TL;DR
- The change: CMS-1828-F (final rule, published December 2, 2025) moved DMEPOS supplier accreditation from every 3 years to every year, effective with the next renewal cycle.
- Why it matters: Triennial worked as a project. Annual only works as a property of the operating system.
- Seven evidence categories must be continuously audit-ready: personnel, patient care, equipment/recall, quality program, policies, billing integrity, information security.
- The 12-month calendar: distribute compliance activities across the year so no single month spikes the workload — and so survey readiness is always month-2 not month-12.
- The automation that makes it work: document capture on creation, indexed retrieval in seconds, automated review-and-attestation workflows, and exception reporting so the compliance officer reviews — instead of chases.
The Quiet Time Bomb in the CY2026 Final Rule
On November 28, 2025, the Centers for Medicare & Medicaid Services finalized CMS-1828-F — the CY2026 Home Health PPS and DMEPOS Competitive Bidding rule. Most of the industry coverage focused, reasonably, on the return of competitive bidding, the new product categories (CGMs, insulin pumps, ostomy/urological, off-the-shelf braces), and the shift from clearing-price to 75th-percentile bid pricing.
Buried in the same rule, with less press, is the provision that touches every accredited DMEPOS supplier — competitive bidder or not. HME Business summed it up: "Accreditation has been required every third year; it now will become a yearly process."
That one sentence rewires how HME compliance has worked since the original DMEPOS accreditation requirement took effect. The accrediting organizations — ACHC, BOC, Joint Commission, CHAP, HQAA, and the others on the CMS-approved AO list — already conduct interim surveys and continuous monitoring in many cases. What's changing is the cadence of full survey events themselves. And what the cadence change actually means in operational terms is more subtle than "we do this three times as often." It means the entire posture changes.
Why "Once Every Three Years" Worked — and Why Yearly Doesn't
Under the triennial cadence, the operational pattern was predictable. Most HME providers ran a project. The compliance officer started the heavy lift roughly six months out from the survey window. The team back-filled documentation, refreshed the P&P manual, sat through training, gathered six months of metrics, ran a mock survey. The survey happened. The team passed. Then everyone went back to operating without much active compliance overhead until year three came back around.
That cadence worked because the math worked. If you spent eight weeks of intense effort once every 156 weeks, your average compliance overhead was about 5%. Manageable as a project budget.
Annual changes the math. Eight weeks of intense effort once every 52 weeks is 15% of the year — and the same team that's running operations is suddenly in survey-prep mode three times more often. Most HME organizations cannot absorb that cadence with the project model. Something has to give, and what usually gives is the quality of the documentation in years 2 and 3 of the old cycle — which, under the new rule, simply doesn't exist.
The fix is to stop running compliance as a project. The fix is to build continuous-compliance into the operating system, so that documentation generation is a side effect of normal operations and survey readiness is a property of the platform — not the output of a six-month sprint.
The Seven Evidence Categories That Must Be Continuously Audit-Ready
Every CMS-approved accrediting organization samples from the same seven evidence categories. The specific standards vary modestly between AOs, but the categories don't. Under annual cadence, all seven need to be retrievable in audit-ready form on demand — not after a 60-day scramble.
| Category | What surveyors sample | The continuous-compliance signature |
|---|---|---|
| 1. Personnel files | License verification, competency assessment, in-service training, background checks, immunization records | Documents captured at hire and on every renewal cycle, indexed by employee ID |
| 2. Patient care records | Orders, prior auth, eligibility verification, proof of delivery, follow-up, complaints, patient education | Each patient encounter generates required evidence as a workflow byproduct |
| 3. Equipment maintenance & recall | PM logs, calibration, FDA recall responses, repair records, sanitization documentation | Asset records keyed by serial number, time-stamped logs, automated FDA recall feed monitoring |
| 4. Quality program | Incident reports, performance improvement projects, satisfaction surveys, outcome metrics, complaint resolution | Reports filed in real time, PI projects tracked with start/end dates, surveys auto-distributed post-encounter |
| 5. Operational policies | P&P manual current, last review date documented, attestation of staff acknowledgment | Versioned policy library with automated annual-review workflow and staff sign-off capture |
| 6. Billing integrity | Claim audits, denials by category, compliance officer reviews, kickback policy attestations | Denial categorization automated, monthly internal audit sample auto-generated, compliance review logged |
| 7. Information security | HIPAA Security Rule risk analysis, workforce training logs, breach response documentation, encryption attestations | Annual risk analysis on a fixed cycle, training delivery tracked, incident log with auto-classification |
The retrievability test: A surveyor asks you to produce all in-service training records for a specific employee for the last 12 months. Continuous-compliance answer: 45 seconds, from a single repository, with timestamps. Project-model answer: "Let me get back to you tomorrow" — followed by an internal scramble across email, shared drives, an LMS, and a paper file in HR. Same documents. Wildly different audit experiences.
The Continuous-Compliance Stack: What's Different About the Architecture
Continuous-compliance isn't a single tool. It's a thin layer of architecture choices applied across the operating stack you already have. Three components matter most.
Component 1: Document capture on creation, not retrospectively
The single highest-leverage move is to capture compliance evidence at the moment of creation, not three months after the fact. Proof of delivery scans? Captured at the driver's tablet, time-stamped, geo-tagged, written to the patient record automatically. In-service training? The LMS records completion and writes to the personnel file automatically. P&P review? The review workflow timestamps the reviewer, the version, and the next review date as a database record — not a Word doc in a shared folder.
This is the difference between compliance as a property of the operating system and compliance as a forensics project. Build it once. It pays back forever.
Component 2: Indexed retrieval in seconds
A document captured but not retrievable is a document that doesn't exist for audit purposes. The continuous-compliance stack indexes every captured artifact by the dimensions surveyors actually sample on: employee, patient, date, document type, policy version, equipment serial, payer. When the surveyor says "show me all the PODs for patients delivered between March 1 and March 15 in the Sugar Land branch," the answer is a filter, not a project.
Component 3: Automated review-and-attestation workflows
Many compliance failures aren't documentation gaps — they're attestation gaps. The P&P was reviewed but no one signed off. The training was delivered but no acknowledgment was captured. The risk analysis was performed but the medical director never countersigned. Automated workflows close the attestation gap by treating the sign-off as a required step in the workflow, not an afterthought. Reviews don't complete until attested. Attestations write to the audit log automatically. The compliance officer's job shifts from chasing signatures to reviewing exception reports.
The 12-Month Calendar That Beats Cramming
Under continuous-compliance, compliance work isn't concentrated in the six months before survey. It's distributed across all twelve months — so no single month spikes the workload, and survey readiness is always month-2 not month-12.
| Month | Recurring compliance activity |
|---|---|
| January | Annual HIPAA Security Rule risk analysis kickoff; OIG compliance plan refresh |
| February | P&P quarterly review batch 1 (1 of 4 categories per quarter) |
| March | Internal billing audit Q1; denial-trend analysis |
| April | Mock survey self-assessment (lightweight, sampling-based) |
| May | P&P quarterly review batch 2; staff competency refresh round 1 |
| June | Equipment PM cycle audit; FDA recall log review |
| July | Internal billing audit Q2; patient satisfaction survey aggregate review |
| August | P&P quarterly review batch 3; in-service training plan refresh |
| September | HIPAA training cycle; cybersecurity tabletop exercise |
| October | Internal billing audit Q3; complaint trend review |
| November | P&P quarterly review batch 4; annual quality program review |
| December | Year-end documentation reconciliation; year-ahead calendar approval |
Notice what this calendar doesn't have: a single month where the team has to perform six months of compliance work. That's the point. Annual accreditation under the project model demands the spike. Annual accreditation under continuous-compliance demands the rhythm.
Related reading: HIPAA-Compliant Automation for DME Providers | 2026 HIPAA Security Rule MSP Checklist for HME | DME Documentation Accuracy & Improper Payments
The Cybersecurity Subplot: Why Information Security Is the Hardest Category to Fake
Of the seven evidence categories, information security is the one most likely to fail an annual sample and the one most likely to surface as a finding even when other categories are clean. The reasons are structural: HIPAA Security Rule requires a documented annual risk analysis. Most HME providers conduct one before each triennial survey and then don't update it for three years. Under annual cadence, the risk analysis itself has to be current — and the workforce training logs, breach response records, and encryption attestations all have to align with the risk analysis findings.
This is the place where good cybersecurity infrastructure earns its keep on the compliance side. Endpoint protection that logs continuously, email security with retained quarantine records, backup with verified restore tests, MDM with device attestation — every one of these produces audit evidence as a byproduct. When the surveyor asks for evidence of access controls, the answer is the Microsoft 365 audit log, not a screenshot taken yesterday.
How SynergyIQ Builds Continuous-Compliance Into HME Operations
SynergyIQ builds the document-management and workflow-automation layer that turns accreditation evidence into a side effect of normal operations. The work splits into four buckets.
Document capture automation: personnel files indexed at hire, license-expiration tracking with automated renewal triggers, proof-of-delivery capture from driver tablets with geo and timestamp, training completion records auto-written from LMS to personnel file. Policy workflow: versioned P&P library with automated annual review cycles, staff acknowledgment capture, attestation logging. Quality program automation: incident report intake with auto-classification, post-encounter satisfaction surveys, complaint-resolution timer with escalation. Information security: annual HIPAA risk analysis workflow, workforce training delivery and tracking, encryption attestation, breach response runbook with logged drills. All four buckets feed a single audit-ready repository with role-based access and CMS-compliant retention policies — the kind of architecture covered in our broader healthcare IT and managed IT practice.
The Real Question Worth Asking
Not "are we ready for our next survey?" — every HME team has rehearsed that one. The real question is: "If a surveyor walked in this Friday, how many hours of internal scramble would happen before they could ask their second question?" Triennial got away with a high answer. Annual doesn't. The providers who handle this well in 2026 will be the ones who stopped treating compliance as a project — and started treating it as a property of the system.
Frequently Asked Questions
What did the CY2026 DMEPOS final rule actually change about accreditation?
CMS-1828-F, published in the Federal Register on December 2, 2025, converted DMEPOS supplier accreditation from a triennial requirement (every 3 years) to an annual requirement (every year). The same rule revived the Competitive Bidding Program with contracts effective no later than January 1, 2028, changed how winning bids are calculated (clearing price → 75th percentile of winning bids), and added new product categories (CGMs, insulin pumps, ostomy/urological supplies, off-the-shelf braces). The annual-accreditation provision touches every accredited supplier — regardless of CBP participation.
Why is annual accreditation a workflow problem and not just a calendar problem?
Triennial worked as a project — heavy lift before survey, then back to normal. Annual requires a continuous-compliance posture: documentation generated as a byproduct of normal operations, captured automatically, indexed for retrieval, and audit-ready at any moment. The workflow change is from project-mode (intermittent heavy lift) to operations-mode (low-grade continuous effort) — and most HME platforms and document systems are not built for the second mode.
What documentation categories must an HME provider maintain in audit-ready form continuously?
Seven: (1) personnel files (licenses, competencies, training, background); (2) patient care records (orders, prior auth, eligibility, POD, follow-up, complaints); (3) equipment maintenance and recall (PM, calibration, FDA recalls); (4) quality program (incidents, PIPs, surveys, outcomes); (5) operational policies (P&P current, review dates, staff attestation); (6) billing integrity (audits, denial categorization, compliance review); (7) information security (HIPAA Security Rule risk analysis, training, breach response).
What is the difference between continuous-compliance and the triennial project model?
Triennial: documentation generated through manual effort, often retrospectively, in the 90 days before survey. Continuous: documentation generated automatically as a byproduct of normal operations, indexed and retrievable in seconds. Triennial: survey prep is a project owned by the compliance officer. Continuous: survey readiness is a property of the operating system. Triennial: cost is high but lumpy. Continuous: cost is lower, predictable, and produces side benefits — faster audits, lower denial rates, better staff onboarding.
How does SynergyIQ help HME providers build continuous-compliance into their operations?
We build the document-management and workflow-automation layer that turns accreditation evidence into a side effect of normal operations: automated personnel-file capture at hire and renewal, proof-of-delivery and follow-up documentation tied to each patient encounter, policy review workflows with timestamped attestations, HIPAA Security Rule risk analysis automation, and a single audit-ready repository with role-based access and retention policies. The compliance officer's job shifts from chasing documents to reviewing exception reports.
Want a Real Read on Your Annual Accreditation Readiness?
SynergyIQ runs a free 30-minute continuous-compliance assessment: we walk the seven evidence categories with you and quantify how many hours of scramble would happen if a surveyor showed up Friday. No commitment.
Book Your Free Compliance Assessment →