CMS Is Increasing Scrutiny on Supplier Licensure: What DMEPOS Providers Need to Know
Recent Medicare enforcement activity indicates an increasing emphasis on supplier compliance with state licensure requirements. This focus is further underscored by a recent reminder posted on the CMS Competitive Bidding Program website, which noted that supplier licensure will be validated throughout the bidding process.
Although state licensure has long been a fundamental Medicare enrollment requirement, recent enforcement actions suggest that CMS is strengthening its oversight in this area as part of broader initiatives to combat healthcare fraud, safeguard program integrity, and ensure supplier accountability.
For suppliers, state licensure should no longer be viewed as a one-time enrollment obligation. Instead, it should be treated as an ongoing compliance priority, requiring continuous monitoring and maintenance to ensure compliance with both Medicare participation requirements and applicable state regulations.
A Changing Enforcement Environment
Over the past several weeks, multiple DMEPOS suppliers have been subjected to Medicare PTAN revocations following CMS determinations that products were furnished or shipped into states in which the suppliers lacked the requisite state licensure. In one such notice, from the National Provider Enrollment Contractor (NPE), CMS stated:
"A review of your billing report for dates of service from June 1, 20XX, through June 23, 20XY, shows that your company submitted claims in the following states without the required state pharmacy licenses...”
Notably, these enforcement actions have been applied retroactively, resulting in significant financial liability through overpayment determinations and substantial operational disruption. In at least one matter, a supplier's PTAN was revoked retroactively to 2021, giving rise to an overpayment assessment in the hundreds of thousands if not millions. CMS has pursued collection efforts aggressively, often initiating recovery through the supplier's surety bond and referring the debt to the U.S. Department of the Treasury shortly after the overpayment determination becomes final.
The procedural mechanisms available to delay or stay recoupment are limited, underscoring the importance of prompt action by affected suppliers to preserve available appeal rights and pursue all applicable administrative remedies. Importantly, CMS has not limited its recovery efforts to claims directly associated with the identified licensure deficiency. Rather, the agency has asserted that claims submitted and paid during the period of noncompliance are not payable under Medicare requirements, thereby exposing suppliers to recoupment of all payments made during the affected timeframe.
These actions should also be viewed within the broader context of CMS's expanding program integrity initiatives and increased enforcement activity across the healthcare sector. Coupled with recent nationwide healthcare fraud enforcement efforts, including one of the largest federal healthcare fraud takedowns involving DME suppliers, these developments demonstrate a heightened regulatory focus on supplier compliance with Medicare enrollment and participation requirements.
The regulatory message is unequivocal: CMS and its contractors are actively scrutinizing supplier compliance, and enforcement activity in this area is expected to continue. Accordingly, suppliers should treat state licensure compliance as a critical and ongoing legal and regulatory obligation, supported by robust monitoring, auditing, and governance processes designed to ensure continuous compliance across all jurisdictions in which they conduct business.
Why Licensure Matters
Pursuant to 42 CFR § 424.57(c)(1), “Application certification standards. The supplier must meet and certify in its application for billing privileges that it meets and will continue to meet the following standards:
- Operates its business and furnishes Medicare-covered items in compliance with the following applicable laws
(i) Federal regulatory requirements that specify requirements for the provision of DMEPOS and ensure accessibility for individuals with disabilities
(ii) State licensure and regulatory requirements. If a state requires licensure to furnish certain items or services, a DMEPOS supplier:
(A) Must be licensed to provide the item or service; and
(B) May contract with a licensed individual or other entity to provide the licensed services unless expressly prohibited by state law.”
This requirement is also memorialized in the Medicare DMEPOS Supplier Standards as it indicates a supplier must be in compliance with all applicable Federal and State licensure and regulatory requirement.
Operating outside those requirements, even unintentionally, can lead to significant consequences, including:
- Medicare payment suspensions
- PTAN being revoked
- Retroactive overpayment demands
- Increased audit activity
- Cash flow disruption
- Operational and staffing challenges
Because licensure requirements vary by state, organizations operating across multiple markets face additional complexity.
The Challenge
Most suppliers are not intentionally attempting to violate supplier standards. However, compliance issues can arise when suppliers are unaware of state-specific licensure requirements or Medicare enrollment obligations.
For illustrative purposes only:
Consider a seasonal beneficiary who spends the winter months in a warmer state, such as Florida, and obtains a CPAP device from a Florida-based supplier. During the summer, the beneficiary returns to their primary residence in Ohio and contacts the Florida supplier to request replacement CPAP supplies be shipped to Ohio. If Ohio requires out-of-state suppliers furnishing CPAP equipment and supplies to hold a valid state license, and the Florida supplier does not possess the required Ohio licensure, the supplier may be in violation of both federal and state regulations by furnishing and billing Medicare for those supplies. Such violations could subject the supplier to its Medicare billing privileges (PTAN) being revoked. In addition, the supplier could be found noncompliant with Medicare enrollment requirements if it has not reported Ohio as a service area on its CMS-855 enrollment application.
Another common scenario occurs when beneficiaries temporarily travel outside of a supplier’s established service area and request replacement supplies be shipped to the state they are visiting. Depending on the licensing requirements of that state, fulfilling such requests may also result in regulatory noncompliance.
Maintaining awareness of changing state licensure requirements, renewal deadlines, and expansion opportunities can be challenging. The DMEPOS Licensure Database Directory, available on the Medicare enrollment contractor websites, provides general licensing requirements and contact information for each state and territory licensing authority. However, suppliers should understand that this resource is intended as a guide only. Because licensing requirements may change, it remains the supplier’s responsibility to ensure all required licenses are current, accurate, and properly reflected in PECOS.
I recommend the supplier consider the licensure database on starting point but always verify with the state and obtain written confirmation when the state suggests a licensure is not required.
Questions Every Organization Should Be Asking
Leadership and compliance teams should periodically evaluate:
- Are we licensed in every state where we currently provide products or services?
- Are all states we service updated on the 855s in PECOS?
- Have we recently expanded into new markets without reviewing state requirements or updated PECOS?
- Who owns our state licensure management process?
- How are license renewals monitored?
- Do our operational workflows identify shipments that could present licensure concerns?
- Have we recently reviewed changing state licensing requirements, and we have policy and procedure to check?
Building a More Proactive Approach
Rather than reacting after an enforcement action, suppliers should consider strengthening their compliance programs by:
- Maintaining a centralized inventory of all state licenses.
- Performing routine licensure audits and consider refunding individual claim if identified. Please note, suppliers must consult their healthcare attorney or Compliance Department on the obligations before issuing refunds.
- Reviewing licensure before entering new markets.
- Educating operational and intake teams on licensure awareness.
- Exploring technology and automation that can identify potential shipping exceptions before they become compliance issues. This includes but is not limited to placing validation rules to stop shipment for states provider do not have the requisite licensure.
As technology continues to evolve, organizations may also benefit from automated alerts that compare shipping destinations against authorized service areas, helping identify potential concerns earlier in the revenue cycle.
How ACU-Serve Can Help
While ACU-Serve does not maintain or validate supplier licensure records, we believe education and proactive operational planning can help reduce compliance risk.
Our compliance and operations teams continue to monitor regulatory developments, educate clients on emerging risks, and evaluate opportunities to strengthen operational workflows that support compliant revenue cycle processes.
As CMS oversight continues to evolve, organizations that regularly review their compliance programs and adapt their operational processes will be better positioned to reduce risk and protect revenue.
Conclusion:
The recent increase in CMS enforcement activity serves as a clear reminder that state licensure compliance is not merely an administrative requirement but a foundational condition of Medicare participation. As demonstrated by recent PTAN revocations, retroactive overpayment demands, and aggressive recovery efforts, even unintentional licensure gaps can expose DMEPOS suppliers to significant financial, operational, and regulatory risk.
In today's evolving enforcement environment, suppliers should take a proactive approach by regularly reviewing licensure requirements, validating service areas reported in PECOS, strengthening internal controls, and educating staff on state-specific compliance obligations. Organizations that implement robust monitoring and governance processes will be better positioned to identify potential issues before they become costly enforcement actions.
Ultimately, maintaining continuous compliance with state licensure requirements is essential to protecting Medicare billing privileges, preserving revenue, and supporting long-term operational stability. As CMS continues to prioritize program integrity, suppliers that invest in proactive compliance strategies will be best equipped to navigate increasing regulatory scrutiny and reduce organizational risk.