To become eligible to bill for services provided to Medicare beneficiaries, prospective Medicare providers and suppliers apply to the program by completing an online enrollment application in PECOS or by submitting a paper enrollment application that is manually entered into PECOS. Application information, such as name, address, specialty area, licensure, and accreditation, is used to create the provider’s or supplier’s enrollment record in PECOS. An individual provider or supplier may have more than one enrollment record; for example, a provider may have one enrollment record for a practice in one state and another enrollment record for a practice in another state. CMS places all provider and supplier types into risk categories—limited, moderate, or high—based on CMS’s assessments of the potential risk of fraud, waste, and abuse each provider and supplier type poses to Medicare program integrity. CMS also designates specific screening activities for each risk category. See table 1 for the types of Medicare providers and suppliers assigned to each enrollment screening risk category. Under contract to CMS, MACs screen providers and suppliers in all risk categories to verify that they meet Medicare eligibility requirements, such as having current federal or state licenses or accreditation. Medicare regulations require that site visits be conducted for all high- and moderate-risk providers and suppliers. Those conducting the site visits determine whether the reported practice locations are operational and meet requirements such as specified hours of operation. In addition to these site visits, high-risk providers and suppliers also are subject to a fingerprint-based criminal background check. In the course of this screening, MACs may request additional information from the prospective provider or supplier. Upon completion of screening, the MAC reaches a decision to approve eligible providers and suppliers, deny ineligible providers and suppliers, or reject incomplete applications. Figure 1 shows the enrollment process, including the screening conducted for each risk category. Once enrolled, to remain eligible to bill Medicare providers and suppliers must continue to meet CMS’s enrollment requirements, and they must report to CMS any changes to their enrollment information, including final adverse actions taken against them, such as a suspension or licensure revocation by a state licensing authority. In addition, providers and suppliers periodically are required to resubmit enrollment information to the MAC to update their enrollment records. The MAC revalidates the provider’s or supplier’s enrollment record using the enrollment screening process, to determine whether the provider or supplier remains eligible to bill Medicare. Upon completing the revalidation process, the MAC reaches a decision to approve providers and suppliers that remain eligible; deactivate billing privileges for providers and suppliers that have not responded to a request to resubmit enrollment information or have not submitted all required information—privileges that may be reactivated upon submission of a new enrollment application or recertifying that current enrollment information is correct; or revoke billing privileges for providers and suppliers determined ineligible. Providers and suppliers must submit updated information for their enrollment records for revalidation every 5 years, with the exception of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers, which must submit their information every 3 years. CMS initiated the first program-wide revalidation effort for all providers and suppliers enrolled in Medicare prior to March 25, 2011, by mailing notices to providers and suppliers in three phases, from September 2011 through March 2015, as shown in figure 2. Each notice sent by the MAC asks the provider or supplier to submit a newly completed enrollment application for revalidation, which the MAC then screens using the enrollment screening process to verify the information provided and determine whether the provider or supplier remains eligible to bill Medicare. A provider or supplier must respond by the due date or may request an extension to submit an application. If the provider or supplier does not respond within the allowed time, the provider or supplier is to be placed on a payment hold and is not to receive Medicare payment for services billed until a complete enrollment application has been submitted and approved by the MAC. Figure 3 illustrates the process MACs use to revalidate existing providers and suppliers. According to our analysis of PECOS data, CMS applied its revised enrollment screening process to over 2.4 million unique new applications and existing enrollment records from March 25, 2011, through December 31, 2015. As a result, CMS took action to deny or reject new applications and to deactivate or revoke existing enrollment records that did not meet the revised screening requirements. CMS’s screening of new enrollment applications resulted in actions against more than 23,000 new enrollment applications—CMS denied over 6,000 applications for ineligible providers and suppliers and rejected over 17,000 incomplete applications during the time period we reviewed. According to our analysis, the denials and rejections were disproportionately for providers and suppliers in the moderate- and high- risk categories. The most commonly recorded reason for a denial was because Medicare provider or supplier type requirements were not met (over 42 percent of total denials). Officials from a MAC said this may occur, for example, if a provider does not hold a certification required for that provider type. See table 2 for the most commonly recorded reasons in PECOS for denial by risk category. The most commonly recorded reason in PECOS for a rejected enrollment application was a deleted enrollment application (about 25 percent of total rejections), which officials from a MAC said may occur when an enrollment application has been entered into PECOS in error, either by a provider or supplier, or by the MAC. See table 3 for the most commonly recorded reasons in PECOS for rejection by risk category. Denied and rejected enrollment applications were relatively more common for moderate- and high-risk providers and suppliers and less common for limited-risk providers and suppliers. According to our analysis, while moderate- and high-risk providers and suppliers accounted for less than 10 percent of all new enrollment application decisions during the time period we reviewed, they accounted for over 30 percent of denials and over 22 percent of rejections. The disproportionate deactivations and rejections could be the result of the additional screening for moderate- and high-risk applicants or the underlying greater risk that these moderate- and high-risk providers and suppliers posed to Medicare. CMS’s screening of existing enrollment records resulted in actions against more than 703,000 provider and supplier enrollment records— CMS deactivated over 660,000 and revoked over 43,000 throughout this period. Providers and suppliers lose their ability to bill Medicare when CMS either deactivates or revokes their enrollment record. Providers and suppliers in the limited-risk category accounted for about 90 percent of deactivations and 84 percent of revocations. Enrollment records of limited-risk providers and suppliers represented about 90 percent of the 1.9 million approved enrollment records as of December 31, 2015. The reasons for deactivations and revocations varied, according to our analysis. Many were the result of enrollment screening conducted during CMS’s first revalidation cycle. For example, the most commonly recorded reason in PECOS for deactivations was not responding to a revalidation request (about 47 percent overall). See table 4 for the most commonly recorded reasons in PECOS for deactivation by risk category. The most commonly recorded reason overall for revocations was not being professionally licensed (over 61 percent), but the most commonly recorded reasons differed between the limited-risk category and the moderate- and high-risk categories. See table 5 for the most commonly recorded reasons in PECOS for revocation by risk category. According to our analysis of PECOS data, there were about 500,000 more approved enrollment records nearly 5 years after CMS began applying its revised enrollment screening process. When the revised enrollment screening process took effect on March 25, 2011, there were about 1.4 million approved enrollment records in PECOS, which increased by more than 30 percent to about 1.9 million approved enrollment records by December 31, 2015. During roughly the same time frame, the number of Medicare beneficiaries increased by more than 13 percent, from 48.7 million in 2011 to 55.3 million in 2015. CMS estimates the revised enrollment screening process avoided $2.4 billion in Medicare payments to ineligible providers and suppliers from March 2011 to May 2015, and CMS and MAC officials report additional benefits. According to CMS officials, the estimate is based on Medicare payments providers and suppliers with revoked enrollment records would have received had they not been revoked. To make its estimate, CMS used the provider’s or supplier’s past billing history and a formula it has developed for estimating Medicare payments avoided from other Medicare program integrity efforts. In addition to Medicare payments avoided, CMS and MAC officials report other benefits from the revised enrollment screening process, including the following: More accurate and complete data in PECOS. For example, the MACs deactivated providers and suppliers that were no longer billing Medicare, and created new PECOS enrollment records during the first program-wide revalidation effort for providers and suppliers that were in the Medicare claims system but not in PECOS. Providers and suppliers more knowledgeable about their responsibilities to keep enrollment information up to date. MAC officials said providers and suppliers are now more frequently providing them with changes of information, which according to CMS and MAC officials may result in fewer deactivated enrollment records during the second program-wide revalidation effort that began in March 2016. Identified provider and supplier enrollment records that needed increased scrutiny. CMS reported in September 2016 that it identified about 1,700 such cases and raised the provider’s or supplier’s risk category from limited or moderate risk to high risk. While CMS and MAC officials reported benefits from the revised enrollment screening process, they also reported challenges. For example, MAC officials said that there were challenges revalidating enrollment information for providers and suppliers with multiple billing locations during the first program-wide revalidation effort, which led to deactivations of some otherwise eligible providers and suppliers.