"If you still have the previous [certification] number, you are still liable for it," Nemzoff said. "If Medicare comes back and says you owe me $25 million because of fraud, you have to pay it."
St. Joseph, when owned by Catholic Health, previously paid the federal government $22 million to settle allegations of a kickback scheme involving the cardiology practice where Midei once worked and to repay Medicare payments received for stents he implanted.
Last week, Catholic Health agreed to pay the federal government $4.9 million for overbilling the Medicaid and Medicare systems by unnecessary hospital stays from 2007 to 2009.
It is unclear when St. Joseph could receive certification, but the hospital said it is cooperating with federal officials.
"We understand CMS needs to follow these processes to issue a new provider number and we are fully committed to following their process, which we anticipate we will be completed in the near future," University of Maryland officials said in a statement.
Nemzoff said the University of Maryland is a large and competent system, and he expects the hospital will eventually get certification.
"I would assume they knew the risk [of new certification] when they took over the hospital," he said.