New Enrollment Regulations: Protect Your Current Medicare Participation

Health Law Alert Newsletter

Summer 2007

By: John J. Eller and Donna J. Senft

On April 21, 2006, the Centers for Medicare and Medicaid Services (CMS) published its final rule, "Medicare Program: Requirements for Providers and Suppliers to Establish and Maintain Medicare Enrollment," which made changes to the existing Medicare rules that significantly affect existing providers and suppliers, as well as new enrollees. Although providers and suppliers have always been required to comply with the Medicare enrollment rules, both for initial enrollment and on a continuing basis thereafter, the new rules require that at some point in the near future, every provider or supplier will need to have a complete CMS 855 form on record. The new requirements contain procedural safeguards for CMS to verify that a provider or supplier is compliant with the enrollment requirements, and also contain significant sanctions for non-compliance. Understanding and adhering to the requirements is, therefore, not only important for a provider or supplier to ensure that initial enrollment is expeditiously obtained, but also critical to help ensure that its Medicare enrollment remains activated without interruption or the imposition of sanctions.

The changes contained in the final rule, published just days before the end of the three-year time period to implement the proposed rule that was published on April 25, 2003, became effective June 20, 2006. They are the latest in a series of initiatives to strengthen the Medicare enrollment process to prevent initial or continued enrollment by unqualified or fraudulent providers or suppliers. Prior initiatives included contracting with the National Supplier Clearinghouse (NSC) regarding initial or continued enrollment of durable medical equipment, prosthetic, and orthotics suppliers (DMEPOS) and authorizing fiscal intermediaries and carriers to conduct site visits to verify if the provider or supplier was eligible to participate in the Medicare program.

Just as providers and suppliers were learning about the new requirements contained in the final rule, on May 1, 2006, CMS released revised enrollment forms (i.e., the CMS 855 series), used by providers and suppliers to apply for initial enrollment and to request changes to the enrollment file. A one-month grace period was established, with providers and suppliers required to use the new forms for any submission after June 2, 2006. The following are direct Internet links to the all of the new enrollment forms:

CMS 855A for Institutional Providers:

CMS 855B for Clinics/Group Practices and Certain Other Suppliers:

CMS 855I for Physicians and Non-Physician Practitioners:

CMS 855R for Reassignment of Medicare Benefits:

CMS 855S for DMEPOS Suppliers:

Key Provisions of the Final Rule

New Enrollment Forms Completion

From the inception of the CMS 855 forms in 1997, providers or suppliers who were already enrolled in the Medicare program did not have to complete and submit the entire CMS 855 application form. With the release of the new versions of the CMS 855 forms, CMS will require all providers and suppliers-even those that have already enrolled in the Medicare program and obtained billing numbers-to submit a completed enrollment application on the applicable new form.

By requiring all providers and suppliers to complete a CMS 855 enrollment form, the Provider Enrollment, Chain, and Ownership System (PECOS) database will be more comprehensive. CMS developed PECOS following a policy decision to create a national, uniform electronic database for recording and retaining enrollment data to combat fraud and abuse. In July 2002, fiscal intermediaries began entering enrollment data for Medicare Part A providers into the system, with carriers following in November 2003, entering data on Part B providers and suppliers.

The final rule did not indicate the timing or discuss the process that will be used to notify previously enrolled providers or suppliers that they will need to complete and submit a CMS 855 form. The Medicare enrollment contractors are suggesting the completion of the entire form when a provider or supplier needs to make changes to its provider or supplier file, even though this completion may be well in advance of the requirement to do so.

Historically, Medicare enrollment contractors would often accept an enrollment application that was missing certain required information or documentation. The new procedures require the Medicare contractors to use an initial screening process which identifies omissions requiring an automatic rejection of the application. Any rejection and return of the application further delays an already lengthy time period to complete the initial enrollment process.

Another new requirement is that any provider or supplier who submits new enrollment applications or enrollment forms to report changes will need to not only indicate its National Provider Identifier (NPI) number, but also, provide verification of the NPI number in order for the enrollment or change forms to be processed. The Health Insurance Portability and Accountability Act (HIPAA) required the adoption of a standard unique health identifier for health care providers. CMS adopted the NPI number as this unique identifier but previously indicated that covered entities would not need to use this identifying number until May 23, 2007. As a result of the advanced notice and delayed implementation date, providers and suppliers may not previously have seen the need to obtain an NPI number as a priority.

As of May 1, 2006, providers and suppliers are able to obtain an NPI number through an online process or the submission of a paper application. Either process is fairly efficient with a number assigned in just days. More information about obtaining an NPI number is available on the CMS website at:

Although the prior version of the CMS 855 forms could be completed electronically, CMS has not provided software to complete the new version of the CMS 855 forms electronically. CMS has indicated its intent to have a Web-based enrollment process operational in 2007.

The new CMS 855 forms continue to be very far-reaching in the scope of information to be reported initially and to be updated in a timely fashion as changes occur. This is particularly true with respect to ownership and control information, which is relevant to CMS' principal concern to protect Medicare beneficiaries from unqualified or fraudulent providers and suppliers. For example, providers and suppliers who enroll in the Medicare program are required to disclose information about individuals or entities that have either a five percent or more direct or indirect ownership interest or a controlling interest in the provider or supplier entity. Even a lending institution with a secured interest in the provider's or supplier's property or assets (e.g., with a mortgage, deed of trust or note) may be considered to have an "ownership or controlling interest" for these purposes. In the case of a corporation, officers and members of the governing board (e.g., the board of directors or board of trustees) are considered to be among those with a controlling interest. The officers include not only those listed in the articles of incorporation or corporate bylaws, but also officers named by the governing board. Therefore, within 30 days of a change in an officer or member of the governing board, updated forms must be submitted to report the officer or board member being removed and the officer or board member being added. Other frequent types of changes that require timely reporting include a change in legal or trade names, addition of practice locations, and changes in managing employees.

Sanctions for Failure to Provide Timely Updates

Included in the regulations are specific time frames for submitting updated enrollment forms. Within 30 days of any change in ownership or control for any provider or supplier, or any reportable change for a DMEPOS supplier, updated enrollment forms must be submitted. For all other reportable changes, updated enrollment forms must be submitted within 90 days following the effective date of the change.

CMS has stated its intention to require deactivation for failure to report changes in a timely manner, which may even result in revocation of the provider's or supplier's billing privileges. Deactivation is the temporary suspension of billing privileges. Although billing is suspended, the deactivation does not have any effect on the provider or supplier agreement. Specific procedures for reactivating a provider number, including the submission of a new CMS 855 enrollment application, are included in the new regulations. Reactivation in those circumstances will not require a new survey or certification.

When billing privileges are revoked, the provider or supplier agreement is also terminated. Additionally, when a revocation occurs, CMS will automatically review any related Medicare enrollment file. For example, if a reported owner (i.e., 5% or greater ownership interest) is also an owner or a person in control of another Medicare enrolled entity, CMS will review the revocation to see if it warrants an adverse action for the associated provider or supplier (i.e., associated in this case by a person with ownership in both enrolled entities.)

Revalidation Process

CMS has developed a procedure to allow it to determine if updated information has been promptly submitted. Under the new regulations, CMS has established a five-year cycle for revalidation, with the ability to perform an "off cycle" revalidation if conditions so warrant. The revalidation process will be an opportunity to ensure that a provider or supplier has remained in compliance with Medicare requirements. In addition to confirming the validity of the enrollment information submitted through the revalidation process, CMS reserves the right to perform unannounced site visits to verify enrollment information. Revalidation is designed to protect beneficiaries and the Medicare trust fund by ensuring services are received from legitimate providers and suppliers.

CMS does not expect the revalidation activities to be significant until 2008, and has not yet announced how providers and suppliers will be chosen to enter into the 5-year cycle, though the first revalidation efforts will focus on providers or suppliers who never previously submitted a complete CMS 855 form. CMS has indicated that the first priority for enrollment contractors should be to process new enrollment applications. Such prioritizing of effort is intended by CMS to address the concern expressed by providers and suppliers regarding the ability of the Medicare enrollment contractors to handle the increased workload. In its final rule, CMS announced the intent to conduct approximately 500 on-site visits to Community Mental Health Centers and 2,800 annual visits to Independent Diagnostic Testing Facilities.

Once the revalidation process becomes established, the burden on providers and suppliers should be relatively minimal. CMS has indicated its intent to send the provider's or supplier's current CMS 855 form on record to the provider or supplier, to verify the accuracy of the information and report any changes to be made regarding the information in the enrollment file.

Initial Enrollment

The new regulations delineate situations in which the initial enrollment application may be rejected. If the application is submitted with missing information and any missing information or requested supporting documentation is not submitted on time, the application will be rejected and the applicant will need to restart the enrollment process. There are no appeal rights granted when an application is rejected.

Additionally, an entity may be denied enrollment or have its enrollment revoked when individuals with ownership or controlling interests have been sanctioned or convicted of certain federal or state crimes. The new regulations delineate the specific offenses, such as exclusion sanctions, that will result in an automatic rejection or revocation, and other offenses that may result in rejection or revocation because the offense has been determined to be detrimental to the best interests of the Medicare program or its beneficiaries.

Enrollment may be denied if there is a determination, based upon the on-site review or other reliable evidence, that the provider or supplier is not in compliance with the Medicare requirements. Appeal rights are granted in this situation. If, however, the decision is appealed, then a new application may not be submitted until a decision is made to uphold the original determination. If the provider or supplier elects not to appeal the decision, a new application may be submitted when the time frame to appeal has lapsed.

Change of Ownership

Consistent with prior requirements, if a change of ownership involves providers, both the buyer and seller need to submit provider enrollment application information. Under the new regulations, the seller risks sanctions if it fails to complete the enrollment materials prior to the change in ownership. When the seller agrees to assign and the buyer agrees to accept the assignment of the seller's provider number, the new regulations allow for deactivation of the billing number any time before the final transference of the provider agreement to the buyer, if the buyer fails to submit what is required within 30 days of the change of ownership. With respect to a change of ownership or control involving suppliers, appropriate CMS 855 forms must be submitted within the 30 days immediately following the change.


It is strongly advisable to become familiar with the new CMS 855 forms, the information required to be reported using these forms, and the supporting documentation to be sent to CMS. This is certainly important for new providers or suppliers, and existing providers and suppliers when they are called upon to complete the CMS 855 form for the first time as part of the revalidation process, or as part of a change of ownership transaction. It is particularly important for existing providers and suppliers who have never completed a CMS 855 form and have changes that would require updating the enrollment file. Existing providers, especially those not familiar with the CMS 855 process, may not be aware that they are required to report certain changes that occur during the ordinary course of conducting their business affairs. Any changes in the categories of information required on these forms,even if the forms had never previously been submitted, and the provider or supplier had never previously reported such information to CMS-must now be reported using the new forms. If unfamiliar with the reporting requirements, a provider or supplier may not realize the broad scope of information that CMS requires to be maintained in its enrollment files and used by CMS for its monitoring activities, and that a failure to properly report any changes in that information using the CMS 855 form creates a risk of being subject to serious sanctions. Providers and suppliers should develop a clear understanding of what is legally required to complete the CMS 855 forms, use them to report changes appropriately, and obtain assistance as necessary in this regard to help assure compliance or deal with regulatory authorities. This will allow providers and suppliers to avoid delays in processing and initial activation, but more importantly to minimize the potential for deactivation of their Medicare number, revocation of billing privileges, further adverse consequences to the provider or supplier, or adverse consequences to other Medicare-enrolled entities having common ownership with the provider or supplier.

This article, published in the September 2006 issue of Compliance Today, appears here with permission from the Health Care Compliance Association. Please call HCCA at 888/580-8373 with reprint requests.

home  | e-mail  |  print


Subscribe to our Newsletters