Why DMEPOS Billing Privileges Get Revoked

CMS's own data shows how exposed DME suppliers are. In its February 2026 moratorium notice (CMS-6099-N, 91 FR 9855), CMS reported that from 2023 to October 2025, medical supply company specialties "had a 17 percent revocation rate, meaning that 17 percent of these suppliers eventually had their Medicare enrollments revoked," which it called "nearly triple the rate for other DMEPOS supplier types." Revocation terminates billing privileges, starts a reenrollment bar and can reach back months. Most of the triggers are compliance failures rather than fraud.

Which revocation grounds hit DME suppliers most?

The grounds are in 42 CFR 424.535(a), with DMEPOS-specific rules in 424.57. The ones we see matter most:

• A supplier standard violation. "CMS revokes a supplier's billing privileges if it is found not to meet the conditions or standards" in 424.57(b) and (c) (424.57(e)(1); 424.535(a)(23)(ii)). Any one of the 30 standards will do; see the 30 supplier standards.
• Not operational at the site. On-site review or other reliable evidence showing the supplier "No longer operational to furnish Medicare-covered items" or failing any enrollment requirement (424.535(a)(5)).
• Insurance lapse. Failure to keep $300,000 of comprehensive liability coverage "results in revocation of the supplier's billing privileges retroactive to the date the insurance lapsed" (424.57(c)(10)(ii)).
• Bond lapse or cancellation. A lapse reported by the surety revokes billing privileges, and Medicare pays nothing for the gap (424.57(d)(6)); for failure to maintain the bond, the revocation "is effective the date the bond lapsed," and payments from that date must be repaid (424.57(d)(11)).
• Accreditation lapse. The CMS manual tells contractors to revoke a supplier that fails to maintain required accreditation. With resurveys now due at least every 12 months (424.57(c)(24)), the window to miss is smaller than it used to be.
• Failure to report changes. DMEPOS suppliers have 30 days for every change (424.57(c)(2)), and failing to report is a ground in itself (424.535(a)(9)).
• Misuse of the billing number. Selling or letting another entity use the supplier number (424.535(a)(7)); supplier standard 18 bars conveying or reassigning it.
• Abuse of billing privileges. Claims for items that could not have been furnished, or a pattern of claims that fail Medicare requirements (424.535(a)(8)).
• Documentation. Failing to keep or provide access to ordering and referring documentation, which must be kept for 7 years (424.535(a)(10); 424.516(f)).
• Conduct and history. Felony convictions within 10 years, exclusions, false information on the application, Medicaid terminations, unpaid debt referred to Treasury, and risky affiliations (424.535(a)(2), (3), (4), (12), (17) and (19)).
• A missed revalidation. Not responding to a revalidation request leads to deactivation or revocation for noncompliance under 424.535(a)(1).

When does a revocation take effect?

Usually 30 days after the notice is mailed, but many grounds have their own dates in 424.535(g), and for DME suppliers they tend to reach backward:

• a supplier standard violation: "the date on which the non-compliance began";
• a non-operational location: the date the location "was no longer operational";
• failure to report an ownership change, adverse legal action or practice location change: "the day after the date by which the provider or supplier was required to report";
• a felony: the date of conviction; a license suspension or revocation: the date of that action;
• false information on the application: "the date the application's certification statement was signed."

Claims paid after the effective date become overpayments. CMS may also reopen claims paid on or after the date of a final adverse action to determine an overpayment (424.57(e)(2)). A revoked supplier must submit all claims for items furnished before the revocation within 60 calendar days after the effective date (424.535(h)).

How long is the reenrollment bar?

At least 1 year and up to 10 years, depending on severity, starting 30 days after the notice is mailed (424.535(c)(1)). CMS can add up to 3 years for trying to get around a bar by enrolling under a different name, and can impose up to 20 years for a second revocation (424.535(c)(2)-(3)). For non-operational and regulatory non-compliance revocations, the CMS manual tells contractors to set a two-year bar. The bar applies "under any of its current, former or future names, numerical identifiers or business identities" (424.535(c)(4)).

Two more reach-backs: CMS may revoke all of a supplier's other enrollments, including under different names and types (424.535(i)), and it automatically reviews every related enrollment file (424.535(f)). A supplier that voluntarily terminates to dodge a revocation can be revoked anyway, effective the day before the contractor received the termination (424.535(j)). The one exception: no reenrollment bar applies when the revocation is under 424.535(a)(1) for failing to respond timely to a revalidation request or other request for information (424.535(c)(1)(ii)).

What are the ways back?

• Corrective action plan. Only for revocations under 424.535(a)(1), noncompliance, and the supplier has "only one opportunity to correct all deficiencies" (42 CFR 405.809(a)). The CMS manual requires the CAP to be received within 35 calendar days of the date of the revocation determination, with verifiable evidence of compliance. If accepted, billing privileges are reinstated effective the date of compliance; a refusal to reinstate is not appealable as an initial determination (405.809(b)).
• Reconsideration. Available for every revocation: a written request within 60 days of receiving the notice (42 CFR 498.22), which the manual counts as 65 calendar days from the date of the determination. Then an administrative law judge hearing, Departmental Appeals Board review and judicial review (498.5(l)). Reconsideration argues that the determination was wrong when made; it is not a chance to fix the problem.
• Reversal. If the revocation rests on a sanction, exclusion or felony of an owner, manager or official, it may be reversed if the supplier ends that relationship within 30 days (424.535(e)).

Both a CAP and a reconsideration must be signed by the supplier's authorized or delegated official or a properly appointed representative. Because the deadlines are short, decide which path applies the day the letter arrives.

What does reenrolling require after a bar ends?

Everything a new supplier needs. The supplier "must re-enroll in the Medicare program through the completion and submission of a new applicable enrollment application ... as a new provider or supplier" (424.535(d)), with accreditation, a bond elevated by the revocation itself (a Medicare revocation is a final adverse action), high-risk screening, and the application fee.

How do we help suppliers stay out of this?

Most of these revocations are preventable with a calendar and a habit of reporting. Annual Survey Readiness ($1,200 per year) keeps accreditation current; License Renewal Tracking ($299 per license, per year) keeps state licenses current; a Change of Information ($249) gets changes in within 30 days (see pricing). If a revocation notice has already arrived, we can organize the record and prepare corrective action plan materials for your official to review and sign; for legal arguments on reconsideration, involve health care counsel. See also why DMEPOS enrollment is denied and the 30-day rule.