How to Use This Checklist
Click each item to mark it complete. Your progress is saved automatically in your browser. Use the Print button to generate a clean paper version with empty checkboxes for manual review.
Exterior signage displays the full legal business name, clearly visible from the street, hallway, or building entrance
Hours of operation are posted and visible from outside the entrance (include lunch breaks if facility closes)
Physical address matches exactly what is on file with CMS/PECOS (including suite/unit number)
Facility is ADA accessible — entrance, pathways, and showroom/fitting areas are accessible to patients with disabilities
Reception/front desk area is clean, professional, and staffed during operating hours
Business telephone number on signage/listings matches the number in PECOS enrollment records
If in a shared/co-located space: business has its own distinct entrance, signage, and clearly separated operational area
Instant Fail
If the inspector arrives and finds no signage, no posted hours, or the location appears non-operational, this is grounds for immediate denial — no second visit will be attempted.
Facility is open and staffed minimum 30 hours/week during normal business hours (Supplier Standard 30)
At least one qualified employee present at all times during posted hours who can speak to business operations
Designated site visit liaison identified and trained — this person can locate all documents and answer inspector questions
Staff can articulate the business purpose: what DME products are supplied, how orders are received, and how delivery works
Backup staffing plan exists for sick days, vacations, and emergencies — facility is never left unstaffed during posted hours
Phone lines answered live during business hours (no answering machine during open hours); after-hours voicemail is acceptable
Inspector Tactic: Staff Interviews
Inspectors often ask front-line staff questions like "What does this company do?" and "How do patients get their equipment?" — if staff cannot answer coherently, this raises a red flag about operational legitimacy.
State business license — current, not expired, and available for review
State DME-specific license/permit (if required by your state) — current and valid
City/county business permits or occupational licenses (if applicable to your jurisdiction)
FDA registration (if required for items sold — e.g., certain Class II/III medical devices)
NPI validation: National Provider Identifier is active and information matches current enrollment data
PECOS enrollment record is current, accurate, and all information matches what is on-site
Accreditation certificate from CMS-approved accrediting organization (ACHC, The Compliance Team, BOC, etc.) — current, displayed, and not expired
Articles of Incorporation / LLC documents and any DBA filings — available for review
General liability insurance policy — current, with minimum coverage meeting state and Supplier Standard 10 requirements
Product liability insurance — current and covering all DME product categories you supply
Surety bond ($50,000 minimum) — Supplier Standard 26 — current, not expired, with bond company information readily available
Workers' compensation insurance (if required by your state and you have employees)
Professional/errors & omissions insurance (if applicable to your service model)
Tip: Insurance Binder
Keep printed copies of all Certificates of Insurance (COIs) together in your site visit binder. If your policy renewed recently, make sure the new certificate is on file — an expired COI is treated the same as no insurance.
Written complaint policy and procedure — documented process for receiving, investigating, and resolving patient complaints (Supplier Standard 12)
Complaint log — maintained with dates, descriptions, resolutions, and response timelines; readily accessible for review
HIPAA Privacy Policy — written policy describing how PHI is collected, used, stored, and disclosed; Notice of Privacy Practices available
HIPAA Security Policy — safeguards for electronic PHI (ePHI) including access controls, encryption, audit trails, and breach protocols
Business Associate Agreements (BAAs) — executed with all third parties who handle PHI (billing companies, software vendors, shredding services)
Patient rights documentation — includes right to choose supplier, right to information about equipment, and right to file complaints
Written delivery/shipping procedures — documenting how products are delivered, including timelines, patient signatures, and proof of delivery
Product recall procedures — written process for handling FDA recalls, patient notification, and product retrieval
Employee training records — documentation showing staff training on compliance, HIPAA, product knowledge, and safety
Quality assurance/performance improvement program — written plan with measurable objectives and regular review schedule
Physical inventory on-site — products matching the categories and HCPCS codes you are enrolled to bill for
Inventory tracking system — documented method for tracking incoming stock, outgoing deliveries, serial numbers, and lot numbers
Proper product storage — DME stored in clean, organized, temperature-controlled (if required) environment away from hazards
Product catalogs/brochures — manufacturer documentation for all items supplied, including specifications and instructions
Warranty information — warranty terms for each product category, including repair/replacement processes (Supplier Standard 11)
Delivery records — signed proof of delivery (POD) documents for recent shipments, including patient signatures and dates
Product sourcing documentation — invoices or purchase orders showing products obtained from legitimate, licensed manufacturers/distributors
Inventory Must Match Billing
Inspectors will cross-reference your physical inventory against the product categories in your Medicare enrollment. If you bill for wheelchairs but have none on-site, this is a serious discrepancy.
Physician prescriptions/orders on file — written orders for DME with physician signature, NPI, diagnosis, and medical necessity
Certificates of Medical Necessity (CMNs) — completed and current for all applicable items (oxygen, hospital beds, etc.)
Prior authorization documentation — evidence of prior auth approvals where required before dispensing
ABN (Advance Beneficiary Notice) forms — properly executed for non-covered or potentially non-covered items
Patient intake/assessment documentation — records showing patient evaluation, equipment fitting, and education provided
Rental/purchase agreement templates — standardized contracts patients sign, including terms, rental conversion info, and return policies
Billing records — clean, organized billing history showing HCPCS codes, dates of service, and claim submissions matching patient records
Active telephone line — working phone number that is answered during business hours (may be tested by inspector calling from outside)
Business website (if listed in enrollment) — functioning, accurate, and matching enrollment information
Utility bills/lease agreement — proof that the business legitimately occupies the space (lease, utility bills in company name)
Bank account documentation — business bank statements or voided check showing company name matches enrollment
Equipment maintenance/cleaning records — documentation of routine maintenance, sanitization, and safety checks for rental equipment
Delivery vehicle documentation (if applicable) — vehicle registration, insurance, and maintenance logs for delivery vehicles
Critical: 2026 Changes Now in Effect
As of January 1, 2026, CMS has significantly tightened DME supplier oversight. The following items reflect new requirements under the updated regulations.
Annual reaccreditation readiness — accreditation cycle is now 12 months (down from 36); confirm your next reaccreditation date and prepare accordingly
Unannounced survey preparedness — 25% of all surveys are now unannounced (up from 10%); site must be inspection-ready at ALL times
Ownership change compliance — any change of majority ownership requires re-survey, re-accreditation, and re-enrollment as a new supplier within 36 months
Accrediting Organization (AO) notification — ownership changes must be reported to your AO within 30 calendar days
Updated compliance training — staff training materials updated to reflect 2026 CMS regulatory changes and new accreditation timelines
Checklist Complete
If you've checked every item above, your facility is well-prepared for a CMS site visit. Continue to Part Two below for the detailed Preparation Guide, including what happens during the visit, staff preparation tips, and the recommended document binder structure.
1. Understanding the Site Visit
Who Conducts Site Visits?
Site visits are conducted by the National Site Visit Contractor (NSVC) on behalf of CMS, or by your accrediting organization (AO) such as ACHC, The Compliance Team, BOC, or AAHomecare. The inspector will carry a photo ID badge and a signed authorization letter on CMS or AO letterhead.
When Do They Happen?
- Initial enrollment — within 60 days of application submission
- Revalidation — now annually as of 2026 (previously every 3 years)
- Adding a new practice location
- Reactivation after deactivation or revocation
- Change of information filings (address, ownership, etc.)
- Random compliance surveys — at CMS's discretion
How Are You Notified?
A pre-visit notification letter is sent to your contact person on file. However, this letter does NOT specify the exact date or time. The visit itself is unannounced — the inspector will arrive without scheduling. This means your facility must be visit-ready at all times.
Two-Attempt Rule
The inspector will attempt up to two visits. However, if the first visit reveals that the location is clearly non-operational (under construction, no signage, locked with no staff), CMS may deny enrollment without a second attempt.
2. What Happens During the Visit — Step by Step
- Arrival & Identification — Inspector arrives unannounced during posted business hours. They present photo ID and CMS/AO authorization letter. Verify their credentials before granting access.
- Exterior Assessment — Inspector photographs the building exterior, signage, posted hours, and accessibility features before entering.
- Interior Walkthrough — Inspector tours the facility examining the reception area, inventory storage, office spaces, and patient areas. They photograph each area.
- Document Review — Inspector requests specific documents from the checklist above. They may photocopy or photograph key records. Have your binder ready (see Section 4).
- Staff Interviews — Inspector asks employees about business operations, their roles, and how the DME supply process works. Staff should answer honestly and confidently.
- Inventory Verification — Inspector compares physical inventory against your enrollment categories. They may ask about product sources, storage conditions, and lot tracking.
- Phone Test — Inspector may call your posted phone number from outside to verify it is answered live during business hours.
- Exit Discussion — Inspector summarizes findings and may note deficiencies. They will NOT give a pass/fail determination on-site. Results come through CMS or your AO.
Average Visit Duration
Most site visits take 45 minutes to 2 hours depending on facility size and document readiness. Having an organized binder can cut the document review portion significantly.
3. Staff Preparation & Interview Readiness
Designate a Site Visit Liaison
Choose one person (with a backup) who will be the primary point of contact when an inspector arrives. This person should:
- Know the location of every document in the compliance binder
- Understand all company policies and procedures
- Be authorized to provide access to all areas of the facility
- Remain calm, professional, and cooperative
Common Interview Questions Inspectors Ask
Prepare ALL staff to answer these questions confidently:
- "What does this company do?"
- "What is your role here?"
- "How does a patient get their DME from you? Walk me through the process."
- "Who is the owner of this business?"
- "How do you handle patient complaints?"
- "Where do you source your products?"
- "How do you verify insurance coverage before providing equipment?"
- "What do you do if a patient's equipment breaks?"
Staff Interview Do's and Don'ts
- DO: Answer honestly, directly, and calmly
- DO: Say "I don't know, but let me find out" if unsure — never guess
- DO: Refer complex questions to the designated liaison
- DON'T: Volunteer information not asked for
- DON'T: Be combative, argumentative, or dismissive
- DON'T: Leave the facility or avoid the inspector
4. Document Binder Organization
Prepare a dedicated compliance binder (physical and digital) organized with the following tab structure. Having this ready dramatically speeds up the inspection and demonstrates operational maturity.
| Tab |
Contents |
Notes |
| 1 |
Business licenses & permits |
State, city/county, DME-specific |
| 2 |
Accreditation certificate |
Current, with expiration date visible |
| 3 |
Insurance & bonding |
All COIs, surety bond, workers' comp |
| 4 |
NPI & PECOS documentation |
NPI confirmation, PECOS printout |
| 5 |
Corporate documents |
Articles of incorporation, LLC docs, DBA |
| 6 |
HIPAA policies |
Privacy, security, BAAs, breach protocol |
| 7 |
Operational policies |
Complaints, delivery, returns, recalls, quality |
| 8 |
Patient rights & forms |
Rights notice, ABNs, rental agreements, intake forms |
| 9 |
Employee records |
Training logs, certifications, org chart |
| 10 |
Product & inventory |
Catalogs, warranties, sourcing invoices, tracking logs |
Pro Tip: Mirror Digital and Physical
Maintain both a physical binder and a digital copy (organized identically) on a tablet or laptop. If the inspector asks for something not in the physical binder, you can quickly access the digital version.
5. Top 10 Reasons Site Visits Fail
- Nobody on-site during posted hours — The #1 failure cause. If no one is there when the inspector arrives, it may result in immediate denial.
- No visible signage or posted hours — Signage must be visible from the approach path, and hours must be clearly posted.
- Expired or missing licenses/insurance — All licenses, insurance COIs, and surety bonds must be current — not "being renewed."
- No physical inventory — A DME supplier with zero product on-site raises immediate legitimacy concerns.
- Staff cannot describe business operations — If employees don't know what the company does, it signals a shell operation.
- Missing complaint log — Even if you've received zero complaints, you need a log with a header and your written policy.
- PECOS information doesn't match — Address, phone number, or business name discrepancies between on-site reality and enrollment records.
- No HIPAA policies — Written privacy and security policies are mandatory. Verbal assurances are not sufficient.
- Location appears non-operational — Under construction, empty office, or "virtual office" appearance.
- Refusing or obstructing the inspection — Asking the inspector to come back later, denying access to areas, or refusing to provide documents.
The #1 Failure: Nobody Home
More site visits fail because no one was present than for any other reason. If your posted hours say 9 AM – 5 PM, someone must be physically present every minute of those hours, including when the inspector arrives unannounced.
6. Emergency Quick-Fix Checklist
If you just received a pre-visit notification letter and need to prepare urgently, prioritize these actions in order:
- Verify signage and posted hours — walk outside and confirm everything is visible and accurate. Fix immediately if not.
- Confirm staffing coverage — ensure someone will be on-site during every posted hour for the foreseeable future. No exceptions.
- Assemble the document binder — use the Tab structure in Section 4. Print every document. Check all expiration dates.
- Verify PECOS accuracy — log into PECOS and confirm address, phone, authorized official, and all other data matches reality.
- Check insurance and bond expiration dates — if anything expires within 60 days, contact your agent immediately for renewal.
- Count and organize inventory — ensure physical products on-site match your enrollment categories.
- Brief all staff — conduct a 15-minute meeting covering: what a site visit is, what inspectors ask, and how to respond.
- Test your phone line — call your posted number from a cell phone to verify it's answered live during business hours.
- Review complaint log — ensure it exists, is formatted properly, and includes your written complaint policy.
- Do a walkthrough — walk through the facility as if you were an inspector. Note anything that looks unprofessional, disorganized, or non-compliant.
7. Post-Visit Actions
Immediately After the Inspector Leaves
- Document everything discussed — write down questions asked, documents reviewed, and any concerns noted
- Note the inspector's name, badge number, and the authorization letter details
- Photograph the current state of the facility (in case of disputes)
- Debrief with all staff who interacted with the inspector
If Deficiencies Are Identified
- You will receive a formal notification through CMS or your AO
- Most deficiencies have a corrective action period (typically 30-60 days)
- Address every deficiency completely — partial fixes may not be accepted
- Document all corrective actions with dates, evidence, and responsible parties
- Submit corrective action response before the deadline
Ongoing Readiness
- Conduct monthly self-audits using this checklist
- Update the document binder whenever anything changes (license renewal, new insurance, etc.)
- Schedule quarterly staff refresher training on site visit readiness
- Review PECOS enrollment data quarterly for accuracy
- Keep a "site visit ready" calendar with all expiration dates for licenses, insurance, bonds, and accreditation
Review Verification
This checklist has been reviewed and all items verified by: