As previously reported by Sheppard, the Centers for Medicare & Medicaid Services (“CMS”) has announced several program integrity actions to combat health care fraud. Among these actions was the issuance of a Request for Information (“RFI”) on February 27, 2026 to gather public feedback on potential rules CMS may propose under its Comprehensive Regulations to Uncover Suspicious Healthcare (“CRUSH”) initiative. The CRUSH initiative is aimed at strengthening CMS’s ability to address fraud, waste, and abuse in Medicare, Medicaid, the Children’s Health Insurance Program (CHIP), and the Health Insurance Marketplace.
One area of CMS’s concern highlighted in the RFI is the ownership of Medicare-enrolled providers or suppliers by individuals who are not United States citizens or permanent residents. Currently, there is no prohibition on such foreign ownership, provided it is properly disclosed on the Medicare Enrollment Application. As described by CMS in the RFI, such individuals who reside outside of the U.S. are beyond the reach of U.S. law enforcement authorities, which impedes fraud investigation and prosecution efforts. To strengthen program integrity, CMS is considering imposing additional restrictions and requirements on the owners of Medicare-enrolled entities.
The Request for Information
In particular, CMS has requested public input on the following questions relating to citizenship and residency requirements for ownership in Medicare-enrolled entities:
- What would be the impact on Medicare-enrolled entities if CMS established a requirement for U.S. citizenship or legal permanent residency for all individuals with an ownership or control interest of 5% or greater in a Medicare-enrolled provider or supplier?
- Are there specific provider or supplier types for which enhanced identity proofing and citizenship or residency requirements would be most critical to preventing fraud?
- Are there additional individuals on the enrollment record for whom enhanced identity proofing and citizenship or residency requirements would help prevent fraud?
- What challenges would these requirements create for entities with foreign parent companies, international investors, or legitimate cross-border business structures?
Implications for Medicare Providers and Suppliers with Foreign Ownership
Many Medicare providers and suppliers have foreign individuals who, through ownership of holding companies and investment firms, hold a greater than 5% indirect ownership interest in the enrolled entity. Unless any new rule provided a grace period or grandfathered existing ownership, requiring U.S. citizenship or permanent residency for owners would require such providers and suppliers to restructure their ownership through divestiture or otherwise, or risk revocation of their Medicare enrollment. A new rule could also complicate pending or planned transactions, as the parties would need to analyze whether the post-closing organizational structure includes any prohibited ownership.
Additional Fingerprinting Requirements
In the RFI, CMS indicated it is considering regulations that would expand the fingerprinting and background check requirements, currently applicable only to “high” risk Medicare-enrolled providers and suppliers[1], to include (i) owners with less than a 5% ownership interest; (ii) managing employees; and (iii) other individuals who are affiliated with or working for the provider or supplier. Expanding the fingerprinting requirement could create additional hurdles for foreign investors seeking to have an ownership interest in a Medicare-enrolled entity.
Next Steps
CMS has requested public comments to the RFI by March 30, 2026. Comments may be sent electronically, by regular mail, or by express/overnight mail to the addresses listed in the RFI.
FOOTNOTES
[1] 42 CFR 424.518(c).
