When the Parent Company Gets in Trouble, Your Medicare Number May Too

By Elena Pak, Credentialing Department, WCH

A new CMS enrollment rule reaches past the provider to its owners. Here is what changes and what to check now.

For most of Medicare’s history, losing billing privileges was a consequence of your own conduct. A practice that billed improperly, lost a license or was convicted of a relevant crime could be removed from the program. A practice whose parent company had a problem elsewhere generally could not, at least not on that basis alone.

That has changed. In the final CY 2027 Home Health Prospective Payment System rule, released November 4, CMS widened its ability to revoke Medicare billing privileges, including when a provider’s parent company violates the rules of other federal health programs or runs into legal trouble. The agency estimates the changes will save taxpayers $82 million a year.

The placement is easy to miss. This is a home health payment rule, and the headline for that sector is a 2.4% pay increase. But the enrollment provisions apply mostly to all provider types, not just home health, and the AHA made the same point, noting that the rule contains significant provisions affecting provider enrollment for all Medicare provider types.

What the Rule Does

The core change is about whose conduct counts. Under the new authority, CMS can deny or revoke Medicare enrollment because of violations by a company’s owners or parent companies, whereas it could previously act only on a provider’s own violations. Triggers include a license suspended or revoked in another state, or a suspension by another federal healthcare program.

Timing matters too. According to Healthcare Dive, actions against providers will be retroactive to the date CMS or its contractors notify them of noncompliance. Other outlets describe the retroactive piece more broadly: Hospice News reports that CMS can now recover payments from providers whose enrollment is revoked across all revocation categories, regardless of the reason. The exact scope is worth confirming in the rule text, because it determines how much money is at risk between the problem and the notice.

Several other provisions came along:

CMS can revoke enrollment where a provider operates in a geographic area with an unusually high concentration of Medicare providers and suppliers.
It can act on convictions within the previous 10 years for certain misdemeanors involving sexual assault or financial misconduct.
For home health agencies, hospices and DMEPOS suppliers, CMS can deny or revoke enrollment for businesses sold within 36 months if they do not enroll as a new provider and complete accreditation or a state survey.
Permanent signage showing hours of operation, previously required of DMEPOS suppliers and imaging facilities, is being expanded to all Medicare providers and suppliers, at an expected $15.6 million in annual compliance costs.

The final version is also narrower than the proposal in places. AHCA/NCAL, a long-term care trade group, reported that CMS did not finalize, or substantially improved, several of the enrollment denial and revocation triggers it had commented on. The fact sheet is the place to check which ones.

Why CMS Is Doing This

The stated target is a specific kind of owner. Regulators say the rule addresses the rise of profit-maximizing companies, and that statutory blind spots limited their ability to stop fraud as ownership changes accelerated over the last decade. The context is a broader push: earlier this year CMS paused new Medicare enrollments for home health and hospice providers for six months, and the agency has promised more analytics-driven investigation of enrollment data.

Private equity is the unspoken subtext. Healthcare Dive links the rule to intense federal and state scrutiny of private equity ownership in healthcare. But the legal hook is ownership, not any particular type of investor. A hospital system, a physician-owned management company or a family-run chain with a troubled affiliate could, on the text as reported, be in the same position.

Industry groups worry about collateral damage. LeadingAge warned that the combined payment and enrollment changes may lead to more closures of home health agencies and the inability of remaining providers to take on new referrals, and said providers need clearer guidance on avoiding unintended affiliations. That concern is the main counterweight to CMS’s fraud-prevention rationale, and it is not trivial. A rule that reaches a clean subsidiary because of a parent’s separate problem can punish the patients and staff who depend on that subsidiary.

What Physician Groups and Practice Owners Should Do Now

*This is practical suggestion, not legal advice, and a health care attorney should review any specific situation.

Map your ownership chain. Know who sits above you: parent entities, management services organizations, investors with significant stakes, and managing employees. Compare that map with what your enrollment records show. Gaps are where surprises come from.

Monitor your owners, not just yourself. If your practice is part of a larger organization, ask how adverse actions elsewhere in that organization, such as a state license action or a suspension from another program, would be detected and reported to you. If the answer is that you would read about it in the news, that is a gap.

Revisit deal documents. Representations, notification duties and indemnities in management and acquisition agreements may not address the risk that a counterparty’s conduct could cost you billing privileges. If you are buying or selling, diligence should now include the other side’s affiliates.

Watch for the 36-month rule if you touch post-acute care. Physician-owned home health agencies, hospices, and DME suppliers face stricter consequences for ownership changes that skip new enrollment, accreditation, or survey.

Check your physical sites. The signage requirement is mundane, but if CMS enforces enrollment standards more actively, simple compliance gaps are the easiest to find.

Audit your enrollment data. Make sure ownership, managing employee and adverse action information in PECOS is current. Stale records can look like concealment.

The Open Questions

Two things will determine how far this reaches. One is how CMS applies it: how aggressively it uses the affiliate-based authority and how much notice providers get. The other is how it is challenged. Retroactive recoupment and liability for conduct the provider did not commit are the kinds of provisions that tend to be tested in appeals and in court. Until there are decisions and sub-regulatory guidance, the safest assumption is that the authority exists and may be used.

Sources