Expansions of the Medicare Revocation Rules are on the Horizon

/ Medicare, Medicaid & Private Payor Updates, Other / By

(July 23, 2026): On July 6, 2026, the Centers for Medicare & Medicaid Services (CMS) published a Proposed Rule that was extraordinarily broad in its scope, covering topics ranging from the Home Health Prospective Payment System to the Medicare Enrollment Rules.[1] This article focuses on CMS’s proposed expansion of Medicare’s existing enrollment enforcement authorities, particularly regarding enrollment, re-enrollment, and billing privilege revocation actions. We have reviewed the proposed changes, analyzed their relationship to existing Medicare revocation authorities, and evaluated the practical consequences of CMS’s latest proposed enforcement enhancements.

I. The Existing Medicare Revocation Framework:

Medicare & Medicaid Services (CMS) exercises administrative authority to revoke the Medicare billing privileges of providers and suppliers under 42 C.F.R. § 424.535.

Over the past two decades, CMS’s administrative revocation authority has developed incrementally, largely through a series of enrollment regulations that transformed Medicare participation from a payment-status issue into a broader program-integrity enforcement tool. Prior to 2006, CMS did not yet have the freestanding revocation structure now codified at 42 C.F.R. § 424.535. Instead, its ability to cut off participation depended primarily on existing enrollment and payment-eligibility provisions in 42 C.F.R. Part 424 and related provider-agreement termination and exclusion mechanisms.

The first major expansion of CMS’s administrative revocation authorities came when the agency issued its 2006 Final Rule on provider and supplier enrollment. This expansion laid the foundation for today’s revocation actions by: making compliance with Medicare enrollment requirements an affirmative condition of billing; authorizing revocation where a provider or supplier was excluded, debarred, or suspended from another federal program; requiring timely updates to enrollment information; and strengthening CMS’s authority to conduct inspections and site visits. In practical terms, the 2006 Final Rule established the regulatory architecture that CMS and its contractors would later rely upon to deny or revoke billing privileges for enrollment-related noncompliance rather than merely addressing claims after payment.[2]

CMS’s revocation framework expanded significantly again in 2014, when the agency added the now-prominent “pattern or practice” basis for revocation under 42 C.F.R. § 424.535(a), allowing CMS to revoke billing privileges where a provider repeatedly submitted claims that did not meet Medicare requirements. CMS indicated that this determination would depend on factors such as the percentage and reasons for claim denials, the provider’s adverse-action history, and the duration of the conduct, while also acknowledging that isolated billing errors should not alone justify revocation and that fully overturned denials should not count in the analysis.[3]

Subsequent rulemakings in 2019, 2023, and 2025 continued to broaden CMS’s administrative revocation arsenal. The 2019 final rule added authorities such as revocation based on risky affiliations, billing from noncompliant locations, and false or misleading enrollment information.[4] The 2023 final rule further expanded revocation for broader enrollment noncompliance, added False Claims Act civil judgments as a basis for revocation, and extended revocation consequences to certain supplier-standard violations.[5] Most recently, the 2025 final rule clarified that state action affecting prescribing authority can support revocation, added beneficiary attestations that services were not furnished as a form of billing-abuse revocation, and expanded CMS’s ability to impose retroactive revocation effective dates.[6]

Taken together, these developments show a clear historical trend: CMS administrative revocation actions have evolved from a narrow enrollment-enforcement tool into a far more aggressive and flexible mechanism for policing billing conduct, ownership and affiliation risks, licensure-related issues, and broader program-integrity concerns.[7] Despite the fact that CMS’s revocation authorities have greatly expanded over the last 20 years, the agency is now seeking to further enhance its ability to revoke a provider’s Medicare billing privileges.

II. The Proposed Rule’s Primary Changes to Medicare’s Revocation Authorities:

Earlier this month, CMS published a Proposed Rule in the Federal Register titled “Calendar Year 2027 Home Health Prospective Payment System (HH PPS) Rate Update; Requirements for the HH Quality Reporting Program and the Expanded HH Value-Based Purchasing Model; Medicare Provider Enrollment, Durable Medical Equipment (DME), and DME, Prosthetics, Orthotics, and Supplies (DMEPOS) Policies.” [8] Among its various provisions, the Proposed Rule includes a wide range of changes to existing administrative revocation rules and introduces several new bases for revoking a provider’s Medicare billing privileges. The proposed rule’s primary changes to Medicare’s revocation authorities are discussed below.

1. Proposed Changes to “Abuse of Billing Privileges” (42 C.F.R. § 424.535(a)(8)(ii))

Currently, when CMS determines that a provider has a pattern or practice of submitting claims that fail to meet Medicare’s requirements, the agency considers the following factors:

  1. The percentage of submitted claims that were denied during the period under consideration;[9]
  2. Whether the provider or supplier has any history of final adverse actions and the nature of any such actions;[10]
  3. The type of billing non-compliance and the specific facts surrounding said non-compliance (to the extent this can be determined);[11] and
  4. Any other information regarding the provider or supplier’s specific circumstances that CMS deems relevant to its determination.[12]

CMS is now proposing to “remove” all four of the factors set out under 42 C.F.R. § 424.535(a)(8)(ii)(A)-(D). In support of this change, CMS argues that “our existing factors often constrain our ability to effectively address all these factual scenarios.” The agency essentially argues that if it is not constrained by these factors, it will have the maximum flexibility it needs to pursue removal actions without having to address the “rigid constraints of [the] existing factors.”[13]

After handling a multitude of “abuse of billing privileges” revocation cases, we have observed that the existing factors have not been a significant hurdle for the agency in revoking a provider’s billing privileges. For instance, several providers we have represented found their billing privileges revoked following just one investigation of under ten claims. Nevertheless, the factors have presented a framework of points that the agency should consider before taking this adverse administrative action. Removing these modest guardrails from the regulations will effectively permit CMS to decide whether an abuse of billing privileges has occurred without any real evidence that such conduct has taken place.

2. Proposed Changes to “False or Misleading Information” (42 C.F.R. § 424.535(a)(4)).

Under the current rule, CMS can revoke the billing privileges of a Medicare provider or supplier if the entity certified false or misleading information as “true” on an enrollment application. CMS is now proposing to revise 42 C.F.R. § 424.535(a)(4) to allow the agency to revoke the billing privileges of a Medicare-enrolled provider or supplier based on the submission of false or misleading information “on or associated with any CMS or Medicare enrollment-related form (including enrollment-related forms created by and/or submitted to CMS contractors). This would also include false or misleading documentation furnished as part of the completion or submission of the CMS or Medicare enrollment-related form.” As CMS further noted, “We believe that our § 424.535(a)(4) expansion would help ensure that providers furnish truthful and accurate enrollment-related data to Medicare.”[14]

From a practical standpoint, this change will expand the scope of a provider’s revocation risk when applying for enrollment or reenrollment in the Medicare program. Providers must ensure that all of the information submitted to CMS and its contractors is complete and accurate. This is especially important if the provider or supplier has relied on a third party to assist with the enrollment process. We recommend that providers review all information to be submitted on their behalf prior to submission.

3. Proposed Changes to “Extension of Revocation” (42 C.F.R. § 424.535(i)).

42 C.F.R. § 424.535(i) currently states that if a provider’s or supplier’s enrollment is revoked under 42 C.F.R. § 424.535(a), the agency can “revoke any and all of the provider’s or supplier’s Medicare enrollments, including those under different names, numerical identifiers or business identities and those under different types.”[15] As currently written, if CMS denies a new or additional enrollment application under 42 C.F.R. § 424.530(a), the supplier’s existing enrollments may remain untouched, even if the facts underlying the denial raise the same program-integrity concerns. The agency perceives this as a potential gap in enforcement. If finalized as proposed, CMS will be able to revoke other enrollments when one of a supplier’s applications has been denied or revoked. In substance, the proposed change would eliminate the distinction between a revocation-based trigger and a denial-based trigger for purposes of cross-enrollment enforcement.

CMS now proposes to expand the scope of 42 C.F.R. § 424.535(i) to allow the agency to also revoke a provider’s or supplier’s other enrollments if the provider’s or supplier’s triggering enrollment is denied under 42 C.F.R. § 424.530(a). In explaining this proposal, CMS provided the following example:

“Suppose Supplier X has three separate enrollments. It submits a fourth application for a new supplier site. The application is denied because CMS discovers that - (1) the new site is actually a false storefront; and (2) X furnished misleading information on its application. Although this conduct reflects on Supplier X as a whole, we could not take action against X’s other enrollments under existing § 424.535(i), since the fourth enrollment was denied rather than revoked.” [16]

Although CMS reiterates that the agency’s decision to revoke a provider’s or supplier’s other enrollments would be discretionary, not automatic, this proposed change would effectively place the financial viability of a company with multiple enrolled entities at risk every time an application for enrollment or reenrollment is submitted to CMS or its contractors. Once again, it will be essential that any Medicare enrollment applications are comprehensively reviewed for completeness and accuracy prior to submission.

4. Proposed Change to “Expansion and Reorganization of Retroactive Revocation Grounds” (42 C.F.R. § 424.535(g)).

CMS’s existing retroactive revocation authority is limited to specific grounds. Under the current text of 42 C.F.R. § 424.535(g), the default rule is that a revocation becomes effective 30 days after CMS or its contractor mails the revocation notice, but the regulation expressly authorizes earlier, retroactive effective dates for specified revocation bases.

CMS has proposed to broaden the agency’s authority to impose retroactive revocation effective dates across all revocation bases under 42 C.F.R. § 424.535, rather than limiting retroactive activity to selected revocation grounds. The practical effect of this change is that CMS will be able to seek recoupment for claims paid during a retroactive revocation period regardless of the specific revocation authority invoked. In ordinary provider-supplier terms, this is a significant expansion of CMS’s claw back authority.

The effective date of revocation often has as much practical significance as the revocation itself. If revocation is made effective retroactively, claims submitted and paid for dates of service preceding the notice of revocation may become overpayments recoverable by CMS or its contractors. A proposal extending retroactive effective dates to all revocation grounds therefore multiplies the financial consequences of every other proposed change. For example:

  1. A revocation based on high-risk geographic concentration would not merely terminate billing privileges prospectively;
  2. A denial-triggered cross-enrollment revocation could also produce retrospective overpayment exposure; and
  3. A revocation grounded in misdemeanor conviction history could carry backward-looking payment consequences even where no claims-related misconduct is alleged.

5. Proposed New Revocation Basis for High-Risk Geographic Concentration.

There is no current Medicare revocation rule expressly based on a high risk of fraud within a limited geographic area. Under the existing text of 42 C.F.R. § 424.535, CMS may revoke a Medicare provider’s billing privileges for enumerated grounds such as noncompliance, non-operational status shown by on-site review or other reliable evidence, undue-risk affiliations, and billing from a non-compliant location, but the regulation does not currently list provider or supplier concentration in a geographic area as an independent revocation basis.

The most novel proposal described above is CMS’s creation of a revocation basis tied to a “high risk of fraud, waste or abuse due to the provider’s or supplier’s location within a limited geographic area that has an excessive number of providers and suppliers.”[17] Based on the discussion above, CMS does not appear to propose a fixed numeric threshold. Rather, CMS describes the concept functionally: a provider or supplier would present a revocation-level risk if it is located in a limited geographic area with an excessive number of providers or suppliers such that the enrollment poses a high risk of fraud, waste, or abuse. As described, CMS would have virtually unfettered authority and discretionary administrative revocation power to act as it wishes when designating an area as a “high-risk geographic concentration” location. As currently proposed, the high risk of fraud within a limited geographic area designation does not specify:

  1. The relevant geographic unit;
  2. At what point is the number of providers or suppliers in a specified location “excessive”?
  3. What factors would CMS use to make a determination that there is a high risk of fraud within a limited geographic area?
  4. Will CMS be considering beneficiary population, utilization patterns, claims volume, or historical fraud indicators?
  5. How will CMS define this standard? Will the agency memorialize it in a regulation, in sub-regulatory guidance, or rely on a case-by-case adjudication?

The vagueness of this proposed change effectively delegates to CMS substantial case-by-case authority to determine whether provider density has crossed an invisible line, triggering the agency’s authority to revoke a provider’s billing privileges for literally being in the wrong place at the wrong time. The principal distinction is that the proposed rule would allow CMS to act based on concentration-based fraud risk itself, rather than requiring misconduct, noncompliance, non-operational status, or an undue-risk affiliation.

6. Proposed Addition of Certain Misdemeanor Convictions as a Denial or Revocation Basis.

Under existing enrollment rules, felony convictions already play a substantial role in enrollment denial and revocation. The proposal would reach some misdemeanor convictions that CMS considers sufficiently probative of program or beneficiary risk. CMS’s fourth proposed change would add a new denial or revocation basis tied to certain misdemeanor convictions occurring within the prior ten years, specifically misdemeanors involving sexual assault or financial misconduct.[18] This proposal appears designed to expand CMS’s screening authority beyond the current felony-based exclusions and revocations. This proposal reflects a shift toward broader character and risk-based screening rather than claims-specific or operations-specific program-integrity enforcement. It also raises a number of implementation questions:

  1. What specific misdemeanor offenses qualify?[19]
  2. Will CMS use categorical offense labels or fact-specific assessments?
  3. How will CMS treat pleas, deferred adjudications, expungements, and state-law offense variations?
  4. Will the financial misconduct category be limited to offenses implicating trustworthiness in handling Medicare funds, or will it include broader dishonesty offenses?

III. Are These Enhancements to Medicare’s Revocation Authorities Really Needed?

Collectively, these proposed revisions will significantly expand CMS’s arsenal of revocations, even though CMS implemented earlier enhancements to the agency’s revocation authorities as recently as 2023 and 2025. The existing administrative revocation action framework is already highly deferential to the agency and prejudicial to targeted Medicare providers and suppliers. Under the current law and regulations, once CMS establishes a lawful basis for revocation under 42 C.F.R. § 424.535, Administrative Law Judges (ALJs) and Departmental Appeals Board (DAB) adjudicators rarely second-guess CMS’s exercise of discretion. That principle is especially important when considering existing CMS authority under the “other reliable evidence” provision,[20] which tribunals have construed broadly as an evidentiary mechanism supporting revocation for non-operational status or failure to satisfy Medicare enrollment requirements.

CMS’s Medicare provider and supplier enrollment rules have become one of the agency’s most powerful program integrity tools. A revocation of billing privileges can halt reimbursement, trigger overpayment exposure, disrupt operations, and prevent a provider’s reenrollment in the Medicare program for years. If finalized, the 2026 Proposed Rule enhancements to the Medicare revocation rules will materially widen that framework.

IV. Anticipated Impact of Medicare’s Expanded Revocation Authorities:

The various proposed changes to CMS’s revocation authorities discussed in Section II should not be viewed separately. Their combined effect would significantly alter the structure of Medicare enrollment enforcement.

A. CMS is Moving From Conduct-Based Revocation to Risk-Based Revocation.

Historically, many revocation authorities have focused on demonstrated conduct:

  • False application statements,
  • Abusive billing,
  • Non-operational status,
  • Criminal history,
  • Failure to report,
  • Location noncompliance.

The proposed “high risk of fraud” within a “limited geographic area” standard departs from that model by authorizing action based on concentration-derived risk. Likewise, extending denial-based cross-enrollment consequences treats the denial of one application as evidence warranting revocation elsewhere. The high-risk geographic concentration proposal raises the most obvious administrability concerns. Terms such as “limited geographic area” and “excessive number” are highly elastic. If not carefully defined in the regulatory text, they may leave providers unable to predict whether a location is considered high risk.

B. Greater Financial Exposure Through Retroactivity.

Extending retroactive revocation effective dates to all revocation authorities would intensify the stakes of every revocation determination. A supplier facing a discretionary, risk-based revocation would also face retrospective overpayment exposure.

Broad, retroactive effective dates could create overpayment exposure even in cases where the basis for revocation has no direct connection to the accuracy or necessity of the claims paid. That result would likely be defended as a consequence of ineligible enrollment status, but it may still attract criticism as a harsh remedy untethered to actual payment error.

C. Extension of Revocation Actions to Other Provider-Owned Entities.

Using a denial of one application to revoke all other enrollments is arguably a disproportionate penalty when the initial denial concerns a discrete application defect, rather than broader misconduct. The proposal’s legality may ultimately depend on how narrowly CMS defines the triggering circumstances.

D. Uniformity and State Variations When it Comes to Misdemeanor Violations.

The misdemeanor proposal similarly raises line-drawing problems because misdemeanor classifications vary widely by state. A rule keyed to offense labels rather than offense elements could produce uneven treatment across jurisdictions.

V. Greater Practical Finality Because Review Is Deferential:

The Department of Health and Human Services (HHS) DAB (or Board) has repeatedly held that the adjudicator’s role in revocation appeals is limited to determining whether CMS had a lawful basis for revocation. In a recent 2026 ruling,[21] the Board has reiterated that an ALJ and the Board “decide only whether CMS has established a lawful basis for the revocation” and do not second-guess whether CMS properly exercised its discretion.[22] That deferential review framework is critical to understanding the stakes of the July 6th Proposed Rule. Once CMS pursues a revocation action, the likelihood of a successful provider appeal is quite small.

This deferential DAB review framework is critical to understanding the stakes of the current Proposed Rule. A further broadening of Medicare’s revocation authorities does not simply expand CMS’s enforcement options; it also effectively expands the scope of revocation actions that ALJ and DAB adjudicators are obliged to sustain when the regulatory elements are met.

VI. Conclusion:

CMS’s 2026 proposed revocation amendments represent a notable escalation in Medicare enrollment enforcement efforts. As described above, the proposal would broaden cross-enrollment consequences, expand retroactive revocation exposure, create a new concentration-based revocation tool, and extend criminal-history screening to certain misdemeanors. If taken together, these revisions would move Medicare revocation practices further toward preventive, risk-based exclusion and away from a framework focused solely on demonstrated enrollment noncompliance or billing misconduct.

That shift is especially significant because existing administrative review already gives CMS substantial enforcement latitude. Under current DAB precedent, adjudicators do not revisit the wisdom of revocation once CMS establishes a lawful basis. Thus, the practical importance of the proposed rule lies not merely in changing procedural details, but in redefining what counts as a lawful basis in the first place.

You should consult with experienced health care regulatory counsel at the earliest indication that CMS or its contractors are pursuing a revocation of your Medicare billing privileges. An experienced health care attorney can analyze the risks presented and advise you of your options for responding to the revocation action.

Are you dealing with a Medicare revocation of your billing privileges? Schedule a free consultation to discuss whether we can assist you. We can be reached at (202) 298-8750 or 1 (800) 475-1906. Liles Parker is not your typical health care regulatory law firm. Our team includes former federal prosecutors, several of whom held significant positions at the U.S. Department of Justice, former HHS legal counsel, and experienced health care regulatory attorneys who hold certifications as Certified Professional Coders (CPC), Certified Medical Compliance Officers (CMCO), and Certified Medical Reimbursement Specialists (CMRS). The firm has been rated "AV" by Martindale-Hubbell — an honor described as "limited to only the most distinguished law practices," for over 20 years.

Michael Tobin is an experienced health care regulatory attorney. For assistance with your case, call (202) 298-8750
Michael Tobin
Annabella Denzel is an experienced health care regulatory attorney. For assistance with your case, call (202) 298-8750.
Annabella Denzel
| Annabella Denzel
Michael Tobin and Annabella Denzel are health care regulatory attorneys at Liles Parker. In addition to being experienced health law attorneys, both Michael and Annabella are also Certified Professional Coders (CPCs) and have extensive experience defending health care providers and suppliers in CMS program integrity audits by UPICs, SMRCs, and RACs. They are also experienced in defending health providers in False Claims Act matters. Is your practice or organization facing a Medicare revocation action? Click here to schedule a free initial consultation with Liles Parker.
+1 (800) 475-1906   |   +1 (202) 298-8750
  • [1] Calendar Year 2027 Home Health Prospective Payment System (HH PPS) Rate Update; Requirements for the HH Quality Reporting Program and the Expanded HH Value-Based Purchasing Model; Medicare Provider Enrollment, Durable Medical Equipment (DME), and DME, Prosthetics, Orthotics, and Supplies (DMEPOS) Policies, 91 Fed. Reg. 41,216 (July 6, 2026).
  • [2] See Final Rule titled "Medicare Program; Requirements for Providers and Suppliers to Establish and Maintain Medicare Enrollment" 71 Fed. Reg. 20,754 (April 21, 2006).
  • [3] See Final Rule titled “Medicare Program; Requirements for the Medicare Incentive Reward Program and Provider Enrollment.” 79 Fed. Reg. 72500 (December 5, 2014).
  • [4] See Final Rule titled “Medicare, Medicaid, and Children’s Health Insurance Programs; Program Integrity Enhancements to the Provider Enrollment Process.” 84 Fed. Reg. 47794 (September 10, 2019).
  • [5] See Final Rule, titled “Medicare and Medicaid Programs; CY 2024 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies; Medicare Shared Savings Program Requirements; Medicare Advantage; Medicare and Medicaid Provider and Supplier Enrollment Policies, and Basic Health Program,” 88 Fed. Reg. 78818 (Nov. 16, 2023).
  • [6] See Final Rule, titled “Medicare and Medicaid Programs; Calendar Year 2026 Home Health Prospective Payment System (HH PPS) Rate Update; Requirements for the HH Quality Reporting Program and the HH Value-Based Purchasing Expanded Model; Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Competitive Bidding Program Updates; DMEPOS Accreditation Requirements; Provider Enrollment; and Other Medicare and Medicaid Policies” 90 Fed. Reg. 55342 (Dec. 2, 2025).
  • [7] For additional information on Medicare revocation actions, see our article titled “Staying Ahead of the Surge in Medicare Revocation Actions.” (April 23, 2026).
  • [8] 91 Fed. Reg. 41,216 (July 6, 2026).
  • [9] 42 C.F.R. 424.535(a)(8)(ii)(A).
  • [10] 42 C.F.R. 424.535(a)(8)(ii)(B).
  • [11] 42 C.F.R. 424.535(a)(8)(ii)(C).
  • [12] 42 C.F.R. 424.535(a)(8)(ii)(D).
  • [13] 91 Fed. Reg. 41,216, 41,284.
  • [14] 91 Fed. Reg. 41,216, 41,285.
  • [15] Id.
  • [16] Id.
  • [17] 91 Fed. Reg. 41,216, 41,291.
  • [18] 91 Fed. Reg. 41,216, 41,314.
  • [19] Because misdemeanor nomenclature varies considerably by state, these questions will matter greatly in application.
  • [20] 42 C.F.R. § 424.535(a)(5).
  • [21] Salman M. Akbar, M.D., DAB No. 3227 (H.H.S. Dep’t Appeals Bd. 2026).
  • [22] Douglas Bradley, M.D., DAB No. 2663 (H.H.S. Dep’t Appeals Bd. 2015).