https://chatgpt.com/c/6a8da199-c37c-83e8-bbe8-847d54cbe10e
##
Who, if anyone, is trying to really predict what will in the actual proposed CRUSH rule?
##
The genuine forecasting literature is surprisingly thin. Most coverage simply restates the February RFI. There is no final CRUSH rule: the proposed rule was sent to OMB’s Office of Information and Regulatory Affairs on August 7, 2026, where it remains under review. OMB identifies it as a proposed rule and “not economically significant”; the Unified Agenda tentatively lists publication in October. OMB review docket; Unified Agenda entry.
The useful forecasting literature
| Source | What it genuinely adds |
|---|---|
| Liles Parker, June 5 | The most direct forecast. It expects more payment suspensions, automated prepayment controls, enrollment screening, ownership scrutiny and revocations. Its AI emphasis is plausible operationally, although AI may appear more in the preamble than in regulatory text. |
| Sidley, May 20 | Predicts continued use of predictive analytics, enrollment interventions, coordinated “war rooms,” suspensions and state pressure. It forecasts the administration’s enforcement model more than individual CRUSH provisions. |
| KFF, June 9 | Shows where Medicaid policy is already going: accelerated revalidation of high-risk providers, additional attention to providers without NPIs, and continuing federal pressure on states. |
| Mintz, July 14 and McDermott, July 22 | These analyze the July home-health proposed rule rather than CRUSH itself. Nevertheless, that rule is probably the best available predictor because it reveals which CRUSH-style enrollment powers CMS has already converted into actual regulatory language. |
| MedScout laboratory analysis | One of the few industry pieces to make a substantive laboratory prediction: laboratories should expect more nationally consistent molecular-test rules. Its prediction does not establish that CMS will adopt national MolDX wholesale. |
| BCBSA recommendations summarized by Becker’s | Particularly useful for predicting how the MA proposal may be narrowed. BCBSA supports real-time notification and coordinated action but cautions that simply transplanting Medicare fee-for-service suspension rules into capitated plans would not work. |
The principal conclusion from the search for forecasts is therefore negative. But important: there is no emerging expert consensus based on leaked text or unusually informed reporting.
The soundest forecast comes from reverse-engineering CMS’s regulatory posture, its actions since February, the July enrollment proposals and the practical constraints that OMB review imposes.
#
#
Chat GPT Steps Into the CRUSH Ring: Forecasting the Proposed Regulation
#
#
What Will Be in the CRUSH Proposed Rule—and What May Have Fallen Off the Truck
The proposed Comprehensive Regulations to Uncover Suspicious Healthcare rule has reached the White House. CMS transmitted the proposal to the Office of Management and Budget on August 7, 2026. No proposed text is public, and no final regulation exists. Nevertheless, the available evidence permits a reasonably discriminating forecast—not simply of subjects that CMS considered in February, but of the provisions most likely to survive the journey from an expansive request for information to an administrable proposed rule.
The February CRUSH request for information, 91 Fed. Reg. 9803, was intentionally panoramic. It raised questions about enrollment, payment suspensions, Medicare Advantage, Part D, laboratories, DMEPOS suppliers, artificial intelligence, claim-filing deadlines, surety bonds, beneficiary solicitation, Medicaid, CHIP and the insurance Exchanges. An RFI can afford to be panoramic. A proposed rule cannot. Its provisions must have statutory authority, workable regulatory language, defensible burden estimates and a plausible implementation path.
OMB’s characterization supplies the first clue. CRUSH is classified as “other significant,” but not major or economically significant. It is also listed as having no federalism, unfunded-mandate or international impact. Those labels are preliminary rather than binding, but they make a massive redesign of every CMS program less likely. They point instead toward a package of administrative enforcement tools—rules that expand CMS discretion, allow faster intervention and concentrate burdens on providers or services classified as high risk.
Enrollment will be central—but much of the first tranche has already appeared
CRUSH will almost certainly contain provisions making it easier to deny, deactivate or revoke the enrollment of providers and suppliers considered high risk. Enrollment has become the administration’s preferred gatekeeping mechanism because it allows CMS to prevent payments without first completing a conventional fraud case. It also produces immediate, visible results: an entity can be kept out, removed or disconnected from Medicare billing before the government has paid years of questionable claims.
But some of the most important enrollment provisions may have “fallen off the CRUSH truck” for an unusual reason: CMS has already placed them in another proposed rule. The CY 2027 Home Health PPS proposed rule, 91 Fed. Reg. 41216, 41285–41327, contains program-wide Medicare enrollment provisions that go well beyond home health.
Among other things, CMS has proposed to loosen the existing standards for revoking enrollment based on abuse of billing privileges; revoke providers based on excessive geographic concentration and perceived fraud risk; propagate a denial or revocation across a provider’s other enrollments; reach parties with business or financial relationships to an applicant; make many revocations retroactive; extend reapplication bars; and reduce the post-revocation claim-submission period from 60 days to 15 days. The proposal frequently avoids fixed numerical thresholds and reserves case-specific discretion to CMS.
This is probably the clearest preview of CRUSH’s drafting philosophy. The agency appears more interested in removing limiting factors from its existing authority than in creating a highly prescriptive new fraud code. CRUSH may add a second enrollment tranche—more frequent revalidation, stronger deactivation authority, elevated screening of newly identified high-risk categories and improved propagation of adverse actions across programs—but it need not repeat every provision already riding in the home-health rule.
This approach also continues a much older progression. CMS created the modern Part 424 enrollment framework in the 2006 enrollment rule, 71 Fed. Reg. 20754. It added risk-based screening, fingerprinting, temporary moratoria and payment-suspension provisions in the 2011 program-integrity rule, 76 Fed. Reg. 5862. The 2019 program-integrity rule, 84 Fed. Reg. 47794, enlarged affiliation disclosure and denial and revocation authorities. CRUSH is likely to be another turn of that ratchet, but with a stronger emphasis on rapid, data-triggered intervention.
Payment suspension and prepayment review should be the rule’s center of gravity
The strongest candidate for a leading role in CRUSH is expanded authority to stop money before it leaves the government. That is the operational meaning of the administration’s promised transition from “pay and chase” to “detect and prevent.”
In traditional Medicare, CMS already can suspend payments when it possesses reliable information concerning an overpayment or a credible allegation of fraud. It can also impose prepayment medical review and automated claim edits. CRUSH could make these tools easier to initiate, maintain or coordinate by revising evidentiary standards, broadening the information that CMS may consider, removing procedural impediments, or explicitly connecting analytics-generated risk signals to medical review and payment action.
The administration’s behavior strongly favors this prediction. CMS reports billions of dollars in suspended payments and repeatedly publicizes moratoria, payment holds, site visits and enrollment removals. Sidley’s May analysis similarly expects continued reliance on predictive analytics, payment and enrollment suspensions and coordinated enforcement teams. These are tools the agency already understands, and expanding them can produce immediate results without waiting for criminal or False Claims Act litigation.
The more difficult question is whether CMS will require Medicare Advantage and Part D plans to suspend payments whenever CMS directs them to do so. Some version of cross-program coordination is highly likely. A provider suspended in traditional Medicare should not be able simply to redirect the same activity to Medicare Advantage. Plans therefore may be required to screen against CMS data, receive suspension information in real time and take specified action against revoked, precluded or suspended parties.
A wholesale transplantation of fee-for-service suspension rules into MA and Part D is less likely. As the Blue Cross Blue Shield Association observed, plans operate through capitation, provider contracts and different payment systems. Questions also arise concerning beneficiary liability, continuity of care, contractual appeals and the treatment of clean claims unrelated to the suspected conduct.
The likely compromise is a graduated system: immediate notification of plans; mandatory screening and internal suspension policies; required action against providers subject to defined CMS sanctions; and possibly CMS-directed suspensions in specified high-risk circumstances. CMS could pilot the broader authority or initially apply it to DMEPOS suppliers and other sectors where the risk of billing migration is especially apparent.
Identity proofing and ownership scrutiny are highly likely to survive
Enhanced identity verification is another strong candidate for inclusion. Modern fraud schemes frequently use stolen identities, nominal owners, rapidly changing corporate shells, shared addresses and individuals who appear on paper while someone else controls the operation. Identity proofing addresses the actor before CMS must adjudicate the validity of thousands of individual claims.
CRUSH therefore is likely to enlarge the circle of persons subject to verification. Owners with meaningful interests are obvious candidates, but CMS also may reach managing employees, authorized officials, directors, compliance personnel and selected affiliated parties. Higher-risk individuals could face fingerprints, criminal-background checks, address verification and confirmation of banking or tax information. CMS could also require more rapid reporting when these parties change.
The July home-health proposal supports this prediction. It would clarify the scope of managing employees, reach a wider range of associated parties and expand ownership-related enrollment reporting. CMS also has proposed to deny enrollment based on misuse of another person’s identity. These are concrete indications that the agency wants to look beyond the billing entity to the people and organizations surrounding it.
A categorical requirement that every person holding a 5% ownership interest be a United States citizen or lawful permanent resident is less likely to survive intact. Such a rule would affect legitimate international ownership structures, invite questions about statutory authority and potentially create consequences far beyond high-risk providers. OMB’s designation of no international impact is another reason for caution. CMS is more likely to require fuller disclosure of foreign or nonresident owners, a verifiable domestic responsible party, an agent for service and reliable financial and location information.
Claim deadlines, bonds and solicitation restrictions will probably be narrower than advertised
The RFI’s proposal to shorten the ordinary Medicare claim-filing period to 90 or 180 days has intuitive political appeal: fraudsters should not be allowed a long period in which to manufacture or warehouse claims. But a universal deadline has a weak connection to the identity of the biller or the medical necessity of the service. It also can penalize legitimate providers dealing with corrected claims, delayed documentation, coordination of benefits or enrollment problems.
For those reasons, a universal 90-day limit appears unlikely. CMS may propose 180 days, incorporate exceptions, or apply a shorter period only to selected suppliers and services. Another possibility is that CMS will use special deadlines after a revocation or other adverse event. The home-health rule’s proposed reduction of the post-revocation filing window from 60 days to 15 days demonstrates that CMS is willing to shorten deadlines when it can connect the change directly to an identified program-integrity risk.
Surety bonds present a similar pattern. CMS already has experience with bonds for DMEPOS suppliers, where inventory, ownership turnover and rapid billing can create collectability risks. An increased DMEPOS bond or a risk-adjusted bond tied to billing volume is plausible. A general bond requirement for laboratories, physicians and institutional providers is less likely. It would require difficult decisions about bond amounts and could restrict legitimate market entry without reliably distinguishing honest providers from fraudulent ones.
Beneficiary-solicitation rules also are likely to be targeted. CMS can plausibly update the DMEPOS prohibition on unsolicited telephone contacts to encompass texts, email, social media and third-party lead generators. But the RFI itself recognized that extending the statutory DMEPOS prohibition to entirely different provider classes may require legislation. The proposed rule may therefore focus on modern communications and indirect marketing within CMS’s existing authority, leaving a general health-sector solicitation ban off the truck.
Laboratories are likely to be visible, but a national MolDX regime is not inevitable
Laboratories—especially genetic and molecular laboratories—are unusually likely to receive their own section. Most of the regulatory history is program-wide; CRUSH may be the first major enrollment and program-integrity package to identify molecular laboratories so prominently as a distinct target.
CMS has a substantial enforcement record on which to draw. A Florida laboratory owner was convicted in a scheme involving approximately $463 million in claims and $187 million paid. In 2026, federal prosecutors in Texas alleged that two laboratories had billed roughly $65 million and received more than $43 million for genetic testing associated with kickbacks and medically unnecessary orders. Those cases make laboratory oversight politically conspicuous and give CMS a clear rationale for action.
But “molecular testing” is not synonymous with fraud. Genomic and biomarker testing has become central to precision oncology, helping identify therapeutic targets, inherited risk and, increasingly, early-detection signals. The National Cancer Institute’s explanation of biomarker testing illustrates how closely testing can be integrated with treatment selection. A rule that treats rapid expenditure growth as proof of abuse would risk obstructing one of medicine’s most consequential areas of development.
The most plausible CRUSH response is therefore targeted rather than categorical. CMS could designate certain laboratory profiles or molecular services as higher risk; require additional enrollment screening or accreditation; intensify prepayment review of outlier codes; verify ordering-provider relationships; collect information about marketers, specimen arrangements and referral entities; and require clearer identification of the particular test being billed. Test-specific identifiers or registration could be attractive because generic CPT codes sometimes aggregate heterogeneous assays and make claims analytics less informative.
Nationwide adoption of MolDX as a unified coverage and payment system is less certain. Supporters argue that MolDX-style registration and technical assessment would give CMS better visibility and more consistent medical-necessity rules. Opponents, including the American Clinical Laboratory Association, warn about duplicating CLIA oversight, prolonged technical-assessment delays and barriers to coverage for new tests. Nationalizing MolDX would also be a substantial coverage-administration project, not merely an anti-fraud control.
Consequently, CRUSH may borrow selected MolDX features without nationalizing the program. Registration of certain high-risk molecular tests, unique test identifiers, uniform data elements or a limited demonstration are more likely than immediate nationwide transfer of molecular coverage authority. CMS also could solicit further comment, establish contractor performance standards or move broader MolDX policy into a separate rulemaking.
Medicaid provisions will emphasize revalidation and federal visibility
The Medicaid portion is likely to focus on tools that CMS can describe as minimum program-integrity standards rather than on a wholesale federal takeover of state operations. Likely provisions include accelerated or off-cycle revalidation of high-risk providers, more consistent risk categorization, improved use of NPIs, reporting of ownership and adverse actions, and faster exchange of suspension and termination information among states and CMS.
That prediction is consistent with current practice. CMS has asked states to revalidate high-risk providers and prepare broader two-year revalidation strategies. KFF’s review identifies high-risk classification, providers without NPIs, state capacity and the public availability of revalidation results as important unresolved questions.
More sweeping Medicaid financing proposals are less likely to be central to CRUSH. Intergovernmental transfers, state-directed payments and eligibility verification involve different legal and policy structures. They also create obvious federalism and economic consequences, whereas the Unified Agenda identifies CRUSH as having no federalism impact. The administration can continue pursuing state-specific deferrals and compliance actions without placing every dispute into this rule.
Artificial intelligence may power the rule without becoming much of the rule
Artificial intelligence will be prominent in speeches, press releases and the preamble. It is less certain that CRUSH will contain extensive binding AI regulations. CMS already can use predictive models and claims analytics to select providers for review. It does not need a new regulation every time it changes an algorithm.
Detailed AI rules for Medicare Advantage coding would raise difficult questions about model validation, explainability, clinical review, performance measurement, proprietary information and appeal rights. Those questions are real, but they could slow a rule centered on immediate enforcement authority. CMS may instead state that data analytics can support payment, medical-review and enrollment decisions while reserving specific AI governance for guidance, contracts, audit protocols or a later rulemaking.
This distinction matters. Operationally, providers may encounter much more automated scrutiny even if “artificial intelligence” appears in few operative provisions. The legally significant change may be the consequence attached to an analytic flag—prepayment review, a site visit, revalidation or suspension—rather than the model that generated the flag.
What probably fell off the truck
The provisions least likely to emerge intact are a universal 90-day filing deadline; a general surety-bond requirement across provider classes; an across-the-board citizenship requirement for owners; immediate nationwide MolDX coverage administration; comprehensive regulation of AI coding tools; and a direct transplantation of traditional Medicare suspension procedures into every MA and Part D payment system.
Marketplace provisions also may have receded. Although the February RFI discussed federal and state-based Exchanges, the later Unified Agenda abstract describes Medicare, Medicaid and CHIP but does not mention the Marketplace. That omission may be accidental, but it is one more sign that the proposal reaching OMB is narrower than the original questionnaire.
Some enrollment concepts may be absent for the opposite reason: CMS has already proposed them elsewhere. The July home-health rule has become a vehicle for broad Medicare enrollment changes, including retroactive revocations, associated-party scrutiny and new risk-based authorities. Those provisions did not necessarily lose favor; they may simply have left the CRUSH package early.
The likely shape of the proposed rule
The most probable CRUSH proposal is a concentrated package built around four ideas.
- First, CMS will acquire or clarify authority to stop suspicious payments earlier, with greater use of prepayment review and some form of required coordination by MA and Part D plans.
- Second, enrollment will become more dependent on verified identity, ownership, management, location and affiliation information.
- Third, Medicaid agencies and managed-care organizations will face stronger revalidation, screening and information-sharing expectations.
- Fourth, CMS will establish targeted controls for conspicuous high-risk sectors, with molecular laboratories and DMEPOS suppliers likely to receive particular attention.
The rule’s practical significance may exceed its formal economic designation. A regulation need not impose a universal multibillion-dollar compliance system to have enormous consequences for an individual provider. A payment suspension, retroactive revocation or enrollment denial can be existential.
The central forecast is therefore not that CRUSH will create an entirely new program-integrity system. It will make the existing system faster, more interconnected and more discretionary. The 2006, 2011 and 2019 rules constructed the enrollment and screening architecture. CRUSH is likely to give CMS more ways to act on the signals that architecture produces—and to act before suspicion has matured into a completed fraud case.
#
#
#
Sidebar: Re ownership idenity, I asked a follow-up. Is it really that they don't know the owners, they used fake IDs, or is it that the money wired at midnight to the Cayman Islands and the owners are in Macedonia?
#
Honestly, the Cayman Islands and Macedonia comments are closer to the mark. FBI and DOJ can often identify the real participants eventually. The problem is that CMS may not know—at enrollment and payment time—whether the reported owner is the actual controller, a straw owner, a stolen identity, or merely the domestic face of a foreign organization. By the time investigators reconstruct that structure, Medicare has paid and the proceeds have been layered through shell companies and a chain of domestic and foreign banks.
The schemes fall into three overlapping categories:
False identity: stolen or fabricated identities are used to establish providers, order services or supply beneficiary data.
Nominee (nominal) ownership: the enrolled “owner” is a real, identifiable person but is not the true operator or beneficiary. Fingerprinting confirms who the nominee is; it does not establish who controls the nominee.
Offshore control and dissipation: the real operators are abroad, while proceeds pass rapidly through money launderers, shell companies and foreign accounts, making asset recovery and extradition difficult.
The enormous 2025 “Operation Gold Rush” case illustrates the combined model: DOJ alleged a foreign-based organization, foreign straw owners, stolen identities and an international money-laundering network. More recent prosecutions describe proceeds moving through global banks, a New Zealand shell company and even construction of a Philippine resort. DOJ’s Operation Gold Rush announcement; 2026 national takedown.
CMS essentially says this explicitly in the CRUSH RFI, 91 Fed. Reg. 9803: it describes opaque ownership, foreign-resident owners and actors beyond the practical reach of American law enforcement. Thus, “identity proofing” is partly an imprecise label for the larger problem of determining beneficial ownership, actual control and collectability before money is released.
But that rationale should not be overgeneralized to laboratory fraud. Many Texas and Florida genetic-testing cases involved perfectly identifiable domestic laboratory owners, marketers and telemedicine participants. Their identities were not the principal mystery; the failures involved kickbacks, medically unnecessary orders, weak prepayment controls and Medicare’s inability to stop aberrant billing quickly. A citizenship rule or more fingerprints would not have prevented most of those claims.
The most effective CRUSH package would therefore combine identity verification with beneficial-ownership disclosure, validation of the receiving bank account, scrutiny of marketers and affiliated entities, and rapid payment holds when billing suddenly becomes aberrant. Fingerprinting alone solves yesterday’s “Who is this person?” problem. The more serious contemporary question is: Whose business is this really, who receives the money, and can the government still reach either one tomorrow morning?
