First a Freeze, Then a Gate: CMS’s DMEPOS Playbook and Where It Goes Next

By Scott S. Driggs

Fraud in durable medical equipment billing is real, and it harms patients, taxpayers, and every honest provider who competes against it. In fiscal year 2025 alone, the Centers for Medicare & Medicaid Services (CMS) suspended payments to 167 DMEPOS (durable medical equipment, prosthetics, orthotics, and supplies) suppliers and revoked the billing privileges of 1,195. Efforts to keep bad actors out of the program deserve the industry’s support. Those same efforts, however, increasingly land on legitimate practices that simply grew, affiliated, or changed hands. The newest example is a prior approval requirement that can turn a routine ownership change into months of denied claims for providers who have done nothing wrong.

Orthopedic groups, podiatry practices, physical therapy clinics, and hospital-owned DME operations that fit patients with braces and walking boots now face a requirement CMS put in place on October 15, 2026. Under Probationary Prior Authorization (PPA), a DMEPOS supplier that is newly enrolled in Medicare, or that has recently changed hands, must obtain approval from its DME Medicare Administrative Contractor before it delivers any item on a CMS list of 40 codes. Nearly all of them are orthoses, from spinal and hip braces to knee braces, ankle-foot orthoses, and walking boots that many practices dispense daily.

CMS treats approval as a condition of payment. If the item goes out the door before a request is submitted and affirmed, the claim is denied, even if the item was medically necessary and well documented. The requirement lasts one year, and the year starts with the supplier’s first claim. Congress allowed CMS to impose this kind of oversight on new suppliers by program instruction rather than formal rulemaking, 42 U.S.C. § 1395cc(j)(3), which is why the code list can change with little warning.

Who counts as “new” is the critical question, and the answer reaches further than many in the industry expect. Under the regulation, it includes a supplier enrolling for the first time, a supplier reactivating a dormant enrollment, and a supplier that has undergone a qualifying ownership change. 42 C.F.R. § 424.527(a). CMS’s FAQs add that a new location of an existing supplier that receives its own billing number is treated as newly enrolled, and contractor guidance excludes retail pharmacies and grocery stores from the program. For DMEPOS suppliers, a qualifying change is not limited to a full sale. Even a change in majority ownership qualifies if it comes within 36 months of the supplier’s initial enrollment or its last majority change. In that case, the supplier’s billing privileges do not carry over, and it must enroll again as a new supplier. 42 C.F.R. § 424.551. The regulation does exempt internal restructurings, changes in business form with the same owners, and transfers resulting from an owner’s death.

Picture a five-physician podiatry group that, two years ago, brought its orthotics business in house and enrolled its own DMEPOS supplier. This fall, a regional health system acquires 60 percent of that supplier as part of a broader affiliation. The office, the staff, and the referral patterns do not change, and nobody in the clinic thinks of the business as new.

The following week, a diabetic patient with a foot ulcer is fitted with a pneumatic walking boot and goes home with it, as patients in that office always have. The claim is denied. Two years after enrollment, the 60 percent acquisition fell inside the 36-month window, which required the supplier to re-enroll and, on the regulation’s plain terms, made it “new” for PPA purposes. CMS has not addressed that point directly. The walking boot is on the list, and no one asked for approval before the boot left the office. Every listed brace and boot the practice dispenses the same way over the next year meets the same result, and the denials may not surface until weeks of revenue are already lost.

Health systems face the same risk from a different direction. When a system opens a new outpatient orthopedic clinic or adds a DME location that receives its own billing number, CMS treats that location as newly enrolled, even though the system has billed Medicare for decades. Staff at the new site will need to follow a process their colleagues at established sites do not.

The first question for any practice or system is whether a recent transaction or expansion has already placed it in a probationary year. Contractor notices describe the trigger as a 100 percent change in ownership, which understates the reach of the rules. Physician buy-ins and buy-outs, health system affiliations, roll-ups, and practice restructurings that cross the majority threshold within the 36-month window can all qualify, as can new locations and reactivated enrollments. CMS has not said so expressly for PPA, but in its pending CY 2027 home health proposed rule, it states that DMEPOS suppliers undergoing a non-exempt majority ownership change under § 424.551 must enroll as new suppliers and are therefore subject to moratoria. 91 Fed. Reg. 41,216 (July 6, 2026) (proposed rule). CMS also decides through the enrollment process whether a particular transaction counts. Timing matters as well. CMS’s FAQs apply PPA to suppliers whose enrollment is approved on or after October 15, 2026, while its webpage refers to enrollments effective on or after that date. For organizations that changed ownership or added a site around October 15, 2026, confirming status with the contractor is far safer than assuming an exemption.

The second question is operational. PPA does not change what Medicare covers or what the chart must show. It changes when the review happens. Practices that fit and dispense at the same visit will need to separate the fitting from delivery for listed items, build approval into scheduling, and make sure the treating physician’s note supports the item before the request goes in. Medicare DME contractors generally decide routine requests within about a week, so the change is manageable for practices that plan for it.

Preparation is what separates a manageable probationary year from a costly one, and the work begins before the first claim. Before a closing, affiliation, or new site goes live, the practices that fare best identify which listed codes they dispense most often and estimate how many requests they will submit each month. They designate one person to own the PPA process, map each step from order to delivery to claim, and work with referring physicians on documentation templates that capture what the contractor will look for. Knowing the first claim date allows the practice to calendar the full year and to tell patients that some items will be delivered a few days after the visit.

Once the year begins, the goal is to catch problems early. Tracking every request, affirmation, non-affirmation, and denial, with a review of the results at least monthly, makes that possible. Each non-affirmation is a lesson about what the contractor expects, and the pattern points to where retraining or template changes are needed. The urgent care exception is reserved for patients who genuinely cannot wait, and a documented reason matters, because those claims receive full prepayment review and overuse invites attention. A periodic internal audit of PPA claims gives the practice a ready answer if its first-year billing is later questioned.

CMS rarely announces its next enforcement step, but its public materials sometimes telegraph it. From inside the agency, a new enrollment or ownership change is the easiest point at which to manage risk, because the supplier is already under review. Read with that in mind, the agency’s recent record suggests a pattern. Citing the HHS Inspector General’s findings on fraud involving off-the-shelf orthotic braces, CMS froze new enrollments of certain DMEPOS suppliers with a six-month nationwide moratorium. 91 Fed. Reg. 9855 (Feb. 27, 2026). The freeze ended August 27, 2026, and seven weeks later PPA took effect. The door reopened, but with a gatekeeper.

The same sequence may be coming for hospices and home health agencies. Nationwide moratoria on new enrollments in both sectors run through November 13, 2026, unless CMS extends them. CMS’s own Federal Register notices announcing those moratoria cite the same statutory authority that supports PPA, and CMS has already placed newly enrolling hospices in Arizona, California, Nevada, Texas, Georgia, and Ohio in a provisional period of enhanced oversight. CMS reports that, as of June 2025, approximately 670 hospices in the original four states were subject to medical review under that program and 122 of them were revoked, an 18 percent revocation rate compared with an average of about 1 to 3 percent. 91 Fed. Reg. 27,946, 27,950 (May 15, 2026). That program already offers a working template: CMS notifies each new hospice by letter of its oversight period, subjects its claims to medical review that can include prepayment review, and warns that a failure to respond may lead to claim denials or revocation. Under the regulation, the period begins on the date of the first claim. 42 C.F.R. § 424.527(b).

The industry itself has asked for more of the same. In a December 2025 letter to CMS, the National Alliance for Care at Home and LeadingAge urged the agency to expand the oversight period to home health and other high-risk areas, noting that CMS can implement it quickly through program instruction, and to pair any targeted moratorium with that oversight in surrounding areas. A nationwide probationary period for new hospices and home health agencies, potentially paired with prior authorization or prepayment review, would fit both CMS’s pattern and the industry’s own recommendation.

Other signals point in the same direction. Because PPA rests on program instruction rather than rulemaking, CMS can add codes with little advance notice, and it has said it “may update this list if new vulnerabilities arise.” CMS, DMEPOS Probationary Prior Authorization webpage (last modified Sept. 29, 2026). The statute also lists payment caps, not only prior authorization, as a form of enhanced oversight, and separately allows CMS to withhold payment on a new DME supplier’s initial claims for 90 days in high-risk categories or areas. Neither is part of PPA, and their availability is a reminder that PPA is not the most restrictive tool available. Providers and their counsel can track these developments through a short list of sources: Federal Register moratorium notices and their extensions, the CMS PPA and prior authorization webpages, MAC bulletins, and CMS’s annual payment rules, where enrollment changes are often proposed.

A practice’s first-year record also matters to that future. At least one contractor has said it will review each supplier’s affirmation rate at the end of the probationary year to decide what happens next. A pattern of denials or non-affirmations is the kind of data that draws audits, payment suspensions, and revocation reviews later. A clean probationary year is a strong protection against that scrutiny.

None of this is an argument against CMS’s fraud fight. It is an argument for lawful providers to meet it on their own terms. Practices that treat the probationary year as an opportunity to demonstrate compliance, rather than an obstacle to work around, may be best positioned when the next enforcement tool arrives.

***Opinions expressed are those of the author and those quoted, and not necessarily the firm’s or their colleagues’.