The DMEPOS Site Visit: What the Inspector Checks

The CMS-855S lists the site visit as a standard step: "The contractor reviews the application and conducts a site visit to verify compliance with the supplier standards found at 42 C.F.R. sections 424.57, 424.58, and 424.500 et seq." For a new supplier it is not optional and not skippable. It is also one of the places where an otherwise complete enrollment fails, usually for something simple: a locked door during posted hours, a missing sign, a cell phone as the main line.

When does a site visit happen?

The screening rules in 42 CFR 424.518 decide it. Newly enrolling DMEPOS suppliers are "high" categorical risk, and high-risk screening includes everything in the moderate level, which "Conducts an on-site visit" (424.518(b)(2)(ii) and (c)(2)(i)). Revalidating DMEPOS suppliers are generally moderate risk, so they get a site visit too. The CMS Program Integrity Manual (chapter 10) adds the operational details:

• For newly enrolling high-risk suppliers, the site visit contractor performs the visit, and the enrollment contractor "shall not switch the provider's enrollment record to 'Approved' prior to the completion of the site visit."
• An enrolled DMEPOS supplier adding a location is classified as high risk, because "each location must be separately enrolled. The enrollment of a new location thus constitutes an initial enrollment."
• A change of location triggers a visit, and that "includes situations in which the provider/supplier is switching suite numbers or floors within a building."
• For revalidating DMEPOS suppliers, "A site visit of the DMEPOS supplier shall be conducted prior to" a final decision on the revalidation.
• Generally, a new visit is not ordered for a location that "has already passed a site visit within the last 12 months" while the supplier is approved.

Visits are also not limited to enrollment. Supplier standard 8 requires you to permit on-site inspections by CMS and its agents to check compliance (424.57(c)(8)), and the accrediting organization's surveys are separate and unannounced.

Which supplier standards can an inspector see?

CMS does not publish a DMEPOS site visit script, so prepare for the standards an observer can verify at the door. These come straight from 42 CFR 424.57(c):

1. The address on the 855S is a real, accessible practice location of at least 200 square feet, not in a gated community or other restricted area (standard 7). Custom O&P practitioners in private practice have an exception to the square footage rule.
2. Someone is there during posted hours and the location is accessible to the public (standard 7). This is the most common failure.
3. A permanent, visible sign in plain view, with hours posted. In a building complex, the sign must be visible at the main entrance, or the hours posted at the supplier's entrance.
4. Hours add up to at least 30 a week and match what the 855S says (standard 30), unless an exception applies. "By Appointment Only" is allowed on the form only for those exceptions.
5. A working primary business phone at the site, listed under the business name, not a cell phone, pager or answering service, and not forwarded exclusively to a cell phone (standard 9).
6. Space for records: delivery, maintenance and beneficiary communication records, and the ordering and referring documentation, unless a multisite supplier keeps them centrally (standard 7).
7. No sharing of the practice location with another Medicare provider or supplier unless an exception applies (standard 29). An unmarked shared suite raises questions fast.
8. Licenses and permits on display. The DMEPOS Quality Standards require the supplier to "display all licenses, certificates, and permits to operate" where customers can see them.
9. Inventory or contracts consistent with the products you listed in 855S section 2E4 (standard 4).
10. The complaint log and complaint resolution protocol kept at the physical facility (standards 19 and 20).

How does the manual describe a closed or empty site?

The manual's general instructions for operational site verifications are instructive even though DMEPOS visit scope follows separate CMS guidance. Verifications "should be done Monday through Friday (excluding holidays) during their posted business hours." If the first attempt finds the facility closed with no obvious sign it has shut down, "a second attempt on a different day during the posted hours of operation should be made." Visitors document the date and time, photograph the business with date and time stamps, and record observations such as a vacant suite, an eviction notice, or another company in the space.

If a supplier is found not operational or out of compliance, the manual directs revocation, unless the supplier had already reported a change of practice location. It tells contractors to establish a two-year reenrollment bar in both the non-operational and the regulatory non-compliance cases. A revocation for a supplier standard violation takes effect "the date on which the non-compliance began" (424.535(g)). A failed visit on a new application leads to denial under 424.530(a)(5).

Who should be at the location on visit days?

Someone who can open the door, answer basic questions about the business, and find documents. Inspectors are not there to interview the owner at length, but a staff member who does not know the business's hours or where the complaint log is kept makes a poor impression. Make sure staff know a visit can come during any posted hour, and that "we're closed for lunch" during posted hours is a failed attempt.

What should you fix before you apply?

• Post the same hours on the door that you put on the 855S, and staff every one of them.
• Install a landline or a business VoIP line that rings at the site, listed under the business name.
• Put up the permanent sign before the application goes in, not after approval.
• Keep copies of state licenses, the accreditation certificate and the insurance certificate on the wall or at the counter.
• Set up the complaint log and the delivery and proof-of-delivery files, even if they are empty.
• If you share a building with a related practice, separate the space clearly and confirm an exception in standard 29 applies.
• Report any move, including a suite change, within 30 days (see the 30-day rule), because a visit to an old address finds an empty room.

For the full list of standards, see the 30 supplier standards in plain English; for the separate accreditation survey, see preparing for an unannounced survey.

Can a consultant attend the site visit?

A site visit tests whether your business operates at the address you listed. It is your staff the inspector needs to see. What we do is prepare the location beforehand: our Medicare DMEPOS Enrollment Package ($1,295 for the first location, see pricing) includes a pre-visit walk-through against every standard an inspector can observe, and the $149 Readiness Review flags location problems before you sign a lease. Neither we nor anyone else can promise the outcome of a visit, but the failures above are almost always preventable.