CMS Provider Enrollment Revocation (855): How to Appeal a Form CMS-855 Action
11 min read · Last reviewed May 23, 2026
If you received a CMS notice of provider enrollment revocation under 42 CFR § 424.535, you have a 60-day window to file a reconsideration request and a defined appeal track under 42 CFR Part 498. The revocation effective date — typically 30 days from notice — is the date billing must stop, not the date the appeal track ends. Engage counsel within 48 hours.
What a CMS-855 revocation is
The CMS-855 forms (CMS-855A for institutional providers, CMS-855B for clinics and group practices, CMS-855I for individual physicians and non-physician practitioners, CMS-855S for DMEPOS suppliers, CMS-855R for reassignment of benefits) are the Medicare enrollment applications. The provider's enrollment record lives in PECOS. Revocation under 42 CFR § 424.535 terminates that enrollment.
Common revocation bases under 42 CFR § 424.535(a) include:
- (a)(1) Noncompliance — failure to meet enrollment requirements
- (a)(2) Provider or supplier conduct — final adverse action against the provider, including state license loss
- (a)(3) Felony conviction within the preceding 10 years for an offense CMS determines is detrimental to Medicare program integrity
- (a)(4) False or misleading information on the enrollment application
- (a)(5) On-site review finding the practice is not operational
- (a)(8) Abuse of billing privileges, including a pattern of submitting claims that do not meet Medicare requirements
- (a)(9) Failure to report a change in ownership, address, or adverse legal action within the required window
- (a)(10) Failure to document or provide CMS access to documentation required by enrollment rules
- (a)(13) Prescribing authority issues, including loss of DEA registration or state authority to prescribe
- (a)(14) Improper prescribing practices — a pattern or practice of prescribing that does not meet Medicare requirements
- (a)(22) Patient harm — when CMS determines the provider's conduct poses an undue risk to Medicare beneficiaries
The basis matters because the re-enrollment bar length and the appeal posture vary by basis.
The re-enrollment bar
Under 42 CFR § 424.535(c), the re-enrollment bar runs from 1 to 10 years.
| Basis category | Typical bar | | --- | --- | | Standard cause-based revocation | 3 years | | Pattern of abusive billing or repeated noncompliance | 3-10 years | | Felony conviction (program-integrity offense) | 10 years | | False statements on the enrollment application | Up to 10 years | | Pattern after prior revocation | Up to 20 years (re-revocation bar extension) |
Failure to respond to a revalidation request is generally a deactivation under 42 CFR § 424.540(a)(3), not a § 424.535 revocation, and deactivation does not itself impose a reenrollment bar. A revalidation deactivation can ripen into a § 424.535 revocation if the provider fails to satisfy CMS reactivation requirements; track revalidation deadlines proactively so a missed cycle stays in the deactivation lane rather than escalating.
The bar runs from the effective date of the revocation, not the date the appeal closes. Successful appeals can reduce both the basis and the bar; even a partial appeal win that shifts the revocation from (a)(8) abuse of billing privileges to (a)(1) noncompliance can shorten the bar materially.
First 48 hours
`` Hour 0–4 Date-stamp the revocation notice. Read the basis, the effective date, the re-enrollment bar length, and the contact for reconsideration. Calendar the 60-day reconsideration deadline and any 30-day rebuttal window. Hour 4–12 Engage outside healthcare counsel. Hour 12–24 Inventory the underlying facts. What is the basis CMS cited? What documentation contradicts it? What state board, NPDB, payer, and credentialing reporting obligations attach? Hour 24–48 Issue litigation hold. Brief leadership under privilege. Stop new patient acceptance for Medicare beneficiaries if the effective date is near. ``
Specific moves:
- Read the basis carefully. The CMS notice cites the specific regulatory subsection. Each subsection has different elements, different appeal arguments, and different bar implications.
- Note both the effective date and the appeal deadline. They are different. Billing stops on the effective date. The appeal can continue. Confusing the two creates independent False Claims Act exposure for post-effective-date claims.
- Identify any rebuttal opportunity. Some CMS revocations are preceded by a 30-day rebuttal notice or are issued with a 30-day rebuttal window before reconsideration. The rebuttal is an earlier, lower-burden opportunity to address CMS directly; it does not extend the 60-day reconsideration deadline.
- Coordinate the parallel reporting timeline. State medical or pharmacy board self-reporting often requires action within 30 days of the federal action. NPDB reporting is automatic. Commercial-payer notification obligations under network contracts run independently.
- Brief Medicare patients only after counsel direction. Continuity-of-care obligations under state medical practice law continue even when Medicare billing rights stop. Counsel coordinates the patient-communication script.
The appeal track under 42 CFR Part 498
The standard CMS enrollment appeal track:
``` Level 1: Reconsideration (Contractor) Filed within 60 days of revocation notice 42 CFR § 498.22(b) Filed with the contractor or hearing officer named in the revocation notice Decision is a "reconsidered determination"
Level 2: Administrative Law Judge hearing Filed within 60 days of unfavorable reconsideration 42 CFR § 498.40 De novo review on the written record (in-person hearing on request) Decision is an "initial decision"
Level 3: Departmental Appeals Board (DAB) Appellate Division Filed within 60 days of unfavorable ALJ decision 42 CFR § 498.82 Review on the record; remand or reverse rarely
Level 4: Federal district court Filed within 60 days of receipt of the DAB decision under 42 CFR § 498.95 Generally limited to the administrative record ```
Each level has a strict filing deadline. Missing any deadline forecloses the rest of the appeal. The reconsideration is the most important stage — it is the first chance to put the underlying facts on the record, the last stage where new evidence is routinely accepted, and the stage at which most revocations are either reversed or affirmed.
Building the reconsideration request
A reconsideration request is the practice's substantive defense. It is not a form letter. Standard structure:
- Cover letter from counsel describing the request, the regulatory citations, the basis being contested, and any procedural objections.
- Statement of facts with citations to the underlying records.
- Legal argument addressing each element of the cited revocation basis.
- Supporting documentation — the enrollment application as filed, communications with the contractor, the underlying records that contradict or contextualize the cited basis, any state board or licensure documentation that bears on the basis.
- Mitigation evidence for the bar length, even when the revocation basis itself is harder to contest.
- Affidavits from individuals with knowledge of the underlying facts, when appropriate.
- Privilege log for any document withheld.
The reconsideration request is the only point in the appeal track at which substantial new evidence is routinely admitted. ALJ and DAB review are largely on the record from below. Build the record at reconsideration.
What NOT to do
- Do not bill Medicare after the effective date. Billing after revocation is treated as billing without enrollment. Claims are denied, the MAC may recoup historical claims tied to the revocation period, and post-effective-date claims can generate independent False Claims Act exposure.
- Do not skip the rebuttal opportunity when one is offered. The rebuttal does not extend the reconsideration deadline, but it can resolve some matters before the formal appeal track begins.
- Do not attempt to re-enroll under a successor entity to circumvent the bar. CMS treats the bar as attaching to common ownership and control under 42 CFR § 424.535(c) and can extend or layer revocations on a successor entity.
- Do not communicate with the CMS contractor informally during the appeal. Every communication is on the record.
- Do not ignore the state board self-reporting clock. Most state boards require self-reporting of federal revocations within 30 days. Missing that window can compound the federal action with a state license action.
- Do not assume the appeal stays the revocation. Filing an appeal does not stay the revocation effective date. Billing must stop. The appeal continues separately.
Special cases by basis
Felony conviction revocation under (a)(3)
CMS may revoke based on any felony conviction within the preceding 10 years that CMS determines is detrimental to Medicare program integrity. The list of named offenses in the regulation is illustrative, not exclusive. The reconsideration arguments are narrow — generally, that the offense is not within the categories CMS may consider, or that the 10-year lookback does not capture the conviction. The bar in (a)(3) matters is typically 10 years.
License loss revocation under (a)(2)
State license loss triggers automatic revocation under (a)(2). The federal reconsideration is generally limited; the substantive defense usually has to be made at the state board level to restore the license. State board reinstatement does not automatically restore Medicare enrollment — a new CMS-855 application is required after the bar period.
Abuse of billing privileges revocation under (a)(8)
This is the most contestable basis because it requires CMS to demonstrate a "pattern" of noncompliant claims. The reconsideration can challenge the claim sample, the determination that the cited claims fail Medicare requirements, the pattern characterization, and the proportionality of the revocation. Many successful enrollment-revocation appeals turn on (a)(8) sample-and-pattern arguments.
False statements revocation under (a)(4)
This basis requires showing that the practice or provider made a false statement in the enrollment application. The reconsideration can challenge whether the statement was material, whether it was false at the time made, and whether the provider had the requisite knowledge. Bar length can be substantial.
Prescribing-related revocation under (a)(13) and (a)(14)
Subsection (a)(13) addresses loss of DEA registration or state prescribing authority. Subsection (a)(14) addresses a pattern or practice of improper prescribing. Both run in parallel to DEA enforcement and state controlled-substance authority interest. Counsel must coordinate the federal enrollment appeal with parallel DEA and state matters from day one.
Continuity of care during revocation
State medical practice acts impose continuity-of-care obligations on physicians regardless of Medicare enrollment status. Abandonment of patients during a revocation period creates state board exposure independent of the federal action.
Counsel coordinates:
- Notification to active Medicare patients of the change in enrollment status
- Referral pathways to other Medicare-enrolled providers
- Continued treatment for emergent and ongoing care needs
- Records release support for patients changing providers
- Coordination with hospitals where the provider has admitting privileges
The federal revocation does not extinguish state medical license obligations.
Parallel exposures
A CMS-855 revocation rarely sits alone. Typical parallel exposures:
- NPDB reporting triggered by the revocation
- State medical or pharmacy board self-reporting within 30 days
- Commercial-payer network termination under contract provisions tied to Medicare enrollment status
- Hospital privileges review under medical staff bylaws
- D&O / E&O insurance notification under policy provisions
- OIG permissive exclusion analysis under 42 USC § 1320a-7(b)(4)
- UPIC, OIG, or DOJ activity if the revocation basis ties to a fraud, kickback, or abuse theory
- DEA enforcement for prescribing-related revocations
Counsel maps each at the day the revocation notice arrives, not later.
State-law overlay
Every state medical and pharmacy board has its own rules on response to federal enforcement actions. Most require self-reporting within 30 days of a federal revocation, denial, or exclusion. Some state boards initiate independent action on the federal basis; others wait for the federal appeal to resolve. State-law analysis is provider-specific and license-specific:
- California Medical Board — self-reporting under Business and Professions Code § 802.1
- Texas Medical Board — self-reporting under 22 TAC § 178
- New York Office of Professional Medical Conduct — under Education Law § 6530
- Florida Board of Medicine — under F.S. § 456.072
State pharmacy boards have parallel rules for pharmacist enrollments. State controlled-substance authorities have their own reporting obligations for prescribing-related revocations.
Restraint about outcomes
No guide can promise a revocation appeal outcome. The most predictable variable is the quality and timeliness of the reconsideration request: a counsel-led record build, supported by documentation, addressing each element of the cited basis and the mitigation case for bar length. Many revocations are affirmed; many are reversed; many are modified. The appeal preserves the option that the practice would otherwise forfeit.
This is not legal advice. CMS enrollment revocation is a strategic legal matter; consult outside healthcare counsel before filing any appeal under 42 CFR Part 498.
How d3rx fits
The d3rx compliance binder assembles the source-grounded enrollment-supporting documentation a revocation appeal is built from — PECOS records, revalidation correspondence, compliance program documentation, internal audit log, training records, billing-policy documentation. The d3rx audit defense workflow walks the 48-hour first response, the litigation hold, the contractor log, and the reconsideration record structure. d3rx does not represent the practice in any CMS, OIG, DOJ, DEA, or state proceeding and does not replace counsel; it is a point-in-time administrative documentation aid that counsel and the practice work from.
Step 1 · Get the binder
Get the d3rx compliance binder for your practice
Pre-filled to address the gaps this guide covers — CMS Provider Enrollment Revocation (855): How to Appeal a Form CMS-855 Action. We will email you the section preview and your binder intake link.
No PHI required. We use your email to send the binder preview and intake link only.
Frequently asked
Can I keep billing Medicare during a CMS-855 revocation appeal?
No. Revocation is effective on the date stated in the notice, which is typically 30 days from the date of the notice for most cause-based revocations under [42 CFR § 424.535(g)](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-D/section-424.535). For revocations based on a felony conviction, exclusion, or license loss, the revocation can be effective as early as the date of the underlying event. Billing after the effective date is treated as billing without an enrollment and creates independent False Claims Act exposure. The appeal continues, but billing stops on the effective date.
What is the re-enrollment bar after a CMS-855 revocation?
Under [42 CFR § 424.535(c)](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-D/section-424.535), the re-enrollment bar runs from 1 to 10 years depending on the basis. Most cause-based revocations carry a 3-year bar by default. Specific bases — fraud felony convictions, patterns of abusive billing, false statements in enrollment applications — can extend the bar to 10 years. The reconsideration and ALJ stages may reduce both the revocation basis and the bar length, which is one of the strongest reasons to appeal even when the underlying facts are not in dispute.
What are the deadlines for a CMS-855 revocation appeal?
The standard appeal track under [42 CFR Part 498](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-498) runs: 60 days for reconsideration under [42 CFR § 498.22(b)](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-498/subpart-B/section-498.22), 60 days for ALJ hearing under [42 CFR § 498.40](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-498/subpart-D/section-498.40), 60 days for Departmental Appeals Board review under [42 CFR § 498.82](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-498/subpart-E/section-498.82), and federal district court review thereafter. Missing the 60-day reconsideration window forecloses the appeal entirely. Some practices receive a CMS-855 letter offering a 30-day rebuttal window before the formal reconsideration — the rebuttal is an additional, earlier opportunity but does not extend the 60-day reconsideration deadline.
What is the difference between a CMS revocation and an OIG exclusion?
Revocation under [42 CFR § 424.535](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-D/section-424.535) terminates Medicare enrollment for the named provider. Exclusion under [42 USC § 1320a-7](https://www.law.cornell.edu/uscode/text/42/1320a-7) bars the individual or entity from all federal healthcare programs, including Medicaid and TRICARE, with a separate appeal track to OIG and the DAB. Mandatory exclusion is automatic on certain felony convictions. A practitioner can be revoked from Medicare without being excluded, or both can run in parallel.
Will a CMS-855 revocation be reported to my state medical board?
Yes, through NPDB and through state cross-reporting arrangements. Most state medical boards have rules requiring self-reporting of federal enrollment revocations, denials, and exclusions within a defined window — often 30 days. State board reciprocal action against the license can compound the federal action significantly. Counsel should map the federal reconsideration and state board self-reporting timelines together from the day the revocation notice arrives.
Can I re-enroll under a new entity or name to avoid the re-enrollment bar?
No. CMS regulations at [42 CFR § 424.535(c)](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-D/section-424.535) treat the bar as attaching to the individual provider and to entities under common ownership and control. Attempting to circumvent the bar by re-enrolling under a different TIN, a new entity, or through a successor practice is independently sanctionable and can extend the bar or trigger additional revocation actions under [42 CFR § 424.535(a)(4)](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-D/section-424.535). Counsel evaluates legitimate successor or change-of-ownership options against the bar mechanically.
Turn this into a review-ready binder
The Security Risk Analysis is where this guide becomes documentation you can actually hand to a reviewer — assembled into one review-ready binder. Source-grounded, citation-linked, and explicit about what it does and does not do.
Editorial process. This guide was drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and edited by the D3rx team for restraint and source fidelity. A named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged to verify citations — see the team page for status. Until that reviewer engagement is finalized, this page does not claim credentialed review.
This article is an administrative documentation aid. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program. References cited link to primary sources at HHS, OCR, CMS, the Code of Federal Regulations, NIST, and state regulators.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
- 42 CFR § 424.535https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-D/section-424.535
- 42 CFR Part 498https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-498
- 42 CFR § 424.540(a)(3)https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-D/section-424.540
Sources verified as of May 23, 2026
This guide is a plain-English summary maintained by D3rx for healthcare practice administrators. It is not legal advice, medical advice, or accounting advice. The authoritative source is the cited regulation or agency document. Always confirm with qualified counsel before acting on a specific compliance question affecting your practice.
Related Guides
Related across the archive
- ComplianceMedicare TPE Audit: The 45-Day Response WindowReceived a Medicare TPE letter from your MAC? You have 45 days from the ADR per claim. Sequence the response, address probe errors, and avoid Round 2.
- ComplianceOIG Self-Disclosure Protocol: When to Use It, When to Hold BackThe OIG SDP is a powerful resolution tool but it is not the right move for every matter. Here is how the 2021-amended SDP works and when counsel uses it.
- ComplianceUPIC Audit Response: What to Do First (and What Not to Touch)A UPIC letter signals suspected fraud, not a routine review. Engage counsel before responding. Here is the procedure that preserves the practice.
- ComplianceOIG LEIE Monthly Exclusion Screening: Process + Audit-Ready LogsMonthly OIG LEIE and SAM.gov exclusion screening for every workforce member and vendor: the workflow, the log fields auditors require, and the escalation path.
- CompliancePECOS Provider Enrollment Verification (2026) — Quarterly ChecklistQuarterly PECOS provider enrollment verification workflow: who to check, the exact lookup steps, the audit log columns, and the revalidation escalation path.
- ComplianceZPIC / I-MEDIC Audit Response: What's Different from UPICZPIC is the legacy FFS program-integrity contractor (now UPIC); I-MEDIC is the Part C and Part D investigations contractor. Counsel before response. Here is what to do first.
- ComplianceAdditional Documentation Request (ADR): How to Respond Inside the WindowMedicare ADR response windows are contractor-specific (45 days for MAC/SMRC/RAC, 30 days for UPIC). Miss the window and the claim auto-denies. Here is the procedure that actually works.
- ComplianceBreach Risk Assessment: The 4-Factor Analysis Required by 45 CFR 164.402After a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.