Medicare High-Risk Enrollment in 2026: Fingerprinting and FBI Background Checks
High categorical risk screening adds fingerprint submission and an FBI criminal history check for individuals with at least a 5% direct or indirect ownership interest. Confirm both the provider category and the specific owners who must complete screening.
High categorical risk Medicare enrollment adds a screening workstream that ordinary practitioner applications may never encounter: fingerprint submission and an FBI criminal history check for individuals with a 5% or greater direct or indirect ownership interest. Under 42 CFR 424.518, the requirement sits on top of the Limited and Moderate screening layers, including an onsite visit. In 2026, the High-risk list includes newly enrolling home health agencies, DMEPOS suppliers, Medicare Diabetes Prevention Program suppliers, certain opioid treatment programs, skilled nursing facilities, and hospices, along with specified higher-risk revalidation or ownership circumstances. The practical challenge is not simply telling a client to 'get fingerprinted.' Enrollment staff need to identify the correct case, the correct owners, the CMS or contractor instructions, and the completion evidence without assuming a universal processing-time guarantee.
Fingerprinting is tied to High categorical risk and ownership
The High-risk rule does not say that every employee, clinician, officer, or board member must provide fingerprints. It adds fingerprint-based criminal history checks for individuals with a 5% or greater direct or indirect ownership interest. That requires the enrollment team to understand the entity’s ownership structure before assigning screening tasks.
For layered entities, trace indirect ownership far enough to identify individuals who meet the threshold. Keep the ownership analysis with the enrollment file so the team can explain why a person was included or excluded. If ownership changes while the application is pending, reassess the screening list instead of assuming the original fingerprint roster remains correct.
High-risk categories are broader than older checklists
Newly enrolling HHAs, DMEPOS suppliers, MDPP suppliers, certain OTPs, SNFs, and hospices appear in the current High-risk framework. For OTPs, the regulation contains a specific continuous-SAMHSA-certification condition. Other High-risk circumstances can arise at revalidation or after particular adverse enrollment events, so the provider type alone is not always the full analysis.
This is why a static intake form labeled 'HHA/DME only' is inadequate in 2026. At the start of each case, verify the current regulation and the reason for filing. The screening plan should match the transaction CMS is reviewing, not an old assumption about the organization’s historical risk category.
The contractor controls the fingerprint workflow
Once CMS or the Medicare contractor identifies the individuals who must complete fingerprinting, follow the instructions issued for that case. Do not send owners to an arbitrary commercial fingerprint vendor or assume that a prior employment background check satisfies Medicare’s process. The screening step must be completed through the route CMS recognizes for the enrollment action.
Track the date the fingerprint request was received, each required individual, completion status, and any follow-up from the contractor. This transforms a vague 'background check pending' note into a manageable work queue and helps the enrollment lead escalate the correct person rather than repeatedly contacting the facility administrator.
Do not promise an unsourced 30-to-60-day approval window
Older operational articles sometimes describe fingerprinting as automatically adding a fixed number of days. The current regulation defines the screening requirement but does not create a universal approval-time guarantee for every High-risk application. Processing depends on the broader enrollment case, including completeness, site screening, ownership information, and contractor development.
Give leadership milestone-based status instead: application submitted, site visit pending or complete, fingerprint instructions issued, required owners completed, contractor development outstanding, and final determination pending. That is more useful than attaching a countdown to one component and then missing the date because another enrollment dependency remains unresolved.
Coordinate fingerprinting with ownership and compliance records
High-risk screening should connect to the same ownership file used for CMS enrollment disclosures. When a person’s direct or indirect ownership percentage changes, the practice needs one source of truth rather than separate spreadsheets for enrollment and fingerprinting. Include legal entity names and effective dates so staff can see which ownership structure applied to the filing.
Keep screening evidence private and role-restricted. The enrollment tracker needs enough information to show whether the required step is complete, but it does not need to become a repository for sensitive criminal-history information. Separate case-status documentation from background-check content that should be handled under the organization’s privacy and compliance controls.
A useful case record separates 'fingerprints requested' from 'fingerprints complete' and from 'FBI check cleared/contractor screening complete.' The practice may control only the owner’s completion step, not the contractor’s downstream processing. Distinct statuses prevent managers from treating an appointment confirmation as the end of High-risk screening.
High-risk screening is only one 2026 enrollment gate
Even perfect fingerprint completion does not guarantee that CMS can process a new enrollment. For example, CMS imposed a nationwide temporary enrollment moratorium on new HHAs and hospices effective May 13, 2026. DMEPOS had a separate temporary moratorium that expired August 27, 2026. These restrictions are different from categorical screening.
A reliable intake therefore asks two questions: what screening level applies, and is CMS currently accepting this transaction? Answer both before the practice spends money on a new site, schedules an aggressive go-live date, or tells an owner that fingerprint completion is the last remaining barrier.
For acquisitions, re-check ownership at signing and again before filing if the structure is still changing. A 5% indirect-interest calculation can move when parent ownership shifts. Screening the wrong ownership snapshot can create rework or an incomplete disclosure even when every person on the original list completed fingerprinting promptly.
Before closing the fingerprint workstream, reconcile the completed-owner list back to the ownership disclosure in the application. If the two lists differ, resolve the reason while the case is still pending. A missing owner may indicate an enrollment disclosure problem; an extra person may show that staff used an outdated ownership chart. This final reconciliation is more valuable than simply counting fingerprint appointments because it proves the screening task and the CMS ownership record are based on the same entity structure.
Operational checklist
- Verify the current High-risk classification for the exact transaction.
- Map direct and indirect ownership to identify individuals at or above 5%.
- Follow the fingerprint instructions issued for the Medicare enrollment case.
- Track completion by required owner without storing unnecessary sensitive background information.
- Check current CMS moratoria or other transaction restrictions separately.
Frequently asked questions
Who must provide fingerprints for a High-risk Medicare enrollment?
Under 42 CFR 424.518, High-risk screening adds fingerprint-based FBI checks for individuals with a 5% or greater direct or indirect ownership interest.
Are new hospices and SNFs included in High categorical risk?
Yes. They are included in the current High-risk categories, along with other specified provider and supplier types.
Does every clinician in a High-risk facility need fingerprinting?
No. The regulatory fingerprint requirement is tied to the specified ownership threshold, not to every employee or clinician.
Does fingerprinting guarantee approval within a fixed 30-to-60-day period?
No universal approval-time guarantee appears in the screening rule. Track the overall enrollment milestones rather than promising a fixed completion date.
Should a practice check moratoria separately from High-risk screening?
Yes. A moratorium can restrict an enrollment transaction even when the organization is prepared to complete High-risk screening.