CMS Hospital Ownership: The Federal Record of Who Owns America's Hospitals

The name over a hospital's door — the saint, the city, the founding family — tells you almost nothing about who controls it. Behind that name may sit a regional health system, a for-profit chain, a real-estate investment trust collecting rent on the building, and a private-equity fund steering the whole structure through a stack of holding companies no patient ever sees. CMS now publishes the federal record of all of it: roughly 147,000 hospital ownership filings, one row per disclosed owner, each tied to a facility by its CMS enrollment and associate IDs and tagged with the owner's role, stake, and entity type — the closest thing the country has to an X-ray of who owns America's hospitals.

This article covers what the hospital all-owners file is and the ownership-disclosure rule that produces it; the schema and the role codes that distinguish a direct owner from an indirect one, a managing employee, or an officer; how the PECOS enrollment and associate IDs anchor every row and join the file to the rest of the hospital record; how to trace an opco/propco/REIT chain through the indirect-ownership records and entity-type flags; the financialization of hospital real estate and the Steward Health Care and Medical Properties Trust collapse that made it national news; how the ownership file joins to the change-of-ownership transaction records and, through an enrollment-to-CCN crosswalk, to the hospital-quality datasets to link ownership to consolidation, price, and outcomes; a Python workflow that pulls the file from data.cms.gov, counts owners per hospital, and surfaces the organizations that own multiple hospitals; and the caveats — self-reporting, indirect-ownership opacity, name normalization, and percentage gaps — that every analyst must hold in mind.

What the dataset is

The hospital all-owners file is CMS's public record of who holds an ownership or control interest in each Medicare-enrolled hospital. It is the acute-care counterpart to the post-acute ownership files: where the skilled-nursing, home-health, and hospice all-owners files map private equity and real-estate trusts in long-term care, this file maps the ownership and control of hospitals — the health systems, for-profit chains, private-equity firms, and real-estate investment trusts (REITs) that have moved into hospital ownership. The data is derived from the ownership disclosures that hospitals make to CMS when they enroll in and revalidate for Medicare, and it is published as structured, downloadable open data on data.cms.gov. The file comprises roughly 147,000 ownership records.

In our database this record is stored as the table cms_hospital_owners, with the grain of one row per owner-facility relationship: a single hospital with fifteen disclosed owners contributes fifteen rows, and a single organization that holds an interest in forty hospitals appears in forty rows. The roughly 147,000 figure is therefore a count of these owner-facility relationships, not a count of distinct hospitals (there are on the order of a few thousand of those) and not a count of distinct owners. Each row ties an owner to a hospital by the hospital's PECOS enrollment and associate IDs and records who the owner is, what kind of entity it is, what role it plays, and how large a stake it holds:

enrollment_id                -- PECOS enrollment ID for the hospital (the facility key)
associate_id                 -- PECOS associate ID for the enrolled hospital
organization_name            -- legal name of the enrolled hospital
associate_id_owner           -- stable id for the owner (org or individual)
organization_name_owner      -- owner legal name (blank for an individual)
first_name_owner / last_name_owner -- owner name when the owner is a person
type_owner                   -- whether the owner is an organization or an individual
role_text_owner              -- direct owner, indirect owner, officer, etc.
percentage_ownership         -- ownership percentage, where applicable
association_date_owner       -- date the ownership / control relationship began
-- entity-type flags (not mutually exclusive, one yes/no each):
for_profit_owner             -- for-profit entity
non_profit_owner             -- non-profit entity
holding_company_owner        -- holding company
management_services_company_owner -- management services company
private_equity_company_owner -- private equity company
reit_owner                   -- real estate investment trust

The enrollment_id and its companion associate_id are the load-bearing columns. The PECOS enrollment and associate IDs are the identifiers CMS assigns through the provider-enrollment system; for hospitals they are the keys that tie an ownership record to the same hospital's enrollment record and its change-of-ownership history. Note that this file does not carry the CMS Certification Number (CCN) — the CCN is the key used by the hospital-quality datasets, so reaching quality and cost data requires a crosswalk from the enrollment ID to the CCN, published in the hospital enrollment file. Because the PECOS identifiers appear on every hospital-level enrollment and ownership table, an ownership relationship recorded in cms_hospital_owners can be joined directly to the enrollment and transaction records of the same facility. The role_text_owner field is the substantive payload: it distinguishes a direct ownership interestfrom an indirect ownership interest held through one or more intervening entities, and both from operational or managerial control, officer and director roles, and managing-employee status. The direct-versus-indirect distinction is what turns a flat list of owners into a traceable chain, and the entity-type flags — for private equity and REIT in particular — are what turn the file from a directory into an instrument for studying who, financially, stands behind a hospital.

The ownership-disclosure rule

The legal spine of the file is the Medicare and Medicaid ownership-disclosure regime, anchored at 42 CFR 455.104. For decades this regulation has required providers that participate in Medicare and Medicaid to disclose the identity of any person or entity with a direct or indirect ownership or control interest of five percent or more, anyone with operational or managerial control, certain officers and directors, and managing employees. The disclosure has always been collected at the point of enrollment and revalidation, through the Provider Enrollment, Chain, and Ownership System (PECOS). For most of that history it sat inside PECOS as administrative plumbing — the government held it, but the public could not readily see it.

What changed in the 2020s was not the obligation to disclose but the decision to publish. As part of a broader ownership-transparency push, CMS began releasing the enrollment-derived ownership records as public, structured open data, first for skilled nursing facilities and then extending the all-owners family to the other provider types, including hospitals. The reasoning was the same across sectors: you cannot hold an owner accountable for the care delivered in a facility if you cannot identify the owner, and the layering of holding companies and related parties had made identification nearly impossible from the outside. The hospital all-owners file is the operational output of that policy applied to acute care — the PECOS ownership disclosures for hospitals, refreshed periodically and stored in our catalog as cms_hospital_owners alongside its post-acute siblings cms_snf_owners, cms_hha_owners, and cms_hospice_owners.

The schema and role codes

The all-owners files share a common shape across provider types, and that uniformity is their great analytic virtue: the same code that parses the nursing-home file parses the hospital file. The fundamental unit is not the hospital and not the owner but the relationship between them. Each row records one owner's association with one hospital, which is why the row count vastly exceeds the number of hospitals and why every metric built on the file must be explicit about whether it is counting relationships, distinct facilities, or distinct owners.

The owner identity fields capture, for an organizational owner, the legal business name and address, and for an individual owner, the person's name and address; a structural flag distinguishes the two, which matters because organizations and individuals demand completely different name-normalization strategies. The role / association code is the heart of the record, tracking the 455.104 categories — five-percent-or-greater direct ownership, five-percent-or-greater indirect ownership, operational or managerial control, officer and director status, and managing employee. The percentage-ownership field carries the numeric stake where applicable; it is frequently blank for control, officer, and managing-employee roles, and, as the caveats explain, the percentages disclosed for a single hospital often do not sum to a clean one hundred. The association date records when the ownership or control relationship began, which is what makes time-series analysis of ownership change possible when read against the change-of-ownership record.

The fields that make the file analytically interesting rather than merely administrative are the entity-type flags: a battery of yes/no indicators describing what kind of entity each owner is — for-profit, non-profit, corporation, LLC, holding company, management-services company, private-equity company, and REIT. These are not mutually exclusive: a single owner can be flagged as both an LLC and a holding company, or as both for-profit and private equity. Without these flags an analyst would have to infer financial structure from corporate names alone — to guess whether “Summit Healthcare Holdings LLC” is a regional nonprofit or a private-equity vehicle. With them, the file says so directly, subject always to the self-reporting caveat that the characterization is the provider's own.

Tracing an opco/propco/REIT chain

The single most important thing to understand about hospital ownership is that, in its most financialized corners, it is deliberately split into layers, and the all-owners file is built to let you walk them. The canonical structure is the operator / property-company split. A hospital can be divided into an operating company (the “opco”), which holds the Medicare certification, employs the clinical staff, and bills the program, and a property company (the “propco”), which owns the building and the land underneath it. The opco pays rent to the propco. When the propco is a REIT — or when the operator sells the real estate to a REIT in a sale-leaseback — the rent flows out of the operating entity to real-estate investors, and the operating company can be left thinly capitalized.

This matters because it determines where the money is and where the liability sits. The operating company is the entity that holds the license, the entity whose margins determine staffing, and the entity that fails first when the model strains. If rent and management fees pull cash out of the opco and into affiliated propco and management entities, the operating hospital can run lean — or, in distress, can be the shell that absorbs the losses while the real estate and the fees are housed safely elsewhere. The all-owners file lets you see the split: the operating entity appears as the enrolled hospital, while the property company, the management company, and the holding companies appear as owners with their respective role codes and entity-type flags.

Tracing a chain in practice means following the indirect ownership records and the holding-company and REIT flags upward. You start from a hospital's enrollment record, list its disclosed owners, and look for entities carrying indirect-ownership role codes or flagged as holding companies, management-services companies, or REITs. Each such entity is a pointer to a higher layer. The file does not always hand you a clean parent-child edge from one entity to the next — that is a real limitation — but the combination of indirect-interest role codes, holding-company and REIT flags, shared owner addresses, and repeated owner names across many hospitals lets you reconstruct the group structure with reasonable confidence. The signature of a sophisticated owner is a cluster of hospitals that share the same handful of holding-company and management-company owners, with a private-equity firm or a REIT sitting at the apex. That reconstruction is what makes related-party transactions legible — the rent paid to an affiliated propco, the fee paid to an affiliated management company — by revealing the shared ownership behind the transacting entities, which is invisible from the hospital's books alone.

REIT-financed hospital real estate and the Steward collapse

The real-estate financialization that defined the nursing-home sector reached general hospitals, and the most spectacular recent failure in American healthcare is the case study. Steward Health Care, a large for-profit hospital system, sold the real estate beneath its hospitals to Medical Properties Trust (MPT), a hospital-focused REIT, in a series of sale-leaseback deals. The transactions converted Steward's owned hospital buildings into leased ones, generating a large upfront cash infusion in exchange for long-term rent obligations — the hospital version of the opco/propco split that defines the post-acute sector. Steward kept operating the hospitals; MPT collected the rent.

The structure unwound badly. Saddled with rent and debt, Steward's operating finances deteriorated; reports surfaced of unpaid vendors, deferred maintenance, and service cuts at hospitals serving vulnerable communities, and in May 2024 Steward filed for one of the largest hospital bankruptcies in U.S. history, throwing the future of numerous community hospitals into doubt and drawing intense congressional scrutiny of both Steward and MPT. The episode became the emblematic warning about REIT-financed hospital real estate: that extracting the real-estate value from a hospital system and converting it into a rent obligation can hollow out the operating entity and put patient access at risk when the model strains. The hospital all-owners file is where these relationships are disclosed — the REIT entity flag and the ownership records are what let an analyst identify which hospitals sit inside a sale-leaseback or REIT-financed structure before, rather than during, a crisis. Read against the change-of-ownership record, the file also shows when those structures were assembled, making the assembly of the next Steward visible as it happens rather than only in the bankruptcy docket.

Consolidation, accountability, and the analytic uses

Because the file establishes ownership structure rather than judgment, its value is in mapping, counting, and joining — and it sits at the center of two of the most pressing questions in health policy: hospital consolidation and accountability for care. Several uses recur.

Identifying system and private-equity ownership is the most direct. Filtering the file to owners flagged as private-equity companies or REITs, or grouping hospitals by their common holding-company owners, produces a national picture of which hospitals sit inside financial-sponsor, real-estate-trust, or multi-hospital-system structures — by state, by chain, by ownership type. This is the foundational layer for almost every downstream question, and it is exactly what the entity-type flags were added to enable.

Cross-referencing common owners across facilitiesturns the file into a consolidation map. By normalizing owner names and addresses and grouping hospitals that share owners, an analyst can reconstruct which nominally independent hospitals are in fact controlled by the same parent — the empirical foundation for studying market concentration, since the antitrust and pricing consequences of consolidation turn on who actually controls a set of facilities, not on the names on the buildings. Because the hospital file shares its owner-identity structure with the post-acute all-owners files, the same normalization can surface owners that span sectors — a financial sponsor that holds hospitals alongside the home-health agencies and skilled-nursing facilities that feed and follow them — a continuum-of-care roll-up invisible in any single file.

Linking ownership to quality and price is the highest-value use, and the reason the data became a policy priority. Crosswalking the enrollment ID to the CMS Certification Number joins the ownership file to the hospital-quality datasets and to the hospital cost and charge data, so the ownership graph can supply the financial-structure dimension while the quality data supplies the outcomes dimension. That makes it possible to ask directly whether private-equity-owned or REIT-leased hospitals staff differently, charge differently, and perform differently than their peers — the empirical question at the center of the whole debate over the financialization of hospital care, which can only be answered when ownership and outcomes are joined on a shared facility key.

Joining to change-of-ownership and quality data

The hospital all-owners file is most valuable not in isolation but as one facet of the integrated CMS hospital record, and the PECOS enrollment and associate IDs are the join keys that make most of the integration possible. Three joins matter most.

The first is to the change-of-ownership (CHOW) record. Where the all-owners file is a snapshot of who holds an interest now, the change-of-ownership data is the transaction log — the record of when a hospital changed hands, who the seller and buyer were, and when the new owner assumed the Medicare provider agreement. Joining the two by enrollment ID converts a static ownership picture into a dynamic one: the all-owners file tells you who owns a hospital today and the CHOW record tells you how it got there, so that a private-equity firm appearing as an indirect owner can be matched to the transaction in which it acquired the facility. (The CHOW file carries both the enrollment ID and the CCN for buyer and seller, so it doubles as a bridge between the two key spaces.) Together they are the raw material for tracing the tempo and pattern of hospital M&A.

The second join is to the provider-ownership files for the other sectors — skilled nursing, home health, and hospice — which share the hospital file's owner-identity structure. Normalizing owner names and addresses across all four files, and matching on the owner's associate ID where it is present, is what surfaces the multi-sector roll-ups described above: the common owner that links a hospital to the post-acute facilities around it. Without the cross-file join, each sector's ownership looks self-contained; with it, the full footprint of a financial sponsor across the care continuum comes into view.

The third, and most consequential, join is to the hospital-quality datasets. Those datasets are keyed by the CMS Certification Number, which the all-owners file does not carry, so the join runs through the hospital enrollment file, which lists both the enrollment ID and the CCN for each facility. With that crosswalk, the ownership file links to the publicly reported measures of hospital performance — mortality, readmission, patient-safety, and patient-experience measures, along with the cost and charge data CMS publishes — so the financial-structure dimension supplied by ownership can be set against the outcomes dimension supplied by the quality record. This is the join that lets the policy question be tested empirically rather than asserted: whether the ownership structure behind a hospital is associated with how that hospital staffs, prices, and performs.

Python workflow: hospital ownership from data.cms.gov

The workhorse analysis on this file is the ownership-structure scan: count how many owners each hospital discloses, flag the private-equity and REIT owners, and surface the organizations that own more than one hospital. The script below pulls the hospital all-owners file from data.cms.gov through the data-api endpoint, normalizes the column names, counts distinct owners per hospital enrollment, flags PE and REIT ownership, and ranks the organizations associated with multiple hospitals. No API key is required for public data. Because CMS re-versions these files, the dataset UUID must be resolved from the current catalog page if a request returns a 404, and because all four provider files share the same shape, swapping the UUID points the identical code at the skilled-nursing, home-health, or hospice file.

import requests, pandas as pd

# CMS data.cms.gov -- Hospital All Owners file.
# Catalog page: https://data.cms.gov/provider-characteristics/
#               hospitals-and-other-facilities/hospital-all-owners
# No API key is required for public data.
#
# CMS publishes a parallel All Owners file for each provider type
# (hospital, SNF, home health, hospice); they share the same column
# shape, so the same code works on each -- only the dataset UUID
# changes. Resolve the current UUID from the catalog page if a request
# 404s, because CMS re-versions these files monthly.
#
# This script:
#   1. Pages the full hospital all-owners file through the data-api
#   2. Counts owners per hospital (by PECOS enrollment / associate ID)
#   3. Flags owners whose entity type marks them PE or REIT
#   4. Ranks the organizations that own multiple hospitals

DATASET_UUID = "REPLACE_WITH_CURRENT_HOSPITAL_OWNERS_UUID"
BASE = f"https://data.cms.gov/data-api/v1/dataset/{DATASET_UUID}/data"


def fetch_all(page_size=5000):
    # Walk size/offset until a short page signals the end. The hospital
    # file is on the order of 147,000 rows -- one row per owner-facility
    # pair, so a hospital with fifteen owners contributes fifteen rows.
    rows, offset = [], 0
    while True:
        r = requests.get(BASE, params={"size": page_size, "offset": offset}, timeout=120)
        r.raise_for_status()
        page = r.json()
        if not page:
            break
        rows.extend(page)
        if len(page) < page_size:
            break
        offset += page_size
    return pd.DataFrame(rows)


def pick(df, *candidates):
    # Column names drift across releases; return the first that exists.
    for c in candidates:
        if c in df.columns:
            return c
    raise KeyError(f"none of {candidates} found")


raw = fetch_all()
raw.columns = [c.strip().lower().replace(" - ", "_").replace(" ", "_") for c in raw.columns]
print(f"Raw ownership rows (owner x hospital): {len(raw):,}")

# The file keys the hospital by its PECOS enrollment / associate ID,
# NOT by the CMS Certification Number (there is no CCN column here).
hosp = pick(raw, "enrollment_id", "associate_id")
owner = pick(raw, "associate_id_owner", "organization_name_owner", "last_name_owner")
pe_flag = pick(raw, "private_equity_company_owner", "private_equity_company")
reit_flag = pick(raw, "reit_owner", "reit")


def is_yes(s):
    return s.astype(str).str.strip().str.upper().isin({"Y", "YES", "TRUE", "1"})


# --- Owners per hospital -------------------------------------------------
per_hosp = raw.groupby(hosp)[owner].nunique()
print(f"Hospitals (distinct enrollment): {raw[hosp].nunique():,}")
print(f"Median owners disclosed per hospital: {per_hosp.median():.0f}")
print(f"Most layered hospital carries: {per_hosp.max():,} disclosed owners")

# --- PE and REIT prevalence ----------------------------------------------
raw["is_pe"] = is_yes(raw[pe_flag])
raw["is_reit"] = is_yes(raw[reit_flag])
pe_hosp = raw[raw["is_pe"]][hosp].nunique()
reit_hosp = raw[raw["is_reit"]][hosp].nunique()
print(f"Hospitals with a PE owner:   {pe_hosp:,}")
print(f"Hospitals with a REIT owner: {reit_hosp:,}")

# --- Organizations owning multiple hospitals -----------------------------
named = raw[raw[owner].astype(str).str.strip().ne("")]
multi = (
    named.groupby(owner)[hosp].nunique().rename("hospitals").reset_index()
    .query("hospitals > 1").sort_values("hospitals", ascending=False)
)
flagged = raw.groupby(owner)[["is_pe", "is_reit"]].max().reset_index()
multi = multi.merge(flagged, on=owner, how="left")
print("\nOrganizations owning multiple hospitals (top 25)")
print(multi.head(25).to_string(index=False))

Two fragile steps deserve emphasis. The first is the unit of analysis: every count must be explicit about whether it is counting ownership rows, distinct hospitals (deduplicated on the enrollment ID), or distinct owners — the roughly 147,000 figure is relationships, not hospitals, and conflating the three is the most common mistake made with these files. The second is the owner-name key. Organizational owners can be aggregated on their legal name with reasonable success, but the same financial sponsor routinely appears under slightly different spellings and through differently named single-purpose holding companies, so any serious common-owner analysis needs a name-and-address normalization pass — collapsing “ABC Capital LLC,” “ABC Capital, L.L.C.,” and a shared headquarters address into one owner — before the hospital counts can be trusted. The script above does the naive grouping; production work adds the normalization layer, and, for national-scale work, the bulk file downloads from data.cms.gov are far more efficient than thousands of paginated API calls.

Limitations and analytical caveats

The hospital all-owners file is the most comprehensive public record of hospital ownership in the United States, but it carries structural limitations that an analyst must internalize before drawing conclusions from it.

The data is self-reported. The ownership records originate in what the hospital disclosed to CMS at enrollment and revalidation. An owner who wishes to obscure a relationship has incentives and, often, the structural means to do so, and CMS does not independently audit every disclosure. The entity-type flags — including the private-equity and REIT flags that make the file so useful — are likewise reported by the provider, which means a financial owner that does not characterize itself as private equity may not be flagged as such. The file is the best available view of ownership; it is not a verified ledger.

Indirect ownership is opaque. The whole point of the layered opco/propco/holding-company structure is to put distance between the named hospital and the ultimate owner, and while the file captures indirect ownership interests, it does not always provide a clean, traversable edge from each entity to its parent. Chains can break: an indirect owner may be disclosed without the intervening entity that connects it being identifiable, and the ultimate beneficial owner can remain a layer beyond what was reported. Reconstructing the full chain often requires combining the file with corporate-registry data, and even then the top of the stack can be a fund whose own investors are not public.

Name normalization governs every count. Owner names — both organizational and individual — are entered as free text and are wildly inconsistent: punctuation, abbreviations, “LLC” versus “L.L.C.,” trailing entity suffixes, misspellings, and the routine use of many distinct single-purpose entities by one sponsor all conspire to fragment a single real-world owner across many string values. Any analysis that counts hospitals per owner, or that tries to link an owner across the four provider files, lives or dies on the quality of the name-and-address normalization, and naive grouping on the raw name will systematically undercount the largest, most sophisticated owners — precisely the ones most worth measuring.

The percentage field is incomplete by design. The ownership-percentage column is blank for control, officer, and managing-employee roles; it is reported only above the five-percent disclosure threshold, so small stakes vanish; and the disclosed percentages across a single hospital frequently fail to sum to one hundred, because indirect interests are reported at the level of each layer rather than reconciled to a single cap table. Treating the percentage field as a precise cap table will mislead; it is best read as an indicator of the presence and rough magnitude of an interest rather than an exact equity split. Held with these four caveats in mind, the cms_hospital_owners table is the authoritative, openly downloadable record of who controls America's hospitals — and the only public instrument that makes the financial structures behind a hospital visible before, rather than after, they fail.