PECOS Surrogate Access: Letting a Consultant Work on Your Enrollment

Medicare enrollment for a DME supplier happens in PECOS, and access to PECOS runs through the CMS Identity & Access Management System (I&A). A supplier that wants outside help with its enrollment does not need to hand anyone its password. I&A has a built-in mechanism for exactly this: the surrogate connection.

What is a PECOS surrogate?

CMS's I&A FAQ (January 20, 2026) defines it: "A surrogate is a user who has been permitted by a Provider (Individual or Organization) to work on that Provider's behalf in the business function(s), PECOS, NPPES, PEPPER, or CBR designated by the Provider." The relationship is called a connection: "one party is a Provider and one is a Surrogate. The Surrogate in the Connection is allowed to access the designated systems on the Provider's behalf."

The surrogate is an organization, not a person. "An Authorized Official or Access Manager for an Organization can make a request for their organization to work on behalf of a Provider. Once approved anyone in the Authorized Official or Access Manager's Organization (e.g., Staff) may work on behalf of that provider," subject to the surrogate organization granting staff access internally.

How is the connection set up?

Either side can start it in I&A under My Connections:

• The surrogate requests it. "If you want to work on behalf of a Provider as a surrogate, you must go to My Connections, select the 'Find Provider' button, search for the Provider you wish to work on behalf of, select that Provider, indicate the business function(s) that you want to access for that provider, and submit the request. The request will be sent to the Provider for approval."
• The supplier invites it. The supplier goes to My Connections, selects "Add Surrogate," searches for the surrogate organization, chooses the business functions, and submits; the request goes to the surrogate for approval.

On the supplier's side, the person who approves is the supplier's own authorized official or access manager in I&A. If invitations do not arrive, the FAQ notes the supplier's email on file may be outdated; the requester can add another email address to receive the notice.

What can a surrogate do?

Only what the supplier approves, in the systems it approves. "The Provider authorizes the business functions that the Surrogate can access," so a supplier can grant PECOS without NPPES. With a PECOS connection, the surrogate's staff can work on the supplier's enrollment record and applications. Approved connections "will not expire," which makes later changes of information and revalidations simpler.

What can a surrogate never do?

Sign. The FAQ is direct: "Individual Providers, Authorized Officials and Access Managers, or anyone else that is required to sign an enrollment application is still require to sign. Surrogates may not sign, electronically or otherwise, any application on behalf of another individual."

That matches the regulation. The certification "must be signed by an individual who has the authority to bind the provider or supplier, both legally and financially," with an ownership or control interest (42 CFR 424.510(d)(3)). An initial enrollment or revalidation must be signed by an authorized official, and a delegated official, who may sign later changes, "must be an individual with ownership or control interest in, or be a W-2 managing employee of" the supplier (42 CFR 424.502). An outside consultant cannot be either one.

The signature is personal for good reason. Section 14 of the CMS-855S cites criminal and civil penalties for false statements, and the authorized official's signature "legally and financially binds this supplier." Whoever prepares the file, the official should read it before signing.

Does using a surrogate slow enrollment down?

No. CMS answers that question in the FAQ: "The use of a Surrogate has no impact on the processing timeframes for your enrollment application." It does not speed it up either; the contractor's screening, fingerprinting and site visit run the same way.

Why not just share a login instead?

Because I&A credentials belong to one person, and the surrogate system makes sharing unnecessary. An I&A account is tied to the individual's identity and their multi-factor authentication. Keep your user ID, password, MFA device and any e-signature PIN to yourself. Anyone who asks for them instead of requesting a surrogate connection is a reason to look elsewhere.

Can a consultant also be the contact person?

Yes, separately. Section 13 of the 855S lets the supplier name a contact person, who "will only be authorized to discuss issues concerning this enrollment application." Several addresses on the form, including correspondence and revalidation notices, "cannot be a billing agency, Management Services Organization, or the supplier's representative," so official notices still come to you.

How do I end a surrogate connection?

At any time. "Either party may login and remove the surrogate's access by disabling the Connection at any time," and "By logging into I&A, the provider can remove the surrogate's access by disabling the connections with any entity they previously authorized." Review your connections when you change consultants or billing companies.

How does White Glove DME use surrogate access?

White Glove Medical LLC is registered in I&A as an organization. When your authorized official approves the connection for PECOS, we prepare the CMS-855S and its attachments, enter them in PECOS, and submit the application for your authorized official to sign. We may be listed as your section 13 contact so development requests reach us. We never hold your I&A login, MFA device or e-signature PIN, and we never act as your authorized or delegated official. The Medicare DMEPOS Enrollment Package is $1,295 for the first location; a Change of Information is $249 (see pricing). See the CMS-855S section by section for what goes into the application.