Enrolling a Medical Supply Company After the Moratorium

"Medical supply company" is one of more than 80 DMEPOS supplier types on the CMS-855S, and in 2026 it became the one CMS watched most closely. CMS barred new enrollments of medical supply companies and their new locations from February 27 to August 27, 2026, citing a 17 percent revocation rate for those specialties from 2023 to October 2025 (CMS-6099-N, 91 FR 9855). The National Provider Enrollment contractors began accepting initial applications again when the moratorium expired. A company enrolling now is doing so with the contractors, and CMS, paying attention.

Is your business a medical supply company in CMS's eyes?

For the moratorium, CMS used a functional definition: a business "whose principal function is to furnish DMEPOS supplies (regardless of supply type) directly to another party," such as patients with a medical order (including by mail), other providers and suppliers, or both. There are seven medical supply company types on the 855S: the base type and versions "with" orthotics, pedorthic, prosthetics, prosthetic and orthotic personnel, a registered pharmacist or a respiratory therapist. A "with" type has at least one such professional in an employment, advisory or contractual role.

Choose the type that honestly describes the business. CMS warned in the moratorium notice that it would check through site visits and online research, and that submitting false or misleading information can lead to denial and a reapplication bar of up to 10 years (42 CFR 424.530(a)(4) and (f)). If your principal business is a pharmacy, see DMEPOS enrollment for pharmacies instead.

In what order does the enrollment happen?

The sequence is fixed by the rules, not by preference. CMS's accreditation fact sheet (MLN905710) says the enrollment contractors "won't process any enrollment application unless the applicant is accredited or exempt," and medical supply companies are not on the exemption list.

1. Entity, tax ID and an NPI for the location. The legal name, TIN and NPI must match across the IRS, NPPES and PECOS.
2. A compliant location. At least 200 square feet, accessible to the public, staffed during posted hours, with a permanent visible sign, open at least 30 hours a week, with a primary business phone at the site that is not a cell phone, and not shared with another Medicare provider or supplier (42 CFR 424.57(c)(7), (9), (29) and (30)). See what the site inspector checks.
3. State licenses for the state you operate in and the states you ship to, where they require one. Accrediting organizations verify licensure at application.
4. Liability insurance of at least $300,000 (424.57(c)(10)). See insurance requirements.
5. Policies, staff training and records, then accreditation from a CMS-approved organization after an unannounced survey. Since January 1, 2026, accreditation is renewed through a resurvey at least every 12 months (424.57(c)(24)).
6. The $50,000 surety bond per NPI, more if there were adverse legal actions in the past 10 years (424.57(d)).
7. The CMS-855S and the application fee, $750 for calendar 2026.
8. High-risk screening: a site visit and fingerprints of every 5 percent or greater owner (424.518(c)).
9. The PTAN, and then Medicaid, payer and competitive bidding work.

Our post on DMEPOS enrollment, step by step covers each stage in more depth.

Why is screening tougher for this supplier type?

Every prospective DMEPOS supplier is already in the "high" categorical risk level under 42 CFR 424.518(c)(1)(ii), which means a site visit and FBI fingerprint checks for every individual with a 5 percent or greater direct or indirect ownership interest. The moratorium notice adds that once a moratorium is lifted, the supplier types it blocked are screened at the high level if they apply within six months (424.518(c)(3)(iii)). In practice: expect the inspector, expect fingerprints, and make sure the ownership section of the 855S lists everyone it should.

Which mistakes cost the most right now?

• Filing before accreditation. The application will not be processed.
• A location that fails on the day. No sign, nobody there during posted hours, hours under 30 a week, or a cell phone as the main line.
• Unlisted owners or managing employees. CMS's notice describes a fraud case built on a "straw" owner. Contractors look for hidden ownership.
• A bond or insurance gap. A lapse in insurance means revocation retroactive to the date of the lapse (424.57(c)(10)(ii)).
• Telephone solicitation. Supplier standard 11 bars calling beneficiaries about Medicare items except in three narrow situations (424.57(c)(11)). Many of the cases CMS cited involved call centers and purchased orders.
• Buying a young company to skip the line. A majority purchase within 36 months of the seller's enrollment means a new enrollment and new accreditation (424.551), which is an initial enrollment for moratorium purposes.

When does competitive bidding come into the plan?

If you intend to supply CGMs, insulin pumps, urological or ostomy supplies, hydrophilic catheters or off-the-shelf braces to Medicare patients after January 1, 2028, Round 2028 matters now. CMS's timeline opens bidder registration December 1, 2026 and the bid window January 5, 2027, with a target close of March 10, 2027. To bid, a supplier must be enrolled, accredited for every item in the category (no exemptions), and have every required state license in PECOS by the close of the window. CMS told prospective bidders to submit enrollment applications "as soon as possible" after the moratorium so the contractors have time to process them. Suppliers without a contract cannot keep furnishing most of these items to Medicare patients once contracts start. See Round 2028: what suppliers need now.

Could another moratorium stop the application?

It could. CMS may impose a moratorium for six months at a time and extend it in six-month increments (42 CFR 424.570(b)); an application the contractor has already received before a moratorium starts is not affected (424.570(a)(1)(iv)). That is the strongest argument for a complete file, submitted promptly, rather than a rushed one that comes back. If a future moratorium does catch an application, the fee is refunded.

Where do Medicaid and private payers fit?

After the PTAN. Many state Medicaid programs require Medicare enrollment first; Texas Medicaid says all DME providers "must be Medicare-certified before applying," and New York requires site-specific Medicare approval before its application. Commercial and Medicare Advantage plans, and the network managers some of them use, usually ask for the PTAN and accreditation as well. See Medicaid DME enrollment and commercial DME networks.

How do we work with a new medical supply company?

We prepare the 855S, the supplier standards evidence and the bond and insurance documents for your surety and insurance agents. Once your authorized official approves White Glove Medical as a PECOS surrogate, we enter and submit the application; only your authorized official signs the certification, and we never hold your I&A login or PIN. Accreditation Readiness ($2,495) prepares your policies, files and a mock unannounced survey; the Medicare DMEPOS Enrollment Package is $1,295 for the first location; Medicaid DME Enrollment is $499 per state. Start with a $149 Readiness Review. You pay the CMS fee, the accreditation fee, fingerprinting and the bond premium directly. We do not sell bonds or equipment, and no one can promise a PTAN or a date.