Most enrollment files do not stall for one reason. A development request lands in an inbox nobody owns and the 30-day window runs out. The legal business name on the application does not match the IRS letter. A sanction screen returns a hit on an owner the practice never disclosed. By the time anyone traces the file, the decision is made.
What this covers
- A development request gives you 30 calendar days from the date of the request, and 42 CFR 424.525(a)(1) makes a missed window a reason to reject the application.
- Supporting documentation is due with the application. Under 42 CFR 424.525(a)(2), missing documents are a rejection reason on their own.
- A rejection is not appealable: 42 CFR 424.525(c) requires a new application, and 424.525(d) gives the applicant no appeal rights.
- A CMS enrollment presentation counted 30 to 35 percent of applications hitting a processing delay, with incomplete files running 30 to 45 days behind.
- A denial based on an excluded owner or employee can be reversed if the practice ends the relationship and proves it within 30 days (42 CFR 424.530(c)).
Every deadline we could find in the enrollment rules runs against the practice.42 CFR 424.525 puts the 30-day clock on the applicant. The contractor’s own clock lives in the Program Integrity Manual, not in the enrollment rules.
Provider enrollment delay is rarely a question of eligibility. It is a paperwork event with a date attached, and the date runs against the practice. Here are the four stalls behind most slow files and the records that keep a file moving.
Four words, four different outcomes
An enrollment file can be pended, rejected, denied or revoked. A pending file is still in review. The other three are decisions, and only one of them is appealable.
| Decision | Trigger | Your move |
|---|---|---|
| Rejection, 42 CFR 424.525 | Incomplete information within 30 days of the request, missing documentation, an unpaid fee, an unauthorized signature | No appeal rights. File a new application with the documentation again. |
| Denial, 42 CFR 424.530 | An excluded owner, a felony in the last 10 years, an unpaid Medicare debt, a revoked license in another state | Reconsideration, then the appeals process. Effective within 30 days of the notice. |
| Revocation, 42 CFR 424.535 | Noncompliance, false or misleading information on the application, an on-site review finding the practice not operational, a failure to report a change | A corrective action plan or a reconsideration, per the paragraph cited. Effective 30 days after the notice. |
The decision letter names the paragraph that matters. The 424.530(a)(2) citation, for instance, is the excluded-owner ground, and that paragraph sets the cure and the route.
Stall one: the document nobody asked for
The most common reason a file sits is a document the practice did not know it owed. Supporting documentation is due at filing, not when the contractor asks for it. Under 42 CFR 424.525(a)(2), failing to furnish all required supporting documentation within 30 calendar days of filing is a rejection reason.
- IRS documentation that establishes the legal business name, such as a CP-575
- The CMS-588 electronic funds transfer agreement
- A voided check or bank letter for the deposit account
- Education documentation where the provider type requires it
- The CMS-460 participation agreement for Part B physicians, practitioners and suppliers
42 CFR 424.525(d) states that rejected applications are not afforded appeal rights, and 424.525(c) requires a new application rather than a correction.
Stall two: the application and the record disagree
Contractors check the application against the records behind it. The legal business name and tax identification number have to line up across the application, the IRS documentation, the EFT agreement and NPPES. A group practice needs a Type 2 NPI on the CMS-855B; an individual enrolls under a Type 1. Our credentialing team sees the same mismatches repeatedly.
- The legal business name on the IRS letter differs from the application by a suffix, an ampersand or punctuation.
- An address change, a new clinician or a merger was never reported. 42 CFR 424.516(d) requires a report within 30 days for a change of ownership, an adverse legal action or a practice location change, and 90 days for everything else.
- A clinician’s reassignment was never filed. The CMS-855R is discontinued, and reassignment actions now go on the CMS-855I.
Stall three: a sanction screen returns a hit
Every application is screened, and the risk level assigned to the provider type decides how deep it goes. 42 CFR 424.518 places physicians, non-physician practitioners and medical groups at limited risk, which brings license verification and database checks before and after enrollment. Community mental health centers sit at moderate risk, which adds an on-site visit. Newly enrolling hospices, home health agencies and skilled nursing facilities sit at high risk.
A hit is a denial ground under 42 CFR 424.530. An exclusion of the provider, an owner, a managing employee or a contracted entity is grounds under 424.530(a)(2); a felony conviction within 10 years falls under (a)(3); a state Medicaid termination or a license revoked in another state falls under (a)(14).
- There is a cure: end the relationship and submit proof within 30 days of the denial notice, and 424.530(c) allows a reversal.
- A denial also triggers a review of every other Medicare file that owner is associated with, under 424.530(d).
Stall four: the contact changed and the file lost its owner
Development requests go to the contact person named on the application, by email or fax. A MAC enrollment presentation showed how thin that link is: the request arrives in an inbox, and if it goes unanswered for 30 days the application is rejected. When that contact leaves the practice, the file keeps its clock and loses the person watching it.
A MAC status page describes the pending state contact stage as one that can take several months, and a filing sent to the wrong contractor is returned rather than forwarded, which adds a full round trip.
Commercial payers run a separate queue on a separate clock. Most pull credentialing data from CAQH ProView, which requires re-attestation every 120 days, or 180 days for providers in Illinois. A profile past its deadline moves to Expired status the next day, and a payer that queries it cannot process the file.
EFT and EDI setup cannot be completed until the claims system updates with the new record, so a credentialing slip delays medical billing readiness as well.
What the deadlines do and do not promise
The regulations put hard dates on the applicant: 30 calendar days to answer a development request under 424.525(a)(1), unless the contractor extends it under 424.525(b), and 60 calendar days to file a revalidation after CMS notifies you under 424.515(a)(2). The cycle repeats every 5 years.
Two limits matter before you promise a start date. Enrollment is not retroactive by default: 424.521 allows up to 30 days of pre-effective-date billing only when circumstances precluded enrolling in advance. The contractor’s own clock is published, and it is generous. The Program Integrity Manual requires a MAC to process 95 percent of paper applications that need development, a site visit or fingerprints within 65 calendar days of receipt, and 100 percent of them within 100 calendar days. A PECOS application that needs development carries a 50-day standard and an 85-day ceiling. A 90-day paper file is inside that published outer bound rather than outside it.
- Confirm the form version and application type match the scenario.
- Reconcile the legal business name, tax ID number and NPI across the application, IRS letter, CMS-588 and NPPES.
- Confirm the certification statement is signed by someone allowed to sign it, and that no paper page was completed in pencil.
- Log the filing date, any development request date, and the day the 30-day window closes.
Recovering a file that is already sitting
Every MAC publishes a status lookup. Noridian’s list has a stage stating that information was requested and the application will be rejected without a response within 30 calendar days.
Search the contact person’s inbox, junk and spam folders, the fax line and the mailing address on file. The request is the clock.
Send everything the request names in one package, on the correct form pages, with signatures. A partial answer does not pause the clock.
A rejection requires a new application and the documentation again. Confirm nothing changed in NPPES or the IRS records, or the same mismatch returns.
Set a date ten days out to call the MAC’s enrollment contact center. Do not wait on a letter mailed to an address the practice stopped using.
Enrollment delay questions we answer every week
CMS puts the contractor’s clock in the Program Integrity Manual, not in the regulations. A MAC must process 95 percent of paper applications that need development, a site visit or fingerprints within 65 calendar days of receipt, and all of them within 100 calendar days. A PECOS application that needs development runs on a 50-day standard and an 85-day ceiling. The 30-day clock in 424.525(a)(1) runs against the practice, not the contractor.
The contractor may reject the application under 42 CFR 424.525(a)(1), and a rejection carries no appeal rights under 424.525(d). Returning to the queue means filing a new application with the supporting documentation again under 424.525(c).
Fix it before you file. If the application is already submitted, expect a development request rather than a silent correction, because contractors compare the legal business name, tax identification number and NPI against NPPES and the IRS documentation in the file.
Yes. A CMS enrollment presentation states that every applicable final adverse legal action must be reported whether or not records were expunged and whether or not appeals are pending. Failing to disclose accurately is treated the same as not disclosing, and 42 CFR 424.530(a)(4) makes false information a denial reason.
Group and individual enrollment are separate transactions. The group enrolls with a Type 2 NPI on the CMS-855B, the individual on the CMS-855I, and the reassignment that lets the group bill for that clinician’s work goes on the CMS-855I because the CMS-855R is discontinued.
No, they are separate systems. Medicare enrollment runs through PECOS and the MAC, while CAQH ProView feeds commercial payer credentialing. CAQH requires re-attestation every 120 days, or 180 days for Illinois providers, and a profile past that deadline moves to Expired status.
The bottom line
Enrollment delay is rarely one event. It is a request nobody opened, a name that did not match, a screen that returned a hit, or a queue that changed owners mid-file. Each has a date attached, and most of those dates still run against the practice.
Which file in your practice is sitting right now?
We run enrollment and credentialing files for behavioral health and medical practices: PECOS reconciliation, development request tracking, CAQH re-attestation calendars, and sanction screens. Learn how our revenue cycle team works, then send us your open files and we will show you where each one stopped.
Request a free credentialing file auditThis article describes federal enrollment rules as published in the Code of Federal Regulations and in CMS and MAC guidance; payer contracts, state licensure and accreditation requirements add their own terms.
