Providers and suppliers participating in the Medicare program should take note of new requirements and compliance considerations related to Medicare enrollment, information updates, changes of ownership, and increased risk for revocation, set to take effect on January 1, 2026. The most consequential changes are found in the CY 2026 Home Health Agency Prospective Payment System (HH PPS) final rule (“Final Rule”), which was published on December 2, 2025.[1] In this Final Rule, Centers for Medicare & Medicaid Services (“CMS”) finalized substantial expansions to its authority to retroactively revoke enrollment for all types of Medicare providers and suppliers, including hospitals, hospices, and home health agencies to physician practice groups and DMEPOS suppliers related to Medicare enrollment and compliance deficiencies. CMS also shortened reporting deadlines and broadened its ability to suspend enrollment during investigations. These changes apply across all Medicare provider and supplier types and significantly tighten compliance expectations. The Final Rule further introduces targeted revisions for Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (“DMEPOS”) suppliers, including expansion of the Medicare 36-month rule and increased survey and reaccreditation frequency.
Retroactive Revocation for Medicare Enrollment Deficiencies
CMS finalized a significant expansion of its authority to apply revocations retroactively related to Medicare enrollment requirements. Generally, a revocation becomes effective prospectively—that is, 30 days after CMS or its contractor mails notice of its determination to the provider or supplier. But in limited circumstances, CMS can give the revocation retroactive effect, allowing CMS to recoup monies for claims that have been paid to the provider with dates of services beginning on the initial date of non-compliance.
Under the Final Rule, CMS may deny or revoke enrollment based on false or misleading information in an enrollment application or record. This revocation will be retroactively effective beginning on the date the provider signed the application’s certification statement. In the Final Rule commentary, CMS declined to add a materiality standard for the false or misleading information, but it did note revocations are typically not imposed for minor, unintentional errors. CMS also amended regulations to specify that, with regard to information provided to CMS, “all providers and suppliers are legally responsible for the accuracy, completeness, and truthfulness of all information they provide on or with their applications, regardless of whether another party completed the application.” This language emphasizes CMS’s ability to permit revocation or denial under 42 C.F.R. §§ 424.535(a)(4) and 424.530(a)(4) if the provider or supplier certified as ‘‘true’’ misleading or false information on the enrollment application, even if another party prepared and submitted the information to CMS.
In addition, the Final Rule gives CMS authority to retroactively revoke enrollment if a provider failed to timely report: a change of ownership; an adverse legal action; or the addition, deletion or change of a practice location. The effective date of the retroactive revocation will be the day after the date by which the provider was required to report the change, addition or deletion. CMS further clarified that if it revokes a provider’s enrollment, it may revoke all of the provider’s other enrollments. The effective dates of the additional revocations would be the effective date of the offense triggering the original revocation.
Importantly, this revocation authority is not limited to instances of intentional misconduct. Thus, even an inadvertent, administrative oversight could result in revocation reaching back months or years, creating substantial overpayment obligations for every claim paid during that period. The Final Rule heightens transactional risk and the importance of due diligence as it relates to a Seller’s current Medicare compliance because failures by a Seller to timely update Medicare enrollment records may be grounds for retroactive revocation, converting otherwise valid claims from the pre-closing period into Medicare overpayments. Providers, suppliers, and deal teams should review CMS enrollment records now to ensure they are accurate and up to date, as the retroactive revocation authority in particular could transform minor administrative oversights into major overpayment obligations and operational disruptions.
Stay of Enrollment
The Final Rule expands CMS’s “stay of enrollment” authority, allowing the agency to hold enrollment applications in suspense during investigations into potential noncompliance. Additionally, the Final Rule shortens the reporting deadline for adverse legal actions. Providers and suppliers must now report adverse legal actions imposed against the provider or supplier, its owners, or its managing employees within 30 days, which was reduced from 90 days.
Medicaid Provider Termination Clarification
The Final Rule includes a technical correction to Medicaid and CHIP enrollment and termination provisions, clarifying that when a provider is terminated or disenrolled from Medicare or from another state’s Medicaid or CHIP program, the state Medicaid agency where the provider is enrolled must also terminate that provider’s enrollment. This revision is intended to remove ambiguity in the current regulation and ensure consistent enforcement across provider types.
Increased Survey Frequency for DMEPOS Suppliers
The Final Rule revised 42 C.F.R. § 424.57(c)(24) requiring DMEPOS suppliers to be surveyed and reaccredited at least once every 12 months, which is much more frequent than the current 3-year cycle. CMS warns that suppliers must always remain fully prepared for survey and should not base the timing of its compliance with the quality standards on when it predicts the next survey will occur, as suppliers may receive surveys at different times, and possibly more than once, during a 12-month survey period. CMS moved forward with adopting this requirement despite stakeholder concerns about significant operational, administrative, and financial burdens on DMEPOS suppliers due primarily to more frequent accreditation fees, more reaccreditation paperwork and having to devote more staff time and resources to surveys and reaccreditations and the supplier’s preparations for them.
Increased survey frequency may also increase opportunities for revocation, as CMS has the right to revoke DMEPOS supplier enrollment if CMS determines that they are not in compliance with the DMEPOS quality standards.[2]
Extension of Medicare 36-Month Rule to DMEPOS Suppliers
The Final Rule extended the Medicare “36-Month Rule” to all DMEPOS suppliers. The rule previously applied only to home health and hospice agencies. However, effective January 1, 2026, if a majority ownership of a DMEPOS supplier changes by sale (including asset sale, stock transfer, merger and consolidation) within 36 months of the DMEPOS supplier’s Medicare enrollment or prior change of majority ownership, the Medicare billing privileges will not be conveyed to the new owner. The prospective provider/owner of DMEPOS supplier must instead enroll in the Medicare program as a new DMEPOS supplier and obtain a new accreditation from a CMS-approved DMEPOS accrediting organization, which creates significant gaps in payment for a supplier between the effective date of the transaction and when new enrollment is established.
There are four primary steps to follow to determine whether the 36-Month Rule applies to a DMEPOS supplier transaction:
- Step 1: Determine whether a change in direct ownership has occurred. The 36-Month Rule does not apply to “indirect” ownership changes.
- Step 2: Determine whether the change involves a party assuming a greater than 50 percent ownership interest in the DMEPOS supplier.
- Step 3: Determine whether the effective date of the transfer is within 36 months after the effective date of the DMEPOS supplier’s initial enrollment in Medicare or most recent change in majority ownership. If the effective date of the transfer does not fall within either of the aforementioned 36-month periods, the 36-Month Rule does not apply.
- Step 4: Determine whether any of the following exceptions apply: (1) the DMEPOS supplier’s parent company is undergoing an internal corporate restructuring, such as a merger or consolidation; (2) the owners of an existing DMEPOS supplier are changing the DMEPOS supplier’s existing business structure (for example, from a corporation to a partnership (general or limited); from an LLC to a corporation; from a partnership (general or limited) to an LLC) and the owners remain the same; or (3) the individual owner of the DMEPOS supplier dies
The expansion of the 36-month rule to DMEPOS suppliers introduces additional regulatory consideration for any healthcare transaction that involves Medicare enrollment of a DMEPOS supplier. Deal teams should carefully consider provider enrollment information during diligence, and, if applicable, the rule may impact the timing of closing and structure of the transaction.
Final Thoughts
CMS indicated in its commentary to the Final Rule that these changes are necessary to ensure payments are made only to qualified providers and suppliers, which CMS believes will help protect both Medicare funds and beneficiaries. As finalized, these reforms significantly alter compliance obligations and increase operational and transactional risks for Medicare providers and suppliers. Given the heightened requirements and risks, awareness of these changes, along with proactive planning and seeking experienced legal counsel, are essential strategies for successfully navigating this evolving regulatory landscape.
FOOTNOTES
[1] Medicare and Medicaid Programs; Calendar Year 2026 Home Health Prospective Payment System (HH PPS) Rate Update; Requirements for the HH Quality Reporting Program and the HH Value-Based Purchasing Expanded Model; Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Competitive Bidding Program Updates; DMEPOS Accreditation Requirements; and Other Medicare and Medicaid Policies, 90 Fed. Reg. 55342 (Dec. 2, 2025) (CMS-1828-F).
[2] 42 C.F.R. § 424.57(c)(24)