CMS billing rules every practice must know in 2026

CMS billing rules are the federal conditions a claim has to meet before Medicare pays it. Most practices that get into trouble miss one of four: a filing deadline, an overpayment they failed to report, a modifier the note doesn't support, or a place-of-service code that doesn't match where the patient actually was.

Every one of those has a hard number attached, and none of the numbers have much slack in them. A Medicare claim is dead 1 calendar year after the date of service (42 CFR 424.44). An overpayment you hold past 60 days becomes a False Claims Act obligation (42 CFR 401.305). And since January 1, 2024, Medicare accepts exactly 2 place-of-service codes for telehealth, and they pay at different rates.

CMS put $28.83B in Medicare fee-for-service improper payments on the books for fiscal year 2025, a 6.55% rate. Most of it wasn't fraud. It was documentation, coding, and timing.

Here are the rules that actually generate denials, recoupments, and audit letters, with the citation for each one.

Key takeaways

• Medicare claims must be filed within 1 calendar year of the date of service. There are 4 narrow exceptions, and each one extends the deadline only to the last day of the 6th calendar month.
• Overpayments must be returned within 60 days of identification, and you can be held to a 6-year lookback.
• CY 2026 pays $33.57 for qualifying APM participants and $33.40 for everyone else. CY 2027's proposed rule turns both negative.
• POS 02 pays the facility rate. POS 10 pays the non-facility rate. Nothing else is valid for Medicare telehealth.
• Modifier 59 never goes on an evaluation and management service. That is modifier 25.
• 77.17% of FY 2025 Medicaid improper payments came from insufficient documentation, not fraud.

What are the CMS timely filing and revalidation deadlines?

42 CFR 424.44 sets the outer limit: a claim must be filed no later than the close of the period ending 1 calendar year after the date of service. That applies to services furnished on or after January 1, 2010.

Four exceptions exist, and they all work the same way. Contractor error, retroactive entitlement, a Medicaid recovery 6 months or more after the service, and retroactive MA disenrollment each extend your window to the last day of the 6th calendar month following the month you were notified.

Commercial payers run their own clocks, and Change Healthcare's analysis of timely filing denials shows how short some of those windows are. State Medicaid programs and commercial plans frequently run tighter than Medicare, which is why a medical billing setup built around your state's rules matters as much as the federal ones.

Enrollment is the other clock, and it runs on a different schedule. CMS deactivates billing privileges when a provider goes 6 consecutive calendar months without submitting a single claim, fails to report a change, or doesn't furnish complete information within 90 calendar days of notice (42 CFR 424.540). Revalidation is every 5 years for most providers and every 3 years for DMEPOS suppliers.

The part practices miss: CMS posts revalidation due dates 7 months in advance, and MACs send notices 3 to 4 months out. A 30-day window to respond to a development request is the whole margin. If your enrollment contact point is a former staffer's inbox, that margin is gone. Our Medicare revalidation control calendar walks through the monthly cadence, and our credentialing services team can own the deadline tracking outright.

What is the 60-day rule for reporting Medicare overpayments?

42 CFR 401.305 is the single most expensive rule on this page. If you identify an overpayment, you must report and return it by the later of 60 days after identification or the due date of the corresponding cost report.

Three follow-on rules make it worse:

• The lookback is 6 years. Identify an overpayment within 6 years of the date you received it, and the 60-day clock applies. Miss that window and the obligation doesn't exist.
• The clock suspends for a good-faith investigation, but only up to 180 days from the date you first identified the overpayment.
• Any overpayment you retain past the deadline is an obligation for purposes of the False Claims Act (401.305(e)). This is the sentence that turns a bookkeeping error into a federal case.

CMS's FY 2025 numbers show how common the underlying documentation failure is. Medicare fee-for-service improper payments were 6.55%, or $28.83B. Medicare Advantage ran 6.09%, or $23.67B. Medicaid hit 6.12%, or $37.39B. GAO put total federal improper payments at $186B for FY 2025, up $24B year over year, with roughly 82% of it (about $153B) being overpayments.

The documentation part is the one you control. 77.17% of FY 2025 Medicaid improper payments came from insufficient documentation, which CMS explicitly notes is generally not indicative of fraud. It's a records problem, and records problems get fixed with a file review. That's what a medical billing audit does.

The deadline exposure calculation

Run this before you assume you're fine. Three inputs:

1. Your annual Medicare paid volume, straight off the 835s
2. How much of that volume rides on a single enrolled entity or NPI
3. The number of days that entity's privileges could plausibly sit off

Exposure = (annual Medicare paid volume ÷ 365) × days at risk

A practice paid $7.3M a year by Medicare runs $20,000 a day. If one billing entity deactivates and reactivation takes 70 days, that's $1.4M in charges Medicare won't pay while the gap is open. The AAD has flagged the compounding risk: services furnished during a deactivated period that Medicare later pays are treated as overpayments. You get the revenue and the recoupment.

Your number is almost certainly smaller than that. It's probably not zero.

What changed in the 2026 and 2027 conversion factors?

Starting in CY 2026, Medicare uses 2 conversion factors instead of one. That's the biggest structural change to physician payment in years, and it's easy to miss because it doesn't look dramatic on a fee schedule.

A qualifying APM participant is a clinician in an approved alternative payment model. Everyone else takes the nonqualifying factor.

CY 2027's proposed rule, published July 14, 2026, reverses it. The qualifying conversion factor is proposed at $33.17, a drop of $0.40, or 1.19%, from $33.57. The nonqualifying factor is proposed at $32.84, down $0.56, or 1.68%, from $33.40.

The reason is arithmetic, not policy. Statute gave physicians a one-year +2.50% conversion factor increase for CY 2026, and that increase expires. Current law therefore requires a 2.50% reduction relative to 2026. Both 2027 figures are proposals. Our CY 2027 physician fee schedule analysis tracks what changes when the final rule lands.

Budget against the 2027 direction now, not the 2026 number.

Which place-of-service code pays the facility rate?

POS 02 pays the facility rate. POS 10 pays the non-facility rate. That distinction is worth real money on every telehealth claim, and it's the single most common telehealth billing error we see.

CMS Transmittal 12671 (Change Request 13582) set the rule effective January 1, 2024:

POS 02 and POS 10 are the only 2 valid codes for Medicare telehealth. Bill POS 10 with a service that isn't on the Medicare telehealth list and the MAC denies it with CO-96, CARC 96.

Modifiers 93 (audio-only) and 95 (audio-video) ride along with either POS code, and neither changes the rate. The POS code alone decides facility versus non-facility.

POS 10 for a patient in assisted living or memory care is the right call when that's where they actually are. Our telemedicine billing service page covers how this interacts with state-specific rules, which is where most of the remaining telehealth denials come from.

When can a modifier unbundle an NCCI edit?

NCCI procedure-to-procedure edits pair codes that generally shouldn't be billed together. Whether you can break the pair depends on one field: the Correct Coding Modifier Indicator, or CCMI.

Only CCMI of 1 opens the door. The modifiers that qualify are a fixed list: anatomic modifiers (E1 through E4, FA, F1 through F9, TA, T1 through T9, LT, RT, LC, LD, RC, LM, RI), global surgery modifiers (24, 25, 57, 58, 78, 79), and 27, 59, 91, XE, XS, XP, XU.

Three rules trip up experienced coders:

Modifier 59 never goes on an E/M service. CMS's MLN booklet on modifiers 59, XE, XS, XP and XU is explicit. For a separate and distinct E/M on the same day as a procedure, you use modifier 25.

Different procedures aren't enough. Two codes at the same anatomic site during the same encounter aren't separate and distinct, so neither 59 nor XU applies. The X-modifiers are more precise where they fit: XE separate encounter, XP separate practitioner, XS separate structure, XU unusual non-overlapping service.

Global surgery determines which E/M modifier you get. Global periods of 000 or 010 mean a minor procedure, which pairs with modifier 25. A global period of 090 is major surgery, and the decision-to-surgery visit takes modifier 57. MACs won't pay modifier 57 on a 000 or 010-day procedure. Our global surgery billing guide has the full modifier breakdown.

How do you check medical necessity before you bill?

Medicare coverage decisions live in 2 places, and they work differently.

National Coverage Determinations apply in all states. Decisions land within 6 months of a complete request, or 9 months when the request needs an external technology assessment or MEDCAC review, with a 30-day comment period and a final decision within 60 days of comment close.

Local Coverage Determinations come from your Medicare Administrative Contractor and only bind in that jurisdiction. MACs generally have 365 days from publishing a proposed LCD to finalize or retire it, plus a 45-day comment period and a minimum 45-day notice before it takes effect.

Here's the gotcha that costs practices the most: under Change Request 10901, the CPT and HCPCS codes and the ICD-10 codes were moved out of the LCDs and into separate Billing and Coding Articles. Searching the LCD for the code list now returns incomplete results. You have to check both the LCD and the associated article.

If medical necessity documentation is where your audit exposure sits, our 2026 medical billing audit scope covers how to build that review.

What are the Medicare appeal deadlines after a denial?

Medicare fee-for-service has 5 appeal levels, and the clock gets shorter at the bottom.

A notice is presumed received 5 days after the date it was sent, unless evidence says otherwise. For calendar year 2026, the Amount in Controversy threshold is $200 for an ALJ hearing and $1,960 for judicial review, adjusted annually against the medical care component of the consumer price index. CY 2027 holds the ALJ threshold at $200 and raises judicial review to $2,000.

Medicare Advantage runs a different track at level 2. A reconsideration request to the Part C Independent Review Entity must be filed within 65 calendar days of the plan's dismissal decision. That's shorter than the 180-day fee-for-service window, and practices that run one appeal calendar for both programs miss it.

For commercial denials, the appeal path runs through the state, and the regulator's name changes by state. Knowing which one to file with is the first step, and it's covered in our New Jersey medical billing guide along with the rest of that state's process.

What prior authorization and MSP rules catch practices out?

Prior authorization. CMS-0057-F split its requirements across 2 dates. Process requirements, including the 7-day response window and the requirement to give specific denial reasons, went live January 1, 2026. The API development and enhancement requirements land January 1, 2027 for MA organizations and state Medicaid and CHIP fee-for-service programs. Our CMS-0057-F readiness guide has the payer-by-payer breakdown.

Medicare Secondary Payer. MSP rules make Medicare secondary when another payer is primary, and "paid promptly" is defined as 120 days for no-fault insurance, workers' compensation, and liability. Bill Medicare first when a group health plan is primary and CMS won't pay conditionally. The denial messages tell you which mistake you made:

• CARC 21 means the claim is the liability of the no-fault carrier
• CARC 19 means it's a work-related injury and workers' comp is primary
• RARC MA04 means secondary payment can't be considered without primary payer identity or payment info
• MSN 29.11 means an automobile medical, liability, or no-fault plan is primary
• MSN 29.8 means the service may be covered by workers' comp

For recurring outpatient hospital services, MSP data has to be re-verified every 90 days. It isn't required at every visit, but an incorrect Medicare payment is still repayable.