Looks like both ways are fine, as long as you stay consistent:
http://www.quickanddirtytips.com/education/grammar/apostrophe-catastrophe-part-two

@jnn41wms, the press releases from the Centers for Medicare and Medicaid Services usually add 's to their acronym's possessive form. However, in some other cases, I've seen how they simply add the apostrophe. The text below was extracted from their press release published on 07/27/2015, Clarifying Questions and Answers Related to the July 6, 2015 CMS/AMA Joint Announcement and Guidance Regarding ICD-10 Flexibilities:

"No. As stated in the CMS’ Guidance, for 12 months after ICD-10 implementation, Medicare
review contractors will not deny physician or other practitioner claims billed under the Part B
physician fee schedule through either automated medical review..."