# CMS Lists NEMT Among High-Risk Medicaid Services in Its CRUSH Anti-Fraud Request for Information

Canonical URL: https://nemtguide.com/news/cms-crush-fraud-rfi/ · Updated 2026-09-30

On February 27, 2026, the Centers for Medicare & Medicaid Services (CMS) published a request for information on Comprehensive Regulations to Uncover Suspicious Healthcare, or CRUSH. Its Medicaid section named nonemergency medical transportation among four service areas identified as high risk for fraud in certain states. Comments closed March 30, 2026. As of September 30, 2026, CMS has issued no CRUSH proposed rule, and the request itself changes no rules.

## What CMS published

| Item | Detail |
|---|---|
| Document | Request for Information (RFI) Related to Comprehensive Regulations To Uncover Suspicious Healthcare (CRUSH) |
| Published | February 27, 2026, at 91 FR 9803 |
| File code and docket | CMS-6098-NC, Regulations.gov docket CMS-2026-0826 |
| Comments due | March 30, 2026 |
| Programs covered | Medicare, Medicaid, CHIP, and the Health Insurance Marketplace |
| Legal effect | None. CMS says the request is for information and planning only |

CMS asked for feedback on changes it might include in a possible CRUSH proposed rule. It tied the request to a Presidential Memorandum of June 6, 2025, on eliminating waste, fraud, and abuse in Medicaid. Most of its 13 topic sections deal with Medicare, such as lab tests, medical equipment suppliers, and Medicare Advantage. The Medicaid and CHIP sections are the ones that reach NEMT, because NEMT is a Medicaid benefit.

## What it says about NEMT

The Medicaid section asks how CMS can help states prevent, identify, and address fraud in service areas "that have been identified as high risk for fraud in certain states." It lists four:

- Housing stabilization services
- Behavioral health services
- Personal care assistant services
- Nonemergency medical transportation

The same section asks whether CMS should require states to make their high-risk providers revalidate more often than every 5 years, and if so, how often. It also asks what tools and guidance would help states oversee both fee-for-service Medicaid and Medicaid health plans. See [NEMT fraud](https://nemtguide.com/guides/nemt-fraud/) for the schemes investigators find most often.

## Other questions that could reach NEMT companies

| Topic | What CMS asked | Program |
|---|---|---|
| Revalidation | Whether high-risk providers should revalidate more often than every 5 years | Medicaid and CHIP |
| Surety bonds | How to strengthen surety bond requirements in Medicaid and CHIP, using home health providers as an example | Medicaid and CHIP |
| Prepayment review | Whether more use of federal databases such as Do Not Pay would move states away from paying first and recovering later, toward review before payment | Medicaid and CHIP |
| Public data | What states, health plans, and providers should make public | Medicaid and CHIP |
| Fingerprints | Whether to fingerprint managing employees and owners under 5 percent, not only 5 percent owners of high-risk companies | Medicare |
| Ownership | The effect of requiring U.S. citizenship or legal permanent residency for every 5 percent owner | Medicare |
| Claim deadlines | Cutting the one-year filing deadline to 90 to 180 days for high-risk items and services | Traditional Medicare |
| Soliciting patients | Extending the ban on unsolicited phone calls, which now covers medical equipment suppliers, to other provider types and to texts, email, and social media | Medicare |

The Medicare items mainly matter to a NEMT company that also enrolls in Medicare, for example as an ambulance supplier. CMS's own summary of the coming proposed rule says it would cover Medicaid and CHIP as well as Medicare.

## Where the rule stands on September 30, 2026

- **Comments.** Regulations.gov shows 560 public comments posted on docket CMS-2026-0826.
- **No proposed rule yet.** None has appeared in the Federal Register.
- **CMS's own timetable.** The 2026 Unified Agenda of federal regulatory actions lists the CRUSH proposed rule (CMS-6098) with a target date of October 2026. It describes provisions on provider enrollment, medical review, investigations, and other program integrity oversight across Medicare, Medicaid, and CHIP. The regulations it would change are not yet listed.

If CMS issues a proposed rule, you can read the actual rule text and comment on it before any final rule. That is the point to check what it would require of a small transportation company.

## What CMS and states did in 2026 without a new rule

**CMS letters to the states.** On April 23, 2026, CMS Administrator Dr. Mehmet Oz asked governors for a swift revalidation of providers at high risk of fraud, with an answer due within 10 business days. Medicaid directors were asked for a two-year revalidation strategy within 30 days. States choose which providers are high risk, but CMS said it expects the group to include any provider without a National Provider Identifier (NPI). It also urged revalidating high-risk provider types more often than the 5-year minimum.

**State enrollment freezes on NEMT.** Under [42 CFR 455.470](https://www.ecfr.gov/current/title-42/section-455.470), a state may pause new enrollments for a provider type at high risk of fraud if the pause will not hurt members' access to care and the HHS Secretary agrees. Each pause lasts 6 months and can be extended 6 months at a time.

| State | What it froze | Dates |
|---|---|---|
| Minnesota | New NEMT providers located in the seven-county Twin Cities metro | January 27, 2026, extended to January 27, 2027 |
| North Dakota | New NEMT agencies statewide. Enrolled providers are not affected | From June 11, 2026, for 6 months, with possible 6-month extensions |

See the [Minnesota metro enrollment freeze](https://nemtguide.com/news/minnesota-metro-nemt-enrollment-freeze/) and what an [enrollment moratorium](https://nemtguide.com/glossary/enrollment-moratorium/) means. The HHS Inspector General also has two NEMT reviews under way, covered in [OIG's NEMT reviews](https://nemtguide.com/news/oig-nemt-fraud-reviews/).

## The rules NEMT companies already follow

The RFI builds on federal screening rules that apply now:

| Rule | What it requires | Citation |
|---|---|---|
| Revalidation | The state revalidates every provider at least every 5 years | 42 CFR 455.414 |
| Screening by risk level | Limited: license and database checks. Moderate: adds site visits. High: adds a criminal background check and fingerprints | 42 CFR 455.450 |
| Fingerprints | A high-risk provider and each 5 percent owner submit fingerprints within 30 days of a request | 42 CFR 455.434 |
| Site visits | Every enrolled provider allows unannounced inspections of any location | 42 CFR 455.432 |
| Ownership disclosure | Owners and managing employees are disclosed, and ownership changes are reported within 35 days | 42 CFR 455.104 |
| Payment suspension | The state suspends payments after a credible allegation of fraud, with notice within 5 days, or up to 90 days if law enforcement asks | 42 CFR 455.23 |

States set the risk level for NEMT. Arizona screens NEMT companies as high risk (PT-28 packet, rev 09/2026). Ohio screens wheelchair van companies as high risk at enrollment and moderate at revalidation. North Carolina screens NEMT van companies as moderate risk (NCTracks matrix, August 16, 2026). Florida requires a Medicaid surety bond, AHCA Form 5000-1064, from non-emergency, multi-load, and taxicab providers, unless they are contracted through the transportation coordinator (Enrollment Policy, February 2026).

## How honest NEMT companies can prepare

1. **Get an NPI if you do not have one.** CMS told states it expects providers without one to be counted as high risk. See [how to get an NPI number for NEMT](https://nemtguide.com/guides/how-to-get-an-npi-number-for-nemt/).
2. **Keep ownership records current.** Report every new owner, officer, and managing employee on time. See [how to report changes to Medicaid](https://nemtguide.com/guides/report-changes-to-medicaid/).
3. **Plan for high-risk screening.** Have every 5 percent owner ready to give fingerprints within 30 days, and keep your office ready for an unannounced visit. Our [Medicaid site visit guide](https://nemtguide.com/guides/medicaid-site-visit/) covers what inspectors check.
4. **Answer revalidation notices fast.** An off-cycle request can come before your usual date. See [Medicaid revalidation](https://nemtguide.com/guides/medicaid-revalidation/).
5. **Make every trip record match a covered visit.** Keep the appointment, driver, vehicle, times, and signature with each claim. The fields are in [NEMT trip documentation](https://nemtguide.com/guides/nemt-trip-documentation/).
6. **Screen owners, managers, and drivers every month** against the [OIG exclusion list](https://nemtguide.com/glossary/oig-exclusion-list/).
7. **Write it down.** A short [compliance program](https://nemtguide.com/guides/nemt-compliance-program/) shows a reviewer how you catch problems.
8. **Watch the Federal Register.** When the proposed rule appears, read what it would require of transportation providers and comment by its deadline.

## Key dates

| Date | What happened |
|---|---|
| June 6, 2025 | Presidential Memorandum on waste, fraud, and abuse in Medicaid |
| January 27, 2026 | Minnesota freezes new NEMT enrollment in the Twin Cities metro |
| February 27, 2026 | CMS publishes the CRUSH request for information |
| March 30, 2026 | Comment period closes |
| April 23, 2026 | CMS asks states to revalidate high-risk providers quickly |
| June 11, 2026 | North Dakota freezes new NEMT agency enrollment statewide |
| October 2026 | CMS's target date for the CRUSH proposed rule |