42 CFR 424.518 – Screening levels for Medicare providers and suppliers
A Medicare contractor is required to screen all initial applications, revalidation applications, change of ownership applications pursuant to 42 CFR 489.18, applications to add a new practice location, and applications to report any new owner (regardless of ownership percentage) pursuant to a change of information or other enrollment transaction under title 42, based on a CMS assessment of risk and assignment to a level of “limited,” “moderate,” or “high.”
(a) Limited categorical risk—(1) Limited categorical risk: Provider and supplier categories. CMS has designated the following providers and suppliers as “limited” categorical risk:
(i) Physician or nonphysician practitioners (including nurse practitioners, CRNAs, occupational therapists, speech/language pathologists, and audiologists) and medical groups or clinics.
(ii) Ambulatory surgical centers.
(iii) Competitive Acquisition Program/Part B Vendors.
(iv) End-stage renal disease facilities.
(v) Federally qualified health centers.
(vi) Histocompatibility laboratories.
(vii) Home infusion therapy suppliers.
(viii) Hospitals, including critical access hospitals, rural emergency hospitals, Department of Veterans Affairs hospitals, and other federally owned hospital facilities.
(ix) Health programs operated by an Indian Health Program (as defined in section 4(12) of the Indian Health Care Improvement Act) or an urban Indian organization (as defined in section 4(29) of the Indian Health Care Improvement Act) that receives funding from the Indian Health Service pursuant to Title V of the Indian Health Care Improvement Act.
(x) Mammography screening centers.
(xi) Mass immunization roster billers
(xii) Opioid treatment programs (if § 424.67(b)(3)(ii) applies).
(xiii) Organ procurement organizations.
(xiv) Pharmacies newly enrolling or revalidating via the CMS-855B application.
(xv) Radiation therapy centers.
(xvi) Religious non-medical health care institutions.
(xvii) Rural health clinics.
(2) Limited screening level: Screening requirements. When CMS designates a provider or supplier as a “limited” categorical level of risk, the Medicare contractor does all of the following:
(i) Verifies that a provider or supplier meets all applicable Federal regulations and State requirements for the provider or supplier type prior to making an enrollment determination.
(ii) Conducts license verifications, including licensure verifications across State lines for physicians or nonphysician practitioners and providers and suppliers that obtain or maintain Medicare billing privileges as a result of State licensure, including State licensure in States other than where the provider or supplier is enrolling.
(iii) Conducts database checks on a pre- and post-enrollment basis to ensure that providers and suppliers continue to meet the enrollment criteria for their provider/supplier type.
(b) Moderate categorical risk—(1) Moderate categorical risk: Provider and supplier categories. CMS has designated the following providers and suppliers as “moderate” categorical risk:
(i) Ambulance service suppliers.
(ii) Community mental health centers.
(iii) Comprehensive outpatient rehabilitation facilities.
(iv) Independent clinical laboratories.
(v) Independent diagnostic testing facilities.
(vi) Physical therapists enrolling as individuals or as group practices.
(vii) Portable x-ray suppliers.
(viii) Prospective (newly enrolling) and revalidating opioid treatment programs that have been fully and continuously certified by the Substance Abuse and Mental Health Services Administration (SAMHSA) since October 23, 2018.
(ix) Revalidating opioid treatment programs that have not been fully and continuously certified by SAMHSA since October 23, 2018, revalidating DMEPOS suppliers, revalidating MDPP suppliers, revalidating HHAs, revalidating SNFs, and revalidating hospices to which CMS applied the fingerprinting requirements outlined in paragraph (c)(2)(ii) of this section upon the provider’s or supplier’s—
(A) New/initial enrollment; or
(B) Revalidation after CMS waived the fingerprinting requirements, under the circumstances described in paragraph (c)(1)(viii) of this section, when the provider or supplier initially enrolled in Medicare.
(2) Moderate screening level: Screening requirements. When CMS designates a provider or supplier as a “moderate” categorical level of risk, the Medicare contractor does all of the following:
(i) Performs the “limited” screening requirements described in paragraph (a)(2) of this section.
(ii) Conducts an on-site visit.
(c) High categorical risk—(1) High categorical risk: Provider and supplier categories. CMS has designated the following provider and supplier types as “high” categorical risk:
(i) Prospective (newly enrolling) home health agencies.
(ii) Prospective (newly enrolling) DMEPOS suppliers.
(iii) Prospective (newly enrolling) MDPP suppliers
(iv) Prospective (newly enrolling) opioid treatment programs that have not been fully and continuously certified by SAMHSA since October 23, 2018.
(v) Prospective (newly enrolling) (SNFs).
(vi) Prospective (newly enrolling) hospices.
(vii) Enrolled opioid treatment programs that have not been fully and continuously certified by SAMHSA since October 23, 2018, DMEPOS suppliers, MDPP suppliers, HHAs, SNFs, and hospices that are submitting a change of ownership application pursuant to 42 CFR 489.18 or reporting any new owner (regardless of ownership percentage) pursuant to a change of information or other enrollment transaction under title 42.
(viii) Except as stated in paragraph (b)(1)(ix) of this section, revalidating opioid treatment programs that have not been fully and continuously certified by SAMHSA since October 23, 2018, revalidating DMEPOS suppliers, revalidating MDPP suppliers, revalidating HHAs, revalidating SNFs, and revalidating hospices for which, upon their new/initial enrollment, CMS waived the fingerprinting requirements outlined in paragraph (c)(2)(ii) of this section in accordance with applicable legal authority due to a national, state, or local emergency declared under existing law.
(2) High screening level: Screening requirements. When CMS designates a provider or supplier as a “high” categorical level of risk, the Medicare contractor does all of the following:
(i) Performs the “limited” and “moderate” screening requirements described in paragraphs (a)(2) and (b)(2) of this section.
(ii)(A) Requires the submission of a set of fingerprints for a national background check from all individuals who maintain a 5 percent or greater direct or indirect ownership interest in the provider or supplier; and
(B) Conducts a fingerprint-based criminal history record check of the Federal Bureau of Investigation’s Integrated Automated Fingerprint Identification System on all individuals who maintain a 5 percent or greater direct or indirect ownership interest in the provider or supplier.
(3) Adjustment in the categorical risk. CMS adjusts the screening level from “limited” or “moderate” to “high” if any of the following occur:
(i) CMS imposes a payment suspension on a provider or supplier at any time in the last 10 years.
(ii) The provider or supplier—
(A) Has been excluded from Medicare by the OIG; or
(B) Had billing privileges revoked by a Medicare contractor within the previous 10 years and is attempting to establish additional Medicare billing privileges by—
(1) Enrolling as a new provider or supplier; or
(2) Billing privileges for a new practice location;
(C) Has been terminated or is otherwise precluded from billing Medicaid;
(D) Has been excluded from any Federal health care program; or
(E) Has been subject to any final adverse action, as defined at § 424.502, within the previous 10 years.
(iii) CMS lifts a temporary moratorium for a particular provider or supplier type and a provider or supplier that was prevented from enrolling based on the moratorium, applies for enrollment as a Medicare provider or supplier at any time within 6 months from the date the moratorium was lifted.
(4) Any screening level adjustment under paragraph (c)(3) of this section also applies to all other enrolled and prospective providers and suppliers that have the same legal business name and tax identification number as the provider or supplier for which the screening level under paragraph (c)(3) of this section was originally raised.
(d) Fingerprinting requirements. An individual subject to the fingerprint-based criminal history record check requirement specified in paragraph (c)(2)(ii)(B) of this section—
(1) Must submit a set of fingerprints for a national background check.
(i) Upon submission of a Medicare enrollment application; or
(ii) Within 30 days of a Medicare contractor request.
(2) In the event the individual(s) required to submit fingerprints under paragraph (c)(2) of this section fail to submit such fingerprints in accordance with paragraph (d)(1) of this section, the provider or supplier will have its billing privileges—
(i) Denied under § 424.530(a)(1); or
(ii) Revoked under § 424.535(a)(1).