On Jan. 1, 2026, several significant changes from the Centers for Medicare & Medicaid Services (CMS) took effect for suppliers of Durable Medical Equipment, Prosthetics, Orthotics and Supplies (DMEPOS). A key change is the extension of the “36-month rule” to DMEPOS suppliers. This rule, which has long applied to home health agencies and more recently, hospices, can prevent the transfer or use of Medicare billing privileges by a buyer if the business was initially enrolled or sold within the prior 36 months. Other changes will affect supplier accreditation, ownership transfers, competitive bidding and oversight.
Though these policy changes have not received widespread attention, they will significantly impact merger and acquisition strategy, deal structuring and daily operations for many DMEPOS suppliers, including healthcare providers like hospitals, pharmacies and physician practices that also supply DMEPOS. The new policies, which CMS included in its CY 2026 Home Health Agency Prospective Payment System Final Rule (Final Rule), are designed to close program integrity gaps. CMS’ stated goal is to strengthen oversight and prevent fraud associated with frequent ownership changes that can obscure a supplier’s identity and compliance history.
For critical action items in light of the changes, see below.
The 36-Month Rule for DMEPOS: Deal-Critical Implications
The Final Rule introduces a “36-month rule” for DMEPOS suppliers that limits the transfer or use of Medicare billing privileges after a “change in majority ownership.” This is defined as an acquisition of more than a 50% direct ownership interest (including in an asset sale, stock transfer, merger or consolidation), which can happen in a single transaction or through multiple smaller deals that add up to over 50% within a 36‑month period. If a change in majority ownership happens within 36 months of the supplier’s initial Medicare enrollment or its most recent ownership change, the billing privileges will not be transferred to or inherited by the new owner. Instead, the buyer must enroll as a new supplier and get a new accreditation, unless a specific exception applies. This rule mirrors a similar one for home health agencies and hospices, and CMS stated it is intended to prevent new suppliers from being quickly “flipped” to new owners without a proper review of the new ownership.
The impact of this rule on DMEPOS suppliers will be much broader than for home health agencies or hospices. Unlike those provider types, the DMEPOS supplier category includes a wide variety of businesses, including traditional DME companies, pharmacies, health systems and physician practices. Critically, each physical location that furnishes DMEPOS must be separately enrolled and accredited — meaning a hospital system, pharmacy chain or orthopedic practice group with multiple offices faces the 36-month rule at each site, independently, creating unique complexities for transactions involving multi-location or diversified healthcare companies. Furthermore, some deal structures involving indirect ownership, which are common for home health agencies, may not be an option for physician practices due to state laws prohibiting non-physician ownership. CMS did not address these wider implications in the Final Rule, creating uncertainty for suppliers on key questions, such as how to measure the 36-month period for a business with multiple locations.
The Final Rule does not include a “grandfather” clause for existing suppliers. This means transactions closing on or after Jan. 1, 2026, will be subject to the rule, even if the supplier’s initial enrollment or a prior ownership change occurred before the policy took effect.
There are three narrow exceptions:
- Internal corporate restructurings at the parent level (such as a merger or consolidation);
- Changes in the DMEPOS supplier’s business structure where the owners remain the same (for example, converting from a corporation to a partnership or LLC); and
- The death of an individual owner.
These exceptions are narrow and require careful, fact-specific analysis to avoid triggering the rule. If an ownership change is not exempt, the buyer must enroll as a new supplier and obtain new accreditation. This process involves significant processing time and uncertainty, typically three to six months. Crucially, because the seller’s Medicare billing privileges do not transfer, the business will face a period without the ability to bill Medicare, creating major transactional and operational challenges.
Investors, sponsors, lenders and strategic buyers and sellers in DMEPOS will need to build additional time and contingencies into diligence, structuring and closing to account for potential new enrollment, accreditation scheduling and payor re-credentialing. Stakeholders in specific service lines that utilize DMEPOS heavily, such as orthopedics, respiratory care, sleep clinics and chronic disease management, should take special note.
The practical takeaway is straightforward: Stakeholders must treat 36-month timing and supplier-level direct ownership changes as gating issues early in diligence and structuring discussions. Where feasible, consider indirect ownership transactions at higher-tier entities that do not alter direct majority ownership at the enrolled supplier, or plan for new enrollment sequencing, accreditation lead time and payor notification logistics if a conveyance is unavoidable.
Accreditation: Shift to Annual Surveys and Enhanced Oversight
With the Final Rule, CMS replaces the triennial accreditation cycle with an annual one, requiring suppliers to be surveyed and reaccredited at least every 12 months. All surveys will now be unannounced. For suppliers accredited before the rule’s effective date, the annual cycle begins upon expiration of the current three‑year accreditation period; for example, by illustration only, a supplier accredited for three years as of June 1, 2023, will begin the new annual resurvey and accreditation cycle on June 1, 2026, and subsequently will be due for its first annual resurvey by June 1, 2027, and annually thereafter. Although, CMS cautions in the Final Rule that suppliers “should not assume that AOs must or will wait until exactly 12 months after the supplier’s previous survey to perform the present survey,” such that DMEPOS suppliers should be ready weeks before.
The Final Rule also eliminates temporary accreditation for new supplier locations. AOs must now survey all new and relocated sites before granting accreditation. Separately, suppliers must report ownership, control and practice location changes to Medicare within 30 days and notify their AO when opening a new location to coordinate its accreditation.
CMS now requires AOs to survey all supplier locations as a condition of accreditation and reaccreditation. While CMS retains discretion to permit an AO to use a CMS-approved sampling methodology in limited instances, the Final Rule does not establish a broad right to sample for large chains or set numeric caps on surveys.
Stronger AO Oversight and Faster Reporting to CMS
These changes strengthen CMS oversight of AOs. Under the Final Rule, AOs must provide monthly submission of survey results, accreditation decisions, resolved deficiencies, corrective action plans and instances where the AO exercised discretion not to survey. Additionally, AOs must respond to CMS data requests within three business days and notify CMS within two business days of identifying an immediate jeopardy deficiency.
The message is clear: CMS expects continuous, high visibility into supplier compliance and AO decision-making, with the goal of consistent enforcement of DMEPOS quality standards and timely intervention where AOs detect noncompliance.
DMEPOS Competitive Bidding Program and Related Payment Policies
The Final Rule also modernizes the DMEPOS Competitive Bidding Program (CBP). Key changes affect how Medicare sets prices, now using the 75th percentile of winning bids to calculate the single payment amount for lead items. The Final Rule also adjusts payments for other items based on 2015 fee schedules and adds an annual inflation update to payments. Finally, it streamlines the bidding process for suppliers by reducing administrative burdens and improving payment accuracy and patient access. While these payment changes are important for revenue forecasting, the more immediate and critical issues for investors and operators are the new 36-month ownership rule and the significant accreditation reforms.
Prior Authorization Exemption Process
The Final Rule adds an exemption process for DMEPOS prior authorization, consistent with CMS’s broader push for heightened oversight. For a decade, CMS has required prior authorization for certain DMEPOS items deemed “frequently subject to unnecessary utilization.” CMS justifies this by pointing to high error rates: DMEPOS claims had a 21.4% improper payment rate in the 2024 CERT report. Under the new framework, suppliers achieving at least a 90% provisional affirmation rate will be exempt from prior authorization. The exemption remains in effect unless the supplier’s non-payable claims rate exceeds 10%. CMS will provide at least 60 days’ notice before an exemption or withdrawal takes effect. This exemption change adds to CMS’s tightened oversight rewards for compliance.
Action Items in Light of the Changes
- Confirm whether a contemplated transaction triggers a change in majority ownership at the enrolled supplier level within the relevant 36-month window. If so, plan for new enrollment and accreditation, or consider structuring alternatives, such as ownership changes at a higher corporate level (where possible) to avoid a direct ownership change at the supplier level.
- Build an internal accreditation preparation calendar that assumes annual, unannounced surveys.
- Eliminate reliance on temporary accreditation for new locations.
- Tighten protocols to ensure AO and National Provider Enrollment notifications occur within 30 days for ownership and location changes and maintain documentation to withstand heightened AO and CMS scrutiny.
The Final Rule meaningfully raises the regulatory bar for DMEPOS suppliers and related stakeholders. The extended 36‑month rule will drive earlier structuring analysis and longer transaction timelines, while annual accreditation and rigorous AO oversight will require year‑round operational readiness. Market participants who adapt quickly by planning for enrollment and accreditation contingencies, preparing for stricter restraints in change of ownership events and maintaining continuous survey preparedness will minimize closing date surprises and preserve enterprise value.
McGuireWoods’ Healthcare Compliance, Regulatory & Policy attorneys continuously monitor CMS developments affecting DMEPOS suppliers and related stakeholders. For more information, contact one of the authors of this article.