Medicare Provider Risk Screening and Site Visits: Tiers and Penalties

Medicare sorts every provider and supplier into one of three Medicare provider risk screening levels — limited, moderate, or high — and that category decides how hard CMS looks at you before letting you bill the program. Limited risk means standard identity and license checks. Moderate risk adds a mandatory unannounced site visit. High risk adds fingerprint-based FBI criminal background checks for anyone with 5 percent or greater ownership. Your provider type sets the starting tier, but your compliance history can override it.¹

CMS applies these levels at initial enrollment, at revalidation, when ownership changes, and when you add a new practice location. The rules live at 42 CFR 424.518.

Which Providers Fall Into Each Tier

Limited Risk

The limited tier is where CMS places provider types with the longest track records and the lowest historical fraud exposure. It covers physicians, nonphysician practitioners such as nurse practitioners and audiologists, medical groups, hospitals (including critical access and rural emergency hospitals), rural health clinics, and several other established categories.¹ If you enroll at this level, you go through database and identity verification but no required site visit and no fingerprinting.

Moderate Risk

Moderate risk applies to provider types CMS considers more vulnerable to abuse. The category includes:¹

Ambulance service suppliers
Community mental health centers
Comprehensive outpatient rehabilitation facilities
Independent clinical laboratories
Independent diagnostic testing facilities
Physical therapists enrolling individually or as group practices
Portable x-ray suppliers

Some providers land in the moderate tier only at revalidation. DMEPOS suppliers, home health agencies, skilled nursing facilities, and hospices that were already fingerprinted when they first enrolled revalidate at the moderate level rather than repeating high-risk screening.¹

High Risk

Three provider types are automatically classified as high risk at initial enrollment:¹

Newly enrolling home health agencies
Newly enrolling DMEPOS suppliers
Newly enrolling skilled nursing facilities

These same providers return to high risk when they submit a change of ownership application or report a new owner of any percentage.

What Can Bump You Into High Risk

Even if your provider type sits comfortably in the limited or moderate tier, CMS will move you up to high risk if any of the following applies to you:¹

CMS imposed a payment suspension on you at any point in the last 10 years.
The Office of Inspector General has excluded you from Medicare.
A Medicare contractor revoked your billing privileges within the last 10 years and you are now trying to enroll as a new provider or add a new practice location.
You have been terminated or precluded from billing Medicaid.
You have been excluded from any federal health care program.
You have been subject to any final adverse action within the previous 10 years.
You apply within six months after CMS lifts a temporary enrollment moratorium that had previously blocked your provider type.

That last trigger matters because CMS periodically freezes new enrollments in provider categories where it sees fraud patterns, and anyone who enrolls in the six months after the freeze lifts is treated as high risk regardless of their normal tier.²

What Screening Actually Involves

Baseline Checks Everyone Faces

Every applicant, regardless of tier, goes through the same starting checks. CMS verifies your Social Security Number or Employer Identification Number against federal records and confirms your National Provider Identifier. The agency searches the OIG’s List of Excluded Individuals and Entities and the General Services Administration’s debarment list. State licenses and professional certifications are checked to confirm you are authorized to practice. Applications flow through the Provider Enrollment, Chain, and Ownership System (PECOS), though paper submissions on the CMS-855 form series are still accepted.³

What Moderate Risk Adds

Moderate-risk providers satisfy every limited requirement and then face a mandatory on-site visit.¹ That single step is the main practical difference between limited and moderate.

What High Risk Adds on Top of That

High-risk providers do everything moderate providers do, plus fingerprinting. CMS requires every individual with a 5 percent or greater direct or indirect ownership interest to submit fingerprints for a national criminal background check through the FBI’s Integrated Automated Fingerprint Identification System.¹

You can submit fingerprints with your enrollment application. If CMS requests them separately, you have 30 days to comply. Missing that deadline results in denial of your application or revocation of existing billing privileges. The regulation builds in no grace period. Professional fingerprinting services for healthcare personnel typically run $35 to $60.

What a Site Visit Looks Like

Site visits are how CMS confirms you are a real, functioning business rather than a mail drop or a shell. Under 42 CFR 424.517, CMS can inspect any provider or supplier to verify enrollment information and Medicare compliance, and the visits are required for moderate and high-risk applicants.⁴

Visits are unannounced. An inspector shows up during normal business hours (typically 9 a.m. to 5 p.m., or whatever hours you have posted) without warning.⁵ They confirm the facility exists at the address on your application, check for permanent signage with the business name and hours, and verify that appropriate staff are present.

Inside, they look for evidence of real operations. For DMEPOS suppliers, that means inventory stored on-site and key documents ready for review: licenses, a written complaint policy and log, warranty records, and proof of business occupancy such as a lease or purchase agreement.⁵ The inspector documents the layout and records findings in a standardized report.

What Fails a Site Visit

A location is deemed non-operational if the inspector finds a vacant suite with no signage, a space with no visible business activity during posted hours, or a different business at the address that does not match any registered name on your application.⁵ Co-working spaces used only to receive or forward mail do not qualify as valid practice locations. Refusing to allow a site visit is itself grounds for denial or revocation. And if CMS finds a location non-operational but you have been billing Medicare for services delivered there, those claims can be treated as evidence of fraudulent billing.

What Failing Screening Costs You

For a new applicant, a failed screening results in denial under 42 CFR 424.530, which authorizes denial for noncompliance, a failed on-site review showing the provider is not operational, and other grounds.⁶

For a provider already enrolled, CMS can revoke billing privileges under 42 CFR 424.535 for similar reasons, including noncompliance found during a site visit or failure to report changes.⁷ Revocation is the heavier consequence because it triggers a re-enrollment bar of 1 to 10 years, starting 30 days after CMS mails the notice. If CMS decides you tried to circumvent the bar by enrolling under a different name or business identity, it can tack on up to 3 additional years. A second revocation can lead to a bar of up to 20 years. One narrow exception: if the revocation was based solely on missing a deadline to respond to a revalidation or information request, no re-enrollment bar applies.

Because your risk level is reassessed at every revalidation (every five years for most providers, every three years for DMEPOS suppliers), the tier that applied to you at initial enrollment is not the tier you keep forever. New history, new triggers, or a change of ownership can put you back at the top of the screening ladder.⁸

1
eCFR. 42 CFR 424.518 – Screening Levels for Medicare Providers and Suppliers
2
eCFR. 42 CFR 424.570 – Moratoria on Newly Enrolling Medicare Providers and Suppliers
3
Centers for Medicare & Medicaid Services. Medicare Provider Enrollment, Chain, and Ownership System (PECOS)
4
eCFR. 42 CFR 424.517 – Onsite Review
5
Centers for Medicare & Medicaid Services. Provider Enrollment Site Visits
6
eCFR. 42 CFR 424.530 – Denial of Enrollment in the Medicare Program
7
eCFR. 42 CFR 424.535 – Revocation of Enrollment and Billing Privileges in the Medicare Program
8
eCFR. 42 CFR 424.515 – Requirements for Reporting Changes and Updates