HHS agenda puts CMS's CRUSH anti-fraud rule on an October track; its RFI floated 90-to-180-day Medicare claim deadlines

How long can a physician practice hold a Medicare claim before it files? Today Medicare gives it one calendar year [3]. In February, CMS asked whether that limit should shrink to 90 to 180 days, and a federal planning document published August 14 says the rule that could carry such a change is due in October [2, 3].

What changed

The 2026 Unified Agenda, the government’s list of rules in development, appeared in the Federal Register on August 14 [1, 2]. It places a CMS proposed rule called Comprehensive Regulations to Uncover Suspicious Healthcare, or CRUSH (file code CMS-6098, RIN 0938-AV97), at the proposed rule stage with a target of October 2026 [2]. The entry says the rule “would include provisions related to provider enrollment, medical review, investigations, and other program integrity oversight provisions that would greatly strengthen CMS’s ability to crush fraud” across Medicare, Medicaid and CHIP [2].

The agenda does not say what the rule will contain beyond that. CMS lists its legal authority as 42 U.S.C. 1395hh, marks the affected CFR sections “Not Yet Determined,” and leaves open whether a small-business impact analysis will be required [2]. CRUSH is also one of the HHS entries in the 2026 Regulatory Plan, published with the agenda [2].

The clearest guide to its contents is the request for information (RFI) CMS published February 27, which drew comments through March 30 [2, 3]. It asked about 13 subject areas, from claim deadlines and ownership rules to lab testing, surety bonds and Marketplace brokers [3]. CMS said the list was not a ceiling: “This RFI does not necessarily solicit comments on the full scope of topics that could be included in a potential, future CRUSH Rule” [3].

Who it affects

Every Medicare-enrolled provider and supplier could be touched by enrollment and medical review rules, but the RFI singled out some groups.

• High-risk items and suppliers. CMS named durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) as an example of a high-risk category for a shorter filing window, and asked whether DMEPOS suppliers’ $50,000 surety bond should rise or extend to other provider types [3].
• Laboratories, especially genetic testing. The RFI cites an OIG finding that genetic tests were 5% of Part B lab tests in 2024 but 43% of Part B lab spending, or $3.6 billion [3, 4]. Total Part B lab spending was $8.4 billion that year, up 5%, while spending on routine tests such as metabolic and lipid panels fell to $4.8 billion [4]. CMS asked why some Medicare Advantage (MA) plans require labs outside MolDX states to register with that program [3].
• Practices that bill only MA plans. CMS asked whether all providers should have to enroll in traditional Medicare as a condition of billing MA, or only high-risk types [3]. Its stated concern: providers revoked from traditional Medicare for reasons not deemed “detrimental to the best interests of the Medicare program” stay off the preclusion list and “often shift their billing operations to MA plans” [3].
• Practices with outside investors. The RFI asked about requiring U.S. citizenship or legal permanent residency for every individual with a 5% or greater ownership or control interest in a Medicare-enrolled provider or supplier [3]. It also asked whether fingerprinting and background checks, now required for 5% owners of “high” risk organizations, should extend to managing employees and smaller owners [3].
• Practices that do patient outreach. DMEPOS suppliers are barred from unsolicited phone contact with beneficiaries; CMS asked about extending that bar to email, text and social media, and about legislation applying it to other provider types [3].

Could Medicare shorten its one-year timely filing limit?

It is on the table, not in a proposal. CMS asked “How would a claim filing deadline of 90 to 180 calendar days, which is consistent with private industry norms, impact your practice?” [3]. Its reasoning was that “Ensuring claims are filed more promptly will assist CMS in evaluating data and reduce the ability of providers to back-bill for fraudulent claims” [3].

CMS laid out four ways to scope it: all claims from high-risk provider types, all claims for high-risk items or services, all claims from individual providers deemed high-risk, or some other method [3]. It also asked whether one deadline for every claim would be simpler, and whether the current flexibilities in 42 CFR 424.44, or new ones, would be needed [3].

The scope matters more than the number. A deadline limited to DMEPOS would apply mainly to suppliers; a single deadline for all Part A and Part B claims would reach every practice that bills traditional Medicare.

What it means for your practice

Nothing changes on your claims or enrollment today. The RFI asked questions, and the agenda sets a target month. What the documents show is where CMS is looking, and some of those places are routine practice operations.

Claim lag becomes a compliance number. If the filing window shrinks, the claims at risk are the ones you hold on purpose. MGMA told CMS that practices sometimes hold claims for months after a change in a patient’s Medicare eligibility or while documentation issues are resolved, and that staff shortages or turnover can push filing past a few months [5]. Those are the claims to track now.

Enrollment records carry more weight. The RFI’s ownership questions focus on identity, citizenship and residency of owners and on who counts as a managing employee [3]. CMS asked specifically about entities with foreign parent companies or international investors [3]. If you have outside owners of any kind, know exactly who appears on your enrollment record.

MA revenue could depend on traditional Medicare status. A clinician who bills only MA plans and has never enrolled in traditional Medicare would face a new step if CMS adopts that idea [3].

Payment suspensions could come from plans. CMS asked whether MA organizations and Part D sponsors should be allowed to suspend payments to providers on terms like traditional Medicare’s, and required to when CMS directs [3].

Medicaid is moving on a separate track. The agenda also lists a July target for a Medicaid and CHIP integrity proposal (CMS-2450) that would add grounds for state Medicaid agencies to terminate or deny enrollment and give them more authority for on-site provider visits [2]. Agenda dates are estimates in both directions. The same document lists a July target for CMS’s drug prior authorization proposal (CMS-0062), which was published April 14 [2, 6].

What to do now

1. Measure your filing lag. Pull the number of days from date of service to first claim submission, by payer and by reason for delay [3, 5]. That data supports a comment if a proposal arrives.
2. Check your enrollment record. Confirm that owners with 5% or more, managing employees and control interests listed for your practice are current [3].
3. Inventory MA-only billing. Identify clinicians or locations that bill MA plans but are not enrolled in traditional Medicare [3].
4. Review outreach. If your practice or a vendor contacts patients by text, email or social media, know who sends what [3].
5. Use the open comment period you have. CMS is already proposing enrollment changes in the CY 2027 home health rule (CMS-1844-P), which applies to physician practices as well; comments are due by 5 p.m. EDT on August 31 [7]. We covered those proposals, including retroactive revocations, in our July report.

The policy fight

CMS frames the effort as closing gaps that bad actors exploit, from the preclusion list’s blind spot in MA to lab billing. Its RFI says CMS’s Fraud Defense Operations Center, formed in 2025, sped up payment suspensions and produced “$1.8 billion in taxpayer savings in 2025, over $100 million of which was related to suspect laboratories” [3].

MGMA, which represents medical group practices, said it supports CMS’s commitment to cutting waste and fraud but wants new rules aimed at “those most likely to commit fraud” [5]. On claim deadlines, it said practices “see the 1-calendar year claim filing deadline as a backstop, not a deadline,” and argued that “Removing this flexibility and reducing the claim filing deadline will not prevent fraudulent actors from back-billing as they will simply change the date of service on their claims” [5].

On MA, MGMA opposed letting plans suspend payments, writing that the power “should not be extended to third-party organizations, such as MA organizations, that may lack the judgment and credibility enjoyed by CMS” [5]. It said requiring MA-only providers to enroll in traditional Medicare “would impose an unnecessary burden and not effectively identify or prevent fraudulent behavior” [5]. On artificial intelligence in coding review, a topic CMS also raised, MGMA urged CMS “not to rush widespread adoption of AI tools until they have been thoroughly tested” [3, 5].

Several RFI questions were addressed to MA plans directly, including whether they would support the traditional Medicare enrollment requirement and whether the preclusion list meets their needs [3]. How the plans answered, and which of the 13 topics make it into the proposal, is not yet public.