CMS CRUSH Initiative Explained: Proposed Program Integrity Changes and What They Mean for Provider Audits

In February 2026, the Centers for Medicare & Medicaid Services (CMS) launched a new anti-fraud rulemaking effort called CRUSH, short for "Comprehensive Regulations to Uncover Suspicious Healthcare." CMS issued a Request for Information (RFI) asking healthcare providers, suppliers, health plans, states, technology companies, patient advocates, beneficiaries, and others for ideas on how CMS could strengthen its ability to prevent, detect, and respond to fraud, waste, and abuse in Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and the Health Insurance Marketplace.

The CRUSH initiative has since moved toward formal rulemaking. Federal regulatory records show that CMS submitted a CRUSH proposed rule to the Office of Management and Budget (OMB) for review on August 7, 2026. The government's regulatory agenda describes the proposed rule as including provisions related to provider enrollment, medical review, investigations, and other program integrity oversight.

For healthcare providers, CRUSH is worth understanding now, even before a proposed rule is published. The RFI shows the topics CMS is considering, many of which could affect provider enrollment, ownership disclosure, identity verification, claim submission deadlines, payment suspensions, medical review, and the audit process.

This article explains what the CMS CRUSH initiative is, what the RFI asked, where the rulemaking stands, how CRUSH fits into CMS's broader program integrity strategy, and what providers can do to prepare. Because the proposed rule had not been published in the Federal Register as of this writing, this article describes topics under consideration, not final requirements.

What Is the CMS CRUSH Initiative?

CRUSH stands for Comprehensive Regulations to Uncover Suspicious Healthcare. CMS announced the initiative on February 25, 2026, at a White House event with Vice President JD Vance, HHS Secretary Robert F. Kennedy, Jr., and CMS Administrator Dr. Mehmet Oz. CMS described CRUSH as part of a broader set of anti-fraud actions announced that day, which also included:

• Deferring $259.5 million in quarterly federal Medicaid funding to Minnesota to prevent payment of questionable claims while further investigation was completed.

• A six-month nationwide moratorium on new Medicare enrollment for certain durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers.

• A nationwide call to action for Americans to support fraud prevention, including stakeholder input through the CRUSH RFI.

The CRUSH Request for Information

The RFI was published in the Federal Register on February 27, 2026, at 91 FR 9803 under file code CMS-6098-NC and Regulation Identifier Number (RIN) 0938-AV97. Comments were due March 30, 2026, and the comment period has closed.

The RFI explained that CMS already uses many program integrity tools, including provider enrollment screening, payment suspensions when there is a credible allegation of fraud or reliable indication of an overpayment, claims data analytics, automatic pre-payment edits, investigations and audits, post-payment medical review, revocations, re-enrollment bans, coordination with law enforcement, and provider education. CMS stated that it was looking for ways to strengthen this toolbox.

The RFI also noted that it did not necessarily seek comments on the full scope of topics that could be included in a future CRUSH rule, which means the eventual proposal could address additional areas.

Where the Rulemaking Stands

According to federal regulatory records:

• The RFI was published on February 27, 2026, and the comment period ended March 30, 2026.

• The Unified Agenda lists CRUSH (CMS-6098) at the proposed rule stage, with a projected notice of proposed rulemaking date of October 2026.

• OMB received the CRUSH proposed rule for review under Executive Order 12866 on August 7, 2026. As of this writing, the OMB review record shows the review as pending.

• OMB lists the proposed rule as not economically significant.

Once a proposed rule is published in the Federal Register, the public will have an opportunity to comment before CMS issues any final rule. Providers should watch the Federal Register and CMS announcements for publication.

What Topics Did the CRUSH RFI Cover?

The RFI was organized into thirteen topic areas. Each section asked stakeholders specific questions. The following summary explains each area in plain language.

A. Modifications to Program Integrity Requirements

CMS asked whether it could better use existing statutory authorities, and whether it should modify provider enrollment (including revocation), medical review, investigation, audit, payment suspension, and other program integrity policies to give CMS more authority and flexibility to act quickly against bad actors. CMS also asked how it could improve transparency about its oversight and enforcement activities.

This section also raised a Medicare Advantage question. CMS noted that it does not currently have affirmative regulatory authority to direct Medicare Advantage (MA) organizations and Part D sponsors to suspend payments to providers that operate only in Part C or Part D, and asked whether CMS should create requirements allowing MA organizations and Part D sponsors to implement payment suspensions similar to the Traditional Medicare authority under 42 CFR 405.371, and require suspensions when directed by CMS.

B. Enhanced Identity Proofing and Ownership Requirements

CMS stated that it has significant concerns about Medicare fraud perpetrated through international schemes with opaque ownership structures, including owners who live outside the United States or operate beyond the reach of U.S. law enforcement. CMS sought feedback on potential requirements for enhanced identity proofing of individuals associated with Medicare-enrolled entities, and on citizenship or legal residency requirements for ownership.

CMS currently requires fingerprinting and criminal background checks for individuals with a 5 percent or greater ownership interest in organizations in the "high" risk screening category under 42 CFR 424.518. The RFI asked whether this should be expanded to managing employees, owners with less than 5 percent, or other affiliated individuals.

C. Preclusion List and Medicare Advantage Enrollment Requirements

CMS asked how to improve the preclusion list so that providers revoked from Traditional Medicare cannot continue billing MA plans, and whether all providers and suppliers should be required to enroll in Traditional Medicare as a condition of billing MA plans.

D. Laboratory Tests, Including Genetic and Molecular Diagnostic Tests

CMS identified laboratory testing as a focus area of its Fraud Defense Operations Center and asked what new authorities, tools, data analytics, and methods would help CMS prevent and address fraud in lab tests, including genetic tests and molecular diagnostic tests.

E. Non-Participating DMEPOS Suppliers in Medicare Advantage

CMS asked what changes MA plans would need to deter fraud by non-participating DMEPOS suppliers and whether these suppliers should be accredited and enrolled in the same way as Traditional Medicare suppliers.

F. Reducing Fraudulent Medicare Parts A and B Claim Submissions

CMS asked about shortening claim filing deadlines. Currently, Medicare generally allows claims to be filed within 12 months of the date of service under 42 CFR 424.44. The RFI asked how a 90- to 180-day deadline would affect practices, which claim or provider types it would not suit, how a shorter deadline could be applied (for example, by supplier type, item, or provider), and whether current flexibilities should change.

G. Artificial Intelligence in Medicare Advantage Coding Oversight and Hospital Billing

CMS asked about artificial intelligence tools that help coders review large volumes of records, features that improve accuracy, how AI recommendations should be presented to reviewers, compliance risks, and whether AI can identify coding overpayments and underpayments and improve hospital billing.

H. Beneficiary Solicitation

CMS asked whether it should pursue a legislative proposal to expand the existing prohibition on unsolicited telephone contact by DMEPOS suppliers to other provider and supplier types, and whether DMEPOS suppliers should be explicitly prohibited from working with marketing agencies or third parties that solicit on their behalf.

I. Beneficiary Contact

CMS asked how beneficiaries would prefer to be contacted about suspicious claims and whether they would want contact before or after claims are processed. CMS encourages beneficiaries to review their Medicare Summary Notices to identify unfamiliar or potentially fraudulent items or services.

J. Surety Bonds

CMS asked how to strengthen the DMEPOS surety bond requirement, which is currently at least $50,000, including by raising the amount, extending bond requirements to other provider types, or taking action against bond companies that fail to pay. CMS also asked about surety bonds in Medicaid and CHIP, including for home health providers.

K. Medicaid and CHIP

CMS asked how it could expand its regulatory authority to act quickly against Medicaid and CHIP fraud, whether states should require high-risk providers to revalidate more often than every five years, and what tools or technologies could improve program integrity in Medicaid managed care and fee-for-service programs.

L. State-Specific Medicaid and CHIP Questions

CMS asked what changes would help states reduce fraud, how CMS could empower states to pursue bad actors, whether databases such as Do Not Pay could help states shift toward pre-payment review, which state practices could be replicated, and what incentives or penalties could drive state program integrity efforts.

M. Health Insurance Exchanges

CMS asked how it could strengthen oversight of agents, brokers, web-brokers, and direct enrollment entities in the Federally Facilitated Exchange and State-Based Exchanges.

Key Program Integrity Terms Providers Should Know

Many of the topics in the CRUSH RFI build on existing Medicare and Medicaid concepts. Understanding these terms makes it easier to follow the rulemaking and to evaluate how a proposed change might affect your organization.

• Provider enrollment screening. CMS assigns providers and suppliers to limited, moderate, or high screening risk levels under 42 CFR 424.518. Higher risk levels involve additional requirements, such as site visits and, for high-risk categories, fingerprint-based criminal background checks for certain owners.

• Revalidation. Providers and suppliers must periodically resubmit and recertify their enrollment information. In Medicaid, states generally revalidate providers at least every five years, and the RFI asked whether high-risk providers should revalidate more often.

• Revocation. CMS can revoke a provider's Medicare billing privileges for reasons listed in 42 CFR 424.535, which generally comes with a re-enrollment bar.

• Payment suspension. CMS can withhold Medicare payments under 42 CFR 405.371 based on reliable information of an overpayment or a credible allegation of fraud.

• Pre-payment review. Claims are reviewed for documentation and medical necessity before payment is made.

• Preclusion list. A CMS list of providers and prescribers who are precluded from receiving payment for Medicare Advantage items and services or Part D drugs.

• Enrollment moratorium. A temporary pause on new enrollment of certain provider or supplier types in certain areas, used when CMS identifies a high risk of fraud.

• Surety bond. A financial guarantee that certain providers, such as DMEPOS suppliers, must obtain to help ensure the government can recover overpayments.

How CRUSH Fits Into CMS's Broader Program Integrity Strategy

CRUSH is part of a larger shift that CMS describes as moving from "pay and chase" toward "stop and caught," in which suspicious payments are stopped before they leave the trust funds. Other parts of this strategy include:

• The Fraud Defense Operations Center (FDOC), launched in March 2025, which CMS reports suspended more than $1.8 billion in Medicare payments across 249 providers and suppliers in 2025.

• The Medicaid Fraud War Room, launched in April 2026 in coordination with the White House Task Force to Eliminate Fraud.

• Enrollment moratoria, including the DMEPOS moratorium announced in February 2026 and the six-month national moratoria on new hospice and home health agency enrollments implemented in May 2026.

• Increased payment suspensions and revocations. CMS reported 537 Medicare payment suspensions, $5.7 billion on hold at the end of 2025, and 5,586 provider and supplier revocations in 2025.

CMS's March 2026 congressional testimony also described CRUSH as part of the agency's effort to engage stakeholders and gather innovative ideas, including concepts such as replacing static identifiers with transaction-based tokens, verifying provider identity in real time, and sending real-time alerts to beneficiaries.

What CRUSH Could Mean for Provider Audits

Because the proposed rule had not been published at the time of writing, no one outside the government can say exactly what it will include. However, based on the RFI topics and the regulatory agenda description, providers can consider several possible implications.

Faster and Broader Administrative Action

The RFI asked how CMS could gain more authority and flexibility to act quickly through enrollment, revocation, medical review, investigations, audits, and payment suspensions. If adopted, changes in these areas could mean that administrative actions occur earlier in a review, with less time between detection and consequence.

Payment Suspensions Beyond Traditional Medicare

If CMS establishes a framework for MA organizations and Part D sponsors to suspend payments, providers that bill MA plans could face payment suspension risk in those programs similar to the risk that exists in Traditional Medicare.

More Scrutiny of Ownership and Identity

Enhanced identity proofing, expanded fingerprinting, and ownership restrictions would increase the importance of accurate ownership and managing employee disclosures. Inaccurate or incomplete enrollment information could become a more significant audit and enrollment risk.

Shorter Claim Filing Windows

If claim filing deadlines were shortened, providers would need billing processes that can submit clean claims quickly, and delays in documentation could have larger financial consequences.

Medicare Advantage Enrollment Alignment

A requirement that providers enroll in Traditional Medicare to bill MA plans would bring more providers under Medicare enrollment screening and revocation rules.

More Frequent Revalidation in Medicaid

If states require high-risk Medicaid providers to revalidate more often, providers in high-risk categories could face more frequent enrollment reviews and site visits.

Increased Use of Technology in Review

The RFI's questions about artificial intelligence, data analytics, and databases such as Do Not Pay suggest continued growth in technology-driven review, which can increase the speed and volume of audits.

How Providers Can Prepare Now

The following steps reflect sound compliance practice and are useful regardless of the final content of the CRUSH rule.

Enrollment and Ownership

• Review your Medicare enrollment in the Provider Enrollment, Chain, and Ownership System (PECOS), including owners, managing employees, and practice locations.

• Confirm that ownership disclosures are complete and accurate, including indirect ownership.

• Track revalidation dates for Medicare and each state Medicaid program.

• Report changes within required timeframes.

• If you bill MA plans, confirm that you are not on the preclusion list and consider how enrollment requirements could affect you.

Documentation and Claims

• Strengthen documentation of medical necessity, orders, and delivery of services.

• Review how quickly claims are submitted after the date of service, and identify bottlenecks.

• Conduct regular internal audits, especially in areas CMS has identified as high risk, such as laboratory testing, DMEPOS, hospice, home health, and skin substitutes.

• If you use artificial intelligence tools for coding or documentation, maintain human oversight and audit outputs for accuracy.

Marketing and Beneficiary Contact

• Review marketing practices and third-party marketing arrangements.

• DMEPOS suppliers should confirm compliance with existing restrictions on unsolicited telephone contact.

• Make sure patient outreach is consistent with federal rules and the Anti-Kickback Statute.

Audit and Payment Suspension Readiness

• Establish a process for receiving and responding to Additional Documentation Requests, pre-payment review notices, and payment suspension letters.

• Understand the payment suspension and rebuttal rules at 42 CFR 405.371 through 405.375.

• Prepare a cash flow contingency plan in case of a payment suspension.

Stay Informed

• Monitor the Federal Register for publication of the CRUSH proposed rule.

• Review CMS's fraud prevention resources at CMS.gov.

• Consider submitting comments when the proposed rule is published, either directly or through professional associations.

Questions Leadership Teams Can Discuss Now

Healthcare leaders can use the CRUSH RFI as a framework for an internal readiness discussion. Useful questions include:

• Are our ownership disclosures in PECOS and state Medicaid systems complete and current, including indirect owners and managing employees?

• If identity proofing or fingerprinting requirements expanded to more owners or managers, would we be ready to comply quickly?

• How many days, on average, pass between the date of service and claim submission, and could we meet a shorter filing deadline?

• What share of our revenue comes from Medicare Advantage plans, and are all of our billing locations and clinicians enrolled in Traditional Medicare?

• Do we rely on marketing companies or other third parties to contact patients, and are those arrangements documented and compliant?

• If our payments were suspended tomorrow, how long could we continue operating, and who would lead our response?

• How are we using artificial intelligence in documentation, coding, or billing, and how do we audit its accuracy?

• Who on our team is responsible for monitoring the Federal Register and CMS announcements, and how will we decide whether to submit comments on the proposed rule?

Documenting the answers to these questions creates a baseline that will make it easier to respond when the proposed rule is published.

Frequently Asked Questions

Is CRUSH a final rule?

No. As of this writing, CMS has issued an RFI and submitted a proposed rule to OMB for review. A proposed rule must be published for public comment before CMS can issue a final rule.

What does CRUSH stand for?

CRUSH stands for Comprehensive Regulations to Uncover Suspicious Healthcare.

Which programs does CRUSH cover?

The RFI covered Medicare (including Medicare Advantage and Part D), Medicaid, CHIP, and the Health Insurance Marketplace.

Can I still comment on the CRUSH RFI?

No. The RFI comment period closed on March 30, 2026. Providers will have an opportunity to comment once the proposed rule is published.

Will CRUSH change payment suspension rules?

The RFI asked about modifying payment suspension policies and about allowing MA organizations and Part D sponsors to suspend payments. Whether and how these changes are proposed will be known when the proposed rule is published.

Which providers should pay the closest attention?

All providers should monitor CRUSH, but the RFI gave specific attention to laboratories, DMEPOS suppliers, providers billing MA plans, Medicaid providers in high-risk categories, home health providers, hospitals, and entities with complex or foreign ownership structures.

Conclusion

The CMS CRUSH initiative is a major anti-fraud rulemaking effort that could reshape provider enrollment, ownership verification, claim submission, payment suspensions, medical review, and audits across Medicare, Medicaid, CHIP, and the Marketplace. The RFI published in February 2026 shows the breadth of topics under consideration, and the proposed rule submitted to OMB in August 2026 is expected to turn some of those ideas into formal proposals.

Providers do not need to wait for the proposed rule to prepare. Accurate enrollment and ownership records, strong documentation, timely claims submission, careful oversight of marketing, regular internal audits, and a ready response plan for audits and payment suspensions will position providers well under current rules and under whatever changes CRUSH ultimately brings.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in program integrity, compliance, and audit readiness. We help providers review enrollment and ownership disclosures, strengthen documentation and billing practices, prepare for pre-payment review and payment suspensions, and track regulatory changes such as the CMS CRUSH initiative. If you would like help understanding how CRUSH may affect your organization and preparing for future audits, please get in touch with us. We will be happy to help you with this topic.

References

• Federal Register. Request for Information (RFI) Related to Comprehensive Regulations To Uncover Suspicious Healthcare (CRUSH), 91 FR 9803 (February 27, 2026). https://www.federalregister.gov/documents/2026/02/27/2026-03968/request-for-information-rfi-related-to-comprehensive-regulations-to-uncover-suspicious-healthcare

• Centers for Medicare & Medicaid Services. Trump Administration Prioritizes Affordability by Announcing Major Crackdown on Health Care Fraud. https://www.cms.gov/newsroom/press-releases/trump-administration-prioritizes-affordability-announcing-major-crackdown-health-care-fraud

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for February 26, 2026. https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-february-26-2026

• Office of Information and Regulatory Affairs, RegInfo.gov. Comprehensive Regulations to Uncover Suspicious Healthcare (CRUSH) (CMS-6098), RIN 0938-AV97, Unified Agenda entry. https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0938-AV97

• Office of Information and Regulatory Affairs, RegInfo.gov. Pending EO 12866 Regulatory Review, RIN 0938-AV97. https://www.reginfo.gov/public/do/eoDetails?rrid=1497865

• Federal Register. Introduction to the Unified Agenda of Federal Regulatory and Deregulatory Actions, 2026. https://www.federalregister.gov/documents/2026/08/14/2026-16603/introduction-to-the-unified-agenda-of-federal-regulatory-and-deregulatory-actions-2026

• U.S. Department of Health and Human Services. CMS Testimony on Combatting Medicare and Medicaid Fraud (March 17, 2026). https://www.hhs.gov/about/agencies/asl/testimony/2026/03/17/cms-testimony-on-combatting-medicare-and-medicaid-fraud.html

• Centers for Medicare & Medicaid Services, Center for Program Integrity. Crushing Fraud: Annual Report 2025. https://www.cms.gov/files/document/crushing-fraud-annual-report.pdf

• Centers for Medicare & Medicaid Services. Fraud Defense Operations Center Fast Facts. https://www.cms.gov/files/document/fdoc-fact-sheet-updated.pdf

• Centers for Medicare & Medicaid Services. Medicaid Fraud War Room Fast Facts. https://www.cms.gov/files/document/medicaid-fraud-war-room-fast-facts.pdf

• Centers for Medicare & Medicaid Services. Crushing Fraud: 2026 CMS Facts and Figures. https://www.cms.gov/files/document/cpi-quarterly-dashboard.pdf

• Electronic Code of Federal Regulations. 42 CFR 405.371, Suspension, Offset, and Recoupment of Medicare Payments. https://www.ecfr.gov/current/title-42/section-405.371

• Electronic Code of Federal Regulations. 42 CFR 424.44, Time Limits for Filing Claims. https://www.ecfr.gov/current/title-42/section-424.44

• Electronic Code of Federal Regulations. 42 CFR 424.535, Revocation of Enrollment in the Medicare Program. https://www.ecfr.gov/current/title-42/section-424.535

• Electronic Code of Federal Regulations. 42 CFR 424.518, Screening Levels for Medicare Providers and Suppliers. https://www.ecfr.gov/current/title-42/section-424.518

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/