On September 10, 2019, the US Dept. of Health and Human Services Centers for Medicare & Medicaid Services (CMS) published a Final Rule requiring Medicare, Medicaid, and Children’s Health Insurance Program (CHIP) providers and suppliers to disclose certain current and previous affiliations with other providers and suppliers. The Final Rule also expands CMS’ authority to deny or revoke a provider’s or supplier’s Medicare enrollment in certain specified circumstances. The Final Rule is effective November 4, 2019. CMS is accepting public comments until that time.

Required Disclosure

Under the Final Rule, providers and suppliers that are submitting an initial or revalidating Form CMS-855 application must disclose whether it, or any of its owning or managing employees or organizations, currently has, or within the previous five years, has had an affiliation with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider with any of the defined disclosable events.

Disclosable Events (§ 424.519)

  • Currently has an uncollected debt to Medicare, Medicaid, or CHIP regardless of: amount of debt, whether debt is currently being repaid, or whether debt is currently being appealed;
  • Has been or is currently subject to a payment suspension under a federal health care program;
  • Has been, or is excluded by the OIG, from participation in Medicare, Medicaid, or CHIP (regardless of appeal status); or
  • Has had Medicare, Medicaid, or CHIP enrollment denied, revoked, or terminated (regardless of appeal status).

Affiliation Defined As:

  • 5% or greater ownership interest that an individual or entity has in another organization;
  • General or limited partnership interest, regardless of percentage;
  • Having managerial or operational control, or directly or indirectly controlling the day-to-day operations of another organization (regardless of whether the managing individual or entity is a W-2 employee of the organization);
  • Acting as a director or officer of a corporation; or
  • Any reassignment relationship under § 424.80.


CMS has adopted a phased-in approach for the Final Rule. For now, providers and suppliers will not be required to disclose affiliations under § 424.519 unless CMS specifically requests it to do so. Once CMS updates its Form CMS-855 applications to include an affiliation disclosure section, providers and suppliers that have at least one affiliation involving a disclosable event will be required to report any and all affiliations upon initial enrollment or revalidation.

Expansion of CMS’s Authority

The Final Rule gives CMS authority to revoke or deny Medicare enrollment if the provider or supplier fails to fully and completely disclose affiliations that have or have had a disclosable event; or if CMS determines that any of the disclosed affiliations pose an undue risk of fraud, waste, or abuse. The factors that will be considered in order to make such a determination are:

  • Duration and extent of affiliation;
  • Whether the affiliation still exists or how long ago it ended;
  • Degree and extent of the affiliation;
  • Reason for termination of the affiliation;
  • The type of disclosable event, when it occurred, and whether the affiliation existed at the time;
  • For uncollected debt--amount, whether it is being repaid, and to whom it is owed;
  • For denials, revocations, terminations, exclusions or payment suspension—the reason for the action; and
  • Any other evidence that the state, in consultation with CMS, deems relevant.

The Final Rule also gives CMS the authority to revoke or deny a provider’s or supplier’s Medicare enrollment in the following circumstances:

  • The provider or supplier is currently revoked under a different name, numerical identifier, or business identity and the applicable reenrollment bar period has not expired;
  • The provider or supplier billed for services performed at, or items furnished from, a location that it knew or should reasonably have known did not comply with Medicare enrollment requirements (Note: revocation of provider’s or supplier’s Medicare enrollment may include all of the provider’s or supplier’s practice locations, regardless of whether they are part of the same enrollment);
  • The provider or supplier has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or fails to meet Medicare requirements;
  • The provider or supplier has an existing debt that CMS refers to the Dept. of Treasury;
  • An enrolled individual or entity fails to report changes to certain listed enrollment information within 30 or 90 days, depending on entity type and information involved;
  • Any owning or managing employee or organization of the provider or supplier has been placed on Medicare or Medicaid payment suspension;
  • The provider or supplier is currently terminated or suspended from participation in a state Medicaid program or any other federal health care program; or their license is currently revoked or suspended in a state other than that in which the provider or supplier is enrolling;
  • If the provider or supplier is revoked under § 424.535(a), CMS may revoke any and all of the provider’s or supplier’s Medicare enrollments; or
  • A provider or supplier voluntarily terminated its Medicare enrollment in order to avoid a revocation under § 424.535(a).

CMS’s changes to reenrollment and reapplication bar periods are as follows:

  • Increase the maximum reenrollment bar period from three years to 10 years;
  • CMS may add up to three more years to the reenrollment bar, even if doing so exceeds the 10-year maximum, if CMS determines that the provider or supplier is attempting to circumvent its existing reenrollment bar by enrolling in Medicare under a different name, numerical identifier, or business identity; and
  • CMS may impose a reenrollment bar of up to 20 years if the provider or supplier is being revoked for a second time.

Additional requirements outlined in the Final Rule are:

  • Physicians, suppliers, and eligible professionals are required to maintain documentation for all Part A and B services, items, and drugs for seven years from the date of service;
  • A physician or practitioner who was revoked due to a voluntary termination of enrollment in an attempt to avoid revocation by CMS may not order, prescribe, certify, or refer a beneficiary for Medicare-covered services, items, and drugs;
  • A provider or supplier cannot move an enrolled practice location inside a moratorium area. A temporary moratorium does not apply to any enrollment application received by the Medicare contractor prior to the date the moratorium is imposed; and
  • To reactivate Medicare billing privileges, deactivated providers and suppliers must recertify that their enrollment information is correct and furnish any missing information. CMS may also require that a new enrollment application be submitted.


The Final Rule creates increased responsibility on new and existing Medicare providers and suppliers to evaluate and report certain affiliations for enrollment and revalidation purposes. The risk of the penalties outlined by the Final Rule calls for increased diligence and awareness. Providers and suppliers should become familiar with the Final Rule and prepare to collect information related to their past and existing affiliations.