Every credential a practice bills on carries a date, and none of those dates announces itself to the billing office. When one lapses, the payer can look back, recalculate the claim and take the money back. The expirables register fixes that with one list, one owner per document, and windows set early enough that nothing gaps.
What this covers
- DEA practitioner registrations run three years, and a renewal cannot be filed more than 60 days early.
- Medicare revalidation runs five years, and the application is due within 60 calendar days of the notice.
- Medicare can date a deactivation back to the day the practice became non-compliant, and services furnished while deactivated are not payable.
- Commercial payers recredential at least every three years under NCQA standards, and CAQH profiles must be re-attested every 120 days.
- CARC 185, CARC 299, CARC B7, RARC M143 and RARC N570 point at a credential that is missing or expired.
Credentialing has two speeds. New enrollments get attention because a clinician is waiting to bill. Renewals get whatever time is left.
What belongs in the expirables register
An expirables register is one table holding every credential a payer or regulator can ask about: the date it expires, the date the renewal work must start, and the person accountable. Board certificates, malpractice coverage, CLIA certificates, Medicaid enrollment and the CAQH attestation clock belong on the same sheet. Our credentialing work starts from that list.
Two entries surprise people. An assigned NPI does not expire, but the NPPES record behind it goes stale, and CMS requires updates within 30 days of any change. A practice that updates the license but not NPPES bills against a directory record that no longer matches the claim. Board certification is the other one: ABMS member boards determine status at least every five years.
| Credential | Cycle | Who renews it |
|---|---|---|
| State professional license | 1 to 2 years | State licensing board |
| DEA registration, practitioner | 3 years | DEA Diversion Control |
| Medicare revalidation | 5 years, plus off-cycle | Medicare contractor |
| Board certificate | Status checked at least every 5 years | Specialty board |
| CAQH profile attestation | 120 days, or 180 in Illinois | CAQH Provider Data Portal |
| BCBA or BCaBA certification | 2 years, 32 CEUs with 4 in ethics | BACB |
An NPI never expires and is never reassigned, so it never lands on a renewal calendar. The record behind it still has to be maintained within 30 days of any change.
The renewal windows that matter
A register that stores only expiration dates will still produce gaps. The number that drives the work is the date the renewal has to start, which comes from the issuer’s rules.
| Credential | The window the rule sets | Source |
|---|---|---|
| DEA registration | Filed no earlier than 60 days before expiration; DEA emails at 60, 45, 30, 15 and 5 days | 21 CFR 1301.13 |
| Expired DEA registration | Reinstatement allowed for one calendar month, then a new application | DEA registration page |
| Medicare revalidation | Due within 60 calendar days of the notice | 42 CFR 424.515(a)(2) |
| Medicare enrollment change | 30 days for ownership, an adverse legal action or a location change; 90 days otherwise | 42 CFR 424.516(d) |
| CAQH attestation | Every 120 days, or 180 days in Illinois | CAQH quick reference |
Federal law prohibits handling controlled substances under an expired DEA registration, even if the registration is reinstated inside the one-month window.
What a lapse actually costs
The cost of a lapse shows up in the effective date, not in the renewal fee.
Medicare deactivation is the clearest example. CMS may deactivate billing privileges when a provider does not report a change within the required period, does not furnish complete information within 90 calendar days of a CMS request, or is not in compliance with enrollment requirements. For those reasons the deactivation effective date is the date the provider became non-compliant. Services furnished while deactivated are not payable.
Revocation goes further. A revoked provider is barred from Medicare from the effective date of the revocation until the end of the re-enrollment bar, which runs one to three years.
Medicaid and commercial contracts follow the same shape. A state Medicaid agency must revalidate every provider at least every five years, and a stale file stops claims at the state line. Medicare Part B pays for a professional’s services only when that person is legally authorized to practice by the state and acting within the license’s scope. A commercial participation agreement conditions network status on current credentials, so a lapsed certificate can end participation retroactively and turn paid claims into overpayments. Medical billing services teams see the result months later.
42 CFR 424.540(d)(1)(ii) lets CMS set a deactivation effective date back to the date the practice became non-compliant. Read it beside 424.540(e), which bars payment for services furnished while deactivated.
Who owns each document
A register with no owner is a spreadsheet. Assign one accountable role per document type, and keep the provider responsible for what only the provider can do: attest, sign and finish the continuing education.
| Document | Accountable role | Evidence to keep |
|---|---|---|
| State license | Credentialing coordinator | Verification printout with the date |
| DEA registration | Provider signs, coordinator tracks the date | Certificate and renewal confirmation |
| Board certificate | Provider, coordinator tracks the cycle | Board status page |
| Malpractice coverage | Practice manager | Certificate of insurance with limits and expiration |
| CAQH profile | Credentialing coordinator | Attestation confirmation and next deadline |
| Medicare and Medicaid enrollment | Credentialing coordinator | Revalidation notice and submission confirmation |
Two rules prevent most gaps. The person who holds the credential never owns the tracking, because the provider has to act and the coordinator has to see the date coming. Every row also needs a named backup. The failure mode behind most lapses is a staff change that carries the login and the reminder email out the door.
Reading the remittance advice when a credential lapses
Denials caused by a credential problem arrive with codes that name the problem. Learn the small set that points at an expirable, and route those denials to the credentialing desk instead of the appeals queue, where a clinical review costs weeks and returns the same answer.
| Code | What it says | Status on the X12 list |
|---|---|---|
| 185 | The rendering provider is not eligible to perform the service billed. | Active |
| 299 | The billing provider is not eligible to receive payment for the service billed. | Active |
| B7 | This provider was not certified or eligible to be paid for this procedure on this date of service. | Active |
| M143 | The provider must update license information with the payer. | Active |
| N570 | Missing, incomplete or invalid credentialing data. | Active |
| N665 | Services by an unlicensed provider are not reimbursable. | Active |
| 52 | The referring, prescribing or rendering provider is not eligible to refer, prescribe, order or perform the service billed. | Deactivated in 2006. Use 185. |
The X12 code lists change, and older provider eligibility codes have been retired. CARC 52 and RARC MA129 are both deactivated. Confirm a code is still active before it goes into a denial workflow.
The twice-a-year reconciliation
The register records what the practice knows. The reconciliation finds out what the payer knows. They drift apart: a roster file never updated after a provider left, or a location added to the license but not the payer’s file.
Request the current roster or directory extract from each contracted payer. Ask for effective dates, participating status and locations on file.
Check the license number and expiration, the DEA number where required, board status, the NPI and every location.
Record what the payer has, what the register has, and the discovery date. That date matters if a claim from that period is denied.
Correct the license or the NPPES record before resubmitting the payer update.
A payer file update is not done until the roster shows the change.
NCQA requires recredentialing at least every three years, and its credentialing programs treat ongoing monitoring of sanctions and license expiration between those cycles as a separate requirement. The same habit applies to records: a comprehensive chart auditing review holds up only if the credentials behind the notes are current.
- Every credential has an expiration date and a renewal start date
- Every row has one owner and one named backup
- DEA registrations are flagged 60 days out, and the registration email goes to the credentialing desk
- CAQH attestation sits on the calendar 90 days after the last attestation
- License numbers in the register match the payer roster character for character
Credentialing expirables questions, answered
The documents a payer or regulator verifies that carry an expiration or renewal date. The core list is the state license, the DEA registration, board certification, malpractice coverage, the CLIA certificate, Medicare and Medicaid enrollment, and the CAQH profile.
For Medicare, the professional must be legally authorized to practice by the state and acting within the scope of that license, so services furnished while the license is expired are not payable. A lapse can also make the practice non-compliant with enrollment requirements, which allows a retroactive deactivation.
No. An assigned NPI does not expire and is never reassigned. What goes stale is the NPPES record behind it. CMS requires updates within 30 days of any change, so a practice that updates a license or address everywhere except NPPES has a directory record that no longer matches its claims.
Every 120 days, or every 180 days for providers in Illinois. Providers who answer the quarterly directory confirmation emails re-attest on a 90-day rhythm instead, but 120 days is the requirement. Miss it and the status changes to Expired, which a payer sees during a recredentialing review.
Every five years for most providers and suppliers, plus off-cycle revalidations CMS can request at any time for random checks, complaints or national initiatives. When the notice arrives, the application is due within 60 calendar days, and CMS can deactivate billing privileges if nothing complete arrives within 90.
Claim adjustment reason code 185 for a rendering provider who is not eligible to perform the service, 299 for a billing provider who is not eligible to receive payment, and B7 for a provider who was not certified on the date of service. On the remark side, M143 and N570 flag credentialing data.
The bottom line
The register decides whether a claim from eight months ago is still collectible. Build it once, give every row an owner and a renewal start date, and put the payer file reconciliation on the calendar twice a year.
How much of your A/R is sitting behind an expiring credential?
We build and maintain the expirables register, run the payer file reconciliation twice a year, and work provider eligibility denials back to the credentialing file. Send a recent remittance advice and your provider list, and we will show you which credentials are closest to a lapse.
Request a free credentialing auditThis article describes Medicare, Medicaid and commercial credentialing requirements as published at the time of writing and is not legal advice. Confirm current requirements with your Medicare Administrative Contractor.
