Access problems in PECOS do not announce themselves. They surface on the afternoon a revalidation notice arrives, when the person who used to sign the application has retired and the portal says your login is not associated with the practice. Medicare gives you 60 calendar days to answer a revalidation notice, and rebuilding access can consume most of them. The work that prevents this takes an afternoon, and almost none of it happens inside PECOS itself.
What this covers
- An I&A account and a PECOS enrollment record are two different things, and registering in I&A does not enroll you in Medicare
- Roles decide everything: the authorized official signs initial applications, and a delegated official can sign a change of information while the authorized official stays in place
- Identity verification and multi-factor authentication are prerequisites, not options, and an account left idle for 180 days is disabled
- A practice whose only approved user is its authorized official has a single point of failure that no one notices until a deadline
- Responding to a revalidation notice is a 60 calendar day obligation under 42 CFR 424.515
Medicare won’t reimburse you for any services during the period that you were deactivated.CMS, Revalidations (Renewing Your Enrollment)
PECOS access is plumbing. It is invisible while it works and expensive the moment it does not, because the failure lands inside a compliance window rather than in a quiet week. What follows is the structure of the access itself: which system holds what, who is allowed to sign, what CMS asks you to prove about your identity, and where practices leave themselves exposed.
An I&A account is not an enrollment
The confusion starts with the login screen. Nobody signs into PECOS with a PECOS password. You sign into the Identity & Access Management system, which everyone calls I&A, and I&A hands you a session in whichever CMS application you have been approved for. The same account opens NPPES, PECOS, PEPPER and CBR. CMS is explicit that registering or updating information in I&A does not enroll you in Medicare, register you for an NPI, or change your enrollment record. It only decides whether you are allowed to walk into the room.
| Record | What lives there | What it controls |
|---|---|---|
| I&A account | Your identity, your employers, the functions granted to you | Whether you can log in at all, and what you can see once you do |
| PECOS enrollment record | The practice’s enrollment data, its authorized official, applications in flight | Whether the practice can submit and sign enrollment actions |
| NPPES record | The NPI and its practice location data | The identity of the practice to every payer that matters, Medicare included |
A practice can hold a clean enrollment record and still be locked out of it, because none of its current staff hold an approved role on the I&A side. That is the state to avoid, and it is invisible from the enrollment record itself.
Registering in I&A is free and takes minutes. Approval to act on behalf of an organization is a separate request that someone else may need to approve.
Who can sign, and who can only look
Three roles carry the access, and they are not interchangeable. CMS describes them as the authorized official, the access manager and the staff end user, and the differences decide who can move an application forward on the day your response window is running.
| Role | Authority | What it takes to get it |
|---|---|---|
| Authorized official | Legally binds the organization, signs initial enrollment applications, approves access managers and staff | Being listed as the authorized official on an approved Medicare enrollment, or submitting the organization’s CP 575 to CMS External User Services |
| Access manager | Manages staff users and connections, can work in PECOS on the organization’s behalf | Approval by an existing authorized official in I&A, or an access manager certification together with the CP 575 |
| Staff end user | Works in the applications the organization grants, including NPPES functions | Approval by an authorized official or access manager |
- The authorized official for an individual provider is the provider, and only the provider. A billing company cannot hold that role.
- Approval is not instant. A request that clears can take up to three hours before the provider’s information appears in PECOS.
- Losing the role is not the same as losing the account. If the enrollment record lapses or the provider leaves the record, the role goes with it, and the account survives with less authority than the holder believes they have.
CMS trains contractors on two signing rules that matter at deadline: the authorized official signs every initial application, while a designated or delegated official can sign a change of information as long as the authorized official is not being replaced. A practice that needs to update a practice location can usually do it without waking the authorized official. A practice that needs to replace them cannot.
The identity check, and the inactivity traps
I&A verifies that you are who you say you are before it grants access, and it does not store the questions it asks. If the check fails, the screen gives you a session ID and a user ID, and you continue with the verification support service rather than starting over. Two rules then govern the account for the rest of its life.
Required for every I&A user since April 21, 2022. If the phone number or device behind the second factor belongs to someone who left, the account is effectively closed until it is changed.
An account idle for more than 180 days but used within the last 365 is disabled. Logging in routes you to a password reset, which is recoverable.
An account untouched for a year must be rebuilt. A new user ID is required, information is verified again, and every employer has to be added back, which means approvals all over again.
A credentialing specialist who touches I&A daily and a physician who signs once every five years are not in the same position. The infrequent user is the one whose account expires, and they are often the one holding the signature.
None of this is exotic. It is simply a set of timers that run whether or not anyone is watching them, and a revalidation notice is a poor moment to discover which one has expired.
The single point of failure nobody notices
CMS does not require a practice to name two people. It does require an authorized official, and it routes most approvals through one. In a small practice that usually means the physician owner or the practice manager holds the only role with real authority, and everyone else works under it.
- More than one person holds an approved role on the organization, rather than a single individual
- The authorized official on the enrollment record is still employed, still reachable, and still willing to sign
- The CP 575, or its approved substitute, is filed somewhere the practice can find it without the person who filed it
- The multi-factor device behind every account belongs to someone who is still there
- A billing company that works in PECOS has a surrogacy connection or an approved role of its own, rather than borrowing a login
The expensive version of this problem is the one that arrives when a practice changes owners, or when the authorized official dies or retires without a change of information on file. Replacing the authorized official is a change of information application, and the person who would normally sign it is the person being replaced. The escape route runs through CMS External User Services with the organization’s tax documents in hand, and it does not run quickly.
Add a second approved user while access is working, even if that person rarely opens PECOS. An account that exists is a spare key. An account that has to be created during a deadline is a project.
How access problems burn a revalidation window
Revalidation is where the plumbing meets a hard clock. Under 42 CFR 424.515, a provider must resubmit and recertify its enrollment information within 60 calendar days of CMS’s notification. CMS sends that notice by email or mail about three to four months before the due date, and posts due dates on its revalidation list seven months in advance, so the date is knowable long before the envelope arrives.
Miss the window and the sequence is worse than the notice suggests. The contractor applies a payment hold and issues a reminder, and deactivation follows. In the timeline CMS published for its last revalidation round, the hold landed within 25 days of the due date and deactivation followed 60 to 75 days after it. Reactivation then runs from the date a new and complete application is received, with no retroactive billing for the gap, which makes every service delivered during it the practice’s own liability.
Medicare won’t reimburse you for any services during the period that you were deactivated.CMS, Revalidations (Renewing Your Enrollment)
Put the two clocks side by side and the risk becomes obvious. Sixty days to respond is generous for a practice that can log in, review its record and upload documents. It is not generous for a practice that has to rebuild an identity, locate a CP 575, obtain an approval from someone who has left, and then answer the application.
CMS states that it does not grant extensions on revalidation, and that there are no exemptions from it. The notice is the deadline, not a warning about one.
An afternoon of setup that removes most of the risk
This is the part that fits in a quiet week. Do it once and the next deadline becomes a data update rather than a recovery.
- Log into I&A as the organization and confirm which people currently hold an approved role. Note the roles, not the names.
- Confirm the authorized official on the enrollment record matches someone the practice can still reach today.
- Add a second approved user with the access needed to submit an application, and have them complete identity verification and MFA while nothing is at stake.
- File the CP 575, the multi-factor device details and the portal credentials somewhere the practice controls, not in one person’s phone.
- Put the revalidation due date in a calendar that outlives staff turnover, and add a reminder at the point the notice should have arrived.
- If a billing company works on the practice’s behalf, confirm the relationship is a surrogacy connection or an approved role, and document who approves what.
The same reasoning applies beyond Medicare. A practice that cannot demonstrate control of its own enrollment record has the same problem in every payer portal it touches, and the enrollment work that keeps reimbursement flowing depends on being able to get in. Where the enrollment record itself needs attention, our credentialing team handles payer enrollment and revalidation as a standing process rather than an annual scramble, and medical billing services picks up from the point a claim is submitted.
If access is already broken
Recovery has three shapes, and knowing which one applies saves days. A disabled account from inactivity is a password reset. A year of silence is a rebuild, with a new user ID and fresh approvals. A lost role is a request to CMS External User Services, supported by documents that prove control of the organization.
- Use the retrieve user ID and reset password tools on the I&A sign-in page before calling anyone. Most lockouts end here.
- If the request has been approved but PECOS still shows nothing, wait the three hours before assuming a fault.
- Check the status of an application submitted in the last 90 days through the self-service kiosk on the PECOS site.
- If you are the billing company rather than the practice, expect to need an approval from the practice’s authorized official or a surrogacy connection. Practicing on the practice’s login is not a substitute.
The recovery path exists in every case. What changes is the calendar: each step routes through a different party, and none of them are available at two in the morning on the day a notice is due.
Questions practice managers ask about PECOS access
No. I&A is the single sign-on that gives you access to PECOS, NPPES, PEPPER and CBR. PECOS is where the enrollment record lives. You log into I&A, and your roles there decide what you can do once PECOS opens. Registering in I&A does not enroll a practice in Medicare or change its enrollment record.
The authorized official signs every initial enrollment application. A designated or delegated official can sign a change of information, provided the authorized official is not being replaced. In practice, most revalidations are signed by the authorized official or by a staff user working under an approved role, so access and authority have to be sorted out before the notice arrives.
Replacing them is a change of information application, and it needs to be signed at a point when the departing person may no longer be available. The route runs through CMS External User Services with proof of authority over the organization, such as the CP 575. Start it as soon as the departure is known, because approvals are not instant.
Approval can be immediate when the request matches an already approved role on an enrollment record, and slower when documents have to be reviewed by CMS External User Services. Once a role is approved, CMS notes that PECOS may take up to three hours to show the provider’s information. Budget a working day, and do not start the week a deadline falls.
Yes, through an approved role or a surrogacy connection. A billing company cannot be the authorized official for an individual provider, since only the provider can hold that role, but it can hold an access manager or staff role for an organization it represents. Sharing one login instead of establishing a connection is the arrangement that breaks first and is hardest to audit.
It is the IRS notice that confirms a business’s legal name and employer identification number. CMS External User Services uses it to confirm that a person requesting an authorized official or access manager role actually represents the organization. If the practice cannot produce it, the request stalls, so the document belongs with the practice rather than with its accountant.
The bottom line
PECOS access is a small piece of administration that quietly decides whether a practice can answer Medicare on time. The rules are stable, the roles are published, and the timers are documented, which means almost every failure here is foreseeable. An hour spent confirming who holds which role, and which account expires next, is cheaper than sixty days spent proving you are allowed to sign your own application.
Is your enrollment access ready for the next deadline?
We run enrollment and revalidation as a standing process: confirming the roles behind each record, tracking due dates before the notices arrive, and keeping the applications moving when one does. Send us a practice and we will show you where its access stands today.
Request a free enrollment auditThis article describes CMS access and revalidation requirements as published in October 2026 and is general information rather than advice on a specific enrollment; confirm your own deadlines in PECOS and with your Medicare Administrative Contractor.
