DME Compliance Requirements for Medicare Suppliers: Standards and Audits

DME compliance requirements for Medicare suppliers sit in six areas: enrollment standards under 42 CFR 424.57, documentation proving medical necessity, accreditation by a CMS-approved organization, accurate claim submission to the DME MAC, seven-year record retention, and the federal fraud and abuse laws that apply to every referral, contract, and claim. Getting any one of them wrong can cost a supplier its billing privileges or trigger penalties that reach six figures per violation, and DME has historically drawn disproportionate enforcement attention because it has been one of Medicare’s highest-fraud categories.

Supplier Standards You Must Meet and Maintain

CMS certifies these standards on the CMS-855S enrollment application, but they are not one-time checkboxes. Billing privileges can be revoked for failing to maintain any of them after enrollment.¹

Every practice location must be at least 200 square feet, accessible to the public, staffed during posted business hours, and marked with a visible sign. Posted hours, licenses, and permits have to be on display. Orders must be filled from the supplier’s own inventory or through contracts with other compliant entities, and no contract can be held with anyone excluded from federal health care programs.¹

Two financial requirements catch suppliers off guard. Each practice location needs a surety bond of at least $50,000, and CMS can require an elevated amount, adding $50,000 for each adverse legal action in the preceding ten years. Suppliers must also carry comprehensive liability insurance of at least $300,000 per incident, kept in force at all times. Any changes to the information on the enrollment application must be reported to CMS within 30 days.¹

Suppliers have to comply with all applicable federal and state licensure requirements. If a state requires a license to furnish certain items, the supplier must hold it or contract with a licensed entity, unless state law prohibits the arrangement. Beneficiaries must be advised of their options to rent or purchase inexpensive or routinely purchased equipment, and warranties must be honored under applicable state law without charging beneficiaries for covered repairs or replacements.¹

Documentation That Proves Medical Necessity

Medicare pays only for items that are medically necessary, and the written record carries the burden of proving it. Clean documentation is what separates a supplier who survives an audit from one who writes a large check afterward.

Written Orders

Every DME item billed to Medicare requires a written order from the treating practitioner as a condition of payment.² The complete order must be in the supplier’s possession before the claim is submitted, and must include the patient’s name, the prescribing practitioner’s signature and date, and a detailed description of the item, including any separately billed accessories or supplies.³

For items on CMS’s Required Face-to-Face Encounter and Written Order Prior to Delivery List, the timing is stricter: the complete order must be in the supplier’s possession before delivery to the patient, not just before the claim goes out.³ Ship first, sign later, and the entire claim is at risk of denial.

Face-to-Face Encounter

For items on that same list, the prescribing practitioner must have an in-person or telehealth visit with the patient within six months before writing the order. As of early 2026, 83 items appear on the list, including power mobility devices, oxygen equipment, and other high-utilization categories.³

The encounter has to gather clinical information related to diagnosing, treating, or managing the condition for which the equipment is ordered. The practitioner’s medical record must document the encounter with patient-specific findings, including subjective complaints and objective clinical data. If the encounter is done via telehealth, all Medicare telehealth requirements apply as well.³

Supporting Medical Records

The written order alone isn’t enough. The patient’s medical record, kept by the treating practitioner, must contain the clinical narrative that substantiates the need for the equipment: diagnosis, duration of the condition, and the functional limitations that make the item necessary. CMS expects the physician’s notes to contain all coverage criteria for the item. A chart entry like “patient needs wheelchair” without clinical support is a reliable path to denial.

Accreditation Before Enrollment

Most DMEPOS suppliers must obtain accreditation from a CMS-approved organization before they can even submit a Medicare enrollment application. CMS will deny claims from unaccredited suppliers.⁴ Certain professionals, such as physicians and physical therapists furnishing DME incidental to their practice, may be exempt.⁵

The process involves a detailed application, documentation submission, and an unannounced site visit. Surveyors evaluate compliance across administrative operations, financial practices, human resources, and product-specific requirements. Accreditation must be renewed periodically. Lapse it, and Medicare billing privileges go with it.

Billing the DME MAC Accurately

Accurate claim submission is a compliance obligation in its own right. Errors, even unintentional ones, can trigger overpayment demands, and patterns of errors attract audit selection.

HCPCS Codes and Modifiers

Every DME item is identified by a Healthcare Common Procedure Coding System (HCPCS) code on the claim. Using the wrong code, whether through carelessness or an attempt to reach a higher reimbursement, is one of the most common compliance failures in DME billing.

Two modifiers come up constantly. The KX modifier is an attestation by the supplier that documentation on file confirms all coverage criteria for the item have been met; adding it without actually having that documentation is effectively a false certification.² The GA modifier signals that the supplier issued a mandatory Advance Beneficiary Notice of Noncoverage (ABN) to the patient because the item may not be covered; the signed ABN has to be kept on file and produced on request.⁶ Incorrect sequencing of modifiers can cause outright claim rejection, so billing staff need to understand not just which modifiers to use but in what order.

Timely Filing

All Medicare fee-for-service claims, including DME claims, must be submitted within 12 months of the date of service. For claims with a date range, the “from” date on the line item controls. Claims filed after this window are automatically denied with no appeal rights.⁷

Competitive Bidding

Reimbursement rates for many DME items are shaped by the DMEPOS Competitive Bidding Program. In competitive bidding areas, contract suppliers submit bids and payment amounts are calculated using the 75th percentile of winning bids. Federal law also requires CMS to use competitive bidding data to adjust fee schedule amounts for items furnished outside competitive bidding areas.⁸ CMS is currently in the pre-bidding phase for a new round, with bidder registration and the bid window expected to open in late summer or early fall 2026.⁹

Record Retention: Seven Years

CMS requires suppliers to maintain medical records for seven years from the date of service.¹⁰ This covers patient records, orders, delivery documentation, and any clinical records supporting the claim. State laws may impose longer retention periods, and suppliers should follow whichever is stricter.

Auditors and recovery auditors can request records years after the date of service. If the documentation doesn’t exist when they ask for it, the claim is unsupported and the supplier owes a refund.

The Fraud and Abuse Laws That Apply to DME

Anti-Kickback Statute

The Anti-Kickback Statute (AKS) is a federal criminal law that prohibits paying or receiving anything of value in exchange for patient referrals or business involving items payable by a federal health care program. It covers both sides of the transaction.¹¹

“Anything of value” is read broadly: cash, free rent, below-market equipment leases, lavish meals, gifts. Common risk areas in DME include payments to referring physicians, free supplies to nursing facilities that steer equipment orders, and marketing arrangements compensated on referral volume.

Violations are felonies. Since the Bipartisan Budget Act of 2018 increased the penalties, each violation can result in a fine of up to $100,000 and imprisonment for up to ten years.¹² Beyond the criminal side, violations can trigger exclusion from all federal health care programs and civil monetary penalties of up to $50,000 per kickback plus three times the remuneration amount.¹¹

The AKS includes regulatory safe harbors that protect certain arrangements from prosecution, provided every element is met. Equipment rentals, personal services and management contracts, and payments to bona fide employees each have safe harbors with specific written-agreement, term, and fair-market-value requirements.¹³ Missing even one element eliminates the protection entirely.

Stark Law

The Stark Law bars a physician from referring Medicare patients for designated health services, including DME, to any entity where the physician or an immediate family member has a financial relationship, unless a specific exception applies.¹⁴ DME is expressly listed as a designated health service.¹⁵

Unlike the AKS, Stark is a strict liability statute. The government does not have to prove that anyone intended to violate it. If a prohibited referral occurs and no exception covers the arrangement, the violation is established regardless of the parties’ state of mind. Sloppy contract drafting or an overlooked ownership interest is enough.

The entity that receives a prohibited referral cannot bill Medicare for the service, and if it already collected payment, it must refund the amount. Knowingly submitting a claim for a prohibited referral carries a civil penalty of up to $15,000 per service, and entering into an arrangement whose principal purpose is circumventing the self-referral prohibition carries a separate penalty of up to $100,000 per arrangement.¹⁴

One trap for DME suppliers: the Stark Law’s in-office ancillary services exception, which allows physicians to self-refer for many services provided within their own practice, specifically excludes most DME. A physician who owns a DME supply company cannot rely on this common exception to justify referrals to it.¹⁴

False Claims Act

The False Claims Act (FCA) is the federal government’s primary civil enforcement tool for healthcare fraud. Any person who knowingly submits a false claim for payment to the government, or causes one to be submitted, faces a civil penalty per claim plus three times the government’s damages.¹⁶

The statutory per-claim penalty range is $5,000 to $10,000, adjusted annually for inflation and significantly higher in current dollars. Because the penalty applies per claim, a supplier that submits hundreds of improperly documented claims faces aggregate liability that can dwarf the underlying reimbursement.

“Knowingly” under the FCA doesn’t require intent to defraud. It includes acting with reckless disregard or deliberate ignorance of a claim’s accuracy. Using the KX modifier without confirming that coverage documentation actually exists could qualify. The FCA also has a whistleblower provision that lets private individuals, often current or former employees, file suit on the government’s behalf and share in any recovery, so compliance failures can surface from inside the organization without any government audit initiating the process.

If a supplier discovers it has submitted false claims and cooperates fully with the government’s investigation within 30 days of learning about the problem, the court may reduce the damages multiplier from three times to two times the government’s losses.¹⁶ Early self-disclosure is almost always less expensive than the alternative.

OIG Exclusion Screening

Federal regulations prohibit DMEPOS suppliers from contracting with any individual or entity excluded from Medicare, state health care programs, or other federal procurement programs.¹ No federal health care program will pay for any item or service furnished, ordered, or prescribed by an excluded person, and that payment prohibition extends to the employer and any provider for which the excluded person works.¹⁷

Screen all employees and contractors against the OIG’s List of Excluded Individuals and Entities (LEIE) before hiring and at regular intervals afterward. If an excluded individual is discovered on staff, consult the OIG’s Self-Disclosure Protocol promptly.

What Happens If You Get Audited

Medicare uses its Targeted Probe and Educate (TPE) program as the primary audit mechanism for DME suppliers. MACs use data analysis to flag suppliers with high claim error rates, unusual billing patterns, or claims for items that carry high national error rates.¹⁸

The process runs in up to three rounds. Each round, the MAC reviews 20 to 40 claims and supporting medical records; if claims are denied, the supplier receives a one-on-one education session explaining the errors and at least 45 days to improve before the next round. Suppliers that demonstrate compliance after any round will not be reviewed again on that topic for at least one year. Lower-volume suppliers go through a similar process with fewer than 20 claims per round.¹⁸

Suppliers that fail to improve after three rounds get referred to CMS for escalated action. That can include 100 percent prepayment review, meaning every claim must be approved before payment is released, extrapolation of error rates across all claims to calculate an overpayment demand, or referral to a Recovery Auditor.¹⁸ Extrapolation is where the real financial damage happens. A 30 percent error rate on a sample of 40 claims, applied statistically across a full year of billing, can produce an overpayment demand that threatens a supplier’s solvency.

1
eCFR. 42 CFR 424.57 – Special Payment Rules for Items Furnished by DMEPOS Suppliers
2
Centers for Medicare & Medicaid Services. Standard Documentation Requirements for All Claims Submitted to DME MACs
3
Centers for Medicare & Medicaid Services. DMEPOS Order and Face-to-Face Encounter Requirements
4
Centers for Medicare & Medicaid Services. DMEPOS Accreditation
5
Centers for Medicare & Medicaid Services. Enroll as a DMEPOS Supplier
6
Centers for Medicare & Medicaid Services. Medicare Advance Written Notices of Non-Coverage
7
Centers for Medicare & Medicaid Services. Medicare Claims Processing Transmittal R2140CP
8
Centers for Medicare & Medicaid Services. Adjustments to Fee Schedule Amounts for Certain DMEPOS Using Information From the Competitive Bidding Program
9
Centers for Medicare & Medicaid Services. DMEPOS Competitive Bidding Program Updates and Important Information
10
Centers for Medicare & Medicaid Services. Medical Record Maintenance and Access Requirements
11
Office of Inspector General. Fraud and Abuse Laws
12
Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
13
eCFR. 42 CFR 1001.952 – Exceptions
14
Office of the Law Revision Counsel. 42 USC 1395nn – Limitation on Certain Physician Referrals
15
Centers for Medicare & Medicaid Services. Physician Self-Referral
16
Office of the Law Revision Counsel. 31 USC 3729 – False Claims
17
Office of Inspector General. Exclusions FAQs
18
Centers for Medicare & Medicaid Services. Targeted Probe and Educate