Recredentialing and revalidation: staying credentialed with Medicare, Medicaid and insurers
Getting credentialed is not a one-time job. Private insurers re-credential you about every 3 years. Medicare revalidates your enrollment every 5 years, and state Medicaid programs at least every 5 years. Your CAQH profile, which insurers rely on throughout, must be re-attested every 120 days. Miss one and you can lose your network status or Medicare billing privileges. With Medicare, you can't bill for the gap.
- Re-attest CAQH every 120 days (180 in Illinois)
- Check your Medicare revalidation due date and file in PECOS on time
- Revalidate with your state's Medicaid program when it asks
- Answer each insurer's re-credentialing requests promptly
- Report changes and upload renewed documents between cycles
The renewal schedule at a glance
| What | How often | Who starts it | If you miss it |
|---|---|---|---|
| CAQH re-attestation | Every 120 days (180 in Illinois) | You. CAQH emails a reminder | Insurers treat your profile as out of date, so applications and re-credentialing stall |
| Commercial re-credentialing | About every 36 months | The insurer | You can be removed from the network, and rejoining may mean a closed panel |
| Medicare revalidation | Every 5 years | CMS posts a due date. Your MAC sends a notice | Billing privileges deactivated, and no payment for the gap |
| Medicaid revalidation | At least every 5 years, sooner in some states | Your state Medicaid program | Claims denied or payments suspended, and enrollment can be terminated |
| License, DEA, malpractice | License by state cycle, DEA every 3 years, malpractice usually yearly | You | Expired documents fail verification and can end your participation |
Medicare revalidation
Every Medicare-enrolled provider and group revalidates every 5 years. CMS can also ask you to revalidate off-cycle.
Find your due date
CMS publishes revalidation due dates in its public Revalidation Lookup Tool on data.cms.gov. Search by your name or NPI. If the due date says "TBD", you're not due yet, and an application sent now will be returned as unsolicited. Your Medicare Administrative Contractor (MAC) usually mails or emails a notice about 2 to 3 months before the due date. Don't rely on the notice alone: if you're within 2 months of your listed date and haven't heard anything, file anyway.
File it in PECOS
Revalidate online in PECOS. Most MACs accept a revalidation within about six months before the due date, so check your MAC's window. Treat it like a fresh application:
- Confirm every practice location, and that each matches NPPES.
- Check reassignments to your group, ownership and managing employees.
- Update your direct deposit details if your bank has changed.
- Answer any MAC request for more information within 30 days.
What happens if you're late
If your revalidation is late, or you don't answer the MAC's questions in time, your Medicare billing privileges can be deactivated and payments stop. Getting back in means a new, complete application, and your reactivation date is the date the MAC receives it. You can't bill Medicare for services in the gap. For a busy practice, that can mean weeks or months of unpaid Medicare visits.
For the forms and effective-date rules behind all this, see our Medicare enrollment guide.
Medicaid revalidation
Federal rules require every state Medicaid program to revalidate every enrolled provider at least every 5 years. Many states do it more often for some provider types. Each state runs its own process through its Medicaid provider portal, and the screening depends on your risk category. It can include a site visit or fingerprinting for higher-risk provider types.
Watch for your state's notice and answer it before the deadline. States commonly deny claims or suspend payments for providers who miss revalidation, and can end your enrollment. If you're in Medicaid managed care plans, they usually re-credential you on their own schedule as well.
Commercial re-credentialing
Private insurers and Medicare Advantage plans re-credential providers about every 36 months, following the national accreditation standards most of them use. The insurer starts the process. It re-verifies your license, board certification, malpractice history and sanctions, mostly from your CAQH profile.
If your CAQH profile is complete and attested, re-credentialing often needs nothing from you. UnitedHealthcare, for example, says a current CAQH attestation every 120 days is all it needs. Where it goes wrong:
- The CAQH attestation has lapsed, so the insurer can't complete verification.
- An expired malpractice certificate or license is still on file.
- The insurer sends a request for updated information and nobody answers.
Being removed from a network at re-credentialing is worse than a delay. To get back in, you usually reapply as a new provider, and the panel may have closed since you first joined. See the Blue Cross Blue Shield guide for how closed panels work.
Between renewals: what to keep current
- Changes to Medicare: report a new practice location, a change of ownership or an adverse legal action within 30 days, and other changes within 90 days.
- Changes to insurers: update CAQH first, then tell each insurer about new locations, a new Tax ID or a new group.
- NPPES: keep your NPI record's addresses and taxonomy current. Insurers compare it with everything else.
- Renewed documents: upload each new license, DEA certificate and malpractice certificate before the old one expires.
Keep one renewal calendar
Most lapses happen because the dates sit in different places: a CAQH email, a MAC letter, a state portal and an insurer's mail. Put every date for every provider in one tracker, with reminders 90 and 30 days ahead:
| Provider | Item | Due | Remind at |
|---|---|---|---|
| Example NP | CAQH re-attestation | Every 120 days | 14 days before |
| Example NP | Medicare revalidation | Date from the lookup tool | 6 months and 2 months before |
| Example NP | Malpractice certificate | Policy renewal date | 30 days before |
| Example NP | Insurer re-credentialing | 3 years from approval | 90 days before |
If credentialing for your practice was done by someone who has since left, start by rebuilding this calendar. Pull Medicare dates from the lookup tool, CAQH dates from the profile, and insurer dates from your approval letters. For the full picture of how each enrollment starts, see how to get credentialed with insurance companies.
Hand your renewals to us
Our recredentialing service takes over CAQH re-attestation, Medicare and Medicaid revalidation and insurer re-credentialing for any provider, whoever did the original credentialing. $50 a month per provider for all of them, or $150 for a single renewal.
Hand over my renewalsCommon questions
How often do providers need to be recredentialed?
Private insurers and Medicare Advantage plans re-credential providers about every 36 months. Medicare revalidates enrollment every 5 years, state Medicaid programs at least every 5 years, and your CAQH profile must be re-attested every 120 days (180 in Illinois).
How do I find my Medicare revalidation due date?
Search your name or NPI in the Medicare Revalidation Lookup Tool on data.cms.gov. If the due date shows TBD, you are not due yet. Your Medicare Administrative Contractor usually sends a notice about 2 to 3 months before the due date.
What happens if I miss my Medicare revalidation?
Your Medicare billing privileges can be deactivated and payments stop. To get back in you submit a new, complete application, and your reactivation date is the date the contractor receives it. You can't bill Medicare for services during the gap.
Can I revalidate Medicare early?
Only within your contractor's window, usually about six months before the due date. Applications sent earlier, or when the lookup tool shows TBD, are returned as unsolicited.
If I revalidate with Medicare, do I still need to revalidate with Medicaid?
Yes. Medicaid revalidation is run by your state through its own portal and schedule. Some states use Medicare's screening results, but you still have to complete the state's process when it asks.