Liability Insurance Requirements for DME Suppliers

Insurance is the supplier standard that ends enrollments most abruptly. A missed survey or a late change report gives a supplier some room to fix the problem. A gap in liability coverage does not: Medicare revokes billing privileges "retroactive to the date the insurance lapsed." The requirement is short, but each word in it matters.

What does Medicare require?

Supplier standard 10, 42 CFR 424.57(c)(10), requires a DMEPOS supplier to have "a comprehensive liability insurance policy in the amount of at least $300,000 that covers both the supplier's place of business and all customers and employees of the supplier." Three more rules follow:

• A supplier that manufactures its own items must also carry product liability and completed operations coverage (424.57(c)(10)(i)).
• "Failure to maintain required insurance at all times results in revocation of the supplier's billing privileges retroactive to the date the insurance lapsed" (424.57(c)(10)(ii)).
• An authorized official of the supplier "must sign the liability insurance policy" (424.57(c)(10)(iii)).

What does the CMS-855S ask for?

Section 7A of the CMS-855S (12/23) restates the requirement as at least $300,000 "for each incident," with insurance that "must remain in force at all times." It adds practical details the regulation does not:

• The enrollment contractor, with its full mailing address, "must be listed on the policy as a certificate holder."
• You submit a copy of the certificate of liability insurance, or evidence of self-insurance, with the application.
• The form asks for the insurer, policy number, issue and expiration dates, the agent and the underwriter.
• "Professional and malpractice insurance is not the same as comprehensive liability insurance and does not meet compliance for this requirement."
• A failure to keep coverage can bring revocation "and/or overpayment collection."

The form also says a change to the business location address requires "proof of insurance covering the new address."

Why doesn't malpractice coverage count?

Because the standard asks for a different kind of protection. Professional liability covers the practitioner's professional judgment. Comprehensive general liability covers injuries at the place of business and the supplier's operations, which is what CMS wants for customers and employees. A pharmacy or physician practice that already carries malpractice coverage still needs a comprehensive liability policy that meets the $300,000 floor for the DMEPOS enrollment. Ask your agent to confirm the policy type in writing.

How does a lapse happen without anyone noticing?

1. The policy renews with a new carrier and the old one ends a day before the new one starts.
2. A premium payment fails and the carrier cancels mid-term.
3. The business moves and the policy still lists the old address.
4. A new location opens and the policy does not cover it.
5. The renewed certificate never reaches the enrollment contractor, so the record shows an expired policy.

Treat the policy like a license: calendar the expiration, get the renewal binder before the old policy ends, update the certificate holder, and report the new policy information on a change of information within 30 days (424.57(c)(2)). See the 30-day rule.

Do states require more than Medicare?

Several do, for their own licenses. Examples we have read in state rules:

• Alabama: comprehensive liability insurance of at least $300,000 covering the place of business, consumers and employees, with product liability and completed operations for manufacturers, as part of the license application (Ala. Admin. Code 473-X-3-.01). See Alabama.
• Arkansas: a copy of liability insurance for products and services of $500,000 or more with the license application, and coverage of at least $500,000 for products and operations of each licensed entity (Arkansas Board of Pharmacy rules, 070-00-06 Ark. Code R. 005). See Arkansas.
• Florida: professional and commercial liability insurance in an amount the agency sets by rule, but not less than $250,000 per claim, with the same floor for contractors (Fla. Stat. 400.931(3)). See Florida.
• Illinois: a certificate showing $1,000,000 of commercial general liability insurance, including products and professional liability, with the license application (68 Ill. Admin. Code 1253.20); Illinois exempts providers accredited under home care standards from the license itself. See Illinois.

A supplier licensed in several states should buy to the highest requirement among them, not to Medicare's floor. Our state index lists other states' requirements as we verify them.

Is insurance the same as the surety bond?

No. The $50,000 DMEPOS surety bond under 42 CFR 424.57(d) names CMS as obligee and protects the Medicare program; it does not insure the supplier against injury claims. You need both, from different sources, and a lapse in either causes trouble. See the DMEPOS surety bond.

Where do accreditation surveyors and site inspectors look?

Expect both to ask for the current certificate. The site inspector checks compliance with the supplier standards at the location (424.57(c)(8)), and accrediting organizations survey against CMS's quality standards. With accreditation now renewed at least every 12 months (424.57(c)(24)), the certificate in your compliance binder needs to be current at every unannounced visit. See the site visit checklist.

How do we handle insurance in an enrollment?

We do not sell insurance or bonds. We tell your agent exactly what the enrollment needs (amount, coverage type, certificate holder, every location), check the certificate before it goes in, enter the policy details on the 855S for your authorized official to sign, and calendar the renewal. When a policy changes, a Change of Information is $249, and License Renewal Tracking is $299 per license, per year. You pay all premiums directly. A $149 Readiness Review checks your current policy against Medicare and every state where you are licensed.