CMS Proposes Sweeping Expansion of Medicare Provider Enrollment Enforcement, Tucked Inside the CY 2027 Home Health Payment Rule

The Centers for Medicare & Medicaid Services (CMS) has proposed one of the broadest expansions of its Medicare provider enrollment enforcement authority in years — not through a standalone program-integrity rule, but as a major component of its annual Calendar Year 2027 Home Health Prospective Payment System (HH PPS) proposed rule. CMS issued the rule July 1, 2026, and it was published in the Federal Register on July 6, 2026, opening a public comment period that runs through 5:00 p.m. Eastern on August 31, 2026.

While the rule's core purpose is the routine annual update to Medicare home health payment rates, CMS used it as the vehicle for a wide-ranging set of amendments to the provider and supplier enrollment regulations at 42 CFR Part 424 — rules that apply not just to home health agencies, but to virtually every category of Medicare-enrolled provider and supplier nationwide. The proposals would make it easier for CMS to revoke and deny Medicare billing privileges, would make many more revocations retroactive, would sharply narrow the runway providers have to submit claims after a revocation, and would give CMS new tools aimed specifically at home health agencies, hospices, and durable medical equipment suppliers that undergo ownership changes shortly after enrolling in Medicare. Below, HealthBridge US walks through what CMS is proposing, why, and what it would mean for providers, suppliers, and the investors who own and finance them.

Quick-Read Summary

Before the details, here is the essential rundown of what CMS is proposing. The agency wants to convert most of its remaining prospective-only Medicare revocation grounds into retroactive ones, tying a provider's loss of billing privileges to the date noncompliance actually began rather than to a later notice date — a change CMS says will let it recover more improper payments, but one that would also compress, from 60 days to 15 days, the window revoked providers have to submit outstanding claims. CMS also wants to add several brand-new grounds for denying or revoking enrollment, including a discretionary authority to act against providers and suppliers operating in geographic areas CMS considers to have an excessive concentration of similar providers, without any fixed numerical threshold; new denial grounds tied to certain misdemeanor convictions, shared office suites with a previously revoked or denied provider, and identity-theft-based enrollment fraud; and a hospice-specific denial ground targeting medical directors and administrators who serve too many hospices or are located too far away to plausibly perform their duties. Separately, CMS wants to strengthen enforcement of the existing "36-month rule," which requires home health agencies, hospices, and durable medical equipment suppliers that change majority ownership shortly after enrolling to go through Medicare enrollment, survey, and accreditation again as if they were new entrants — a rule CMS says some transactions have been structured to sidestep. The proposed rule would also remove the current five-year lookback limit on disclosable business affiliations, broaden the legal definition of "affiliation" itself, expand who counts as a "managing employee" subject to background disclosure, and direct CMS enrollment forms to start asking suppliers whether their owners include private equity firms or real estate investment trusts. CMS is accepting public comments on all of these provisions through August 31, 2026.

Why This Matters Right Now

Medicare's provider enrollment system is often described, including by CMS itself, as the front-line "gatekeeper" of the Medicare program — the mechanism that determines who is allowed to bill Medicare in the first place, long before any individual claim is ever reviewed. For years, CMS has periodically expanded that gatekeeping authority in response to fraud schemes it says exploit gaps in the enrollment rules: shell entities that enroll briefly and disappear, ownership structures designed to obscure who actually controls a provider, and rapid post-enrollment sales — commonly called "flipping" — that let new owners take over a Medicare-participating business without CMS ever screening them the way it would screen a brand-new applicant.

This proposed rule continues that trajectory, but does so with unusual breadth. Rather than targeting a single narrow loophole, CMS is proposing changes across nearly every stage of the enrollment enforcement lifecycle: how revocations take effect, how far back they can reach financially, how long a barred provider can be kept out of the program on reapplication, what conduct can trigger a denial or revocation in the first place, and what CMS is entitled to know about a provider's ownership, management, and business relationships before and after enrollment. For an industry already navigating home health, hospice, and durable medical equipment sectors that CMS has flagged repeatedly as areas of elevated fraud and program-integrity concern, the proposal signals that enrollment compliance is becoming a more continuous and higher-stakes obligation, not a one-time hurdle cleared at initial application.

A Pattern of Escalating Enrollment Enforcement

This proposed rule did not emerge in isolation. CMS has steadily expanded its Medicare provider enrollment enforcement toolkit over roughly the past decade, adding new denial and revocation grounds, tightening affiliation-disclosure rules, and building out the enrollment moratorium and preclusion-list authorities that today already give the agency considerable discretion to keep providers with troubled histories out of the program or remove them once enrolled. Each expansion has generally followed a similar pattern: CMS identifies a specific fraud or program-integrity pattern its existing authorities don't clearly reach, then proposes a new or broadened rule addressing that specific gap.

What distinguishes this proposed rule is less any single new authority than its cumulative scope — touching retroactivity, reapplication bars, multiple new denial and revocation grounds, affiliation disclosure, managing-employee definitions, and ownership transparency essentially all at once, within a single rulemaking cycle. CMS frames the breadth of the package as a reflection of how many distinct evasion patterns it says it continues to observe across enrolled providers and suppliers, from undisclosed ownership changes to management arrangements structured around the 36-month rule to enrollment attempts built on stolen identities. Critics of rapid, broad enrollment-enforcement expansions have, in past rulemaking cycles, raised concerns that removing structured regulatory factors — such as those CMS proposes to remove from its abuse-of-billing-privileges and reapplication-bar authorities in this rule — trades predictability and due-process clarity for broader agency discretion, a tension likely to feature in public comments on this rule as well.

Background: Where This Rule Comes From

CMS updates home health payment rates annually, as required by law, and its home health rulemaking has increasingly become a vehicle for policy changes that reach well beyond payment mechanics — a pattern also visible in the CY 2025 HH PPS final rule, which added the home health "acceptance-to-service" Condition of Participation covered elsewhere in CMS's regulatory calendar this cycle. The CY 2027 HH PPS proposed rule follows that same pattern, pairing its home health-specific payment and quality provisions with an extensive set of Medicare-wide provider enrollment amendments.

On the payment side, the proposed rule would apply a 2.1% home health payment update for CY 2027, an increase CMS estimates at roughly $370 million, alongside other adjustments including an updated outlier fixed-dollar-loss ratio and a continued temporary payment reduction tied to CMS's ongoing recoupment of past overpayments linked to the 2020 shift to 30-day payment periods and the Patient-Driven Groupings Model. Combined, CMS estimates aggregate Medicare payments to home health agencies would rise by about 2.4%, or roughly $420 million, in CY 2027 relative to CY 2026 under the proposed policies. The rule separately proposes to recalibrate case-mix weights, update low-utilization payment thresholds, seek comment on a home health-specific wage index, and address a range of other home health quality-reporting and durable medical equipment coverage topics, including implementation of a Consolidated Appropriations Act, 2026 provision expanding durable medical equipment coverage for certain home infusion pumps and drugs beginning April 1, 2027.

It is the rule's provider enrollment provisions, however, that carry the broadest reach — because unlike the home health-specific payment and quality provisions, the enrollment amendments would apply to essentially every type of Medicare-enrolled provider and supplier, not just home health agencies, even though CMS chose to advance them through home health rulemaking.

The table below summarizes several of the most consequential proposed changes, comparing current Medicare enrollment rules to what CMS has proposed.

Making Revocations Retroactive: The Biggest Structural Change

Under current Medicare enrollment rules, when CMS revokes a provider's or supplier's billing privileges, that revocation sometimes takes effect prospectively — typically 30 days after CMS or its contractor mails the revocation notice — and sometimes takes effect retroactively, reaching back to the date the underlying noncompliance actually began, depending on which specific regulatory ground supports the revocation. CMS is proposing to largely eliminate that split by converting most of its remaining prospective-only revocation grounds into retroactive ones under 42 CFR § 424.535(g).

CMS's stated rationale is straightforward: the agency takes the position that Medicare should not pay for services rendered during a period when a provider was not actually in compliance with enrollment requirements, regardless of when CMS got around to sending a revocation notice. Under the proposal, revocations tied to general enrollment noncompliance would become effective on the date that noncompliance began, revocations for false or misleading information would similarly reach back to when the false information was submitted or when a requirement stopped being met, and a long list of program-integrity and conduct-based revocation grounds — including terminations from Medicaid or other federal health programs, Drug Enforcement Administration registration actions, improper prescribing, False Claims Act judgments, Treasury-referred debts, undue-risk affiliations, and billing from noncompliant locations, among others — would likewise become retroactive. Where a single uniform effective date isn't administratively workable for a given ground, CMS proposes to simply determine, itself or through its contractor, the date on which it believes the provider should have been revoked.

The practical effect, if finalized, is a meaningful increase in providers' financial exposure to retroactive Medicare recoupment: a provider found noncompliant could see its billing privileges — and the corresponding Medicare payments already received — invalidated back to a point in time well before it received any notice from CMS. CMS is pairing that change with a second, tightly related proposal: shortening the window revoked providers and suppliers have to submit outstanding claims for services furnished before the revocation, from the current 60 calendar days down to just 15 days, and measuring that shortened window from the date of the revocation notice letter itself rather than from the revocation's now-often-retroactive effective date — since measuring from an already-past effective date could otherwise leave providers with essentially no time to submit claims at all.

New and Expanded Grounds for Revocation

Beyond the retroactivity changes, CMS is proposing several entirely new bases on which it could revoke a provider's or supplier's Medicare enrollment, along with expansions of authorities that already exist.

The most structurally novel of the new grounds is a proposed "high-risk enrollment" authority under 42 CFR § 424.535(a)(24), which would let CMS revoke enrollment where it determines that a provider or supplier's location presents an elevated fraud, waste, or abuse risk simply because it operates within a geographic area CMS considers to have an excessive concentration of similar providers or suppliers — citing, as an example, clusters of home health agencies or hospices operating out of the same building, suite, or tightly bounded neighborhood. Notably, CMS is not proposing any fixed numerical threshold defining what counts as excessive concentration, nor would the agency be required to first establish that actual fraud, waste, or abuse has occurred; the proposal is built around CMS's discretionary, fact-specific risk assessment rather than an objective, rules-based trigger. CMS states it does not intend to target legitimate providers merely for operating near others, but the absence of clear numerical guardrails means providers in densely served markets, or providers that share office space for legitimate operational reasons, may face a genuinely open-ended risk assessment rather than a bright-line test.

CMS is also proposing a new revocation ground tied to certain misdemeanor convictions, under proposed 42 CFR § 424.535(a)(16), reaching providers and suppliers — or their owners, managing employees, officers, directors, or managing organizations — convicted within the preceding ten years of a federal or state misdemeanor involving sexual assault or financial misconduct that CMS determines is detrimental to the Medicare program or its beneficiaries. This proposal is narrower than a broader misdemeanor-conviction concept CMS floated in a 2023 physician payment rulemaking cycle but ultimately did not finalize after receiving stakeholder pushback, suggesting CMS has scoped this version more specifically in response to that earlier experience.

Among expansions to existing revocation authorities, CMS's proposed changes to its "abuse of billing privileges" authority under 42 CFR § 424.535(a)(8)(ii) are likely to draw particular attention from providers with a history of billing errors. CMS already has authority to revoke enrollment where a provider has a pattern or practice of submitting noncompliant claims, but current regulations list specific factors CMS must weigh in that analysis, including claim denial rates and any prior adverse actions. CMS is proposing to eliminate those guiding factors entirely, arguing they can inappropriately shield providers with recurring billing problems from revocation simply because they lack a formal adverse-action history or maintain a comparatively low overall denial rate. CMS is explicit that it is not proposing to eliminate the underlying "pattern or practice" requirement itself, and states it does not intend to establish a minimum claims-volume threshold or invoke the authority routinely — but removing the specific regulatory factors would nonetheless hand CMS considerably more discretion in deciding, case by case, what constitutes an abusive billing pattern.

CMS is likewise proposing to broaden its existing false-or-misleading-information revocation authority under 42 CFR § 424.535(a)(4). Today, that authority is generally limited to false information certified on formal Medicare enrollment applications. CMS's proposal would extend it to false or misleading information submitted in connection with any CMS or Medicare enrollment-related form or supporting documentation — expressly naming, among other examples, electronic funds transfer authorization forms, home health agency capitalization documentation, physician opt-out affidavits, and records used to establish authorized or delegated official status, while making clear that list is illustrative rather than exhaustive. CMS would also drop the current requirement that the false information have been submitted specifically for the purpose of obtaining or maintaining enrollment, meaning the authority could reach inaccuracies in a far broader range of routine enrollment-related paperwork than it does today.

Rounding out the revocation-side proposals, CMS wants to expand its authority under 42 CFR § 424.535(i) to revoke a provider's other, otherwise-compliant Medicare enrollments not only when one of its enrollments is formally revoked, as current rules allow, but also when a separate enrollment application from that same provider is denied on certain grounds — reasoning that some denial scenarios, such as those involving false information or a non-operational practice location, reflect on the provider's overall trustworthiness rather than on the specific application at issue alone. This would matter most for organizations that hold multiple Medicare enrollments under common ownership, since a single denied application could now put a provider's existing, otherwise-compliant billing privileges at risk elsewhere in its portfolio.
New and Expanded Grounds for Denial

Parallel to its revocation proposals, CMS is proposing several changes on the enrollment-denial side — the point at which CMS decides not to let a provider or supplier into the Medicare program, or back into it, in the first place.

Mirroring its revocation proposal, CMS wants to broaden its existing debt-based and payment-suspension-based denial authorities under 42 CFR § 424.530(a)(6) and (a)(7). Today, those authorities generally reach the enrolling provider and its owners. CMS's proposal would extend both to managing employees, managing organizations, and any individual or entity that maintains a broader "business or financial relationship" with the provider — a term CMS does not precisely define in the proposed rule, but explains is meant to capture parties who exert real influence over a provider's operations without necessarily holding a formal ownership or management title, out of concern that such relationships could otherwise be used to sidestep the debt and suspension-based denial rules through informal or non-titled arrangements.

CMS also proposes to broaden its existing denial authority tied to program terminations and licensure actions under 42 CFR § 424.530(a)(14) in two ways: extending it to a provider's owners, managing employees, and managing organizations (not just the enrolling provider itself), and extending it to cover licenses that were voluntarily surrendered in lieu of formal disciplinary action, on the theory that a voluntary surrender under threat of discipline typically reflects the same underlying concerns as an outright suspension or revocation.

Among entirely new denial grounds, CMS is proposing a mirror-image misdemeanor-conviction denial authority under proposed 42 CFR § 424.530(a)(16), paired with a corresponding update to the regulatory definition of "final adverse action" to formally capture these convictions. CMS also proposes a new denial ground under proposed 42 CFR § 424.530(a)(19) reaching applicants whose practice location shares a suite or office with a provider whose own enrollment has already been denied or revoked — while stressing that shared office space alone would not automatically trigger denial, and that CMS would evaluate the specific facts of each shared-location arrangement before acting.

Two additional new denial grounds are narrower in scope but notable for the sectors they target. A hospice-specific proposal under proposed 42 CFR § 424.530(a)(20) would allow CMS to deny enrollment where a hospice's medical director or administrator simultaneously serves in a comparable role at multiple other hospices, is based too far away from the hospice to realistically fulfill their duties, or lacks an active physician license in the relevant state — a direct response to CMS's continued concerns about hospice governance and clinical oversight. A separate, identity-fraud-focused proposal under proposed 42 CFR § 424.530(a)(21) would let CMS deny enrollment where an applicant attempts to enroll using another individual's or entity's identity, addressing a pattern CMS says it has increasingly encountered involving stolen credentials and fraudulent enrollment activity carried out without the knowledge of the physician or practitioner whose identity was used.

Cracking Down on the 36-Month Ownership-Change Rule

Among the enrollment proposals most likely to affect healthcare transactions specifically, CMS is proposing new denial and revocation authorities — under proposed 42 CFR §§ 424.530(a)(22) and 424.535(a)(25) — aimed squarely at enforcing the existing "36-month rule" that applies to home health agencies, hospices, and durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers.

Under current rules, a home health agency or hospice that undergoes a change in majority ownership within 36 months of its initial Medicare enrollment, or within 36 months of a prior ownership change, generally must enroll as an entirely new provider, undergo a fresh state survey or accreditation review, and obtain a new Medicare provider agreement, unless a specific regulatory exception applies; DMEPOS suppliers face a parallel requirement. The rule exists specifically to prevent "flipping" — enrolling a provider and then quickly selling it to a new owner who never goes through Medicare's full screening process — and to ensure CMS can properly vet new ownership before it takes over a Medicare-participating operation.

CMS states in the proposed rule that it continues to see attempts to work around this requirement, including ownership changes that go undisclosed to Medicare altogether, and more subtle arrangements in which a management agreement, transition services agreement, or similar contractual structure effectively hands a new owner practical operational control of a provider well before any formal ownership transfer takes place — timed so that the formal transfer doesn't occur, on paper, until after the 36-month window has already expired. CMS's proposed new denial and revocation authorities would let the agency act against home health agencies, hospices, and DMEPOS suppliers that CMS determines have failed to comply with the underlying change-in-ownership requirements, with the revocation, where applicable, becoming effective on whatever date CMS or its contractor determines the provider should have been revoked.

The significance of this proposal extends well beyond any single transaction: healthcare attorneys who advise on home health, hospice, and DMEPOS mergers and acquisitions have flagged it as potentially the single most consequential enrollment change in the proposed rule from a deal-structuring standpoint, since it signals that CMS intends to scrutinize the practical substance of pre-closing management and governance arrangements — not just the formal date an ownership transfer is signed and recorded — when evaluating whether the 36-month rule has been honored or circumvented.

A Much Broader Reapplication Bar

Separate from its revocation and denial proposals, CMS wants to significantly expand its authority to bar a rejected applicant from reapplying for Medicare enrollment for an extended period. Under current rules, CMS can impose a reapplication bar of up to ten years, but only in one specific circumstance: when an enrollment application is denied because it contained false or misleading information. CMS is proposing to extend that authority to any enrollment denial issued under 42 CFR § 424.530(a) — meaning any of the numerous denial grounds described throughout this article, existing and newly proposed alike, could potentially trigger a multi-year bar on reapplying, not just the false-information ground.

CMS argues that many of its other denial grounds — such as exclusion from other federal health programs, disqualifying felony convictions, enrollment at non-operational practice locations, or attempting to re-enroll under a different identity after a prior revocation — reflect program-integrity concerns just as serious as, or more serious than, submitting false information on an application, and that limiting the reapplication bar to that single ground lets some clearly problematic applicants simply reapply again and again until they succeed. CMS also proposes to eliminate the specific factors that currently guide whether and how long a bar should last, factors that were originally designed around the false-information scenario specifically and, in CMS's view, don't translate well across its full, expanding menu of denial grounds. The proposed ten-year statutory maximum would remain in place, but CMS would gain substantially more discretion both in deciding whether to impose a bar at all and in setting its length within that ceiling.

Ownership Transparency: Affiliations, Managing Employees, and Private Equity Disclosure

A separate cluster of proposals would expand what CMS knows — and requires providers to disclose — about ownership, management, and business relationships, independent of any specific revocation or denial action.

The most far-reaching of these involves CMS's existing affiliation-disclosure framework under 42 CFR §§ 424.502, 424.519, 424.530(a)(13), and 424.535(a)(19). Current rules generally require disclosure of certain "affiliations" — defined categories of ownership, control, or reassignment relationships between a provider and other individuals or entities — but only for affiliations that existed within the preceding five years. CMS is proposing to eliminate that five-year lookback entirely, meaning historical affiliations would remain disclosable indefinitely, regardless of how long ago they existed or ended. CMS also proposes adding a sixth category to the regulatory definition of "affiliation" itself, sweeping in marketing, business, fulfillment, financial, managerial, and beneficiary-related relationships not already captured by the existing five categories — a substantial broadening of what counts as a reportable relationship in the first place. CMS would further clarify that affiliations involving a provider's managing employees or managing organizations, not just its formal owners, can independently support a denial or revocation.

Relatedly, CMS is proposing to expand and clarify the regulatory definition of "managing employee" under 42 CFR § 424.502 by specifically calling out additional categories of clinical and operational personnel who should generally be disclosed whenever they meet the existing managerial-control standard — a change CMS frames as a clarification of current policy, but one that would likely draw more individuals, particularly clinical leaders, department heads, and service-line directors at larger organizations, into the population whose backgrounds and histories become relevant to Medicare enrollment screening.

Finally, without proposing any change to the underlying regulatory text, CMS signals its intent to revise several standard Medicare enrollment forms — including the CMS-855B, CMS-855S, and CMS-20134 — to add a new disclosure item asking suppliers to identify whether any of the organizations they disclose as owners are private equity companies or real estate investment trusts. CMS does not propose any substantive consequence tied specifically to PE or REIT ownership itself, but the proposal, read alongside CMS's broader push to expand the false-or-misleading-information denial and revocation authorities described earlier in this article, means an inaccurate answer to that new disclosure question could itself become grounds for enrollment consequences once the expanded false-information authority is in place.

Smaller Procedural Changes Worth Noting

Alongside its higher-profile enforcement proposals, CMS included a handful of more modest procedural updates. The agency proposes to formally codify its existing practice of allowing corrective action plans in response to certain enrollment denials, not just revocations, extending a process previously associated mainly with revocation remediation to a broader set of denial scenarios. CMS also proposes to allow enrollment determinations, reconsideration decisions, denials, revocations, and related notices to be delivered electronically by email, in addition to the traditional mail-based notice process — a change that, combined with the proposal to measure the shortened post-revocation claims-filing window from the date of the revocation notice letter, underscores the practical importance of providers monitoring all channels, not just physical mail, for time-sensitive CMS enrollment correspondence going forward.

CMS separately proposes revisions to its enrollment moratorium authority — the mechanism CMS uses to temporarily halt new enrollments in a given provider category or geographic area when it identifies a heightened risk of fraud, waste, or abuse in that space — aimed at strengthening the agency's ability to freeze new enrollments in sectors or regions presenting elevated program-integrity concerns. Read alongside the proposed geographic-concentration revocation ground described earlier, the moratorium revisions suggest CMS wants a more coordinated set of tools for addressing markets it views as oversaturated with a particular provider type: the moratorium authority to prevent new entrants from a given area, and the geographic-concentration revocation ground to address existing enrollees already operating there.

CMS also proposes to expand its preclusion list authority — the list of individuals and entities barred from receiving payment for services or prescriptions furnished to Medicare Advantage and Part D enrollees, functioning as a parallel enforcement mechanism to standard fee-for-service enrollment revocation — to reach felony convictions involving a provider's or prescriber's owners, managing employees, managing organizations, officers, or directors, rather than being limited to convictions of the enrolled provider or prescriber personally. CMS's rationale mirrors its reasoning throughout the broader rule: individuals who exercise real influence over a provider's operations, even without being the named enrollee, can meaningfully affect program integrity, and CMS wants its enforcement authorities to reach those individuals directly rather than only the formally enrolled entity.

Timeline: What Happens When

July 1, 2026 — CMS issues the CY 2027 Home Health Prospective Payment System proposed rule, including its provider enrollment amendments.

July 6, 2026 — The proposed rule is published in the Federal Register, formally opening the public comment period.

By 5:00 p.m. Eastern, August 31, 2026 — The deadline for the public, including providers, suppliers, trade associations, and other stakeholders, to submit comments on the proposed rule to CMS.

Following the comment period — CMS will review public comments and determine which provisions to finalize, modify, or withdraw, typically publishing a final rule later in the year with most provisions taking effect for CY 2027, though CMS has not committed to specific effective dates for the individual enrollment provisions ahead of finalization.

April 1, 2027 — The proposed effective date for the separate, statutorily required expansion of durable medical equipment coverage for certain home infusion pumps and drugs under the Consolidated Appropriations Act, 2026, included elsewhere in this same proposed rule.

What This Means for Providers and Suppliers

For any Medicare-enrolled provider or supplier, not just home health agencies, hospices, and DMEPOS suppliers, the proposed rule's cumulative effect is to make enrollment compliance a materially higher-stakes, more continuously monitored obligation than it has been. Compliance teams should treat the shift toward retroactive revocations as reason to tighten ongoing monitoring of enrollment-related compliance in real time, rather than treating enrollment as a matter addressed once at initial application and again only at periodic revalidation, since noncompliance that persists undetected for months or years could, if this rule is finalized as proposed, translate into a revocation reaching all the way back to when the noncompliance actually began.

Organizations should also review the accuracy of the full range of documents they submit to CMS and its contractors — not just formal enrollment applications, but electronic funds transfer forms, capitalization documentation, opt-out affidavits, and other supporting paperwork — given the proposed expansion of the false-or-misleading-information authority to cover essentially any enrollment-related submission. Providers and suppliers that hold multiple Medicare enrollments under shared ownership should pay particular attention to the proposed cross-enrollment revocation authority, since a problem with one enrollment application could, under the proposal, place otherwise-compliant enrollments elsewhere in the same organization at risk. Given the proposed 15-day post-revocation claims-filing window, organizations should also confirm their billing and revenue-cycle teams have a clear, fast internal process for identifying a revocation notice — including by email, given CMS's proposed shift toward electronic notice — and rapidly reconciling and submitting any outstanding claims.

Home health agencies, hospices, and DMEPOS suppliers involved in any recent or pending ownership transition should specifically review that transaction's timing and structure against the 36-month rule, paying close attention to any management agreements, transition services arrangements, or similar contracts that could be read as transferring practical operational control ahead of a formal ownership change, given CMS's stated intent to scrutinize the substance of such arrangements rather than only their formal paperwork dates.

Providers operating multiple locations in close geographic proximity — a common arrangement for home health, hospice, and certain DMEPOS operations that share administrative space to control overhead — should also review their footprint against the proposed high-risk geographic-concentration ground, even absent any actual compliance problem, given that the proposal does not establish a numeric safe harbor and instead relies on CMS's discretionary risk assessment. Organizations in this position may want to consider whether their comments during the public comment period should request that CMS adopt clearer numerical thresholds or defined categories of legitimate shared-location arrangements, to reduce the open-ended quality of the proposed standard as currently drafted.

What This Means for Private Equity Sponsors and Healthcare Investors

For private equity sponsors, platform operators, lenders, and other healthcare investors, several provisions in this proposed rule carry direct transactional significance. The proposed changes to the 36-month rule enforcement mechanism raise the diligence bar for any acquisition of a home health agency, hospice, or DMEPOS supplier that enrolled, or last changed majority ownership, within the past three years, since deal structures relying on management or transition-services arrangements ahead of a formal closing may now draw more direct CMS scrutiny.

The proposed removal of the five-year affiliation lookback and the broadened definition of "affiliation" itself would meaningfully expand the historical ownership and business-relationship information relevant to Medicare enrollment diligence in any transaction involving a Medicare-enrolled target, since affiliations that would currently have aged out of the disclosure requirement after five years would, under the proposal, remain disclosable indefinitely. Combined with the proposed expansion of the "managing employee" definition, investors evaluating a potential acquisition or platform build may need to expand the scope of pre-transaction background diligence to a broader set of clinical and operational leaders than current practice typically requires. And while CMS's proposed addition of a private-equity and REIT ownership disclosure field to standard enrollment forms would not, on its own, create new substantive restrictions on PE or REIT ownership of Medicare providers, it reflects a level of continued regulatory interest in that ownership structure that investors in the space should expect to see reflected in future rulemaking cycles as well.

The Bigger Picture

Taken together, the enrollment provisions in this proposed rule describe a CMS that increasingly views Medicare enrollment not as a discrete, front-door screening event, but as an ongoing compliance relationship subject to continuous risk reassessment — one where noncompliance can be identified and financially unwound well after the fact, where a single problematic application can jeopardize an organization's broader Medicare footprint, and where CMS wants visibility into ownership and management relationships that extends further back in time and further down an organization's management structure than current rules require.

That shift is most visible in the home health, hospice, and DMEPOS sectors specifically targeted by the proposed 36-month rule enforcement mechanism and the hospice medical director and administrator denial ground — sectors CMS has repeatedly flagged in recent years as areas of elevated fraud and program-integrity concern. But because most of the proposed changes amend Medicare-wide enrollment regulations at 42 CFR Part 424 rather than home health-specific rules, their reach extends across virtually the entire Medicare provider and supplier community. Whether CMS finalizes these proposals as written, narrows them in response to public comment, or adjusts specific thresholds and definitions, the comment period running through August 31, 2026 represents the primary opportunity for affected providers, suppliers, and investors to shape the final outcome before these authorities potentially take effect.

Given how many separate, individually significant proposals are bundled into this single rulemaking — retroactivity, reapplication bars, new geographic and misdemeanor-based grounds, 36-month rule enforcement, affiliation disclosure, and private-equity ownership transparency among them — stakeholders across the home health, hospice, and DMEPOS sectors, along with the broader Medicare provider and supplier community and the investors who finance them, have a relatively narrow window to evaluate the full scope of what CMS is proposing and to weigh in before any of it becomes binding.

Frequently Asked Questions

What rule contains these Medicare provider enrollment proposals? They appear within CMS's Calendar Year 2027 Home Health Prospective Payment System (HH PPS) proposed rule, issued July 1, 2026, and published in the Federal Register on July 6, 2026. Although the rule's primary purpose is the annual home health payment update, its enrollment provisions would amend Medicare-wide regulations at 42 CFR Part 424 affecting nearly all provider and supplier types.

When are comments on the proposed rule due? By 5:00 p.m. Eastern time on August 31, 2026.

What is the biggest proposed change to how revocations work? CMS wants to convert most of its remaining prospective-only revocation grounds into retroactive ones, tying a revocation's effective date to when the underlying noncompliance began rather than to a later notice date, which would significantly increase providers' exposure to retroactive Medicare payment recoupment.

How would the claims-filing window after a revocation change? CMS proposes shortening it from 60 calendar days to 15 calendar days, measured from the date of the revocation notice letter rather than the revocation's effective date.

What is the proposed "high-risk enrollment" ground? A new authority under proposed 42 CFR § 424.535(a)(24) that would let CMS revoke enrollment based on a provider or supplier operating in a geographic area CMS considers to have an excessive concentration of similar providers, without requiring proof of actual fraud or a fixed numerical threshold.

What is the 36-month rule, and how would this proposal change its enforcement? The 36-month rule requires home health agencies, hospices, and DMEPOS suppliers that change majority ownership within 36 months of initial enrollment, or a prior ownership change, to re-enroll as new providers and undergo new survey or accreditation review. CMS is proposing new denial and revocation authorities specifically to enforce this rule, aimed particularly at transactions structured around management or transition-services agreements that transfer practical control ahead of a formal ownership change.

How would the reapplication bar change? Currently, CMS can bar reapplication for up to ten years only for denials based on false information submitted with an application. The proposal would extend that authority to any enrollment denial ground, while keeping the ten-year statutory maximum in place.

What is changing about affiliation disclosure requirements? CMS proposes eliminating the current five-year lookback period, meaning affiliations would remain disclosable indefinitely, and proposes adding a sixth category to the definition of "affiliation" covering marketing, business, fulfillment, financial, managerial, and beneficiary relationships not currently captured.

Is CMS proposing to restrict private equity ownership of Medicare providers? No. CMS is proposing to add a disclosure field to certain enrollment forms asking suppliers to identify private equity or real estate investment trust ownership, but is not proposing substantive ownership restrictions tied to that disclosure in this rule.

Where can stakeholders submit comments on the proposed rule? Through the process described in the Federal Register notice for the CY 2027 HH PPS proposed rule, consistent with CMS's standard notice-and-comment rulemaking procedures.

Does this proposed rule only affect home health agencies? No. While it was issued through home health rulemaking, most of the provider enrollment amendments would revise Medicare-wide regulations at 42 CFR Part 424, affecting essentially all categories of Medicare-enrolled providers and suppliers. Certain specific provisions — the 36-month rule enforcement mechanism and the hospice medical director and administrator denial ground — are targeted specifically at home health agencies, hospices, and DMEPOS suppliers.

What is the "managing employee" definition change, and why does it matter? CMS proposes to expand and clarify which clinical and operational personnel qualify as "managing employees" subject to Medicare enrollment disclosure requirements when they meet the existing managerial-control standard. A broader definition means more individuals' backgrounds could become relevant to enrollment screening, denial, and revocation decisions, particularly at larger organizations with layered clinical leadership structures.

Would these changes take effect immediately if finalized? No. As a proposed rule, none of these provisions are currently in effect. CMS must review public comments submitted by August 31, 2026, and issue a final rule before any of these provisions could take effect, and CMS may modify, narrow, or decline to finalize individual provisions in response to comments received.

This article is based on CMS's Calendar Year 2027 Home Health Prospective Payment System proposed rule (CMS-1844-P), issued July 1, 2026, and published in the Federal Register on July 6, 2026, along with CMS's accompanying fact sheet and industry legal analysis of the rule's provider enrollment provisions. For the complete proposed rule and instructions on submitting comments, stakeholders should consult the official Federal Register notice and CMS's newsroom fact sheet directly.

Reporting: HealthBridge US Policy Desk