Title 42

SECTION 424.518

424.518 Screening levels for Medicare providers and suppliers.

§ 424.518 Screening levels for Medicare providers and suppliers.

A Medicare contractor is required to screen all initial applications, including applications for a new practice location, and any applications received in response to a revalidation request based on a CMS assessment of risk and assignment to a level of “limited,” “moderate,” or “high.”

(a) Limited categorical risk - (1) Limited categorical risk: Provider and supplier categories. CMS has designated the following providers and suppliers as “limited” categorical risk:

(i) Physician or nonphysician practitioners (including nurse practitioners, CRNAs, occupational therapists, speech/language pathologists, and audiologists) and medical groups or clinics.

(ii) Ambulatory surgical centers.

(iii) Competitive Acquisition Program/Part B Vendors.

(iv) End-stage renal disease facilities.

(v) Federally qualified health centers.

(vi) Histocompatibility laboratories.

(vii) Home infusion therapy suppliers.

(viii) Hospitals, including critical access hospitals, Department of Veterans Affairs hospitals, and other federally owned hospital facilities.

(ix) Health programs operated by an Indian Health Program (as defined in section 4(12) of the Indian Health Care Improvement Act) or an urban Indian organization (as defined in section 4(29) of the Indian Health Care Improvement Act) that receives funding from the Indian Health Service pursuant to Title V of the Indian Health Care Improvement Act.

(x) Mammography screening centers.

(xi) Mass immunization roster billers

(xii) Opioid treatment programs (if § 424.67(b)(3)(ii) applies).

(xiii) Organ procurement organizations.

(xiv) Pharmacies newly enrolling or revalidating via the CMS-855B application.

(xv) Radiation therapy centers.

(xvi) Religious non-medical health care institutions.

(xvii) Rural health clinics.

(xviii) Skilled nursing facilities.

(2) Limited screening level: Screening requirements. When CMS designates a provider or supplier as a “limited” categorical level of risk, the Medicare contractor does all of the following:

(i) Verifies that a provider or supplier meets all applicable Federal regulations and State requirements for the provider or supplier type prior to making an enrollment determination.

(ii) Conducts license verifications, including licensure verifications across State lines for physicians or nonphysician practitioners and providers and suppliers that obtain or maintain Medicare billing privileges as a result of State licensure, including State licensure in States other than where the provider or supplier is enrolling.

(iii) Conducts database checks on a pre- and post-enrollment basis to ensure that providers and suppliers continue to meet the enrollment criteria for their provider/supplier type.

(b) Moderate categorical risk - (1) Moderate categorical risk: Provider and supplier categories. CMS has designated the following providers and suppliers as “moderate” categorical risk:

(i) Ambulance service suppliers.

(ii) Community mental health centers.

(iii) Comprehensive outpatient rehabilitation facilities.

(iv) Hospice organizations.

(v) Independent clinical laboratories.

(vi) Independent diagnostic testing facilities.

(vii) Physical therapists enrolling as individuals or as group practices.

(viii) Portable x-ray suppliers.

(ix) Revalidating home health agencies.

(x) Revalidating DMEPOS suppliers.

(xi) Revalidating MDPP suppliers.

(xii) Prospective (newly enrolling) opioid treatment programs that have been fully and continuously certified by the Substance Abuse and Mental Health Services Administration (SAMHSA) since October 23, 2018.

(xiii) Revalidating opioid treatment programs.

(2) Moderate screening level: Screening requirements. When CMS designates a provider or supplier as a “moderate” categorical level of risk, the Medicare contractor does all of the following:

(i) Performs the “limited” screening requirements described in paragraph (a)(2) of this section.

(ii) Conducts an on-site visit.

(c) High categorical risk - (1) High categorical risk: Provider and supplier categories. CMS has designated the following home health agencies and suppliers of DMEPOS as “high” categorical risk:

(i) Prospective (newly enrolling) home health agencies.

(ii) Prospective (newly enrolling) DMEPOS suppliers.

(iii) Prospective (newly enrolling) MDPP suppliers

(iv) Prospective (newly enrolling) opioid treatment programs that have not been fully and continuously certified by SAMHSA since October 23, 2018.

(2) High screening level: Screening requirements. When CMS designates a provider or supplier as a “high” categorical level of risk, the Medicare contractor does all of the following:

(i) Performs the “limited” and “moderate” screening requirements described in paragraphs (a)(2) and (b)(2) of this section.

(ii)(A) Requires the submission of a set of fingerprints for a national background check from all individuals who maintain a 5 percent or greater direct or indirect ownership interest in the provider or supplier; and

(B) Conducts a fingerprint-based criminal history record check of the Federal Bureau of Investigation's Integrated Automated Fingerprint Identification System on all individuals who maintain a 5 percent or greater direct or indirect ownership interest in the provider or supplier.

(3) Adjustment in the categorical risk. CMS adjusts the screening level from “limited” or “moderate” to “high” if any of the following occur:

(i) CMS imposes a payment suspension on a provider or supplier at any time in the last 10 years.

(ii) The provider or supplier -

(A) Has been excluded from Medicare by the OIG; or

(B) Had billing privileges revoked by a Medicare contractor within the previous 10 years and is attempting to establish additional Medicare billing privileges by -

(1) Enrolling as a new provider or supplier; or

(2) Billing privileges for a new practice location;

(C) Has been terminated or is otherwise precluded from billing Medicaid;

(D) Has been excluded from any Federal health care program; or

(E) Has been subject to any final adverse action, as defined at § 424.502, within the previous 10 years.

(iii) CMS lifts a temporary moratorium for a particular provider or supplier type and a provider or supplier that was prevented from enrolling based on the moratorium, applies for enrollment as a Medicare provider or supplier at any time within 6 months from the date the moratorium was lifted.

(d) Fingerprinting requirements. An individual subject to the fingerprint-based criminal history record check requirement specified in paragraph (c)(2)(ii)(B) of this section -

(1) Must submit a set of fingerprints for a national background check.

(i) Upon submission of a Medicare enrollment application; or

(ii) Within 30 days of a Medicare contractor request.

(2) In the event the individual(s) required to submit fingerprints under paragraph (c)(2) of this section fail to submit such fingerprints in accordance with paragraph (d)(1) of this section, the provider or supplier will have its billing privileges -

(i) Denied under § 424.530(a)(1); or

(ii) Revoked under § 424.535(a)(1).

[76 FR 5963, Feb. 2, 2011, as amended at 82 FR 53368, Nov. 15, 2017; 84 FR 63203, Nov. 15, 2019; 85 FR 70355, Nov. 4, 2020; 85 FR 85038, Dec. 28, 2020]

---