CMS Proposes Sweeping Changes to Medicare Revocation and Enrollment Rules

The Centers for Medicare and Medicaid Services (CMS) wants more authority to revoke your Medicare billing privileges – including retroactive revocations, expanded (and easier to prove) grounds for revocation, and less time for providers to respond afterward.

On July 6, 2026, CMS published a proposed rule that would rewrite significant parts of the Medicare provider enrollment framework. If finalized, nearly every revocation would become retroactive, several new grounds for revocation and denial would take effect, and the window to submit claims after a revocation would shrink from 60 days to 15.

Following the federal rulemaking process, CMS published its proposed rules in the Federal Register and opened the proposal for public comment. Anyone – providers, associations, individuals – can submit input during this window, which closes at 5 p.m. EDT on August 31, 2026.

A note on terminology: CMS uses "provider" as shorthand for both providers and suppliers enrolled to bill Medicare – whether that’s an individual or an entity. This article adopts that usage unless otherwise noted.

Almost Every Revocation Would Become Retroactive

Right now, some revocations take effect 30 days after CMS mails its notice. Others, such as those tied to a license revocation or a felony conviction, are already retroactive to the date the problem started. CMS wants to eliminate the 30-day version almost entirely.

Under the proposed rule, a revocation would generally take effect on the date the underlying problem began, not the date CMS catches it. If a provider misses a routine deadline to report a change of address, for example, the revocation would reach back to the day after that deadline passed, not the day CMS mails the letter.

The catch: a retroactive effective date means Medicare paid you during a period when you were not entitled to payment. That opens the door to recoupment of everything paid in the interim, on top of the revocation itself.

New Grounds for Revocation and Denial

CMS is proposing several new triggers:

1. Geographic over-saturation. CMS could revoke or deny enrollment if a provider is in an area with an excessive concentration of providers and suppliers, not necessarily of the same type, that CMS deems a high risk for fraud, waste, or abuse. No finding of actual fraud is required, and CMS has declined to set a specific distance or headcount threshold.
2. Certain misdemeanor convictions. A misdemeanor conviction for sexual assault or financial misconduct within the past 10 years, for the provider or any owner, officer, director, or managing employee, would become grounds for revocation or denial.
3. Sharing a suite with a revoked or denied provider. CMS could deny enrollment if a provider's practice location is the same suite or office as another provider whose enrollment was revoked or denied.
4. Enrolling under another party's identity. A new denial ground would target providers who attempt to enroll using someone else's identity, mirroring an existing revocation ground for providers who sell or lend their billing number.
5. The 36-month rule for home health agencies, hospices, and DMEPOS suppliers. CMS wants to create a new ground to deny or revoke enrollment when providers structure a sale or management arrangement specifically to avoid triggering the required 36-month ownership hold.

CMS Wants to Loosen Restrictions on the Grounds It Already Has

Beyond new grounds, CMS wants to loosen the constraints on several revocation reasons it already uses:

1. Abuse of billing privileges. CMS currently has to weigh specific factors, like a provider's history of prior sanctions and the percentage of denied claims, before revoking for a pattern of non-compliant billing. CMS wants to drop those required factors entirely, arguing they make it too hard to act against first-time offenders and high-volume billers with a low denial rate.
2. False or misleading information. Today, this ground is limited to information submitted on an enrollment application, and only if certified as true. CMS wants to expand it to cover any enrollment-related document, including things like electronic funds transfer forms, regardless of why the information was submitted or whether it was formally certified.
3. Extending revocation to a provider's other enrollments. CMS can currently reach a provider's other Medicare enrollments only when one of them is revoked. The proposed rule would let an enrollment denial trigger that same authority, meaning a provider with several active enrollments could lose all of them because one new application was denied.
4. Program termination and license action. Right now, CMS can deny enrollment or revoke a provider's Medicare enrollment if that specific provider was terminated from Medicaid or another federal health program or had their medical license suspended or revoked. Under the proposal, CMS would also look at the people and entities connected to the provider, specifically owners, managing employees, and managing organizations. This means that if a physician group is enrolled in Medicare, and one of its owners or managing employees was separately terminated from Medicaid, or had their own license suspended, that could now become grounds to revoke the entire group's Medicare enrollment.
5. Voluntary license surrenders. CMS also wants to treat a license surrendered voluntarily to avoid discipline the same as a suspension or revocation imposed after a hearing.
6. A broader definition of "managing employee." CMS wants to explicitly add medical directors, clinical directors, department heads, supervising physicians, nursing directors, alternate administrators, and other clinical staff to the definition of managing employee. A broader definition means that more people with license problems, debts, or convictions could threaten the provider's enrollment.
7. Existing Medicare debt could block enrollment for more than just owners. CMS can already deny a new enrollment application if the provider or an owner has unpaid Medicare debt, or previously owned a provider that had Medicare debt when its enrollment ended. CMS wants to extend that ground to managing employees, managing organizations, and anyone else with a business or financial relationship with the provider.
8. A payment suspension anywhere in your business could block a new enrollment. CMS can already deny enrollment when the provider, or an owner or managing employee, is under a Medicare or Medicaid payment suspension. The proposal would extend that ground to anyone with a business or financial relationship with the provider, closing what CMS sees as a workaround: parties quietly stepping back from an ownership or management role to dodge the current definition.

CMS Wants a Stricter Definition of "Operational"

Every enrolled provider already has to be "operational" to hold Medicare billing privileges. CMS wants to spell out, for the first time, exactly what that means.

Under the proposal, being operational would also require:

• A location accessible to patients, including compliance with the Americans with Disabilities Act
• Hours sufficient to regularly serve patients, and the ability for beneficiaries to find the provider through public information
• Staff who are properly licensed or certified, equipment that's functional and adequate for the services offered, and medications in sufficient supply
• Written policies covering patient care, patient safety, recordkeeping, and general administration

Falling short of this operational requirement would trigger revocation on the grounds of noncompliance with enrollment requirements – one of more than 20 grounds CMS currently has to revoke billing privileges.

The Consequences Are Getting Steeper

Three changes raise the stakes for anyone who is revoked or denied:

• A longer reapplication bar for any reason. CMS can currently impose a reapplication bar of up to 10 years, but only for denials based on false or misleading information. The proposed rule would let CMS impose that same 10-year bar regardless of why the application was denied.
• A broader preclusion list. CMS wants to extend Medicare Advantage and Part D preclusion list placement to felony convictions against a provider's owners, managing employees, officers, or directors, not just the enrolled provider.
• A shorter claims window. Providers currently have 60 days after a revocation's effective date to submit claims for services already furnished. CMS wants to cut that to 15 days, measured from the date of the revocation letter rather than the effective date.

One Change Would Work in Providers' Favor

Not every proposed change makes enrollment harder for providers. CMS wants to let providers file a corrective action plan after an enrollment denial, not just a revocation. Today, that option only exists after a revocation for noncompliance.

Under the proposal, a provider whose new application is denied for a similar compliance problem could also submit a corrective action plan to fix the issue and get the application approved, instead of restarting the enrollment process.

Who This Hits Hardest

Home health agencies, hospices, and DMEPOS (durable medical equipment, prosthetics, orthotics, and supplies) suppliers face additional exposure beyond the general changes above. CMS is proposing hospice-specific denial grounds for medical directors or administrators who serve at multiple hospices, are located too far from the facility to perform their duties, or lack an active license in the state where they practice. Reactivating hospices would also need to undergo a new state survey or accreditation.

Providers involved in ownership changes or private equity transactions should also take note. CMS wants to remove the current five-year lookback limit on affiliation disclosures, meaning old affiliations would need to be reported no matter how long ago they occurred. CMS also wants to broaden what counts as a reportable affiliation by adding a catch-all category for any marketing, business, fulfillment, financial, managerial, or beneficiary relationship.

CMS gave this example: A provider’s relationship with a marketing firm that was tied to four revoked DMEPOS suppliers would count as a reportable, and potentially disqualifying, affiliation under the proposed rules.

Separately, CMS wants to require disclosure of private equity companies and real estate investment trusts on several enrollment forms.

What Providers Should Do Now

The rule is not final, but the direction is unmistakable, and the comment period is the only window to influence it before it is. Providers should:

• Confirm every enrollment on file is current and accurate, including addresses, ownership, and managing employees.
• Check whether any owner, officer, director, or managing employee has a misdemeanor conviction in the past 10 years that could now become relevant.
• Review affiliations that would fall outside the current five-year lookback, or that would newly qualify under the broader definition if that expansion goes through.
• Walk your practice location, staffing, and written policies through the proposed operational standard to identify any gaps.
• If your organization is a home health agency, hospice, or DMEPOS supplier, confirm 36-month rule compliance on any recent or pending ownership change.
• Submit comments to CMS by August 31, 2026, if the proposed rule would affect your practice.

Frequently Asked Questions

Is this rule final?

No. It was proposed on July 6, 2026, and CMS is accepting public comments through August 31, 2026. CMS could revise, narrow, or finalize the proposal largely as written.

Does this apply to my provider type?

Most of the changes described here apply to all Medicare-enrolled providers and suppliers. A smaller set, including the 36-month rule and the hospice medical director provisions, applies specifically to home health agencies, hospices, and DMEPOS suppliers.

What should I do if I've already received a revocation notice?

This proposed rule does not change your current deadlines. If you have received a Medicare revocation notice, your response window is running now under the existing rules.

If you've received a revocation or denial notice, or if your organization needs to assess its exposure under this proposed rule, our healthcare regulatory attorneys can help. Call (713) 783-3110 or contact us online.