A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable.

(a) Screening for providers designated as limited categorical risk. When the State Medicaid agency designates a provider as a limited categorical risk, the State Medicaid agency must do all of the following:

(1) Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination.

(2) Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with §455.412.

(3) Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with §455.436.

(b) Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a “moderate” categorical risk, a State Medicaid agency must do both of the following:

(1) Perform the “limited” screening requirements described in paragraph (a) of this section.

(2) Conduct on-site visits in accordance with §455.432.

(c) Screening for providers designated as high categorical risk. When the State Medicaid agency designates a provider as a “high” categorical risk, a State Medicaid agency must do both of the following:

(1) Perform the “limited” and “moderate” screening requirements described in paragraphs (a) and (b) of this section.

(2)

(i) Conduct a criminal background check; and

(ii) Require the submission of a set of fingerprints in accordance with §455.434.

(d) Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the provider, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its—

(1) Application denied under §455.434; or

(2) Enrollment terminated under §455.416.

(e) Adjustment of risk level. The State agency must adjust the categorical risk level from “limited” or “moderate” to “high” when any of the following occurs:

(1) The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State's Medicaid program within the previous 10 years.

(2) The State Medicaid agency or CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted.