DME Compliance Updates 2026: Latest Rules, Deadlines, and Checklist

Annual Accreditation: A Structural Change for the Industry

The CY 2026 final rule replaced the three-year accreditation cycle with annual surveys. Under the new 42 CFR 424.57(c)(24), DMEPOS suppliers must be surveyed and reaccredited at least once every 12 months.

The change is phased in. According to CMS’s accreditation guidance, a supplier’s annual cycle begins when its current three-year accreditation expires. CMS gives this example: a supplier accredited on June 1, 2023 reaches the end of its three-year cycle on June 1, 2026, then must be reaccredited by June 1, 2027 and again by June 1, 2028. Suppliers first accredited on or after January 1, 2026 are on the annual cycle from the start. That means many suppliers will go through their first annual survey in 2027.

Other accreditation changes in the rule:

• All accreditation surveys of DMEPOS suppliers must be unannounced.
• Every supplier location must be accredited, and new locations must be surveyed before they are accredited.
• Accreditation organizations face more detailed and more frequent reporting to CMS, plus new conflict-of-interest rules.

Operationally, compliance becomes part of daily workflows. Policies must stay current, patient files must be complete at all times, and staff must follow procedures consistently. Our DMEPOS accreditation guide covers what surveyors look for.

Ownership Changes and the 36-Month Rule

The CY 2026 final rule added a new 36-month rule for DMEPOS suppliers at 42 CFR 424.551. If an owner acquires more than 50% direct ownership of a supplier within 36 months of the supplier’s initial enrollment, or within 36 months of its most recent change in majority ownership, the billing privileges do not transfer. The supplier must enroll as a new supplier and obtain a new accreditation. Ownership changes are counted cumulatively over the 36 months.

The rule has limited exceptions, including internal corporate restructuring, a change in business structure where the owners stay the same, and the death of an owner.

This matters as consolidation continues across the DME industry. Situations that often raise compliance risk include:

• Selling a majority stake in a DME company
• Adding a new partner with controlling ownership
• Merging two supplier entities under one structure
• Acquiring another enrolled supplier’s assets
• Several smaller ownership transfers that together exceed 50% within 36 months

Many ownership changes happen for good business reasons and still carry regulatory consequences. A new enrollment can also trigger probationary prior authorization (see below). Involve compliance and legal review before a deal is structured, not after.

Enrollment Oversight: Revocation, Moratorium, and Probationary Prior Authorization

Expanded Retroactive Revocation

The CY 2026 final rule lets CMS make certain revocations retroactive, which allows Medicare to recover payments made during a period of noncompliance. For example, a revocation for violating a DMEPOS supplier standard can now take effect on the date the noncompliance began. A revocation for failing to report a change of ownership or location can take effect the day after the reporting deadline. A beneficiary’s attestation that an item was never furnished is also a new basis for revocation. The rule also tightened the $300,000 liability insurance standard, and a lapse in coverage can lead to retroactive revocation.

Six-Month Enrollment Moratorium (Ended)

CMS imposed a nationwide six-month moratorium on new enrollments for several types of medical supply company suppliers, effective February 27, 2026. Most ownership changes were exempt, except majority ownership changes within 36 months. AAHomecare reported that the moratorium ended on August 27, 2026 without an extension.

Probationary Prior Authorization for New Suppliers

Starting October 15, 2026, CMS requires probationary prior authorization for certain DMEPOS items billed by newly enrolled suppliers and by suppliers undergoing certain changes of ownership. The program uses the one-year probationary period in 42 CFR 424.527. Suppliers with an enrollment date or ownership change effective on or after October 15, 2026 must submit a prior authorization request before delivering any item on CMS’s Probationary Prior Authorization List. These suppliers must also follow the standard Required Prior Authorization List.

Prior Authorization: More Codes in 2026

For items on the Required Prior Authorization List, prior authorization is a condition of payment. CMS expanded the list twice in 2026.

• April 13, 2026: seven codes were added, including orthoses L0651, L1844, L1846, L1852, and L1932, and pneumatic compression devices E0651 and E0652.
• October 28, 2026: eight more codes. Thoracic-lumbar-sacral orthoses L0456, L0457, and L0486, knee orthosis L1833, air-fluidized bed E0194, and ultralightweight manual wheelchair K0005 apply nationwide. Elbow and wrist-hand orthoses L3761 and L3916 start in California, Florida, Michigan, and New York on October 28, 2026, expand to more states on January 26, 2027, and go nationwide on April 26, 2027.

The CY 2026 final rule also created an exemption. Suppliers with a payable claims rate of at least 90% on prior authorization requests can be exempted, and the exemption is withdrawn if their non-payable rate rises above 10%. CMS began the first exemption cycle on June 1, 2026.

Documentation still drives most outcomes. The practitioner’s notes, the standard written order, and the billed item must tell the same clinical story. Common weaknesses CMS continues to flag include:

• Missing or incomplete written orders before delivery
• Practitioner notes that do not clearly support medical necessity
• A mismatch between the diagnosis and the equipment type
• Templated notes with no patient-specific detail
• No proof of a face-to-face encounter when one is required

See how to get DME prior authorizations approved faster.

Competitive Bidding Returns: Round 2028

The CY 2026 final rule, published in the Federal Register on December 2, 2025, rebuilt the DMEPOS Competitive Bidding Program. The program has been paused since January 1, 2024, and the next round starts no later than January 1, 2028.

• A nationwide Remote Item Delivery program. Round 2028 uses a single competitive bidding area covering every state, territory, and the District of Columbia for items usually shipped to patients.
• Seven product categories: Class II continuous glucose monitors (CGMs), insulin pumps, urological supplies, ostomy supplies, hydrophilic urinary catheters, and off-the-shelf back, knee, and upper extremity braces.
• CGMs and insulin pumps become monthly rentals. Once Class II CGMs and insulin pumps are furnished under the program, Medicare pays for all CGMs and insulin pumps as frequent and substantial servicing items, with supplies included in the monthly rental payment.
• A new payment method. Single payment amounts are set at the 75th percentile of winning bids instead of the maximum winning bid.

On October 7, 2026, CMS announced the Round 2028 bidding timeline. Bidder registration opens December 1, 2026, and the bid window opens January 5, 2027. CMS expects to announce contract suppliers in 2027, ahead of the January 1, 2028 start. AAHomecare is asking Congress and the Administration to pause the Remote Item Delivery model.

Suppliers that bill any of the seven categories should decide their Round 2028 strategy now, whether or not they plan to bid. Non-contract suppliers will generally not be paid for these items in the program once it starts, apart from transition rules for existing patients.

Proposed for 2027: The CY 2027 Home Health and DMEPOS Rule

CMS published the CY 2027 proposed rule (CMS-1844-P) on July 6, 2026. Comments closed August 31, 2026. As of October 13, 2026, the final rule had not been released. CMS usually publishes it in early November. The DMEPOS proposals include:

• No new face-to-face encounter when an item is replaced with an identical item under the same HCPCS code. A new order would still be required.
• More grounds for enrollment denial and revocation, more retroactive revocation reasons, and a reapplication bar of up to 10 years.
• Expanded DME coverage for certain external infusion pumps, home infusion drugs, and supplies.
• A requirement for competitive bidding contract suppliers to report the country of origin for lead items.

We will update this section when the final rule is published.

Fee Schedule and Coding Updates

CMS updates the DMEPOS fee schedule every January and adjusts it quarterly. For CY 2026, most items received a 2.0% update, based on a 2.7% CPI-U increase minus a 0.7% productivity adjustment. The October 2026 quarterly update, effective October 1, 2026, added and deleted several HCPCS codes and set out CGM and insulin pump coding changes that take effect January 1, 2028. The CY 2027 update is usually published in December.

One more deadline: CMS says providers and suppliers must verify their HETS email address by December 1, 2026, or their eligibility requests will be rejected.

Fee changes are financial, but billing accuracy is a compliance issue. Claims with outdated amounts, wrong modifiers, or deleted codes can quickly become audit findings. Billing-focused best practices include:

• Loading fee schedule and HCPCS updates every quarter
• Auditing modifier use on high-volume codes
• Monitoring denial trends by payer and product category
• Keeping clear records of coverage criteria for common items

Our Medicare DME fee schedule guide explains how to find the right rate.

Fraud Enforcement and OIG Focus Areas

Enforcement against DME fraud reached new levels in 2025 and 2026, and legitimate suppliers feel the effects through more reviews and stricter enrollment.

• The 2025 National Health Care Fraud Takedown charged 324 defendants in schemes with $14.6 billion in intended losses. Operation Gold Rush accounted for $10.6 billion in urinary catheter and DME claims.
• The 2026 Takedown, announced June 23, 2026, charged 455 defendants in schemes involving more than $6.5 billion in false claims, including DME schemes.
• In August 2026, OIG published a white paper on the challenge of combating DME fraud in Medicare. In September 2026, it recommended that all DMEPOS suppliers billing Medicare Advantage be enrolled in Medicare.
• On September 8, 2026, CMS added 11 DMEPOS suppliers to its Preclusion List for Medicare Advantage and Part D, tied to $3.4 billion in suspected fraud.
• DME MACs continue Targeted Probe and Educate reviews, which CMS uses for providers and suppliers with high denial rates or unusual billing patterns.

The WISeR prior authorization model that started in six states in 2026 does not cover DMEPOS supplier items. OIG has no DMEPOS-specific compliance guidance beyond its General Compliance Program Guidance from November 2023, which applies to all providers and suppliers.

Our guide to avoiding Medicare audit clawbacks covers the documentation auditors check most often.

HIPAA and Privacy Updates

The proposed update to the HIPAA Security Rule, published in January 2025, had not been finalized as of October 2026. Separately, the compliance date for the revised 42 CFR Part 2 rule on substance use disorder records was February 16, 2026, and HHS announced a civil enforcement program for it. Suppliers that receive these records as part of referrals should confirm their privacy policies cover them. See our HIPAA compliance checklist for DME providers.

Key DME Compliance Deadlines for Late 2026 and 2027

Compliance Then vs. Now

DME Compliance Checklist for 2026 and 2027

The suppliers that adapt best are not always the largest. They make compliance practical, visible, and shared across intake, billing, delivery, and leadership.

• Find your current accreditation expiration date and plan for annual, unannounced surveys from that date.
• Run quarterly internal chart audits and mock surveys instead of annual reviews.
• Review any planned ownership change against the 36-month rule before signing.
• Report changes of ownership, location, and key information on time to avoid retroactive revocation.
• Keep liability insurance and the $50,000 surety bond current for every enrolled location.
• Update intake checklists for the April and October 2026 prior authorization codes.
• If you enrolled or changed ownership on or after October 15, 2026, check the Probationary Prior Authorization List before delivery.
• Decide your Round 2028 strategy if you bill CGMs, insulin pumps, urological or ostomy supplies, or off-the-shelf braces.
• Load HCPCS and fee schedule updates every quarter.
• Track denial rates and documentation errors by branch and payer on a dashboard.
• Run short, recurring staff training on new CMS rules.

These steps reduce audit risk and also improve revenue cycle efficiency, because fewer claims need rework.

Why Compliance Is Becoming a Competitive Advantage

Compliance can look like overhead. In 2026, it increasingly supports growth. Payers are more selective about their networks, referral sources prefer suppliers that avoid documentation problems, and buyers review compliance maturity during due diligence. Under the 36-month rule, a clean compliance record also protects business value during an ownership change.

Strong compliance programs help suppliers pass accreditation with fewer deficiencies, reduce denials and appeals, perform better in payer audits, qualify for prior authorization exemptions, and build trust with referral partners.

How NikoHealth Supports Compliance Workflows at Scale

For large, multi-location DME providers, staying survey-ready every day means applying the same checks to every order, at every branch. NikoHealth runs intake, orders, delivery, and billing on one platform, with a payer rules engine, prior authorization tracking, automated pre-submission claims scrubbing, and patient records that store orders, clinical documents, and proof of delivery in one place. NikoHealth is HIPAA-compliant and ISO 27001-certified. Accreditation is earned by the supplier. NikoHealth supports the documentation and workflow consistency that makes surveys and audits easier to pass.