A hospice that was clean on its own claims — no abusive billing, no failed cap, nothing wrong with its own documentation — just received a letter revoking its Medicare enrollment and billing privileges. The reason had nothing to do with anything the hospice billed. It had to do with a person. Someone with managerial control of the agency had an outside affiliation that CMS decided posed an “undue risk of fraud, waste, or abuse to the Medicare program.” That was enough. This is guilt by affiliation, and it is one of the least understood ways a legitimate hospice can lose everything.

A hand holds a magnifying glass over a printed corporate org chart, zooming in on two boxes connected by an arrow that are circled in red — a metaphor for CMS scrutinizing a hospice's ownership and management affiliations.

We are sharing a redacted copy of an actual letter because the mechanism it describes is going to catch good operators off guard. Below is exactly what happened, the regulation behind it, and the vetting work that would have prevented it.

A CMS / National Government Services letter revoking a hospice's Medicare enrollment and billing privileges under the affiliation that poses an undue risk provision, with the provider name, address, and ID numbers redacted. — A real revocation notice from a CMS Medicare Administrative Contractor citing the “Affiliation Poses Undue Risk” provision. Provider name, address, and identifying numbers redacted.

What the Letter Actually Says

Strip out the names and the chain of events is short:

An individual with managerial control of the hospice had an affiliation (as defined in the regulations) with a separate medical-services entity.
That other entity had already had its Medicare billing privileges revoked — a revocation is, in CMS’s language, a “disclosable event.”
Weighing the duration, degree, and extent of that relationship, CMS concluded the affiliation posed an undue risk of fraud, waste, or abuse.
On that basis alone, CMS revoked the hospice’s enrollment and billing privileges, imposed a re-enrollment bar, and added the provider to the CMS Preclusion List.

Read that again, because the part that matters is what is missing. There is no allegation that the hospice itself submitted a bad claim. There is no live-discharge outlier, no skilled-visit problem, no cap overage. The hospice is being revoked for who is connected to it, and for the fact that the relationship was not disclosed. CMS does not have to prove the hospice did anything wrong with its billing. It only has to conclude that an affiliation creates risk.

The Authority: CMS’s “Affiliations Rule”

This power comes from the 2019 final rule formally titled Program Integrity Enhancements to the Provider Enrollment Process, effective November 4, 2019. The healthcare bar nicknamed it the “affiliations rule,” and one widely cited law-firm alert called it exactly what it is: “Guilt by Affiliation.”

Two pieces of the regulation work together:

42 CFR § 424.535(a)(19) — the revocation ground. CMS may revoke a provider or supplier when it “determines that the provider or supplier has or has had an affiliation under § 424.519 that poses an undue risk of fraud, waste, or abuse to the Medicare program.” That is the entire test. (A note on citation: the revocation letter labels this the “Affiliation Poses Undue Risk” provision and cites it under an older subsection numbering; in the current Code of Federal Regulations the operative paragraph is (a)(19). The substance is identical.)
42 CFR § 424.519 — the disclosure framework that defines what an “affiliation” is, what a “disclosable event” is, and the factors CMS weighs to decide whether a given affiliation is too risky to allow.

In other words: the program does not just police what you bill. It polices the company you keep.

Who Counts as an “Affiliation”

This is where operators underestimate their exposure. An “affiliation” is not limited to a co-owner. Under the rule it reaches anyone connected to your agency through:

A 5% or greater direct or indirect ownership interest;
A general or limited partnership interest, at any percentage;
Operational or managerial control, or someone who directly or indirectly conducts the day-to-day operations — this is the category that caught the hospice in the letter above;
Serving as an officer or director of the entity.

So your administrator, your managing employee, a silent partner, a board member, and depending on the arrangement your medical director can all be “affiliations” whose history becomes your problem. A “disclosable event” attached to any of them is the spark. The four disclosable events are an affiliate who:

has been suspended or excluded from a federal health care program;
had Medicare, Medicaid, or CHIP enrollment denied, revoked, or terminated;
had billing privileges denied, revoked, or suspended; or
has an uncollected debt to a federal health care program — an overpayment, a civil money penalty, or an assessment — regardless of whether a repayment plan exists.

In the redacted case, the affiliate’s disclosable event was a prior revocation of another entity’s billing privileges. That revocation, attached to a person who later took a controlling role at the hospice, is the entire foundation of the action.

How CMS Decides an Affiliation Is an “Undue Risk”

The existence of a disclosable event does not automatically end your enrollment. The rule directs CMS to weigh a set of factors — found at § 424.519(f) — before deciding the affiliation poses an undue risk:

the duration of the affiliation;
whether the affiliation still exists, and if not, how long ago it ended;
the degree and extent of the affiliation;
if the relationship was terminated, the reason for the termination;
the details of the disclosable event itself — its type, when it happened, the size and status of any debt, and the reason for the denial or revocation; and
any other evidence CMS deems relevant.

The practical takeaway: a current, close, controlling relationship with someone tied to a recent revocation is the worst-case profile — and it is exactly the profile that produced the letter above. A brief, long-ended, arms-length connection is far more defensible. But you do not control how that balancing comes out, and you do not get to make the argument unless you have disclosed the relationship in the first place.

The Consequences Stack Up Fast

A revocation under this authority is not a single penalty. It triggers a cascade:

Loss of enrollment and billing privileges on the effective date in the letter — roughly 30 days out. Medicare stops paying.
A re-enrollment bar under 42 CFR § 424.535(c), which can run from one to ten years. You cannot simply re-apply the next day.
Placement on the CMS Preclusion List. This is the quiet killer. Preclusion blocks payment for items and services furnished to Medicare Advantage enrollees and blocks Part D coverage of drugs prescribed by a precluded individual. For any agency with MA business, that is a second revenue hit beyond traditional Medicare.
Downstream damage that no regulation lists: commercial payors terminating contracts, accreditation and licensure questions, and the reputational mark of appearing on a public exclusion-style list.

You do have an appeal. The letter offers a reconsideration request — an independent review you generally must file within 30 days of the notice — and from there the path runs to a hearing before an Administrative Law Judge. But reconsideration is a documentation exercise on a tight clock, and the burden is on you to show the affiliation does not pose the risk CMS found. That is a much harder position than never having had the exposure.

This Is Not a One-Off

It would be easy to dismiss the letter as a fluke. It is not. CMS has used this exact authority against hospices before. In a 2026 departmental appeals decision involving a hospice agency, CMS revoked the agency’s Medicare enrollment under § 424.535(a)(19) on the ground that, within the prior five years, an individual had held managing control of another hospice whose enrollment and billing privileges had been revoked. Same statute, same fact pattern: a controlling person carries a prior revocation from one entity into the next, and the new entity pays for it.

This lands in the middle of the broadest hospice-enforcement push in Medicare history — the wave we have been tracking all spring, from the Qlarant payment suspensions that grew to roughly 800 Los Angeles–area providers, to the nationwide enrollment moratorium, to the FBI’s public fraud alert. As more entities are revoked and excluded, the population of people carrying a “disclosable event” grows — and every one of them is a potential affiliation risk to the next agency that hires, partners with, or is quietly controlled by them.

The Actionable Part: Vet Your People Like CMS Will

The good news is that this is a preventable failure. It is not a billing problem you have to out-document; it is a diligence problem you have to get ahead of. Build the following into how you stand up and run the agency:

1. Screen every principal before they have control

Before anyone takes a 5%+ ownership stake, a partnership interest, an officer or director seat, a managing-employee role, or operational control, run them. Check each individual and the other entities they have been tied to against the OIG List of Excluded Individuals/Entities (LEIE), the CMS Preclusion List where accessible, SAM.gov, and Medicare revocation history. A clean personal record is not enough — you are screening for a disclosable event attached to any entity they controlled.

2. Treat your medical director as an affiliation, not just a contractor

The relationship in the redacted letter ran through a medical-director role at the affiliated entity. Your medical director’s other engagements matter. Ask, in writing, whether they hold or have held ownership, managing control, or a medical-director or officer role at any provider that has been revoked, excluded, suspended, or carries an uncollected federal debt — and re-ask on a schedule.

3. Make affiliation disclosure part of onboarding

Have every owner, partner, officer, director, and managing employee complete and sign a disclosure questionnaire covering the four disclosable events — for themselves and for every other health care entity they have been associated with in the last five years. This is the same information the Form CMS-855A asks for. Capturing it yourself means you are never surprised by what an enrollment application or revalidation surfaces.

4. Disclose — do not gamble on staying quiet

A non-trivial part of this case is that the affiliation was undisclosed. Hiding a connection does not make it go away; it removes your chance to argue the § 424.519(f) factors in your favor and it hands CMS a cleaner case. If a principal has a disclosable event, get counsel involved and disclose it deliberately, with the context that frames the risk as manageable.

5. Re-screen on a schedule, not just at enrollment

A principal who was clean at hire can pick up a disclosable event later — their other venture gets revoked, an overpayment goes uncollected. Re-run your owners, managing employees, and medical director against the federal lists at least annually, and immediately when you learn of trouble at any entity they touch.

6. Build an exit when an affiliation goes bad

Know, in advance, how you would unwind a relationship if a principal becomes a liability — how a managing employee is removed, how an ownership interest is bought out, how a medical-director contract is terminated. Because the § 424.519(f) factors reward affiliations that have ended and ended cleanly, the ability to sever a bad relationship quickly is itself a compliance asset.

The Bottom Line

Most compliance work in hospice right now is aimed inward — your live-discharge rate, your visit minutes, your election statements, your claims. This letter is a reminder that one of the fastest ways to lose your Medicare enrollment has nothing to do with any of that. It is about who owns, controls, directs, and medically supervises your agency, and what those people are connected to. CMS can revoke you for an affiliation that poses an undue risk, bar you from re-enrolling for years, and preclude you from Medicare Advantage and Part D — all without ever alleging that you billed a single thing wrong. The defense is not a better rebuttal after the fact. It is knowing exactly who your people are, and who they are connected to, before you ever hand them control.

Revoked for Who You Know: A Hospice Just Lost Its Medicare Enrollment Over an Affiliation — Not Its Own Billing