Medicare screens a newly enrolling opioid treatment program at the high-risk level unless SAMHSA has fully and continuously certified it since October 23, 2018. High-risk screening adds fingerprint-based FBI background checks of every person with a 5 percent or greater direct or indirect ownership interest, on top of license checks, database checks and an on-site visit.
Every Medicare enrollment application is screened, and CMS sorts providers into three risk levels: limited, moderate and high (42 CFR 424.518). Most behavioral health providers land in the lower two. Opioid treatment programs (OTPs) are different, because the level depends on how long SAMHSA has certified the program without a break.
Which OTPs are high risk?
The rule names them. "Prospective (newly enrolling) opioid treatment programs that have not been fully and continuously certified by the Substance Abuse and Mental Health Services Administration (SAMHSA) since October 23, 2018" are high risk (42 CFR 424.518(c)(1)(iv)). So are enrolled OTPs without that continuous certification when they file a change of ownership or report any new owner, regardless of percentage (424.518(c)(1)(vii)).
A newly enrolling OTP that has been fully and continuously certified since October 23, 2018 is moderate risk instead (424.518(b)(1)(viii)). For a new program in 2026, the practical answer is simple: it has not been certified since 2018, so it is screened at the high level.
What does each level involve?
- Limited. The Medicare contractor verifies the provider meets federal and state requirements for its type, verifies licenses, including across state lines, and runs database checks before and after enrollment (424.518(a)(2)).
- Moderate. Everything in limited, plus an on-site visit (424.518(b)(2)).
- High. Everything in limited and moderate, plus fingerprints: the contractor "requires the submission of a set of fingerprints for a national background check from all individuals who maintain a 5 percent or greater direct or indirect ownership interest in the provider" and runs a fingerprint-based check of the FBI's Integrated Automated Fingerprint Identification System on each of them (424.518(c)(2)).
When are fingerprints due?
Each owner subject to the requirement must submit fingerprints "upon submission of a Medicare enrollment application" or "within 30 days of a Medicare contractor request" (424.518(d)(1)). If they do not, the program's billing privileges are denied or, if already granted, revoked (424.518(d)(2)). Thirty days is not long when an owner is a holding company with several individual owners above 5 percent, some of them out of state. Identify every person who meets the 5 percent direct or indirect threshold before filing.
Can a program's level go up later?
Yes. CMS raises any provider from limited or moderate to high if, among other things, it had a payment suspension in the last 10 years, has been excluded by the OIG, had billing privileges revoked within 10 years and is trying to enroll again or add a location, has been terminated or precluded from billing Medicaid, or had a final adverse action within 10 years (424.518(c)(3)). The higher level also applies to other enrollments with the same legal business name and tax identification number (424.518(c)(4)).
Does a lapse in SAMHSA certification matter?
It can. The test in the rule is certification that is both full and continuous since October 23, 2018. A program whose certification expired must reapply as a new program under 42 CFR 8.11(a)(6), and on a plain reading of 424.518 it can no longer show continuous certification since that date, so it should expect the high-risk category on a new enrollment, a change of ownership or a new owner report. Keeping SAMHSA certification current protects more than the certification itself; see SAMHSA certification renewal.
What about revalidation?
An enrolled OTP completes moderate-level screening when it revalidates (42 CFR 424.67(e)(1)(iii)), which includes a site visit. Revalidation comes every five years (424.515). OTPs that were fingerprinted under a waiver at initial enrollment are treated differently at revalidation under 424.518(b)(1)(ix) and (c)(1)(viii), so check which paragraph applies to your program.
How should an OTP prepare?
- Map ownership. List every individual with a 5 percent or greater direct or indirect interest, tracing through holding companies.
- Brief owners early. Tell them fingerprints will be required and how CMS's contractor will instruct them, so no one is surprised by a 30-day request.
- Be ready for the site visit. Both the moderate and high levels include an on-site visit by the Medicare contractor. Make sure the location, hours and staff on site match what the application says.
- Check staff against the OTP staffing bars in 42 CFR 424.67(b)(6) before filing; see Medicare enrollment for OTPs.
- Plan for ownership changes. A new owner at a program without continuous certification since 2018 brings high-risk screening again.
How do we help?
We prepare the CMS-855A or 855B and the ownership disclosures, map the owners who must be fingerprinted, and prepare the program for the site visit. We submit as your PECOS surrogate once your authorized official approves us; your official signs, and owners submit their own fingerprints. The scope and flat fee are set in a $149 Facility Readiness Review, credited toward the work. See pricing.
Common questions
- Why is my new OTP screened as high risk by Medicare?
- 42 CFR 424.518 designates newly enrolling OTPs as high risk unless they have been fully and continuously certified by SAMHSA since October 23, 2018. Any program certified after that date falls in the high category.
- Who has to be fingerprinted for an OTP's Medicare enrollment?
- Every individual with a 5 percent or greater direct or indirect ownership interest, when the OTP is screened at the high level. Fingerprints are due with the application or within 30 days of the contractor's request.
- What happens if an owner does not submit fingerprints?
- The program's Medicare billing privileges are denied, or revoked if already granted, under 42 CFR 424.518(d)(2).
Need Help with Enrollment or Licensing?
We prepare your Medicare enrollment, accreditation survey and state licenses in the order CMS requires, for your official to sign, and track every one to a decision.