sections. As already noted, we believe our Sec. 424.58 proposals are necessary, though we will continue our communications with stakeholders as they are implemented.

Comment: A commenter stated that: (1) physicians should not be permitted to fit off-the-shelf devices; and (2) mailing orthotics to patients should be prohibited.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter requested that Post-Mastectomy Products/ Facilities be given their own prosthetic category, such as “Mastectomy Prosthetics and Products” as a unique specialty.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter stated that CMS should adopt a personnel standard requiring each supplier location to employ at least one individual holding the Certified Durable Medical Equipment Specialist (CDME) credential.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter stated that CMS should develop a specific list of issues that pose a serious risk of fraud, waste and abuse (such as prior instances of noncompliance) to identify requirements for annual reaccreditation.

Response: We appreciate this comment but believe it is outside the scope of this final rule.

Comment: A commenter stated that in lieu of some of our DMEPOS accreditation proposals, CMS could adopt the same monitoring system it uses to oversee hospices and HHAs.

Response: We appreciate this comment but are respectfully unclear as to the monitoring system to which the first commenter refers. We also restate that while our proposals mirror certain provisions in 42 CFR part 488, DMEPOS suppliers are entirely different from HHAs, hospices and must, accordingly, have unique accreditation requirements. 17. Final Provisions

After reviewing the comments received, we are finalizing all of our proposals without modification except as follows:

The proposed 2 calendar day timeframe for reporting immediately jeopardy situations to CMS will be changed to 2 business days.

We are not finalizing proposed Sec. 424.58(f)(2)(ii). Proposed Sec. 424.58(f)(2)(iii), (iv), and (v) will be redesignated and finalized as Sec. 424.58(f)(2)(ii), (iii), and (iv).

Although we did not receive comments on the matter, we also have decided not to finalize the proposed language in Sec. 424.58(e)(1)(i) that reads “no later than the last day of each month.” We will instead retain the language in the opening paragraph of Sec. 424.58(c)(1) (which we are redesignating as new paragraph (e)(1)(i)) that states “on a monthly basis”. This is because the monthly reports currently required under existing paragraph (c)(1) are not necessarily due at the end of each month.