Reading CRUSH Before It Arrives: What CMS’s Recent Fraud Announcements May Signal—and Why Legitimate Molecular Laboratories Should Care
CMS’s proposed Comprehensive Regulations to Uncover Suspicious Healthcare (CRUSH) rule remains under review at the Office of Management and Budget. CMS transmitted the proposed rule on August 7; OIRA lists it as a proposed rule, with no statutory deadline and without an “economically significant” designation. (RegInfo)
The public starting point was CMS’s unusually broad February request for information. The RFI ranged across provider enrollment, payment suspensions, ownership and identity verification, Medicare Advantage and Part D, laboratories, DMEPOS, artificial intelligence, claims deadlines and other program-integrity tools. It specifically asked how CMS could gain more authority and flexibility to intervene quickly against suspected fraud and how analytics could be connected more effectively with those interventions. (Federal Register)
Earlier background on the CRUSH initiative and its arrival at OMB is available in Discoveries in Health Policy: CRUSH Reaches White House / OMB and CRUSH at OMB: The Next Stage of a Twenty-Year Medicare Anti-Fraud Campaign.
While CRUSH has been at OMB, CMS has issued two unusually prominent anti-fraud announcements involving precisely two sectors emphasized in the RFI. On August 28, CMS announced more than $1.6 billion in laboratory-related enforcement actions. On September 8, it announced action involving $3.4 billion in suspected DMEPOS billing. (Centers for Medicare & Medicaid Services)
A press release is not a leaked regulation.
It would be a mistake to treat either announcement as a clandestine preview of particular CFR amendments. The communications staff preparing an enforcement announcement need not be the attorneys drafting the CRUSH rule, and common terminology can simply reflect an administration-wide program-integrity campaign.
But the opposite mistake would be to assume the announcements tell observers nothing. By the time a proposed rule has been sent to OMB, CMS is no longer brainstorming. It has selected policies, drafted regulatory language and assembled a proposed rule package for executive-branch review. At approximately the same time, senior CMS officials are deciding which fraud problems, enforcement mechanisms and success stories deserve public emphasis.
The announcements therefore can reasonably be read not as leaked provisions, but as evidence of what CMS currently considers important program-integrity problems and effective solutions.
Two Press Releases That Fit CRUSH Remarkably Well
The August 28 laboratory announcement is notable because CMS did considerably more than announce arrests or recoveries.
The agency described a technology-powered enforcement system using advanced analytics, including artificial intelligence and machine learning, to identify unusual combinations of testing, billing, documentation and relationships. High-risk patterns can cause claims to be flagged for review and, where appropriate, held, rejected or denied before Medicare money is released. CMS reported investigations involving 600 laboratories, 185 payment suspensions, 157 provider revocations and hundreds of millions of dollars in overpayments and prevented payments. (Centers for Medicare & Medicaid Services)
CMS: “CMS Prevents $1.6 Billion in Fraudulent Medicare Laboratory Payments” — August 28, 2026
This fits extremely well with one of the clearest themes of the February CRUSH RFI. CMS expressly asked how it could improve payment suspensions, medical review and other oversight; how it could gather actionable information more rapidly; and what analytics and data-driven approaches could identify fraud prospectively. (Federal Register)
The September 8 DMEPOS announcement may be even more revealing.
CMS identified 11 suppliers associated with $3.4 billion in suspected fraudulent billing. Four had already been revoked from Original Medicare and subsequently began billing Medicare Advantage plans. CMS then used the Preclusion List to prevent the companies from obtaining future MA and Part D payments. (Centers for Medicare & Medicaid Services)
That is strikingly close to a specific structural problem identified in the CRUSH RFI. CMS wrote that providers revoked from Traditional Medicare can shift billing into Medicare Advantage and asked how the Preclusion List should be strengthened to close that gap. (Federal Register)
The September enforcement announcement therefore reads almost like a real-world case study for the policy problem that CRUSH was designed to address.
The Emerging Philosophy: Stop the Money Earlier
Taken together, the two announcements reinforce a broader governing philosophy.
The objective is increasingly to stop questionable money before it leaves the government, rather than paying first and attempting recovery years later. Payment suspensions, automated claim edits, prepayment medical review, enrollment revocation and rapid administrative intervention can act long before a criminal prosecution or False Claims Act case reaches a conclusion.
CMS already possesses many of those tools. CRUSH therefore may be less about inventing an entirely new anti-fraud architecture than about making the existing architecture faster, more interconnected and easier to activate.
The February RFI itself describes existing enrollment screening, payment suspension, data analytics, automatic prepayment edits, audits, revocations and law-enforcement coordination, and asks what regulatory changes would give CMS greater authority and flexibility to deploy them more expeditiously. (Federal Register)
The recent press releases make that interpretation increasingly persuasive.
Analytics May Matter More Than “AI Regulation”
The laboratory announcement also provides a useful clue about artificial intelligence.
AI received explicit attention in the CRUSH RFI, which could lead observers to expect extensive regulations governing artificial intelligence itself. Yet the August release presents AI primarily as an instrument inside the enforcement machinery.
Algorithms identify anomalous patterns. The important governmental action comes afterward: additional review, denial, a payment hold, a site visit, revalidation, suspension or revocation.
That distinction could matter enormously to providers. CRUSH might contain relatively little operative language about machine-learning models while nevertheless producing a substantial increase in automated scrutiny. The legally consequential change would be the action CMS can take on the signal, rather than the technology producing the signal.
Laboratories and DMEPOS Are Plainly in the Spotlight
The sectors highlighted in the two releases are themselves significant.
The February RFI devoted a separate section to laboratory tests, particularly genetic and molecular diagnostics. CMS noted that genetic tests accounted for only about 5% of Medicare Part B laboratory test volume in 2024 but 43% of spending—approximately $3.6 billion. CMS asked what new authorities, analytics and program-integrity tools might be appropriate and specifically raised the experience of MolDX registration. (Federal Register)
A separate RFI section focused on fraud involving DMEPOS suppliers in Medicare Advantage. (Federal Register)
The fact that CMS subsequently chose laboratories and DMEPOS for two major fraud announcements while CRUSH is undergoing OMB review does not prove that any particular proposal survived the drafting process. But it makes it increasingly difficult to regard those sectors as incidental.
| Possible CRUSH emphasis | Current inference |
|---|---|
| Earlier intervention and prepayment safeguards | Very likely |
| Analytics connected to review, denial, suspension or enrollment action | Very likely |
| Stronger enrollment, revocation and revalidation mechanisms | Likely |
| Propagation of sanctions across Original Medicare, MA and Part D | Very likely |
| Specific DMEPOS attention | Very likely |
| Specific laboratory attention | Very likely |
| AI as a large body of standalone regulation | Less likely than AI as an enforcement tool |
| Better molecular-test identification or registration | Plausible |
| Immediate nationwide MolDX administration | Still uncertain |
| Broad identical restrictions on every laboratory | Less likely than risk-targeted controls |
The Harder Question: What Happens to Legitimate Molecular Diagnostics?
The laboratory industry's more difficult concern is not whether CMS should pursue sham laboratories. Few legitimate stakeholders would object to stopping claims for tests never performed, fake beneficiaries or nonexistent laboratory operations.
The harder question is spillover.
Advanced molecular diagnostics can possess some of the same superficial characteristics that naturally draw the attention of a fraud-detection system: relatively high payment amounts, rapid utilization growth, nationwide specimen flows, sophisticated referral relationships, repeated testing and substantial aggregate Medicare expenditures.
Consider comprehensive genomic profiling or molecular residual disease testing. Companies such as Natera and other established molecular laboratories may be furnishing medically necessary testing under well-developed clinical pathways. Nevertheless, the resulting claims can be expensive, rapidly growing and unusual when compared with conventional laboratory medicine.
Those characteristics do not indicate fraud. But they can make legitimate diagnostics conspicuous to an analytic system specifically designed to find outliers.
Indeed, CMS's own RFI acknowledges the policy tension. Immediately after describing rapid growth in genetic-testing expenditures and fraud concerns, it asks what tools and authorities would improve program integrity. The challenge is therefore not merely to increase enforcement. It is to discriminate successfully between suspicious business models and legitimate high-value medicine. (Federal Register)
Spillover Does Not Require a Dramatic New Rule
The most consequential effects on legitimate laboratories may arise from provisions that sound relatively modest in a Federal Register notice.
CMS could intensify prepayment review for selected molecular billing patterns. It could require stronger confirmation of the ordering-provider relationship. Certain laboratory profiles might trigger additional-documentation requests or enhanced enrollment scrutiny. CMS could seek clearer identification of the individual test being performed, additional registration information, or greater disclosure of marketers, referral arrangements or affiliated parties.
None of those mechanisms necessarily changes Medicare coverage for MRD or comprehensive genomic profiling.
Yet each can change how reliably and rapidly a covered test gets paid.
That distinction is commercially important. A laboratory does not need to be accused of fraud to be harmed by an anti-fraud mechanism. If a meaningful fraction of otherwise legitimate claims is diverted into prepayment review, documentation requests or payment holds, the consequences can include slower cash collection, higher administrative costs, uncertainty in revenue recognition and additional burden on ordering physicians.
Eventually, reimbursement friction can become clinical friction. Physicians may become less willing to order a test that repeatedly produces paperwork, payment delays or patient confusion.
Thus, the legitimate molecular industry's concern should not be framed only as, “Could CRUSH deny coverage for our test?”
A more useful question is:
Could CRUSH alter the operational pathway between a medically necessary test and a paid Medicare claim?
The Challenge Is Discrimination
A sophisticated program-integrity system should be capable of distinguishing very different patterns.
A high-value molecular test ordered by an oncologist for a patient with documented cancer, repeated at clinically expected intervals and billed by an established laboratory should look very different from a newly enrolled laboratory suddenly generating enormous molecular-testing volume through beneficiaries who have little or no relationship with the purported ordering physicians.
That appears to be where CMS itself wants analytics to go. In the August laboratory announcement, the agency described models that examine not simply dollar amounts but combinations of testing, billing, documentation and relationships. (Centers for Medicare & Medicaid Services)
That is more reassuring than a crude policy based merely on price or test category.
But sophisticated policies can still produce crude implementation. A carefully designed risk model may ultimately be translated into contractor edits, documentation requirements or payment holds whose boundaries are less precise than their creators intended.
For legitimate molecular laboratories, that may be the most important aspect of CRUSH to examine when the proposed rule becomes public.
Reading Signals Without Inventing Them
The recent CMS announcements therefore warrant two forms of caution at once.
The first is caution against overinterpretation. A press release is not a leaked regulation. No outside observer can reconstruct the exact CRUSH regulatory text from CMS newsroom language.
The second is caution against underinterpretation. While CRUSH is undergoing executive review, CMS has chosen to showcase the same high-risk sectors prominently identified in the RFI and to emphasize the same tools repeatedly: analytics, payment intervention, enrollment authority, prepayment controls and cross-program enforcement.
That convergence may not reveal which subsection of Title 42 CMS will amend.
It may reveal something more strategically useful: what CMS currently believes an effective program-integrity system should do.
For the legitimate molecular diagnostic industry, the resulting message is mixed. Nothing now visible suggests that CMS intends to equate sophisticated genomic testing with fraud, and risk-targeted approaches would make considerably more policy sense than indiscriminate restrictions on advanced diagnostics.
But legitimate laboratories should not conclude that a fraud regulation is therefore someone else's problem.
CRUSH can affect innovative testing without ever questioning its clinical validity or formally changing its coverage. More aggressive analytics, prepayment intervention, enrollment scrutiny or test-identification requirements could create significant operational consequences for entirely legitimate companies.
The real policy test for CRUSH will therefore not simply be whether CMS succeeds in becoming more aggressive against fraud.
It will be whether CMS can become more aggressive without making legitimate advanced diagnostics collateral damage of the fraud war.
