CMS bars 11 DME suppliers from Medicare Advantage and Part D payments; new-supplier prior authorization starts Oct. 15

On December 15, 2025, one Florida medical supply company billed Medicare about $6.1 million for urinary catheters for 500 beneficiaries. The next day it billed $12.3 million more, for 777 [1]. The Centers for Medicare & Medicaid Services (CMS) suspended those payments before they reached the supplier [1]. On September 8, it said that company is one of 11 it is now barring from Medicare Advantage (MA) and Part D payments.

What changed

CMS placed 11 suppliers of durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) on its Preclusion List, the roster that MA plans and Part D sponsors must check before paying a claim [1]. CMS ties the companies to more than $3.4 billion in suspected fraudulent billing in 2025 and 2026 [1]. According to the agency, all 11 had filed no claims before 2025, used improper billing practices, billed for beneficiaries who were already deceased, and supplied equipment to people who never asked for it or never got it [1].

Four had already been revoked from traditional Medicare and had moved on to billing MA plans [1]. CMS made the placements after determining the companies’ conduct was “detrimental to the best interests of the Medicare program,” working with the HHS Office of Inspector General (OIG) [1].

A second change for suppliers starts October 15. Suppliers newly enrolled in Medicare, or going through a change of ownership, enter a one-year probationary period in which prior authorization is a condition of payment for certain items with dates of service on or after that date [2]. The first list covers 40 HCPCS codes [3].

Who it affects

MA enrollees and their clinicians. The barred companies included a Texas orthotics firm that billed about $5.5 million, a New Jersey firm that billed an MA plan for 38 encounters after the patient had died, and a Florida company suspected of a telemarketing scheme involving braces [1]. In the Texas case, six beneficiaries told investigators they did not know the ordering providers and did not need the orthotics [1]. CMS has not named any of the companies [1].

Practices that order braces and bone stimulators. The probationary list is mostly orthoses: lumbar and lumbar-sacral braces, hip, knee, ankle-foot and walking-boot orthoses, and shoulder, elbow and wrist-hand orthoses, plus two non-invasive electrical osteogenesis (bone growth) stimulators, E0747 and E0748 [3]. That reaches orthopedics, sports medicine, podiatry, spine and primary care.

Practices that are DMEPOS suppliers themselves. A practice that dispenses braces under its own DMEPOS supplier enrollment is a supplier for these purposes. If that enrollment begins, or a change of ownership takes effect, on or after October 15, the probationary rules apply to it like any other supplier [2, 3].

What is the Medicare Preclusion List?

CMS created the list in an April 2018 final rule (CMS-4182-F). Earlier CMS rules would have required clinicians who write Part D prescriptions or treat MA patients to enroll in traditional Medicare. The 2018 rule dropped that approach for a claims-based one: a Part D sponsor must reject a pharmacy claim if the prescriber is on the list, and an MA item or service “will not be covered” if the provider that furnished it is on the list [5]. CMS said the switch would “reduce the burden on Part D prescribers and MA providers without compromising our program integrity efforts” [5].

An individual or entity can land on the list two ways [5]:

• it is revoked from Medicare, is under a reenrollment bar, and CMS finds the conduct behind the revocation detrimental to the program; or
• it engaged in behavior for which CMS could have revoked it had it been enrolled, and CMS makes the same finding.

The second path matters here. It lets CMS reach suppliers that bill only MA plans and never enrolled in traditional Medicare. CMS weighs the seriousness of the conduct, how much it could affect program integrity, and any other relevant evidence [5].

The rule sets out what happens next. CMS sends the listed entity a letter giving the reason and its appeal rights, which run through the HHS administrative appeals process in 42 CFR part 498 [5]. An MA plan that receives a claim from a listed entity must notify both the enrollee and the entity in writing that payment will not be made, and a plan that pays anyway can face sanctions or contract termination [5].

What it means for your practice

Some MA patients may need a new supplier. If a patient’s catheter, brace or other supply came from one of the 11 companies, the patient’s plan will stop paying that company [1, 5]. Patients who rely on recurring supplies may call your office when the plan’s letter arrives. Since CMS has not published the names, the plan’s notice is the practical signal [1, 5].

Your NPI may be on claims you never wrote. OIG’s August 17 white paper on DME fraud (OEI-02-24-00311) lists four ways bad actors get orders: forging them, paying kickbacks to physicians, tricking physicians into signing, for example by “faxing pre-filled orders for physicians to sign,” and using stolen physician identifiers with no order at all [4]. It adds that “Physicians are not routinely notified when DMEPOS claims list them as the ordering physician” [4]. Schemes have also adapted to detection: OIG says some fraudsters bought lists pairing Medicare enrollees with their own physicians, then put that physician on the claim to avoid analytics that look for no prior relationship [4]. The Texas case, where patients did not recognize the ordering providers, fits the pattern CMS describes [1].

New suppliers will ask for your paperwork sooner. Under probationary prior authorization, the supplier must get approval before delivery, which means it needs your documentation first [2]. CMS’s newsletter says these suppliers are also subject to the face-to-face encounter and written order prior to delivery requirements [2]. Our July report on the face-to-face and prior authorization lists explains those requirements, which take on 22 more codes on October 28.

Documentation gaps cost suppliers money, and you hear about it. In the same newsletter, CMS pointed to an OIG finding that continuous positive airway pressure (CPAP) devices had the second highest improper payment amount in the DMEPOS category because claims lacked required documentation [2].

What to do now

1. Ask MA patients on recurring supplies whether their plan has sent a nonpayment notice about their supplier, and route new orders to a different supplier where one has [5].
2. Review DME order requests that arrive unprompted. Confirm the patient is yours and that you evaluated the need before signing, as OIG’s examples of pre-filled faxed orders show [4].
3. Report orders you did not write to CMS or OIG, the two offices OIG names for physicians who spot fraudulent billing under their names [4].
4. Prepare chart notes for the 40 probationary codes so suppliers new to Medicare can submit prior authorization requests for deliveries on or after October 15 [2, 3].
5. If your group dispenses DME, check whether a new supplier enrollment or ownership change on or after October 15 puts your orthotic billing into the probationary year [2, 3].

The policy fight

CMS frames the action as fraud prevention before payment. “Fraudsters who take advantage of the recently deceased to line their pockets represent a level of indecency that we will not stand for,” said CMS Administrator Dr. Mehmet Oz [1]. The agency says it used data analytics, payment safeguards, enrollment authorities and the Preclusion List together [1].

OIG wants more up-front screening. Its white paper says DMEPOS suppliers that bill only MA “are not required to enroll in Medicare,” so they skip CMS’s screening checks, and it calls on CMS to require all of them to enroll, a step it says “may require statutory change” [4]. It also wants CMS to require MA plans to report the ordering physician’s NPI on encounter data, which a prior OIG report found was largely missing [4]. In its July 23 response, CMS said its February request for information for a planned anti-fraud rule asked about “reducing risks from non-participating DMEPOS suppliers in Medicare Advantage,” along with surety bonds and unsolicited outreach [4]. Our August report on that rule’s timeline covers what the request asked.

That would reverse the trade-off CMS made in 2018, when it chose a list applied at the claim over enrollment for everyone billing MA, to spare clinicians the paperwork [5]. A list works only after the conduct is found, and four of the 11 were billing MA plans after traditional Medicare had already removed them [1].

The OIG also floated options that would involve practices directly, such as an electronic way for physicians to confirm their orders before certain claims are paid, or reports showing physicians the DMEPOS billed under their names [4]. CMS has not said whether it will adopt either.