Understanding the CMS Anti-Fraud CRUSH Rule for Medical Billers (2026)

If you work in medical billing, you’ve probably heard the word “CRUSH” floating around lately. It sounds dramatic, and honestly, it kind of is. CRUSH is the federal government’s newest plan to catch healthcare fraud before it happens — not after.

For medical billers, coders, and healthcare practices, this matters a lot. CRUSH could change how claims are reviewed, how providers get approved to bill Medicare, and how quickly a payment can get frozen if something looks “off.” This guide breaks it all down in plain language: what’s real right now, what’s still just a proposal, and what your team should do today.

What Does CRUSH Actually Stand For?

CRUSH stands for Comprehensive Regulations to Uncover Suspicious Healthcare. It’s a program from the Centers for Medicare and Medicaid Services (CMS), and it covers Medicare, Medicare Advantage, Medicaid, CHIP, and the Health Insurance Marketplace.

On February 27, 2026, CMS published a Request for Information, usually called an RFI, laying out more than a dozen areas where it might tighten the rules. An RFI is CMS’s way of saying: “We’re thinking about changing things, and we want feedback before we write the actual rule.”

That’s an important detail, because a lot of what you’ll read online blurs this line. The RFI itself does not create new legal requirements. It’s a listening exercise, not a law. But — and this is the part that trips people up — CMS didn’t wait around while it collected feedback. It launched real, already-active enforcement at the very same time.

The Timeline: Where Are We Right Now?

Here’s the simplest way to picture where CRUSH stands today:

You are here: CMS has collected feedback and is now working toward drafting an actual proposed rule. That proposed rule will open its own comment period before anything becomes fully binding. So while CRUSH is a serious signal, the formal regulation billers will eventually have to follow hasn’t been written yet.

What’s Already Enforceable vs. What’s Still Just a Proposal

This is the single most confusing part of CRUSH, so let’s separate it clearly.

Already enforceable today (real, active enforcement):

• A six-month nationwide moratorium on new DMEPOS (durable medical equipment, prosthetics, orthotics, and supplies) provider enrollment
• A $259.5 million deferral of federal Medicaid funds to the state of Minnesota
• 2025 enforcement totals that CMS has already finalized: $5.7 billion in suspended Medicare payments, more than 122,000 denied claims, 5,586 provider and supplier revocations that are now public, and 372 cases worth an estimated $3.7 billion referred to law enforcement

Still just a proposal (part of the RFI, not yet law):

• Enhanced identity proofing and ownership disclosure requirements
• Changes to the preclusion list and Medicare Advantage enrollment rules
• New scrutiny on laboratory testing, including genetic and molecular diagnostics
• Additional safeguards around DMEPOS suppliers in Medicare Advantage
• Shorter filing deadlines for Medicare Part A and B claims
• Rules around artificial intelligence used in medical coding
• Stronger protections against misleading beneficiary marketing
• Expanded use of surety bonds
• State-specific Medicaid and CHIP program changes
• New oversight tools for the ACA Marketplace

Notice the pattern: the enforcement actions are already happening under CMS’s existing authority. The regulatory ideas listed in the RFI are the part that’s still on the drawing board. Treating both as equally “final” is the mistake a lot of articles make — and it’s exactly the confusion this guide is meant to clear up.

Where You Stand: A Quick Self-Check by Role

CRUSH doesn’t hit every part of the healthcare system the same way. Here’s a fast way to see where your risk sits.

If you’re a medical biller or billing vendor: Your biggest exposure is documentation quality. CMS is leaning harder on AI-based claims review, which means unusual billing patterns — even honest ones — can trigger a closer look. Action: tighten claim-level documentation now, before any formal rule requires it.

If you’re a healthcare provider or practice: Enrollment accuracy matters more than ever. If your NPI records, ownership disclosures, or credentialing files are outdated, this is the moment to fix them. Action: run an internal enrollment audit this quarter.

If you’re a Medicare Advantage organization (MAO) or health plan: Provider directory accuracy is now a compliance issue, not just a customer-service one. Since January 1, 2026, MA plans must submit directory data directly to CMS and update it within 30 days of any change. Action: reconcile credentialing, directory, and roster systems so they match.

If you’re a DMEPOS supplier: You’re under a direct, active enrollment moratorium right now, plus heightened scrutiny on high-risk bracing and orthotic billing codes. Action: confirm whether the moratorium applies to your enrollment status before submitting anything new.

If you’re a lab, especially one running genetic or molecular testing: You’re named specifically in the RFI, and lab test fraud is one of CMS’s stated top concerns. Action: review your test-ordering and billing documentation for medical necessity support.

Why This Matters More Than a Typical Regulatory Update

It’s easy to see “RFI” and think “not urgent yet.” That would be a mistake here, for one simple reason: CMS has said clearly that it’s moving away from a “pay-and-chase” model — where fraud gets caught after the money is already paid — toward a “detect and prevent” model that flags problems before payment happens.

That shift changes the burden. Instead of proving fraud happened, CMS increasingly just needs a claim pattern to look suspicious enough to pause payment while it investigates. For billers, that means clean, well-supported documentation isn’t just good practice anymore. It’s your best protection against getting caught in an automated flag, even when your billing was completely correct.

There’s also a reputational piece worth knowing about. CMS has said it plans to make more provider and supplier data public, not just the fact of a revocation, but additional details tied to it. That’s a real business risk on top of the financial one, since revocation data becomes visible to patients, partners, and payers.

How to Prepare Before the Proposed Rule Drops

You don’t need to panic, but you do need a plan. Here’s a practical checklist:

1. Audit high-risk service lines first. DMEPOS, lab billing, skin substitutes, and risk-adjustment coding are the areas CMS has flagged most heavily.
2. Verify enrollment documentation. Make sure NPI records, ownership disclosures, and credentialing files are current and accurate.
3. Strengthen claim-level documentation. Every code should be backed by clear, contemporaneous notes, since AI-driven review tools are now part of the process.
4. Watch for the proposed rule. Once CMS publishes it, there will be a new formal comment period. Submitting comments is free, public, and a legitimate way to influence the final requirements — and any organization affected by CRUSH should consider participating.
5. Build an internal response plan. Decide now who handles a payment suspension or audit request, so your team isn’t improvising during an actual event.

The Bottom Line

CRUSH is not a finished rule yet, but it’s also not something to shrug off. The RFI is exploratory, but the enforcement actions running alongside it are very real, already active, and backed by billions of dollars in suspended payments and thousands of revocations. The smartest move for medical billers, providers, and health plans alike is to treat this as an early warning: clean up documentation, verify enrollment records, and stay ready for the proposed rule that’s still coming. The organizations that prepare now, while CMS is still shaping the details, will be in a far stronger position than those that wait for the rule to become official.