Two Years for a Standards Case, Ten for an Affiliation
Medicare's re-enrollment bar is a severity grade CMS writes in years, and it publishes the grades without ever calling them that. We diffed the revoked-provider extract CMS posted October 21 against the July build: 940 enrollments arrived, 456 left, and the two populations are nothing alike.
"What does Medicare think a paperwork failure is worth, in years?"
The regulation answers it directly, and almost nobody reads it as an answer. A re-enrollment bar "lasts a minimum of 1 year, but not greater than 10 years … depending on the severity of the basis for revocation."
That last clause is a grading scale. CMS assigns every revoked enrollment a number of years, and it publishes all of them.
On October 21 it published 8,620 of them.
What Ten Years Buys
Take the file CMS posted Wednesday, keep only the 4,046 records that cite exactly one ground under 42 CFR 424.535(a), and take the median bar length for each ground. The spread runs from 2.10 years to the statutory ceiling, and five separate grounds sit exactly on that ceiling (chart below).

Felonies at 10.00 years is the number you would guess. Look at the bar sitting above it.
424.535(a)(19) lets CMS revoke you because you have, or have had, an affiliation under 424.519 that poses an undue risk of fraud, waste, or abuse. No conduct of your own is alleged in that sentence. The median bar on the 317 records that cite it alone is 10.00 years, identical to the felony grade, and the shortest one in the file is 4.79.
The other end of the scale is where most enrollments actually live. Plain noncompliance, 424.535(a)(1), grades at 2.10 years across 1,399 single-ground records, and on-site review failures at 3.14.
Why the List Looks Like a Fraud Registry
The extract holds only providers currently sitting under a live bar, which makes it a stock of standing punishments rather than a feed of new ones. So we keyed the October build against the July 30 build CMS still serves, by enrollment ID.
940 enrollment IDs are in the new file and not the old one. 456 are in the old one and not the new. The list grew by 484 on net, and that number hides almost everything interesting about it.
The arrivals and the residents are different populations:
- Of the 940 that arrived, 484 cite noncompliance, 51.5%. Of the 7,680 that were already there, 1,374 do, 17.9%.
- Felonies run the other way: 16.6% of the arrivals, 46.3% of the residents.
- And of the 456 that left, 308 cite noncompliance. 67.5%.
Those three cuts are all the same mechanism. A two-year bar cycles through the file in two years and a ten-year bar sits in it for ten, so the standing list silts up with the severe grades while the quarter's actual intake is supplier standards and licensure. 436 of those 484 noncompliance arrivals are specifically DME standards. The top four provider types among the arrivals are DME pharmacies at 187, medical supply companies at 135, clinic and group practices at 113, and hospices at 69.
Here's the catch worth carrying out of this: anyone reading the standing list as a picture of enforcement is reading a ten-year archive of felonies and calling it this quarter's risk.
The Ten-Year Line Is Moving
One more thing the file does that the regulation text will not tell you. (a)(9) failure to report appears on 3,632 of the 8,620 records, second only to felonies, and it is the sole ground cited on 20 of them.
Twenty. On 1,964 records it rides alongside a felony instead, which makes it the charge CMS stacks rather than the one it leads with.
That matters now because of what is sitting unfinalized. The CY 2027 home health proposed rule (CMS-1844-P, comments closed August 31, still no final rule) proposes to make every remaining prospective revocation ground retroactive, and new 424.535(g)(1)(ix) would make an (a)(9) revocation effective the day after the reporting deadline you missed. Everything billed between that date and the notice becomes an overpayment. CMS prices the whole retroactive package at $81,963,430 a year across an estimated 337 providers, roughly $243,000 each.
The same rule reaches the top bar on that chart. In 424.535(a)(19), CMS proposes to insert "or any of its owning or managing employees or organizations," so the affiliation that costs you ten years would no longer have to be yours.
The file already shows where that lands. Of the 72 arrivals citing (a)(19), 66 cite nothing else, their median bar is 10.00 years, 21 are hospices, and 39 of the 72 are in California.
Final Thoughts
Nothing here is an enforcement trend. Three months of one stock file cannot carry that weight, and we would not ask it to.
What it does carry is the price list. Medicare has been publishing its own severity grades in a column nobody reads as a column, and those grades say a reporting lapse is worth two years while an association is worth ten.
The rule that would widen the second one has been through comment and is waiting on a signature.
Thanks for reading.