The Medicare DMEPOS surety bond is one of the few obligations in the federal enrollment universe that operates as a true condition precedent: no bond on file, no billing privileges. This guide explains where the requirement came from, precisely what 42 CFR § 424.57(d) demands, how the bond behaves as a credit instrument, and what suppliers and their counsel should understand before signing an indemnity agreement.
Where the Requirement Comes From
The statutory root is the Balanced Budget Act of 1997, which amended section 1834(a)(16)(B) of the Social Security Act to require that suppliers of durable medical equipment, prosthetics, orthotics and supplies furnish the Secretary a surety bond "in a form specified by the Secretary" in an amount of not less than $50,000. Congress's purpose was unambiguous: the DMEPOS benefit had become a fraud magnet, with sham storefronts enrolling, billing aggressively, and dissolving before the government could recover a dollar of the resulting overpayments. A surety bond converts that recovery problem into someone else's balance sheet — a licensed surety's.
Implementation took more than a decade. The Centers for Medicare & Medicaid Services published its final rule on January 2, 2009 (74 Fed. Reg. 166), codifying the requirement at 42 CFR § 424.57(d). Newly enrolling suppliers were required to have bonds in place by May 4, 2009; suppliers already enrolled were given until October 2, 2009. Since those dates, the bond has been a standing condition of DMEPOS enrollment, verified at initial enrollment, revalidation, reactivation, and change of ownership.
The Three Parties and What Each One Promises
Like every surety instrument, the DMEPOS bond is a three-party contract, and confusion about the roles is the single most common misunderstanding we correct for new applicants.
Principal — the DMEPOS supplier. The bond is written in the exact legal name under which the supplier enrolls, and it guarantees the supplier's obligations, not the surety's generosity. Obligee — CMS, the protected party, with the requirement administered through the National Supplier Clearinghouse and the National Provider Enrollment contractors that process DMEPOS applications. Surety — the underwriter that stands behind the supplier's Medicare obligations with its own capital and must be listed on the U.S. Department of the Treasury's Circular 570 of federally acceptable sureties.
The critical point for a supplier's principals: the bond is not insurance that protects the supplier. It protects the government. When the surety pays CMS on a valid claim, it turns immediately to the supplier and every individual who signed the indemnity agreement for full reimbursement, with interest and costs. A DMEPOS bond is best understood as an unsecured line of credit extended to the supplier for the government's benefit — which is exactly why underwriting looks at owner credit and financial statements rather than equipment inventories.
What the Bond Must Say — and What It Pays
Section 424.57(d) does not permit freelance drafting. The bond must be issued on terms that guarantee payment to CMS of unpaid amounts owed by the supplier, and the regulation specifies the categories of recoverable loss: unpaid claims (overpayments) determined against the supplier, unpaid civil money penalties, and unpaid assessments, together with accrued interest, arising from the supplier's Medicare activity during the term of the bond. The instrument functions on demand — upon CMS's written notice to the surety of an unpaid final obligation, the surety pays up to the penal sum within the short window the bond prescribes, and litigation over the underlying merits is not a precondition to payment.
The penal sum is the ceiling of the surety's liability, and the base is $50,000 for each National Provider Identifier for which billing privileges are sought or maintained. Multi-location suppliers stack the requirement — a mechanic significant enough that we treat it in a dedicated guide. Where a supplier's record includes overpayment or sanction history, CMS may direct an elevated penal sum above the base, imposed in $50,000 increments commensurate with the demonstrated risk.
Continuity: The Requirement Never Sleeps
The bond is a continuous obligation. It must be effective on the date billing privileges are granted and must remain unbroken for as long as the supplier participates in the program. Three consequences follow from continuity, and each of them generates the emergency calls we receive every month.
First, cancellation has teeth. A surety that intends to cancel must give advance written notice to CMS as well as to the supplier — typically thirty days — and the supplier must have replacement coverage on file before the cancellation takes effect. There is no grace period on the government's side of the ledger. An uncured lapse is treated as a failure to meet supplier standards and results in revocation of Medicare billing privileges.
Second, liability has a tail. The surety remains answerable for obligations that arose during the term of the bond even if CMS's demand arrives after cancellation or expiration. Overpayment determinations frequently trail the conduct that produced them by a year or more; the bond that was on the risk when the claims were submitted is the bond that answers. Suppliers switching sureties should understand that changing providers does not launder history — it simply changes which surety holds the tail.
Third, corporate events reset the paper. A change of ownership, a new legal entity, a conversion from sole proprietorship to LLC — each of these generally requires the bond to be reissued or ridered so that the principal's name on the bond matches the enrollment record exactly. Mismatched names are among the most common causes of enrollment development requests, and they are entirely avoidable.
How the Bond Is Underwritten
Because the DMEPOS bond guarantees payment of money rather than performance of work, it is underwritten as commercial surety credit. The core file is short: the application, a personal financial statement from each owner of ten percent or more, a current business financial statement, the supplier's most recent fiscal year Medicare billed amount, the NSC PTAN and accreditation details, and the schedule of NPIs the bond must cover. Owner credit drives the standard rate; business financial strength and Medicare history move it in either direction.
Adverse history — prior overpayments, an NSC denial, a revocation, a bankruptcy, a prior bond claim — does not end the conversation at this shop. It changes the structure of the offer. Non-standard placements may carry a modified rate, a funded collateral component, or additional indemnity, but they produce a CMS-acceptable bond that keeps the supplier billing. Our operating philosophy is the same one Surety One, Inc. has applied for three decades: we decline no application; we offer terms that fit the applicant in front of us.
The Compliance Checklist, in Prose
A supplier that wants to stay permanently out of bond trouble needs to do exactly five things: keep the bond continuously in force with a Treasury-listed surety; keep the principal's name on the bond identical to the enrolled legal business name; keep the NPI schedule current as locations open, close, or change; respond to any elevated-bond directive by sending the directive itself to a surety equipped to underwrite it rather than shopping it as a commodity; and treat any cancellation notice from a surety as a same-week emergency rather than a renewal-season chore. Suppliers that do those five things never think about this obligation again. Suppliers that miss one of them meet the revocation process, and re-enrollment after revocation is a far more expensive education than any premium we have ever quoted.
Authorities: Social Security Act § 1834(a)(16)(B); Balanced Budget Act of 1997; 74 Fed. Reg. 166 (Jan. 2, 2009); 42 CFR § 424.57(c)–(d); U.S. Dept. of the Treasury Circular 570. This page is practitioner commentary by a surety underwriter, not legal advice; enrollment counsel should be consulted on entity-specific questions.