Medicare Provider Enrollment and Billing Privileges — How Providers Get Into Medicare and What Can Get Them Kicked Out

Legal Authority

• 42 U.S.C. § 1302 — Social Security Act § 1102; grants HHS Secretary general rulemaking authority to administer Medicare; statutory basis for CMS's authority to establish enrollment requirements and conditions for billing privileges
• 42 U.S.C. § 1395cc — Social Security Act § 1866; authorizes provider agreements (hospitals, SNFs, home health agencies) as the contract mechanism for Medicare participation; establishes conditions of participation that providers must meet
• 42 U.S.C. § 1395u — Social Security Act § 1842; governs physician and supplier payment; authorizes CMS to set supplier standards and conditions for assignment of Medicare payment
• 42 CFR Part 424, Subpart P — CMS implementing regulation; establishes enrollment procedures, application requirements, site inspections, risk-tiered enrollment, revocation grounds and bars, and reactivation procedures

Key Mechanics

CMS requires every provider and supplier seeking Medicare payment to enroll through the Provider Enrollment, Chain, and Ownership System (PECOS), obtain a National Provider Identifier (NPI), and receive a Provider Transaction Access Number (PTAN). CMS risk-stratifies applicants into three tiers — limited (low-risk individual practitioners), moderate (clinics, group practices), and high (DME suppliers, home health agencies, hospices) — with more rigorous screening applied at higher tiers, including unannounced site visits. Once enrolled, providers must revalidate every 3–5 years. CMS may revoke billing privileges on more than 20 enumerated grounds including felony convictions, license surrenders, abuse of billing, abusive prescribing patterns, and operating at a non-operational location; revocation bars the provider from re-enrolling for 1–10 years and from reassigning claims. Revocation operates independently of OIG exclusion (which covers all federal health programs), though both may apply simultaneously. Ordering and referring providers (physicians ordering home health, DME, or lab tests) must also be enrolled even if they never directly bill Medicare.

Current Rule (2026)

What This Rule Does

Before a physician, hospital, home health agency, or other healthcare provider can bill Medicare for a single service, they must be enrolled in Medicare and hold active "billing privileges." 42 CFR Part 424 — particularly Subpart P — is the federal regulation governing this enrollment process: who must enroll, how the application works, what on-site inspections CMS may conduct, and — critically — when CMS may revoke billing privileges, how long the revocation lasts, and what the provider must do to get back in.

Medicare provider enrollment is not a formality. It is a gatekeeping mechanism designed to keep fraudulent, unqualified, and high-risk providers from accessing the Medicare payment system. Revocation of billing privileges can end a practice's economic viability immediately: once revoked, a provider cannot bill Medicare for services rendered during the revocation period, cannot reassign claims to another provider, and in egregious cases may be barred from re-enrolling for up to 10 years. The enrollment and billing privilege rules operate alongside (but independently of) the OIG exclusion authority — a provider excluded by OIG cannot participate in any federal health program; a provider whose billing privileges are revoked by CMS specifically cannot bill Medicare, though exclusion is a separate, often more severe, action.

Key Provisions

Who Must Enroll (Subpart P — § 424.502 and § 424.505)

Any person or organization that provides services covered by Medicare Parts A or B and wants to receive Medicare payment must enroll in Medicare and be issued a National Provider Identifier (NPI) and a Provider Transaction Access Number (PTAN) — Medicare's internal billing identifier. This includes:

• Physicians and non-physician practitioners (nurse practitioners, physician assistants, clinical social workers, psychologists)
• Hospitals (Part A), outpatient departments, and ambulatory surgical centers
• Skilled nursing facilities, home health agencies, and hospice providers
• Suppliers of durable medical equipment, prosthetics, and orthotics (DMEPOS)
• Clinical laboratories, dialysis facilities, and comprehensive outpatient rehabilitation facilities
• Ordering and referring providers who do not bill Medicare directly but order items and services that Medicare will pay for (physicians ordering home health, DME, or lab tests must be enrolled even if they don't bill Medicare themselves)

The Enrollment Application (§§ 424.510–424.516)

• § 424.510 — Conditions for enrollment: CMS will enroll a provider if it meets the applicable supplier standards, is not excluded from Medicare by the OIG, and the enrollment application is complete and accurate; any misrepresentation in an enrollment application can result in revocation and a 10-year re-enrollment bar
• § 424.515 — Application resubmission: CMS may return an incomplete application; the provider has 30 days to resubmit; failure to resubmit within the deadline results in rejection
• § 424.516 — Reporting changes: enrolled providers must report certain changes to their enrollment information within specified timeframes — changes to ownership within 30 days, changes to practice location within 90 days; failure to timely report changes is itself a basis for revocation
• On-site inspections: CMS may conduct unannounced on-site inspections of any enrolled provider's practice location to verify that the location exists and is operational; an enrolled provider that does not appear to be practicing at its enrolled location is a revocation risk; DMEPOS suppliers face the most rigorous inspection requirements, including independent verification of a physical location

Revocation of Billing Privileges (§ 424.535)

The most consequential provision in Part 424's enrollment framework is § 424.535, which lists the grounds on which CMS may revoke an enrolled provider's Medicare billing privileges:

• Felony conviction: CMS must revoke billing privileges if the provider, its owner, or a managing employee has been convicted of a felony within the preceding 10 years; the conviction must relate to Medicare/Medicaid fraud, patient abuse/neglect, financial crimes, or any felony CMS determines is detrimental to the best interests of the Medicare program
• Submission of false or misleading enrollment information: providing inaccurate information in the enrollment application or during the maintenance of enrollment — including misrepresentations about ownership, practice location, or scope of practice — is grounds for revocation and a re-enrollment bar of up to 10 years
• Non-operational status: CMS may revoke if the provider is no longer operational at the enrolled location, or is not providing the services it enrolled to provide; this provision targets "ghost" practices and dormant enrollments
• Failure to meet supplier standards: DMEPOS suppliers must continuously meet the specific supplier standards in 42 CFR Part 424; failure to comply — including failure to maintain a physical location, maintain required accreditation, or staff appropriately — results in revocation
• Abuse of billing privileges: CMS may revoke if it determines the provider poses an undue risk to the Medicare program based on patterns of billing, including billing for services not rendered, billing for services that could not have been provided given the patient panel, or billing patterns inconsistent with the stated specialty
• Adverse legal actions: revocation may occur if the provider has been subjected to a payment suspension under 42 CFR § 405.371 (credible allegation of fraud), or if a state has taken adverse action against the provider's professional license
• National Provider Identifier (NPI) deactivation: if a provider's NPI is deactivated, their Medicare billing privileges are automatically revoked

The revocation may be accompanied by a re-enrollment bar — a period (up to 10 years for the most serious violations) during which the provider may not re-enroll in Medicare. CMS has the authority to impose bars of varying length based on the severity and nature of the conduct.

Re-Enrollment Bar (§ 424.535(c))

• Standard revocations allow re-enrollment after a bar period determined by the reason for revocation; after the bar expires, the provider may submit a new enrollment application
• A re-enrollment bar of up to 10 years applies when the revocation is based on fraud, criminal conviction, or submission of false information; bars of 1–3 years are more common for operational deficiencies
• During the bar period, the provider may not be listed as an owner, manager, or authorized official of any other Medicare-enrolled entity — meaning the revocation effectively bars the individual from participating in Medicare through any business structure, not just the original practice

Deactivation vs. Revocation (§ 424.540)

Deactivation is a less severe action than revocation. CMS deactivates billing privileges when a provider fails to submit Medicare claims for 12 consecutive months or fails to report required changes. Deactivation suspends billing but does not impose a re-enrollment bar; a deactivated provider may reactivate by certifying to the current accuracy of its enrollment information. Deactivation matters for solo practices that stop accepting Medicare patients — the clock starts running toward automatic deactivation from the last Medicare claim, and reactivation requires going through an application process.

How It Affects You

New providers seeking to enroll in Medicare: The Medicare enrollment application — Form CMS-855 (physicians/practitioners), CMS-855A (institutions), CMS-855B (clinics), or CMS-855S (DMEPOS suppliers) — is completed through PECOS (Provider Enrollment, Chain, and Ownership System) at pecos.cms.gov. Budget 3–4 months from application submission to receipt of your PTAN and activation of billing privileges. CMS reviews applications for completeness and accuracy; submitting incomplete or inconsistent information is the most common cause of delay or rejection. For new physicians joining a practice, ensure the group's enrollment is current and that your individual provider record is linked to the group PTAN. Ordering physicians who don't bill Medicare directly must still have active enrollment to order home health, DME, or lab services that Medicare will pay — your patients may be denied services if your enrollment has lapsed.

Established providers managing their enrollment: The biggest enrollment risk for an ongoing practice is "deactivation by neglect" — billing privileges that lapse because the provider stopped billing Medicare, didn't report address changes, or didn't respond to CMS revalidation requests. CMS requires revalidation every 5 years (every 3 years for DMEPOS suppliers) — a verification of enrollment information triggered by CMS with a fixed response deadline. Missing a revalidation request results in deactivation; missing it while also having unreported changes can escalate to revocation. Designate someone in your practice to manage CMS enrollment maintenance and ensure your enrollment contact address receives and responds to CMS correspondence.

Providers facing revocation: If you receive a revocation notice under § 424.535, you have the right to appeal through CMS's Provider Enrollment Appeals process (42 CFR Part 498). The appeal must be filed within 60 days of the initial determination. You may also request a reactivation after the re-enrollment bar expires by submitting a new PECOS application and addressing the underlying reason for the revocation in your reapplication. Given the potentially career-ending consequences of a revocation determination (especially with a lengthy re-enrollment bar), engage Medicare regulatory counsel immediately upon receipt of any revocation or adverse action notice.

DMEPOS suppliers: Durable medical equipment suppliers face the most rigorous enrollment and oversight requirements in Part 424 — mandatory physical location, prohibition on selling from a vehicle or catalog-only business, supplier accreditation requirements, and frequent on-site inspections. CMS has used DMEPOS supplier revocations extensively to combat fraud in the power wheelchair, back/knee brace, and glucose monitor supply sectors. If you are a DMEPOS supplier, maintain your physical location documentation, accreditation certificates, and compliance records continuously — not just at application time.

Statutory Authority

This rule implements:

• 42 U.S.C. § 1395cc — Social Security Act § 1866; establishes the conditions under which providers may participate in Medicare and the grounds for termination from participation
• 42 U.S.C. § 1395u — Social Security Act § 1842; authorizes CMS to impose conditions on assignment of claims and billing privileges for Part B services
• 42 U.S.C. § 1302 — General HHS regulatory authority for Medicare program administration

Recent Rulemakings

• 2023 (88 FR 77150): Updated provider enrollment provisions including expanded grounds for revocation and enhanced overpayment collection authorities; implemented provisions of the Consolidated Appropriations Act of 2023 related to enrollment integrity
• 2019 (84 FR 47794): Significant expansion of revocation authority adding grounds related to felony convictions of associated persons (owners and managing employees); extended the maximum re-enrollment bar from 3 years to 10 years; added "pattern or practice of abusive billing" as a revocation ground
• 2011 (76 FR 5862): Major expansion of CMS enrollment screening authority implementing ACA § 6401; introduced risk-based screening categories (limited, moderate, high risk) with different screening intensities including on-site inspections for high-risk providers and suppliers

Pending Action