CMS Pub. 100-08, ch. 10, § 10.6.15

Consistent with 42 CFR § 424.518, newly-enrolling and existing providers and suppliers will,

beginning on March 25, 2011, be placed into one of three levels of categorical screening: limited,

moderate, or high. The risk levels denote the level of the contractor’s screening of the provider

when it initially enrolls in Medicare, adds a new practice location, revalidates its enrollment

information, or, in certain circumstances, changes all or part of its ownership.

A. Specific Screening Categories

1. Limited Risk

The “limited” level of categorical screening consists of the following provider and supplier

types:

• Physicians

• Non-physician practitioners other than physical therapists

• Physician group practices

• Non-physician group practices other than physical therapist group practices

• Ambulatory surgical centers

• Competitive Acquisition Program/Part B Vendors

• End-stage renal disease facilities

• Federally qualified health centers

• Histocompatibility laboratories

• Home infusion therapy suppliers

• Hospitals (including critical access hospitals, rural emergency hospitals, Department of

Veterans Affairs hospitals, and other federally-owned hospital facilities.

• Health programs operated by an Indian Health Program (as defined in section 4(12) of the

Indian Health Care Improvement Act) or an urban Indian organization (as defined in section

4(29) of the Indian Health Care Improvement Act) that receives funding from the Indian

Health Service pursuant to Title V of the Indian Health Care Improvement Act

• Mammography screening centers

• Mass immunization roster billers

• Organ procurement organizations

• Outpatient physical therapy/outpatient speech pathology providers enrolling via the Form

CMS-855A

• Pharmacies that are newly enrolling or revalidating via the Form CMS-855B application

• Radiation therapy centers

• Religious non-medical health care institutions

• Rural health clinics

For providers and suppliers in the “limited” category, the contractor shall process initial,

revalidation, and new location applications in accordance with existing instructions.

2. Moderate Risk

a. General Information

The “moderate” level of categorical screening consists of the following provider and supplier

types:

• Ambulance service suppliers

• Community mental health centers (CMHCs)

• Comprehensive outpatient rehabilitation facilities (CORFs)

• Independent clinical laboratories

• Independent diagnostic testing facilities

• Physical therapists enrolling as individuals or as group practices

• Portable x-ray suppliers (PXRSs)

• Newly Enrolling Opioid Treatment Program (OTP) that were SAMSHA certified prior to

October 24, 2018

• Revalidating home health agencies (HHAs)

• Revalidating hospices

• Revalidating DMEPOS suppliers

• Revalidating MDPP suppliers

• Revalidating OTP providers

• Revalidating SNFs

• Pursuant to § 424.518(b)(1)(ix), revalidating OTPs that have not been fully and continuously

certified by SAMHSA since October 23, 2018, revalidating DMEPOS suppliers, revalidating

MDPP suppliers, revalidating HHAs, revalidating SNFs, and revalidating hospices to which

CMS applied the fingerprinting requirements outlined in § 424.518(c)(2)(ii) upon the

provider’s or supplier’s—

o New/initial enrollment; or

o Revalidation after CMS waived the fingerprinting requirements, under the circumstances

described in § 424.518(c)(1)(viii), when the provider or supplier initially enrolled in

Medicare. (See subsection (A)(5) below for more information.)

For providers and suppliers in the “moderate” level of categorical screening, the contractor shall

(unless section 10.6.15(A)(4) of this chapter or another CMS directive applies): (1) process

initial, revalidation, and new location applications in accordance with existing instructions; and

(2) order an NSVC site visit through PECOS consistent with subsection 2(b) below. (Unless

stated otherwise in this chapter, the scope of the site visit shall be consistent with existing

instructions.)

b. Provider/Supplier-Specific Information

(i) Ambulance suppliers, independent clinical laboratories, physical therapists, and physical

therapist groups

If the supplier submits an initial application, revalidation application, or application to add a new

practice location, the contractor shall order a site visit. (For new location additions, the site visit

shall be of the new location.) The contractor shall not make a final decision regarding the

application (or, for initial applications, shall not convey Medicare billing privileges) prior to the

completion of the NSVC’s site visit and the contractor’s review of the results.

(ii) CMHCs, CORFs, Hospices and PXRSs

For site visits regarding these four provider/supplier types, the contractor shall adhere to the site

visit instructions in, respectively, sections 10.2.1.1, 10.2.1.2, 10.2.1.7, and 10.2.2.8 of this

chapter.

(iii) IDTFs

Initial applications - The NSVC will conduct site visits of initially enrolling IDTFs consistent

with section 10.2.2(O)(15) of this chapter.

Revalidations - The NVSC will conduct site visits of revalidating IDTFs (prior to the

contractor’s final decision regarding the revalidation application) consistent with section

10.2.2(I)(15) of this chapter.

IDTF Code Changes - The NSVC will conduct site visits for IDTF code changes as specified in

section 10.2.2(I)(17) of this chapter.

(iv) Revalidating HHAs and SNFs

For site visits regarding revalidating HHAs and SNFs, the contractor shall adhere to the site visit

instructions in, respectively, sections 10.2.1.6 and 10.2.1.14 of this chapter.

(v) Revalidating DMEPOS Suppliers

A site visit of the DMEPOS supplier shall be conducted prior to the NSC making a final decision

regarding the revalidation application.

(vi) Revalidating MDPP Suppliers

If an MDPP supplier submits a revalidation application, the contractor shall order a site visit. The

contractor shall not make a final decision regarding the revalidation application prior to the

completion of the NSVC’s site visit and the contractor’s review of the results.

(vii) Revalidating OTP Providers

If an OTP provider submits a revalidation application, the contractor shall order a site visit. The

contractor shall not make a final decision regarding the revalidation application prior to the

completion of the NSVC’s site visit and the contractor’s review of the results.

3. High Risk

a. General Information

Pursuant to 42 CFR § 424.518, the “high” level of categorical screening consists of the following

provider and supplier types:

• Newly enrolling DMEPOS suppliers

• Newly enrolling HHAs (including HHAs that must submit an initial enrollment application

pursuant to § 424.550(b)(1))

• Newly enrolling hospices

• Newly enrolling MDPP suppliers

• Newly enrolling OTP providers that were SAMSHA certified after October 24, 2018

• Newly enrolling SNFs

• DMEPOS suppliers, HHAs, MDPP suppliers, OTP providers that were SAMSHA certified

after October 24, 2018, SNFs, and hospices submitting either: (i) a change of ownership

application pursuant to 42 CFR § 489.18; or (ii) an application to report any new owner

(regardless of ownership percentage, though consistent with the definition of owner in

section 10.1.1 of this chapter) pursuant to a change of information or other enrollment

transaction under title 42.

• Except as stated in § 424.518(b)(1)(ix), revalidating OTPs that have not been fully and

continuously certified by SAMHSA since October 23, 2018, revalidating DMEPOS

suppliers, revalidating MDPP suppliers, revalidating HHAs, revalidating SNFs, and

revalidating hospices for which, upon their new/initial enrollment, CMS waived the

fingerprinting requirements outlined in paragraph (c)(2)(ii) of this section pursuant to

applicable legal authority due to a national, state, or local emergency declared under existing

law. (See subsection (A)(5) below for more information.)

For newly enrolling providers and suppliers in the “high” level of categorical screening:

(i) The contractor shall process the application in accordance with existing instructions.

(ii) The NSVC will perform a site visit. The contractor shall not switch the provider’s

enrollment record to “Approved” prior to the completion of the site visit and the contractor’s

review of the results.

(iii) Their 5 percent or greater direct and indirect owners must undergo fingerprint-based

criminal background checks. The contractor shall not switch the provider’s enrollment record to

“Approved” prior to the completion of fingerprinting and the contractor’s review of the results.

(iv) The contractor shall, upon switching the provider’s or supplier’s enrollment record to

“Approved,” enter the provider’s risk category as “moderate” into PECOS.

b. Additional Considerations

(i) Enrolled DMEPOS suppliers that are adding another location will be classified as “high” for

screening purposes.

(ii) The addition of a new HHA branch falls within the “moderate” level of categorical

screening. A site visit of the branch shall thus be performed consistent with the instructions in

this chapter (including those in section 10.2.1.6).

(iii) The addition of a new MDPP supplier administrative location that does not result in a new

PTAN does not require an additional site visit. Any additional MDPP supplier administrative

location that results in a new PTAN, either due to being in a new jurisdiction or because of a new

CDC organizational code, the contractors shall order a site visit of the location through PECOS.

This is to ensure that the supplier is in compliance with CMS’s enrollment requirements. The

scope of the site visit will be consistent with section 15.19.2.2(B) of this chapter. The NSVC will

perform the site visit. The contractor shall not switch the provider’s enrollment record to

“Approved” prior to the completion of the NSVC’s site visit and the contractor’s review of the

results.

c. Changes of/in Ownership

As explained above and in more detail in section 10.6.21(E)(3), the “high” screening category

includes DMEPOS suppliers, HHAs, MDPP suppliers, OTP providers that were SAMSHA

certified after October 24, 2018, SNFs, and hospices submitting either: (i) a change of ownership

application pursuant to 42 CFR § 489.18; or (ii) an application to report any new owner

(regardless of ownership percentage, though consistent with the definition of owner in section

10.1.1 of this chapter) pursuant to a change of information or other enrollment transaction under

title 42. Accordingly, any change of/in ownership that meets all of the following criteria would

fall under (i) or (ii) above:

• Does not involve the triggering of an initial enrollment (e.g., an HHA or hospice change in

majority ownership for which no exception applies requires a new enrollment); and

• The change reports either:

o For partnerships: A new partner (general or limited) who owns any percentage (even 1

percent) of the provider/supplier; or

o Excluding partnerships: A new direct or indirect owner of at least 5 percent of the

provider/supplier.

Upon receipt of an application described above, the contractor shall process it consistent with the

instructions in this chapter and this section 10.6.15. This includes requesting fingerprints from

the new owner(s) if the owner has a 5 percent or greater direct or indirect ownership interest.

However, the contractor need not also solicit them from the provider/supplier’s existing owners;

only the new owner(s) need be fingerprinted.

(Note that if a new partner is being reported but the partner owns less than 5 percent of the

provider/supplier, the provider/supplier’s application must still be processed at the high

screening level. However, the new partner need not be fingerprinted. This is because

fingerprinting only applies to 5 percent or greater direct or indirect owners. It is therefore

possible that, in such a change of ownership transaction, no fingerprinting will have to be

conducted at all.)

The contractor shall also order a site visit of the provider/supplier consistent with existing

instructions. In terms of the timing of the HHA, SNF, or hospice site visit, however, the

contractor shall adhere to the following:

• No State/SOG Location Approval Required – If the ownership change does not require state

or SOG Location approval under existing CMS instructions (see sections 10.6.1.1, 10.6.1.2,

10.6.22, and 10.6.22.1 of this chapter for more information on this topic), the site visit shall

be ordered and performed prior to the contractor’s final decision regarding the application.

• State/SOG Location Approval Required - If the ownership change requires state or SOG

Location approval under existing CMS instructions, the site visit shall be ordered and

performed no later than 5 business days after the contractor receives notice of approval from

the state or SOG Location but before the contractor switches the provider/supplier’s

enrollment record to an “Approved” status.

(See section 10.6.21(E)(3) of this chapter for more information.)

4. Elevating Existing Providers and Suppliers into the High-Risk Screening Category

a. Criteria for Raising Providers/Suppliers to High-Risk

Under § 424.518(c)(3), CMS may adjust (or “bump up”) a particular provider or supplier’s

screening level from “limited” or “moderate” to “high” if any of the following occur:

(i) CMS imposes a payment suspension on a provider or supplier at any time within the last 10

years;

(ii) The provider or supplier:

• Has been excluded from Medicare by the Office of Inspector General;

• Had its billing privileges revoked by a Medicare contractor within the previous 10 years and

is attempting to establish additional Medicare billing privileges by: (A) enrolling as a new

provider or supplier; or (B) obtaining billing privileges for a new practice location;

• Has been terminated or is otherwise precluded from billing Medicaid;

• Has been excluded from any federal health care program; or

• Has been subject to any final adverse action (as defined in § 424.502) within the previous 10

years.

(iii) CMS lifts a temporary moratorium for a particular provider or supplier type, and a provider

or supplier that was prevented from enrolling based on the moratorium applies for enrollment as

a Medicare provider or supplier at any time within 6 months from the date the moratorium was

lifted.

b. Extension of Application of a Provider/Supplier’s “Bump-Up”

Effective January 6, 2023 (and pursuant to § 424.518(c)(4)), any screening level adjustment

under § 424.518(c)(3) also applies to all other enrolled and prospective providers and suppliers

that have the same legal business name (LBN) and tax identification number (TIN) as the

provider or supplier for which the screening level under § 424.518(c)(3) was originally raised.

To illustrate, suppose an entity is enrolled as an ambulance supplier, a CORF, and a home

infusion therapy (HIT) supplier. All three providers/suppliers are under the entity’s TIN and

LBN. The HIT supplier is under a payment suspension and is thus bumped-up to “high.”

Pursuant to § 424.518(c)(4), the ambulance supplier and CORF will also be moved to “high”

because they have the same LBN and TIN as the HIT supplier.

c. List of Bumped-Up Providers/Suppliers

The CMS makes available to the contractor on a bi-monthly basis a list of current and former

Medicare providers and suppliers within the contractor’s jurisdiction that have been “bumped-up” pursuant to § 424.518(c)(3) and (c)(4). Upon receipt of an initial or revalidation application

from a provider or supplier that otherwise falls within the limited or moderate screening category

(and after the appropriate fee has been paid, etc.), the contractor shall determine whether the

provider or supplier is on the bi-monthly “high” screening list. If the provider or supplier is not

on said list, the contractor shall process the application in accordance with existing instructions.

If the provider or supplier is on the list, the contractor shall process the application using the

procedures in the “high” screening category unless the provider is on the list solely because of a

revocation for failing to timely respond to a revalidation request. If such is the case, the

contractor shall contact its CMS Provider Enrollment & Oversight Group Business Function

Lead (PEOG BFL) for guidance as to how the situation should be handled.

d. Post-Moratorium Applications

If the contractor receives an initial or new location application from a provider or supplier: (a)

that is of a provider or supplier type that was subject to a moratorium and (b) within 6 months

after the applicable moratorium was lifted, the contractor shall process the application using the

procedures in the “high” screening category.

5. Prior Waiver from Fingerprinting

During the recent COVID-19 public health emergency (PHE), CMS temporarily waived the

requirement for fingerprint-based criminal background checks (FBCBCs) for 5 percent or greater

owners of newly enrolling providers and suppliers falling within the high-risk screening category

in § 424.518(c). CMS seeks to perform FBCBCs for high-risk providers and suppliers that

initially enrolled during the PHE upon their revalidation once the PHE ends. This was not

previously possible under our prior regulations because the revalidation applications would only

be screened at the moderate-risk level. Pursuant to our regulatory revisions in the CMS CY 2024

Home Health Prospective Payment System final rule, however, CMS --- effective January 1,

2024 ---- may fingerprint the 5 percent or greater direct/indirect owners of these

providers/suppliers. Specifically:

(i) Revalidating OTPs that have not been fully and continuously certified by SAMHSA since

October 23, 2018, revalidating DMEPOS suppliers, revalidating MDPP suppliers,

revalidating HHAs, revalidating SNFs, and revalidating hospices for which, upon their

new/initial enrollment, CMS waived the fingerprinting requirements pursuant to a legally

declared national, state, or local emergency declared under existing law --- These

providers/suppliers fall within the high-risk screening category and are subject to the

fingerprinting requirement as part of their revalidation requirement.

(ii) Once the providers/suppliers in (i) have been fingerprinted, they fall within the moderate-risk

category.

Upon receipt of an application from a revalidating OTP that has not been fully and continuously

certified by SAMHSA since October 23, 2018, revalidating DMEPOS supplier, revalidating

HHA, revalidating MDPP supplier, revalidating SNF, or revalidating hospice, the contractor

shall determine whether the provider/supplier was waived from the fingerprinting requirement

pursuant to applicable legal authority due to a national, state, or local emergency declared under

existing law. If the provider/supplier was waived and has not yet been undergone fingerprinting,

the contractor shall process the revalidation using the high-risk screening procedures. If the

provider/supplier was not so waived or has otherwise undergone fingerprinting after a waiver,

the revalidation application shall be processed consistent with the moderate-risk screening

procedures.

Note that any such waiver must have been directed by CMS.

B. Changes of Information (Including Additions and Changes of Practice Locations)

(This subsection (B) does not apply to ownership changes that qualify as a mere change of

information (e.g., reporting a new 10 percent owner).) These transactions are addressed in

subsection (C) below.)

1. Limited

Changes of information (including additions of practice locations) submitted by

providers/suppliers in the “limited” level of categorical screening shall be processed consistent

with existing instructions.

2. Moderate

Changes of information submitted by providers/suppliers in the “moderate” level of categorical

screening shall be processed consistent with existing instructions, although practice location

additions and changes in a practice location’s physical location also require a site visit as

described in this section 10.6.15. The site visit shall be performed consistent with the applicable

instructions in this chapter (e.g., section 10.2.1.2 for CORFs). The contractor shall not make its

final decision regarding the application prior to the completion of the site visit and the

contractor’s review of the results.

3. High

Except as stated below, changes of information submitted by providers/suppliers in the “high”

level of categorical screening shall be processed consistent with existing instructions, although

practice location additions and changes in a practice location’s physical location also require a

site visit as described in this section 10.6.15. The site visit shall be performed consistent with the

applicable instructions in this chapter. The contractor shall not make its final decision regarding

the application prior to the completion of the site visit and the contractor’s review of the results.

For purposes of this requirement:

• A change of location includes situations in which the provider/supplier is switching suite

numbers or floors within a building. A site visit is required.

• If the provider/supplier’s physical location is not changing (e.g., the provider’s street name is

changing but its actual office space is not), no site visit is required.

• A DMEPOS supplier that is adding a new practice location falls within the “high” screening

category. This is because each location must be separately enrolled. The enrollment of a

new location thus constitutes an initial enrollment.

• A DMEPOS supplier undergoing a change in TIN with no change in ownership falls within

the “moderate screening category.

C. Change of Ownership

1. Limited

Changes of ownership (regardless of whether a new TIN is triggered) shall be processed

consistent with existing instructions.

2. Moderate

If a provider or supplier is undergoing a change of ownership resulting in a new TIN, the

contractor shall:

a. Process the application consistent with existing instructions, and

b. Order a site visit through PECOS in accordance with the following:

• For ownership changes that must be approved by the state or SOG Location under current

CMS instructions (see sections 10.6.1.1, 10.6.1.2, 10.6.22, and 10.6.22.1) of this chapter), the

site visit shall be ordered and performed after the contractor receives notice of approval from

the state or SOG Location but before the contractor switches the provider/supplier’s

enrollment record to an “Approved” status. The contractor shall not switch the

provider/supplier’s enrollment record to “Approved” prior to the completion of the NSVC’s

site visit and the contractor’s review of the results.

• For ownership changes that do not require state or SOG Location approval under current

CMS instructions, the site visit shall be ordered and performed prior to the contractor’s final

decision regarding the application.

3. High

See subsection (A)(3)(c) for information on processing changes of/in ownership applications

from DMEPOS suppliers, HHAs, MDPP suppliers, OTPs that have not been continuously

SAMSHA-certified since October 24, 2018, SNFs, and hospices.

D. Reactivations

a. Limited

Form CMS-855 reactivation applications submitted by providers and suppliers in the “limited”

level of categorical screening shall be processed in accordance with existing instructions.

b. Moderate

Form CMS-855 reactivation applications submitted by providers and suppliers in the “moderate”

level of categorical screening – including existing DMEPOS suppliers, HHAs, MDPP suppliers,

OTPs that have not been continuously SAMSHA-certified since October 24, 2018, and SNFs –

shall be processed in accordance with the screening procedures for this category. A site visit will

therefore be needed prior to the contractor’s final decision regarding the application.

c. High

Form CMS-855 reactivation applications submitted by providers and suppliers in the “high”

level of categorical screening shall be processed in accordance with the screening procedures for

this category. A site visit will therefore be needed prior to the contractor’s final decision

regarding the application.