CMS Revoked Providers: The Federal List of Who Lost the Right to Bill Medicare

There is a single federal action that can switch off a provider's connection to the largest payer in American healthcare. When CMS revokes a provider or supplier's Medicare billing privileges, the claims stop being paid—and a re-enrollment bar slams shut behind them, commonly one to ten years and as long as twenty for the worst cases. The list of who has lost that privilege runs to roughly 7,000 revocation records, each naming a provider, an NPI, a provider type, the regulatory ground for the action, and the dates it takes effect. It is one of the clearest maps there is of where Medicare improper enrollment and fraud actually concentrate.

This article covers what the revoked-providers dataset is and the legal frame that governs it under 42 CFR 424.535; the difference between revocation and the broader HHS-OIG exclusion that bars a party from all federal health programs; the specific grounds CMS revokes on, from felony convictions and loss of a state license to abusive billing and being found not operational; the re-enrollment bar and how its length is calibrated; the way the Affordable Care Act rebuilt CMS enrollment screening with risk-based categories, fingerprint background checks, site visits, and affiliations authority; how the table joins by NPI to the rest of the provider universe and to the OIG exclusions list; a Python workflow that pulls the revocations from data.cms.gov and tallies them by reason, by provider type, and by year; and the caveats—snapshot scope, reporting lag, and the gap between a revocation and a finding of fraud—that every analyst must internalize before drawing conclusions.

What the dataset is

Every provider and supplier that wants to bill Medicare must first enroll—submit a Medicare enrollment application (the CMS-855 family of forms, processed through the Provider Enrollment, Chain, and Ownership System, or PECOS), have it screened and approved, and receive billing privileges. Enrollment is the gate. The revoked-providers list is the record of the parties whose privileges, once granted, were taken away: revocation is the affirmative act by which CMS ends a provider's ability to bill the Medicare program. Published through the CMS data portal at data.cms.gov, the file comprises roughly 7,000 revocation records.

In our database this record is stored as the table cms_revoked_providers, with the grain of one row per revocation: each row is a single CMS action against a single enrolled provider or supplier. The columns capture who was revoked, of what type, on what regulatory basis, and when the action takes effect:

provider_name              -- the revoked provider or supplier
npi                       -- National Provider Identifier (10-digit join key)
provider_type             -- physician, DME supplier, home health, lab, etc.
revocation_reason         -- the 42 CFR 424.535 ground (felony, no license,
                            abusive billing, not operational, non-compliance)
revocation_effective_date -- the date billing privileges end
reenrollment_bar_months   -- length of the bar before the party may re-enroll
-- supporting context where published:
specialty                 -- enrolled specialty / taxonomy
state                     -- practice-location or enrollment state
record_status             -- active revocation vs. reinstated / overturned

The npi is the load-bearing column. The National Provider Identifier is a persistent ten-digit number assigned to every covered healthcare provider, and it is the key that ties a revocation to the same provider's record everywhere else: to the ordering-and-referring file, to the physician and supplier enrollment data, to the ownership records, and—crucially for program-integrity work—to the HHS-OIG exclusions list, which is also keyed by NPI. The revocation_reason is the substantive payload: it records which of the enumerated grounds in 42 CFR 424.535 CMS invoked, and aggregating that single field across the list is what turns a roster of names into a picture of why providers lose the right to bill. The revocation_effective_date and the re-enrollment-bar length together fix the action in time and define how long the door stays shut. A revocation is a durable, dated, NPI-anchored fact, which is exactly what makes the file useful for screening and analysis rather than merely for lookup.

The legal frame: 42 CFR 424.535

Medicare provider enrollment is governed by a body of regulation at 42 CFR Part 424, Subpart P, and the specific authority to revoke is 42 CFR 424.535. That regulation enumerates the grounds on which CMS may revoke a currently enrolled provider or supplier's billing privileges and the Medicare enrollment agreement that goes with them. Revocation is a program-integrity tool: it is the mechanism by which CMS removes from the program parties it has determined should not be billing it, whether because they are unqualified, untrustworthy, or simply not really operating as enrolled.

It is important to place revocation in the right part of the enforcement spectrum. Medicare program integrity runs along a continuum from the routine to the punitive: ordinary claim denials and overpayment recoveries sit at one end; payment suspensions, which freeze payment while an investigation proceeds, sit in the middle; revocation—ending billing privileges outright—sits near the far end; and criminal prosecution and civil False Claims Act judgments sit beyond it. Revocation is administrative, not criminal: CMS does not need a conviction to revoke for many of the grounds, and a revocation is not itself a finding that the provider committed a crime. But it is one of the most consequential administrative actions in the program, because for a provider whose practice depends on Medicare patients, losing the ability to bill the program is, in practical terms, existential.

Procedurally, a revocation is initiated by CMS or, very often, by its contractors—the Medicare Administrative Contractors (MACs) that handle enrollment, and the Unified Program Integrity Contractors (UPICs) that investigate fraud, waste, and abuse. The provider receives notice of the revocation and the ground for it, the action takes effect on a stated date, and the provider has the right to appeal through the administrative process (reconsideration, and onward through the Medicare appeals system) and, in some cases, to submit a corrective action plan. Because of that appeal right, the list is not static: a record that reflects an active revocation today may be overturned on appeal, which is one reason a record_status distinction between active and reinstated revocations matters for any analysis.

Revocation vs OIG exclusion

The single most important conceptual distinction for anyone using this data is the difference between a CMS revocation and an HHS-OIG exclusion. They are often spoken of in the same breath, they overlap in the parties they affect, and they are easy to conflate— but they are different legal actions, taken by different offices, under different authorities, with different scope.

A revocation, as described above, is a CMS action under 42 CFR 424.535 that ends a party's ability to bill Medicare. Its scope is the Medicare billing privilege. An exclusion is an action by the Office of Inspector General of the Department of Health and Human Services, taken under the OIG's own statutory authority, that bars a party from participation in all federal healthcare programs—not just Medicare but Medicaid, the Children's Health Insurance Program, and the rest—and that, when a party is excluded, prohibits federal healthcare programs from paying anyone, anywhere, for items or services the excluded party furnishes, orders, or prescribes. An exclusion is broader in reach and lands on the OIG's List of Excluded Individuals and Entities (LEIE), the healthcare-specific bar list; a revocation lands on the CMS revoked-providers record.

The two interact, and the interaction is one of the most useful things the data reveals. A CMS revocation can be a precursor to or a companion of an OIG exclusion: a provider revoked for a felony conviction is a strong candidate for exclusion on the same underlying facts, and the OIG and CMS coordinate on serious cases. Because both the revoked-providers file and the LEIE are keyed by NPI, an analyst can join them directly to ask which revoked providers are also excluded, which excluded parties were first revoked, and how the two enforcement tracks line up in time. But the join also exposes the gap: a party can be revoked from Medicare billing without being excluded from all federal programs, and a party can be excluded by the OIG without a corresponding CMS revocation record. A compliance program that screens only one of the two lists has a hole. The correct mental model is two overlapping but distinct circles—CMS revocation for the Medicare billing privilege, OIG exclusion for the whole of federal healthcare—each of which must be checked on its own terms.

The grounds for revocation

The revocation_reason field records which of the enumerated grounds in 42 CFR 424.535 CMS invoked, and the regulation lists a substantial set. A handful of categories account for the bulk of the list, and recognizing them is what turns the reason codes into an account of how providers actually lose their billing privileges.

Felony conviction. CMS may revoke when the provider, supplier, or an owner or managing employee has been convicted of a felony that CMS determines is detrimental to the best interests of the Medicare program and its beneficiaries—a category that includes financial crimes such as fraud, theft, and embezzlement; felonies against persons; and certain drug and controlled-substance offenses. The conviction need not have arisen from the provider's Medicare practice; the theory is that a felon of the relevant kind cannot be trusted with program funds and patients.

Loss of a state license. A provider whose license to practice has been suspended or revoked by the state, or who is otherwise no longer licensed and in good standing to furnish the services for which it enrolled, is subject to revocation. Medicare billing privileges rest on the underlying professional license—when the state takes the license away, the federal billing privilege follows.

Abusive or improper billing patterns. A significant stream of revocations targets billing conduct itself: a pattern or practice of submitting claims that fail to meet Medicare requirements, billing for services that could not have been furnished as claimed, or other abusive billing that the regulation reaches. This is the ground most directly aimed at fraud and abuse, and it is where revocation operates as an active enforcement instrument rather than a reaction to an external event such as a conviction or a license loss.

Not operational / failure of a site visit. CMS may revoke when it determines that the provider or supplier is not operational—not actually open and furnishing the services it bills for at the enrolled location. This ground is policed substantially through on-site reviews: a contractor visits the enrolled address and finds no real practice, a phantom storefront, or a location that does not meet the standards for the supplier type. This category looms especially large for high-risk supplier types such as durable medical equipment, where sham storefronts have historically been a fraud vector, and it is one of the clearest illustrations of why the site visit became a central screening tool.

Non-compliance with enrollment requirements. A broad and common family of grounds covers failures of the enrollment relationship itself: failing to comply with the enrollment requirements, failing to report a change such as a new location or a change in ownership within the required time, failing to maintain or furnish documentation, failing to be open to a site visit, or submitting false or misleading information on the enrollment application. These are the administrative-integrity grounds, and while they sound procedural, they are consequential—many of them are designed to ensure that CMS always knows who is really behind an enrolled entity, which is the precondition for every other kind of oversight.

The re-enrollment bar

A revocation is not just an ending; it comes with a forward-looking consequence that is often more important than the revocation itself: the re-enrollment bar. When CMS revokes a provider's billing privileges, it also sets a period during which the party may not re-enroll in Medicare at all. The bar is what gives revocation its teeth, because it prevents a revoked provider from simply re-applying the next day under the same identity.

The length of the bar is calibrated to the seriousness of the conduct. The common range is one to ten years, with the length set according to the severity of the basis for the revocation and the provider's history. For repeat or egregious cases—a provider revoked again after a prior revocation, or conduct of exceptional seriousness—the bar can extend up to twenty years. CMS has over time expanded both the maximum length of the bar and the situations in which a longer bar applies, reflecting a deliberate policy choice to make revocation a more durable deterrent rather than a temporary inconvenience.

The bar is also where the program's concern with evasion shows most clearly. The obvious way to defeat a re-enrollment bar is to re-enter under a different name—through a new corporate entity, a different ownership structure, or a fresh front person—and much of the modern enrollment-screening apparatus exists to defeat exactly that maneuver. The affiliations authority discussed below, the reporting requirements that force disclosure of owners and managing employees, and the ability to deny enrollment to a new entity tied to a barred party are all, in part, about making the bar stick. For the analyst, the bar length on a record (where published) is a rough proxy for how serious CMS judged the underlying conduct to be, and a useful field to weight by when comparing revocation reasons or provider types.

The ACA enrollment-screening expansion

The shape of the modern revocations list cannot be understood without the Affordable Care Act (ACA), which substantially rebuilt CMS provider enrollment screening and the agency's revocation authority. The ACA and the regulations implementing it shifted the program toward prevention—keeping bad actors out at the front door and detecting them faster—and gave CMS sharper tools to revoke those already inside.

The centerpiece is risk-based screening. CMS now assigns every category of provider and supplier to one of three screening levels—limited, moderate, and high—according to the fraud risk that the category historically presents. Limited-risk categories (such as many physician specialties and established institutional providers) receive baseline screening; moderate and high-risk categories receive progressively more. Newly enrolling durable medical equipment suppliers and home health agencies, for example, have been placed in higher-risk categories precisely because those types have been disproportionately associated with fraud. The screening level determines how hard CMS looks before granting privileges and how closely it watches afterward, and it is one of the structural reasons the revocations list is concentrated in particular provider types.

On top of the risk tiers, the ACA framework added concrete screening measures. Fingerprint-based criminal background checks are required for high-risk enrollees and certain individuals with ownership or control interests—a far more rigorous check than the self-attestation that preceded it. Site visits, conducted by contractors, verify that an enrolling or enrolled provider actually exists and operates at its address, feeding the not-operational revocation ground directly. And, more recently, CMS gained authority to act on a provider's affiliations: under the program-integrity enhancements built on the ACA framework, CMS can deny or revoke enrollment based on a provider's disclosed affiliations with parties that have themselves been subject to a disclosable event—a prior revocation, an exclusion, an unpaid Medicare debt, or a payment suspension. The affiliations authority is the program's answer to the shell-company problem: it lets CMS reach the person behind a new entity who was barred behind an old one. Together these tools turned enrollment from a largely clerical gate into an active screening system, and the revocations list is one of its principal outputs.

Joining by NPI to the provider universe

The revoked-providers table is most valuable not in isolation but as one node in the larger graph of federal provider data, and the npi is the universal join key that makes the integration possible. Three joins matter most.

The first is to the OIG exclusions list (LEIE), the join this article has emphasized. Because both files carry the NPI, an analyst can directly relate a CMS revocation to an OIG exclusion of the same party—measuring the overlap between the two enforcement tracks, identifying parties who appear on one but not the other, and, with the effective dates on each side, ordering them in time to see which came first. That ordering speaks to how the two offices coordinate: whether revocation tends to precede exclusion on shared facts, or trail it. A serious healthcare-compliance screen runs both lists and treats a hit on either as disqualifying within its respective scope.

The second join is to the broader CMS provider and ownership data. CMS publishes physician and supplier enrollment data, the ordering-and-referring file, and detailed ownership records for institutional provider types. Joining the revocations list to those datasets by NPI—and, through the ownership records, to the owning organizations and individuals behind a provider—is what lets an analyst move from “this NPI was revoked” to “this revoked entity is owned by a company that also owns these other still-enrolled providers.” That is the affiliations question turned into a data query, and it is how an analyst can surface the corporate families and repeat principals that the re-enrollment bar and the affiliations authority are designed to catch.

The third join is to Medicare claims and utilization data. CMS publishes provider-level utilization and payment data—what each NPI billed, for which services, and how much it was paid—and joining the revocations list to that record by NPI lets an analyst look at what a revoked provider was billing before the action, which abusive-billing revocations were preceded by visibly anomalous utilization, and whether the providers revoked for billing reasons stand out in the claims data in ways that a prospective screen could have flagged earlier. This is the analysis that closes the loop—from the billing behavior, to the revocation it produced, to the forward-looking risk model the pairing makes possible.

Analytical uses

A national, NPI-resolved, dated, reason-coded record of who lost the right to bill Medicare supports a distinctive set of analyses, well beyond the single yes-or-no lookup a credentialing office performs.

Program-integrity screening is the foundational use: checking a prospective contracting partner, a referral source, or a network applicant against the list before doing business with them. A hospital system credentialing a physician, a health plan building a network, or a provider organization vetting a referral relationship all have reason to know whether a counterparty has had its Medicare billing privileges revoked—and, paired with the LEIE, whether it has been excluded. The NPI makes the screen mechanical; the reason and dates make a hit interpretable.

Mapping where fraud and improper enrollment concentrate exploits the reason and provider-type fields. Tallying revocations by reason reveals the mix of integrity-based, license-based, billing-based, not-operational, and administrative actions, and how that mix differs across provider types. The disproportionate appearance of certain supplier categories—durable medical equipment, home health, and the like—is itself a finding, one that corroborates the risk tiers CMS assigns and tells an oversight body where the recurring problems live. Trending the count by year, as the Python below does, shows the enforcement cadence and how it responds to program-integrity initiatives.

Cross-list and affiliations analysis is the most powerful use, and it is where the NPI joins pay off. Relating revocations to exclusions, to ownership records, and to claims data lets an analyst build the kind of entity-resolved view that individual lists cannot supply: the repeat principal who surfaces behind multiple revoked entities, the still-enrolled provider whose owners include a barred party, the revoked NPI whose pre-revocation billing was a visible outlier. That is the analysis that converts the revocations list from a backward-looking roster into a forward-looking tool for deciding which enrolled providers warrant a closer look next.

Python workflow: revocations by reason, type, and year from data.cms.gov

The script below pulls the revoked-providers file from the CMS data portal, resolves its (verbose and version-dependent) column names defensively, and computes the core views: the distribution of revocations by reason (the 42 CFR 424.535 grounds), the distribution by provider type, the count by effective year as a simple enforcement trend, and a check of how many records carry a usable ten-digit NPI—the key on which every cross-list join depends. No API key is required for public data. Because the public file is served both as a flat CSV download and through the data.cms.gov datastore query API, and because the column names have shifted across releases, any production use should be validated against the current dataset page and should prefer the bulk download for whole-file analysis. Requirements: requests and pandas.

import requests, pandas as pd
from collections import Counter

# CMS publishes the revoked-providers file through the data.cms.gov
# Provider Data / open-data portal. No API key is required for public
# data. CMS serves each dataset both as a flat CSV download and through
# a Socrata-style / datastore REST query API; the distribution id and
# exact path change between releases, so isolate them here and confirm
# against the current data.cms.gov dataset page.
#   - flat CSV download:  the dataset's "Download" CSV link
#   - datastore query:    https://data.cms.gov/data-api/v1/dataset/<id>/data
CSV_URL = "https://data.cms.gov/sites/default/files/medicare-revoked-providers.csv"


def load_revocations(url=CSV_URL):
    r = requests.get(url, timeout=300)
    r.raise_for_status()
    # The file is plain CSV with a header row.
    from io import StringIO
    return pd.read_csv(StringIO(r.content.decode("utf-8", errors="replace")),
                       dtype=str)


df = load_revocations()
print(f"Revocation records loaded: {len(df):,}")

# Column names in the public file are verbose and have shifted across
# CMS releases; resolve them defensively rather than hard-coding.
def col(frame, *candidates):
    lower = {c.lower(): c for c in frame.columns}
    for cand in candidates:
        if cand.lower() in lower:
            return lower[cand.lower()]
    raise KeyError(f"none of {candidates} in {list(frame.columns)[:12]}...")

c_npi    = col(df, "NPI", "National Provider Identifier")
c_type   = col(df, "Provider Type", "Specialty", "Taxonomy")
c_reason = col(df, "Revocation Reason", "Reason", "Reason Code")
c_eff    = col(df, "Revocation Effective Date", "Effective Date", "Revocation Date")


# --- 1. Revocations by reason (the 42 CFR 424.535 grounds) -------------
print("\nTop revocation reasons:")
for reason, n in df[c_reason].fillna("(blank)").value_counts().head(12).items():
    print(f"  {str(reason)[:46]:<46} {n:>6,}")


# --- 2. Revocations by provider type ----------------------------------
print("\nTop provider types revoked:")
for ptype, n in df[c_type].fillna("(blank)").value_counts().head(12).items():
    print(f"  {str(ptype)[:38]:<38} {n:>6,}")


# --- 3. Revocation count by year (the enforcement trend) --------------
eff = pd.to_datetime(df[c_eff], errors="coerce")
by_year = eff.dt.year.dropna().astype(int).value_counts().sort_index()
print("\nRevocations by effective year:")
for yr, n in by_year.items():
    bar = "#" * int(40 * n / max(by_year.max(), 1))
    print(f"  {yr}  {n:>5,}  {bar}")


# --- 4. NPI hygiene: how many records carry a usable join key ---------
# The NPI is the key that joins this list to other provider datasets
# and to the OIG exclusions list; a missing or malformed NPI is a record
# that cannot be linked.
valid = df[c_npi].fillna("").str.fullmatch(r"\d{10}")
share = valid.mean() if len(df) else 0.0
print(f"\nRecords with a valid 10-digit NPI: "
      f"{int(valid.sum()):,} of {len(df):,} ({share:.1%})")

Two things about this script deserve emphasis. First, the NPI-hygiene check at the end is not incidental bookkeeping—it is a precondition for everything else. The whole value of the revocations file in a wider analysis comes from joining it by NPI to the OIG exclusions list, the ownership records, and the claims data, and a record with a missing or malformed NPI is a record that simply cannot be linked. Measuring the share of records that carry a valid key tells you how much of the list is reachable by join before you start. Second, the reason-by-type cross-tabulation is the analytically interesting extension the script sets up but leaves as the next step: a single column of reasons and a single column of provider types are far more revealing crossed against each other—not-operational revocations concentrated in supplier types, license-loss revocations concentrated in clinician types—than either is alone, and the same NPI key that anchors the cross-list joins supports that internal breakdown directly.

Limitations and analytical caveats

The revoked-providers list is authoritative for what it records, but it has structural limitations that an analyst must internalize before drawing conclusions—or, worse, before treating a record as more than it is.

A revocation is not a finding of fraud or guilt.Revocation is an administrative action, and several of its grounds—not operational, failure to report a change, non-compliance with enrollment requirements—are integrity-of-the-enrollment failures rather than findings of fraud. Even the billing-pattern and felony grounds are not criminal adjudications: CMS revokes on its own administrative authority, and a revocation can be, and sometimes is, overturned on appeal. Treating every record on the list as a proven fraudster over-reads the data badly. The reason field is essential context precisely because it distinguishes the serious integrity cases from the administrative ones, and any analysis that lumps them together will mislead.

The published file is a snapshot, not a complete history. Like most operational bar lists, the revoked-providers file reflects the current set of revocations as CMS maintains it; records can be added as new actions are taken and can change or drop off as revocations are reinstated on appeal, as re-enrollment bars expire, or as the file is refreshed. A single day's extract is therefore an account of who is recorded as revoked now, not a longitudinal census of everyone who has ever been revoked. An analyst who wants the full history must capture the file repeatedly over time rather than assuming one download is the complete record, and should read the record_status field carefully rather than treating presence in the file as a permanent fact.

There is reporting lag, and revocation is not exclusion.A revocation appears in the public file after CMS or its contractor takes and records the action, so there is an interval between the underlying event and the record's appearance, and the most recent activity is systematically under-represented in any snapshot. More fundamentally—and this is the caveat most likely to cause a real error—a CMS revocation is not an OIG exclusion. The revocations file tells you who cannot bill Medicare; it does not tell you who is barred from all federal healthcare programs. A compliance screen that checks only the revocations list will miss parties who are excluded but not revoked, and vice versa. The two lists are complementary, not interchangeable, and both must be run.

Name and NPI matching needs care. As with any list of named parties, joining the revocations file to other datasets is only as good as the identifiers it shares with them. Where the NPI is present and valid, the join is clean; where it is missing or malformed, the fallback to name matching brings all the usual false-positive risk of common provider and business names. A candidate match found on name alone is a record to investigate by hand against the NPI, the provider type, and the state—not a determination. Treating a name hit as a conclusion is the single most dangerous mistake an analyst can make with this data.

Held with those caveats, the cms_revoked_providers table is a uniquely valuable program-integrity resource: roughly 7,000 NPI-anchored, reason-coded, dated records of the providers and suppliers the federal government has decided are no longer fit to bill Medicare—each one carrying the why, the who, and the how-long that turn a bare name into an accountable record, and each one joinable to the wider provider universe in which the same parties, and the people behind them, tend to reappear.