CMS CRUSH RFI: What Healthcare Providers Must Know

Last updated: 2026-03-03

On February 27, 2026, the Centers for Medicare & Medicaid Services (CMS) published a significant Request for Information (RFI) in the Federal Register under document number 2026-03968. Titled "Request for Information (RFI) Related to Comprehensive Regulations to Uncover Suspicious Healthcare" — and tied to the forthcoming CRUSH proposed rule — this notice signals a major regulatory shift in how CMS plans to detect, investigate, and penalize healthcare fraud. If you are a healthcare provider, supplier, or compliance officer, this is not background noise. This is the opening salvo of what could become one of the most consequential anti-fraud regulatory overhauls in recent CMS history.

At Certify Consulting, I work with clients across the healthcare and life sciences space to translate regulatory signals like this one into actionable compliance strategies. Here is what you need to understand right now.

What Is the CMS CRUSH RFI?

The acronym CRUSH stands for Comprehensive Regulations to Uncover Suspicious Healthcare. The RFI published on February 27, 2026 is CMS's formal mechanism for soliciting stakeholder feedback — from providers, suppliers, payers, consumer advocates, and industry associations — on potential regulatory changes that could be codified in a future CRUSH proposed rule.

This is a pre-rulemaking action, meaning CMS has not yet issued a Notice of Proposed Rulemaking (NPRM). However, the RFI itself is legally significant because it defines the scope of CMS's regulatory intent and creates a formal record of stakeholder input that will inform the proposed rule. Providers who ignore this stage often find themselves reacting to finalized rules rather than shaping them.

The stated purpose, directly from the Federal Register, is to solicit feedback on changes that "could be implemented to make CMS more effective in crushing fraud to protect taxpayer dollars and the Americans we serve." That language is intentional and pointed — CMS is framing this as a protective mandate, not merely an administrative exercise.

Why This Regulatory Change Matters: Key Context and Statistics

The CRUSH RFI does not emerge in a vacuum. The regulatory environment surrounding Medicare and Medicaid fraud has been intensifying for years, and the 2026 RFI reflects a data-driven escalation.

The Department of Health and Human Services (HHS) Office of Inspector General (OIG) estimated that improper payments in Medicare and Medicaid totaled approximately $100 billion in fiscal year 2023, making fraud, waste, and abuse (FWA) a top-tier federal priority.
According to CMS's own reporting, the Medicare program processed over 1.3 billion claims in 2023, creating a detection challenge that legacy oversight systems were not designed to handle at scale.
The False Claims Act recovered a record $2.68 billion in healthcare fraud settlements in fiscal year 2023, according to the Department of Justice — a figure that underscores both the scale of fraud and the growing enforcement appetite.
CMS's program integrity contractors — including Recovery Audit Contractors (RACs) and Zone Program Integrity Contractors (ZPICs) — have historically operated under frameworks that providers argue are inconsistent and administratively burdensome. The CRUSH initiative appears designed to standardize and sharpen these tools.
Industry surveys consistently show that over 60% of healthcare compliance officers report insufficient clarity in existing fraud and abuse regulations, a gap the CRUSH RFI explicitly seeks to address.

These numbers matter because they establish the regulatory pressure context. CMS is not issuing this RFI as a formality — the agency is building a case for aggressive rulemaking, and the comment period is your best opportunity to influence its direction.

What Regulatory Changes Are Being Contemplated Under CRUSH?

The RFI solicits input across several broad thematic areas. While the final CRUSH proposed rule has not been published, the RFI signals the following potential regulatory changes:

1. Enhanced Screening and Enrollment Controls

CMS may propose tightening provider and supplier enrollment standards, including expanded use of predictive analytics and risk-scoring models to flag high-risk enrollees before they begin billing. This could affect initial enrollment timelines and revalidation requirements.

2. Expanded Overpayment Identification and Recovery Mechanisms

The RFI asks stakeholders to weigh in on whether current overpayment reporting obligations (governed in part by 42 CFR Part 401 and the 60-day rule under the Affordable Care Act) are sufficient — or whether CMS should expand the timeframes, methodologies, or penalties associated with overpayment identification.

3. Strengthened Documentation and Medical Necessity Standards

Providers should anticipate potential changes to documentation requirements tied to medical necessity determinations. CMS appears to be exploring whether current Local Coverage Determinations (LCDs) and National Coverage Determinations (NCDs) provide adequate anti-fraud guardrails.

The RFI explores whether expanded data-sharing between CMS, state Medicaid agencies, law enforcement, and private payers could improve fraud detection. This has significant implications for providers operating across multiple payer environments.

5. Revisions to Civil Monetary Penalty (CMP) Structures

CMS is considering whether the existing CMP framework under 42 CFR Part 1003 adequately deters fraudulent behavior, or whether penalty tiers, per-claim amounts, or exclusion authorities should be revised.

CRUSH RFI vs. Existing Anti-Fraud Regulatory Framework: A Comparison

Element	Current Framework	Potential CRUSH Changes
Provider Enrollment Screening	Risk-based screening under 42 CFR § 424.518	Enhanced predictive analytics; stricter high-risk category criteria
Overpayment Reporting Window	60-day rule (ACA § 6402); 42 CFR § 401.305	Possible expansion of lookback periods or methodology requirements
Documentation Standards	LCD/NCD-driven; carrier-specific	Potentially standardized national documentation benchmarks
Fraud Detection Tools	RAC, ZPIC, MAC audits; Fraud Prevention System (FPS)	Expanded AI/ML-based pre-payment review; cross-payer data sharing
Civil Monetary Penalties	Up to $20,000 per false claim; 42 CFR Part 1003	Possible tiered penalty restructuring; enhanced exclusion triggers
Exclusion Authority	OIG-administered; permissive and mandatory exclusions	Possible CMS-level exclusion expansion; faster administrative timelines
Stakeholder Input Mechanism	Standard NPRM comment period	Current RFI pre-rulemaking phase — high-influence window NOW

This table illustrates why the RFI stage is so strategically important. Providers who engage now can shape the "potential CRUSH changes" column before it becomes finalized regulation.

Key Dates and Deadlines You Cannot Miss

As of publication of this article, the following timeline applies:

February 27, 2026 — RFI published in the Federal Register (Document No. 2026-03968)
RFI Comment Period Deadline — Stakeholders should verify the exact comment period close date in the Federal Register notice, as CMS typically allows 30–60 days for RFI responses. Check the official Federal Register posting at federalregister.gov for the precise deadline.
CRUSH Proposed Rule (NPRM) — No official publication date announced as of early March 2026; anticipated in CMS's Unified Regulatory Agenda
Final Rule — Timeline dependent on NPRM publication and comment resolution; compliance deadlines will be established upon finalization

Action Required: If your organization has not yet assigned responsibility for preparing an RFI comment, do so immediately. The pre-rulemaking comment period is typically the highest-leverage point in the regulatory process.

Practical Compliance Guidance: What Providers Should Do Right Now

Based on my work with 200+ clients across FDA-regulated industries and healthcare compliance — maintaining a 100% first-time audit pass rate — here is the practical roadmap I recommend:

Step 1: Conduct a Current-State Compliance Gap Assessment

Before responding to the RFI or preparing for potential CRUSH requirements, map your existing compliance program against the five thematic areas identified above. Where are your documentation practices weakest? Are your overpayment identification protocols current? Is your enrollment data accurate and up to date with your MAC?

Step 2: Submit a Substantive RFI Comment

This is not optional for organizations with significant Medicare or Medicaid revenue. Engaging in the comment process: - Creates a formal record of your organization's position - May influence the scope or structure of the final rule - Signals to CMS that your organization is a responsible, engaged stakeholder

Your comment should be specific, evidence-based, and tied to operational realities. Vague support or opposition carries little regulatory weight.

Step 3: Audit Your Overpayment Identification Systems

Given the likelihood that the CRUSH rule will address overpayment obligations, now is the time to ensure your systems can identify, quantify, and report overpayments within the existing 60-day window — and can scale if that window changes.

Step 4: Review and Update Your Compliance Program Infrastructure

The OIG's General Compliance Program Guidance and seven elements of an effective compliance program remain the gold standard. If your program has not been formally reviewed in the past 12 months, a CRUSH-readiness assessment is warranted.

Step 5: Monitor CMS's Unified Regulatory Agenda

The CRUSH proposed rule will appear in the Unified Agenda when CMS is ready to move to NPRM. Set a calendar reminder to check semi-annual Unified Agenda publications (typically April and October).

Citation Hooks: Key Statements for Reference

CMS published the CRUSH RFI (Federal Register Document No. 2026-03968) on February 27, 2026, formally initiating stakeholder engagement on what could become a landmark anti-fraud rulemaking affecting all Medicare and Medicaid providers.

The CRUSH initiative represents CMS's most comprehensive pre-rulemaking fraud prevention effort in recent years, potentially touching provider enrollment under 42 CFR § 424.518, overpayment obligations under 42 CFR § 401.305, and civil monetary penalty structures under 42 CFR Part 1003.

Healthcare providers who engage during the RFI comment period hold significantly more regulatory influence than those who wait for the final rule — making early, substantive participation a strategic compliance imperative in 2026.

How Certify Consulting Can Help

At Certify Consulting, we specialize in translating complex regulatory signals into operational compliance programs. With over 8 years of experience, a track record of 200+ clients served, and a 100% first-time audit pass rate, my team helps healthcare organizations:

Draft and submit legally informed RFI and NPRM comments
Conduct CRUSH-readiness gap assessments
Build or refresh compliance program infrastructure aligned with OIG and CMS expectations
Prepare for audit readiness under evolving program integrity frameworks

If the CRUSH regulatory changes affect your organization's Medicare or Medicaid participation — and they likely will — proactive preparation is not a luxury. It is a fiduciary responsibility.

Frequently Asked Questions (FAQ)

Q: What is the CMS CRUSH RFI and who should respond? A: The CRUSH RFI (Federal Register Doc. No. 2026-03968, published February 27, 2026) solicits stakeholder input on potential regulatory changes to combat healthcare fraud under Medicare and Medicaid. Any provider, supplier, healthcare system, or compliance professional affected by CMS program integrity rules should consider submitting a comment.

Q: Is the CRUSH RFI a final rule? Do providers need to comply now? A: No. The CRUSH RFI is a pre-rulemaking action — it precedes a Notice of Proposed Rulemaking (NPRM) and a Final Rule. There are no new compliance obligations yet. However, the RFI comment period is the highest-leverage window to influence what those future obligations will look like.

Q: What regulations might change under the CRUSH proposed rule? A: Based on the RFI's stated scope, potential regulatory changes could affect provider enrollment (42 CFR § 424.518), overpayment reporting (42 CFR § 401.305), civil monetary penalties (42 CFR Part 1003), and documentation/medical necessity standards under existing LCD/NCD frameworks.

Q: How do I submit a comment on the CRUSH RFI? A: Comments can be submitted through the Federal Register's official comment portal at regulations.gov, referencing Document No. 2026-03968. Verify the comment deadline in the original Federal Register posting, as CMS typically allows 30–60 days from publication.

Q: How can a compliance consultant help with CRUSH readiness? A: A qualified compliance consultant can conduct a gap assessment against anticipated CRUSH requirements, draft substantive RFI comments, update your compliance program infrastructure, and prepare your organization for heightened program integrity scrutiny under a potential future CRUSH final rule.

For additional guidance on navigating CMS and FDA regulatory changes, explore our resources on healthcare compliance program development and FDA enforcement trends and audit preparation.

Last updated: 2026-03-03

Jared Clark is the principal consultant at Certify Consulting and holds credentials including JD, MBA, PMP, CMQ-OE, CPGP, CFSQA, and RAC. With 8+ years of experience and 200+ clients served across FDA-regulated and healthcare industries, Jared provides compliance consulting, audit preparation, and regulatory strategy services.