High-Risk Screening: Fingerprints for Every 5% Owner

Medicare sorts every enrolling provider and supplier into one of three screening levels: limited, moderate or high. A newly enrolling DMEPOS supplier is in the top tier. "Prospective (newly enrolling) DMEPOS suppliers" are listed by name as "high" categorical risk in 42 CFR 424.518(c)(1)(ii), alongside new home health agencies, hospices and skilled nursing facilities. That classification is why enrolling a DME company involves fingerprints, and why owners who expected a paperwork exercise sometimes find themselves at a fingerprint site.

What does high-risk screening involve?

Three layers, each building on the one below (424.518):

• Limited: verification that the supplier meets federal and state requirements for its type, license verification "including licensure verifications across State lines," and database checks before and after enrollment.
• Moderate: all of that, plus an on-site visit.
• High: all of that, plus "the submission of a set of fingerprints for a national background check from all individuals who maintain a 5 percent or greater direct or indirect ownership interest," and a fingerprint-based criminal history check through the FBI's Integrated Automated Fingerprint Identification System.

The CMS Program Integrity Manual tells contractors not to switch a high-risk enrollment to "Approved" until both the site visit and the fingerprinting are complete and reviewed.

Who has to be fingerprinted?

Individuals with a 5 percent or greater direct or indirect ownership interest. Officers, directors and managing employees are reported on the 855S, but the fingerprint rule is written around ownership.

Indirect ownership is multiplied through the chain. The manual's example: if A owns 10 percent of a corporation that owns 80 percent of the supplier, A has an 8 percent indirect interest and must be reported. If B owns 80 percent of a corporation that owns 5 percent of the supplier, B's interest is 4 percent and need not be reported. Investors in a holding company can cross the 5 percent line without realizing it, and the 855S requires every 5 percent owner in section 6 whether or not they are involved in the business.

When and how are the prints submitted?

Each person must submit fingerprints "Upon submission of a Medicare enrollment application; or Within 30 days of a Medicare contractor request" (424.518(d)(1)). The CMS-855S tells suppliers to contact Accurate Biometrics, the vendor it names for CMS fingerprinting, "to find a fingerprint collection site, and to ensure the fingerprint results are accurately submitted to the FBI and properly returned to CMS." Use the CMS process, not prints taken for a state license or a job; those do not reach CMS.

What if someone does not get printed in time?

The supplier pays for it. If a required individual fails to submit fingerprints on time, the supplier will have its billing privileges "Denied under § 424.530(a)(1); or Revoked under § 424.535(a)(1)" (424.518(d)(2)). An investor overseas or an owner who ignores the request can stall or sink the whole enrollment.

What do the results get checked for?

The fingerprints support the conduct-based denial rules. CMS can deny enrollment if the supplier or any owner, managing employee, officer or director was convicted within the previous 10 years of a federal or state felony that CMS finds detrimental to Medicare, including crimes against persons, financial crimes such as embezzlement, insurance fraud or tax evasion, and felonies that would require exclusion (424.530(a)(3)). Felonies must also be reported in section 3 or section 6B of the 855S. A conviction that shows up in prints but not on the application adds a false-statement problem to the original one, and CMS can bar a supplier for up to 10 years for false or misleading information on an application (424.530(f)).

The 855S asks about felony convictions in the preceding 10 years and about certain health-care-related misdemeanors, among other adverse actions. Owners should review their own history before the application is signed.

Does screening happen again after enrollment?

Yes, in several situations:

• Revalidation: revalidating DMEPOS suppliers are generally moderate risk, which means a site visit (424.518(b)(1)(ix)). They return to high risk, with fingerprints, if fingerprinting was waived at initial enrollment during a declared emergency (424.518(c)(1)(viii)).
• A new owner: an enrolled DMEPOS supplier "reporting any new owner (regardless of ownership percentage)" or submitting a change of ownership is high risk (424.518(c)(1)(vii)).
• A new location: the manual classifies an enrolled supplier adding a location as high risk, because each location is a separate enrollment.
• An adverse history: CMS raises any provider to high risk after a payment suspension in the last 10 years, an OIG exclusion, a Medicare revocation within 10 years when it seeks new billing privileges, Medicaid termination, or another final adverse action within 10 years (424.518(c)(3)). The adjustment follows every enrollment under the same legal business name and TIN.
• After a moratorium: a supplier that was blocked by a moratorium and applies within 6 months after it is lifted is screened as high risk (424.518(c)(3)(iii)).

How do we prepare owners for screening?

We map the ownership chain down to every individual at 5 percent or more, collect the section 6 data, and walk each owner through the fingerprinting step and the adverse action questions before anything is submitted. Each owner schedules and pays for their own fingerprinting. The Medicare DMEPOS Enrollment Package is $1,295 for the first location (see pricing). For the full sequence see DMEPOS enrollment step by step, and for the visit itself, the site visit checklist.