CMS Bars 11 Companies in $3.4 Billion Medicare Billing Fraud Crackdown

Quick Answers

As of September 2026, the Centers for Medicare and Medicaid Services (CMS) has barred 11 durable medical equipment (DMEPOS) suppliers from receiving future Medicare Advantage and Part D payments after linking them to more than $3.4 billion in suspected fraudulent billing during 2025 and 2026. The enforcement action, announced on September 8 as part of the White House Anti-Fraud Task Force, uses the CMS Preclusion List to cut off payment and signals a broader shift toward AI-powered fraud detection that affects every provider and billing company in the Medicare ecosystem.

• Who was targeted: All 11 companies were DMEPOS suppliers that had no claims before 2025, billed for deceased beneficiaries, and supplied equipment patients never requested.
• What CMS used: Advanced data analytics, payment suspensions, enrollment revocations, and the Preclusion List, a tool that blocks suppliers from billing Medicare Advantage plans.
• Why practices should care: CMS is now using the same analytics tools to scrutinize billing patterns across all provider types, which means any practice with unusual claim volume or coding anomalies could trigger a review.

What CMS Found in the Investigation

The September 8, 2026, CMS press release detailed a pattern of fraud that went beyond typical billing errors. Every one of the 11 suppliers shared a common profile: they had submitted zero claims before 2025, used improper billing practices from the start, billed Medicare for equipment supplied to patients who were already deceased, and supplied equipment to beneficiaries who never requested or received it.

Four of the 11 companies had already been revoked from Original Medicare. Rather than stopping, they pivoted to billing Medicare Advantage plans instead, exploiting a gap that CMS has now closed through the Preclusion List.

Two cases stand out for the scale of the suspected fraud. A Florida-based provider submitted approximately $18.4 million in catheter claims over two consecutive days in December 2025, billing $6.1 million tied to 500 beneficiaries on one day and $12.3 million for 777 beneficiaries the next. A Texas-based company submitted $5.5 million in orthotics claims. When investigators contacted six beneficiaries, all six said they did not know the ordering providers, had never heard of the company, and did not need the equipment. CMS also identified claims for nine beneficiaries with dates of service after their deaths.

A New Jersey firm billed a Medicare Advantage plan for 38 separate encounters where the beneficiary was already deceased on the reported date of service. Another Florida company was suspected of participating in a DME telemarketing scheme involving oversupply of medical equipment, with multiple beneficiaries reporting they never received the braces for which the company billed.

Who Does the CMS Fraud Crackdown Affect?

The immediate targets are the 11 DMEPOS suppliers now on the Preclusion List. But the broader impact reaches every provider, practice, and billing company operating in the Medicare ecosystem.

CMS has stated publicly that it is deploying the same advanced data analytics used to catch these suppliers across all Medicare billing categories. The agency reported $42 billion in fraud prevention savings in Fiscal Year 2025 alone. So far in 2026, CMS has identified $1.8 billion in Medicare overpayments through medical review, collected $378 million through post-payment reviews, and suspended more than $539 million in suspected fraudulent payments.

That means any practice, not just DME companies, with billing patterns that look unusual to CMS’s algorithms could trigger a review. Practices that rely on third-party billing companies or outsource portions of their revenue cycle should be asking whether their billing partners are enrolled, compliant, and transparent. In our experience matching providers with billing partners, one of the most common gaps we see is that practices have never independently verified their billing company’s Medicare enrollment status or checked the CMS Preclusion List.

Why This Crackdown Is Different

CMS has pursued billing fraud for decades. What makes this enforcement cycle different is the technology behind it and the speed at which the agency is acting.

The Fraud Defense Operations Center (FDOC), launched in March 2025, uses AI-driven data analytics to flag suspicious billing patterns before payments are issued. In previous years, CMS relied heavily on post-payment audits and whistleblower tips. By the time fraudulent payments were identified, the money was already gone. The FDOC model is built to stop payments before they clear, and it is working. Since January 2026, the FDOC has accounted for more than $371 million in suspended Medicare payments across 267 providers and suppliers.

This is not limited to DME. The same analytics tools flagged $1.6 billion in fraudulent Medicare laboratory payments announced on August 28, 2026, and have been deployed against hospice, skin substitute, and autism therapy billing. If you follow the OIG Medicare billing audit developments we covered earlier this year, you can see the pattern: CMS and OIG are coordinating enforcement across every billing category simultaneously.

For practices, the message is clear. The scrutiny is algorithmic, it runs across every claim type, and it acts before payment is released. Reactive compliance is no longer a viable strategy.

How Does CMS Detect Billing Fraud?

CMS uses a combination of enrollment screening, claims analysis, and advanced data analytics to identify suspicious billing. Understanding what triggers a review helps practices avoid unintentional red flags.

The key takeaway from this table is that CMS is layering multiple detection tools simultaneously. A single unusual claim may not trigger action. A pattern of unusual claims absolutely will.

What to Do Now to Protect Your Practice

Whether you handle billing in-house or outsource it, the September 2026 enforcement actions require a concrete compliance response. Here are the steps to take this month.

1. Verify your billing partner’s Medicare enrollment status. Log in to PECOS (Provider Enrollment, Chain, and Ownership System) and confirm your billing company’s enrollment is active. Four of the 11 barred companies had been revoked from Original Medicare and were billing MA plans instead. A simple PECOS check catches this.
2. Check the CMS Preclusion List. The Preclusion List is public. Search it for any vendor, supplier, or billing company your practice works with. If a company appears on this list, they cannot receive Medicare Advantage or Part D payments.
3. Audit your claim volume reports. Request a monthly claims summary from your billing company. Look for sudden volume increases, claims for patients you do not recognize, and services that do not match your appointment schedule.
4. Review your Explanation of Benefits (EOB) statements. If Medicare or an MA plan sends EOBs to your practice for services you did not order or patients you do not treat, that is a red flag. Report it immediately.
5. Confirm documentation matches billed services. Every claim your practice submits or allows a billing company to submit must have supporting documentation in the medical record. Documentation gaps are the single fastest way to trigger a CMS review.
6. Report suspected fraud. If you suspect a vendor or billing partner is engaging in fraudulent billing, contact the Medicare hotline at 1-800-MEDICARE or report to the HHS-OIG at oig.hhs.gov. CMS has stated that early reporting from providers is one of its most effective fraud detection inputs.

Common Compliance Mistakes That Trigger Scrutiny

Most practices caught in a CMS review are not committing fraud. They are making billing errors or overlooking vendor compliance issues that put them in the same data pattern as bad actors. The most common issue we see providers run into is not realizing their billing company’s behavior is generating the same flags that CMS uses to identify fraud.

• Failing to update patient eligibility before billing. Claims submitted for patients whose coverage has lapsed or who have passed away generate the same flags as the deceased-beneficiary billing in this crackdown. Running eligibility verification before every encounter is not optional.
• Not reviewing what your billing company submits. Outsourcing billing does not outsource responsibility. The rendering provider’s name is on the claim, and the provider is accountable for what is billed under their NPI. Request and review claim submission reports monthly.
• Ignoring Medicare enrollment maintenance. Medicare enrollment must be revalidated on schedule. A lapsed enrollment can cause bulk denials and, worse, can make legitimate claims look suspicious if they are submitted during a gap. Track your revalidation dates or ensure your billing partner does.
• Coding higher than documentation supports. Upcoding, whether intentional or from documentation shortfalls, is one of the most consistently audited billing patterns. If your E/M level selection does not match the medical decision-making documented in the chart, a CMS review will find it. Understanding how the modifier 25 payment reduction proposal could further tighten same-day billing scrutiny makes this even more urgent.
• Using a billing company without verifying their credentials. One question we hear constantly from practice managers is how to tell whether a billing company is legitimate. At minimum, verify their Medicare enrollment in PECOS, check the Preclusion List, ask for references from current clients, and confirm they carry errors and omissions insurance.

Should You Outsource Billing or Handle It In-House?

The fraud crackdown raises a fair question for practice managers: is outsourcing billing riskier than keeping it in-house? The answer depends entirely on who you outsource to and how you manage the relationship.

In-house billing gives you direct control over every claim. But it also means your staff must track every CMS quarterly update, monitor payer policy changes, maintain enrollment and revalidation timelines, and manage denial workflows across multiple payers. Most practices that handle billing internally find it works at small volume but breaks down past a few thousand encounters per month.

Outsourcing to a reputable billing company shifts that operational burden to a team that manages billing across dozens of practices and stays current on CMS changes by necessity. The risk is not in outsourcing itself. The risk is in choosing the wrong partner and failing to monitor their work.

Across the billing companies we vet, a recurring pattern is that practices wait until they have a denial crisis or an audit notice before evaluating their billing partner. The better approach is to build compliance checks into the relationship from the start. Ask to see their claim acceptance rate, denial rate, days in accounts receivable, and a sample monthly report before signing. If a billing company cannot produce these metrics, that tells you something. Compare what to look for when vetting a billing company against the compliance profile CMS is now enforcing.

Frequently Asked Questions

Next Steps