If you sell wheelchairs, oxygen equipment, braces, diabetic supplies, or any other durable medical equipment to Medicare patients, your entire business model just spent six months inside a federal freeze — and the scrutiny did not lift when the freeze did. In February 2026, CMS barred new Medicare enrollment for medical supply companies nationwide. In September 2026, it barred 11 suppliers tied to $3.4 billion in suspected fraudulent billing from Medicare Advantage payments entirely. Legitimate suppliers were never the target, but they are absolutely feeling the blast radius: slower claim approvals, tougher documentation checks, and a payment-suspension regime that can freeze your cash flow first and ask questions later.
This guide walks through what CMS actually did, why honest suppliers get caught in the net, and the bookkeeping and billing controls that keep your claims paid and your supplier number safe.
What CMS Actually Did in 2026
Three actions matter for your business. Here they are in plain order.
The six-month enrollment moratorium. Effective February 27, 2026, CMS imposed a nationwide moratorium on new Medicare enrollment for seven categories of DMEPOS suppliers: medical supply companies generally, plus medical supply companies with orthotics personnel, pedorthic personnel, prosthetics personnel, prosthetic-and-orthotic personnel, a registered pharmacist, or a respiratory therapist. During the freeze, no new suppliers in these categories could enroll, no new practice locations of these types were accepted, and most changes in majority ownership were treated as new enrollments and blocked too. The one exception was an application the Medicare contractor had already received before the effective date.
The moratorium expired on August 27, 2026. CMS announced the expiration and said suppliers may once again submit new initial enrollment applications. If you shelved an expansion, an acquisition, or a new location in the spring, the door is open again — but expect the application to be examined harder than it would have been a year ago. More on that below.
The $3.4 billion enforcement action. On September 8, 2026, CMS announced it was barring 11 medical supply companies tied to more than $3.4 billion in suspected fraudulent billing in 2025 and 2026 from future Medicare Advantage Part C and Part D payments by placing them on the Preclusion List. The patterns CMS described are worth studying, because they are exactly what the agency's detection systems now hunt for: suppliers that had submitted no claims at all before 2025 and then exploded in volume, billing for equipment furnished to beneficiaries who were already deceased, billing for equipment patients never requested or received, and — in four cases — suppliers already revoked from Original Medicare that simply pivoted to billing Medicare Advantage plans instead.
Two surrounding facts complete the picture. CMS deferred $259.5 million in quarterly federal Medicaid matching funds for Minnesota while it investigates questionable claims concentrated in personal care services, home and community-based services, and practitioner services — a reminder that state Medicaid dollars attached to home-based care are under the same microscope. And CMS closed out 2025 reporting $5.7 billion in suspended suspected-fraudulent Medicare payments, $1.5 billion in prevented DMEPOS billing, 122,658 claims denied for failing preliminary medical-necessity checks, 5,586 providers and suppliers revoked from billing Medicare, and 372 fraud referrals representing $3.7 billion sent to law enforcement. The agency has also said explicitly that it is replacing the old "pay and chase" model with real-time "detect and deploy" analytics that stop suspicious payments before they go out. Translation: the filter sits in front of your cash flow now, not behind it.
Finally, CMS issued a request for stakeholder input under its CRUSH initiative (Comprehensive Regulations to Uncover Suspicious Healthcare), signaling that new anti-fraud rules are coming. The direction of travel is one-way: more pre-payment review, more data matching, more consequences.
Why Honest Suppliers Get Hurt
None of this targets a clean operation. But three mechanisms in the crackdown hit legitimate suppliers as collateral damage.
First, pre-payment review delays your money. When 122,658 claims in a year die at preliminary approval checks, many of them belong to real suppliers whose documentation was merely incomplete — a missing detailed written order, a face-to-face encounter note that does not quite establish medical necessity, a delivery ticket without a beneficiary signature. Under "detect and deploy," a thin file does not produce a polite request for more information weeks later; it produces a denial now.
Second, payment suspensions freeze first and investigate second. When CMS or a Medicare contractor has reliable information of an overpayment or potential fraud, it can suspend payments while the review runs. For a supplier whose revenue is 60 to 80 percent Medicare, even a partial suspension is an existential cash event. Appeals exist, but the money does not flow while you use them.
Third, enrollment errors are now punished like billing errors. Revocation — losing the privilege to bill Medicare at all — reached 5,586 providers and suppliers in 2025. Revocations are triggered not only by fraud but by enrollment fouls: failing to maintain accreditation, letting the surety bond lapse, failing to respond to revalidation, or an unreported change in ownership or practice location. In this environment, an administrative lapse reads as a red flag.
The Billing Traps That Trigger Overpayments
Federal auditors have documented the same improper-billing patterns for years, and each one maps directly to a control you can build. Three findings are especially relevant:
- Billing for patients in inpatient stays. One HHS Office of Inspector General audit found Medicare improperly paid suppliers $34 million for DMEPOS furnished to beneficiaries during inpatient hospital stays — items bundled into the facility payment that a supplier may not bill separately. If your system does not check inpatient status before the claim goes out, you are replaying this exact finding.
- Billing for hospice beneficiaries. Another OIG audit estimated $117 million in improper payments over four years for DMEPOS provided to hospice beneficiaries, where most suppliers simply did not know the patient had elected hospice. Durable equipment related to the terminal condition belongs to the hospice benefit, not your claim.
- Power mobility device repairs. Auditors estimated $8 million of $40 million paid for power mobility repairs was improper. High-cost, frequently serviced items attract sampling — and sampling extrapolates.
The common thread is billing without verifying the beneficiary's status at the time of service. Every one of these errors is preventable with an eligibility check before shipment, not after denial.
The Enrollment Gauntlet: Getting and Keeping Your Supplier Number
With the moratorium lifted, applications are moving again — into a system tuned for suspicion. Treat enrollment as an ongoing compliance function, not a one-time form. The durable requirements for a Medicare DMEPOS supplier number are:
-
NPI first. Obtain the National Provider Identifier before anything else; every enrollment step keys off it.
-
CMS-855S through the contractor. File the enrollment application with the National Supplier Clearinghouse contractor, complete and consistent — mismatched legal business names, addresses, and ownership details across the NPI record, the application, and state licensure are a classic trigger for development requests and delays.
-
The $50,000 surety bond. Maintain a base surety bond of $50,000 for each enrolled location's NPI, plus an additional $50,000 for each adverse legal action in the preceding ten years. Calendar the renewal: a lapsed bond is one of the fastest routes to revocation, and it is also the most embarrassing, because it is purely administrative.
-
Accreditation. Obtain and maintain accreditation from an approved accrediting organization against the Medicare quality standards, and keep the certificate where your revalidation file can find it. No accreditation, no billing privileges.
-
Revalidation and updates. Respond to every revalidation request on time, and report changes — new practice locations, ownership changes, changes in personnel categories — promptly. Remember that a change in majority ownership within 36 months of initial enrollment can be treated as a new enrollment, which is exactly the transaction type the moratorium taught CMS to scrutinize.
-
State licensure. Keep every state license, certification, and permit current for each location, and make sure the specialties on file match what you actually bill. Respiratory equipment billed from a location whose file shows no respiratory therapist is precisely the mismatch profile the seven moratorium categories were drawn around.
Bookkeeping Controls That Keep You Paid — and Off the Radar
Compliance keeps your supplier number; bookkeeping keeps the business alive while compliance does its work. Build these seven controls into your monthly routine.
1. Verify beneficiary status before you ship, not after you bill
Make eligibility verification a pre-shipment step, owned by name: check that the beneficiary is alive, enrolled, not in an inpatient stay, and not under a hospice election covering the item. Log the verification with a timestamp in the order file. The OIG findings above — $34 million in inpatient-overlap billing, an estimated $117 million in hospice-overlap billing — both came down to suppliers who billed first and discovered the patient's status later. A two-minute check at intake is the cheapest control in this entire article.
2. Build a medical-necessity file for every claim
For each order, keep together the detailed written order, the treating practitioner's face-to-face encounter documentation supporting medical necessity, proof of delivery with beneficiary (or designee) signature and date, and any prior-authorization confirmation. When a claim fails a preliminary approval check, this packet is your appeal — and when an auditor samples your claims, thin files extrapolate into large overpayment demands. File completeness is a revenue-protection activity, not paperwork for its own sake.
3. Age your Medicare receivables separately — and watch the pattern
Track Original Medicare, Medicare Advantage, and Medicaid receivables in separate aging buckets, and review them monthly. A sudden slowdown in one payer's days-in-accounts-receivable is often your first signal of elevated review activity, well before any formal notice arrives. Also reconcile your books to the payer's remittance: if the 1099-equivalent payment totals and your bank deposits diverge, find out why before the contractor does. Suppliers that cannot reconcile gross billings to net deposits look, to an analytics engine, like the billing patterns CMS just barred 11 companies over.
4. Hold an overpayment reserve and return overpayments fast
Federal law generally requires providers and suppliers who identify an overpayment to report and return it within 60 days. Maintain a dedicated reserve — not a mental note — for refunds, and run a standing monthly process that reviews credit balances, duplicate payments, and denials-later-paid-twice for amounts owed back. Voluntary refunds with documentation read as good faith; amounts a contractor discovers for you read as findings. The reserve also smooths the P&L shock when a payer recoups by offsetting future claims.
5. Keep a suspension survival buffer
Because payment suspensions cut cash flow while appeals pend, hold an operating reserve sized to your payer concentration: if Medicare is 70 percent of revenue, three to six months of operating expenses in liquid reserve is prudent, not paranoid. Model the scenario explicitly — which leases, payroll runs, and supplier payments get covered in month two of a suspension — before you need the answer. Businesses that plan the buffer survive the review; businesses that discover the gap during one often settle claims they could have contested, just to restart cash flow.
6. Calendar every credential, bond, and license renewal
Put the surety bond renewal, accreditation expiration, state licenses, and revalidation windows on a single compliance calendar with 90-day advance alerts and a named owner. Lapsed credentials cause revocations that take months to unwind, during which billing stops entirely. This is pure process discipline, and it is the control most small suppliers skip.
7. Screen against the Preclusion List before every referral relationship
CMS now publishes revoked and precluded parties, and the September 2026 action shows it expects the industry to steer clear of them. Before entering referral, staffing, or billing arrangements, check the counterparty against the Preclusion List and document the check. Doing business — knowingly or not — with a barred entity invites your own review.
If the Moratorium Blocked You, Move Now — Carefully
If you deferred an enrollment application, a new location, or an ownership change during the freeze, the window is open, but the reviewers are newly trained to look for the fraud markers described above. Three precautions pay for themselves:
- Season your file. New entities with no claims history that spike in volume immediately are the exact profile CMS flagged. If you are genuinely new, ramp deliberately and keep immaculate records from claim one — your first hundred claims establish your statistical identity with the contractors.
- Disclose ownership fully. Changes in majority ownership drew moratorium-level scrutiny; incomplete ownership disclosures in a post-moratorium application invite denial. List every owner at or above the reporting threshold, and reconcile the application against your formation documents.
- Do not bill Medicare Advantage as a workaround. Four of the barred suppliers tried exactly that after revocation from Original Medicare. Contractors and plans now share data across programs — including through the CMS-state tax fraud partnership covering 28 states and the Virgin Islands — so a problem in one program follows you into the other.
Simplify Your Financial Management
Running a medical supply business in this enforcement climate means your billing records, receivables, and reserves have to be audit-ready every month, not just at year end. Beancount.io offers plain-text accounting that is transparent, version-controlled, and AI-ready — so every claim, adjustment, and refund is traceable when a contractor, auditor, or buyer asks. Get started for free and keep your financial records as disciplined as your compliance files.
