Medicare enrollment is not permanent, and it is not maintenance-free. Every provider and every supplier has a revalidation date, and missing it does not produce a warning that costs you nothing, it stops your claims paying. Here is what the requirement actually is, how the notice works, and the calendar most practices fail to keep.
What this covers
- Revalidation is due at least every five years, and CMS can require it sooner.
- The group and each individual provider revalidate as separate records.
- Miss the deadline and CMS deactivates the enrolment, which stops claims paying.
- Medicare generally allows retroactive billing for the 30 days before the reactivation is filed.
If you bill Medicare, at some point your Medicare Administrative Contractor (MAC) will ask you to revalidate your enrollment. That is not a formality. Revalidation is a fresh look at whether the provider or supplier is still eligible, still in the same ownership, still at the same location, and still meets the screening requirements that were applied the first time.
What revalidation actually is
The requirement comes from the Affordable Care Act. Section 6401 requires all providers and suppliers enrolled in Medicare to revalidate their enrollment records periodically, using the same application forms and screening standards applied at initial enrollment. Congress wrote it that way deliberately: an enrollment record is a snapshot, and a five-year-old snapshot may describe a practice that no longer exists in that form.
Revalidation is not the same as credentialing, and the two get confused constantly. Credentialing is a payer verifying a provider is qualified to join its network. Revalidation is Medicare confirming an existing enrollment record is still accurate and the provider is still eligible to remain enrolled at all. You can be fully credentialed with every commercial payer in your state and still have your Medicare billing stop because a revalidation went unanswered.
How often it is due
The baseline is at least every five years. CMS can require it sooner, and does for higher-risk provider categories, so a five-year habit is the floor rather than a guarantee.
| Enrollment | Revalidation cycle | Notes |
|---|---|---|
| Physicians, non-physician practitioners | At least every 5 years | Individual and group enrollments are separate records |
| Group practices (billing as an organization) | At least every 5 years | Revalidated independently of the individuals inside it |
| Higher-risk categories | More frequently | CMS may revalidate high-risk categories sooner and check them harder |
| DMEPOS suppliers | Per CMS cycle | Uses the 855S, plus accreditation and surety bond obligations |
| Ordering and certifying only (no billing) | Per CMS cycle | Uses the 855O, commonly overlooked by hospital-based clinicians |
One practical point that surprises practice managers: the group enrollment and each individual enrollment have their own revalidation dates. A MAC can ask the group to revalidate while individual providers are mid-cycle, and vice versa. Both need an owner.
CMS sends revalidation notices by mail, and increasingly by email, to the address on file in PECOS. That address is the one from your last enrollment action, which may be an old billing office, a former office manager’s inbox, or a fax number nobody has watched since 2019. Before you need the deadline, log into PECOS and confirm the correspondence address and email are the ones you read today.
The things that trigger revalidation outside the cycle
Waiting for the five-year clock is not enough, because a number of events force an updated enrollment regardless of cycle:
- Change of ownership. A sale, a merger, a partner buy-in or a change in the entity’s ownership structure generally requires a new enrollment or a change of information filing, not a letter telling Medicare afterwards.
- Change of practice location or the addition of a new one. A new service address is a new site for enrollment and directory purposes.
- Change of business structure. Sole proprietor to LLC, or a new Tax ID, can mean a new enrollment record rather than an update.
- Adverse actions. A licence suspension, exclusion, revocation or a felony conviction must be reported, and it affects the enrollment record.
- A targeted revalidation. CMS runs data checks; a record that looks inconsistent with other CMS or IRS data can be pulled out of sequence.
Most of these events carry a reporting obligation with its own deadline, independent of revalidation. Practices that handle the revalidation fine still get caught by an unreported address change or a new location that was never added to the enrollment record. Treat a change in the practice as a trigger to review enrollment, not as an administrative footnote for the accountant.
The revalidation notice, and the clock it starts
The notice identifies your enrolment record and gives you a date to respond by. The window is finite and it starts when the notice is issued, not when you read it. If the deadline approaches and you need more time, ask your MAC for an extension before the date passes. MACs have discretion to grant one, and they have no obligation to be generous after the fact.
The application itself depends on which record is being revalidated:
- 855B for the group or organisation enrolling to bill
- 855I for an individual physician or practitioner
- 855R to reassign an individual’s billing rights to the group
- 855S for DMEPOS suppliers
- 855O for ordering or certifying providers who do not bill Medicare directly
Practically, everyone revalidates through PECOS, which now sits behind the CMS Identity & Access system with multi-factor authentication. That is a real dependency inside the deadline: if the person with the I&A account has left the practice, or the account is locked, the clock keeps running while you work out access. Fix ownership of that account before you need it.
What it costs when a revalidation is missed
Miss the deadline and CMS deactivates the enrollment. Not a warning: a deactivation. The practical consequences, in the order practices notice them:
- Claims stop being paid. Services furnished while the enrollment is deactivated are not payable to that provider or supplier, so revenue begins accumulating off the books immediately.
- Patients get billed correctly and still can’t see you in-network. Front-desk eligibility checks start failing in ways that look like a payer problem rather than an enrollment problem.
- Referrals and orders break. If an ordering provider is deactivated, the claims of the practice that received the order can be affected too, the blast radius goes beyond one clinician.
- Reactivation is a fresh application, not a phone call. You file again, with the documentation and screening that entails, and you wait.
There is one partial mercy, and it is the reason filing speed matters: Medicare generally allows retroactive billing for services furnished in the 30 days before the application was filed. That is not a grace period on the deadline, it is a window tied to your filing date. Every day spent deciding who is going to handle the reactivation shortens the period you can still bill for.
Two practices with identical timelines can end up with different recovery outcomes purely because one filed the reactivation three weeks earlier. This is where a credentialed practice and an uncredited one diverge: the work is administrative, but the financial deadline is hard.
The five mistakes we see most
- The notice went to a dead mailbox. Revalidation notices arrive at the address and email on record. Nobody updates that until the deadline is missed.
- The group was revalidated and the individuals were not. They are separate records with separate cycles, and both fail independently.
- An address or ownership change was never reported. The revalidation application then contradicts CMS’s existing data, which stalls the filing instead of completing it.
- Nobody owns the PECOS I&A account. Access issues consume the whole response window.
- The 60-day window was treated as flexible. Extensions are granted on request before the deadline, not as an excuse afterwards.
The calendar that prevents all of it
Revalidation is not difficult work. It is dated work, and dated work fails silently when nobody holds the calendar. What works is unglamorous:
- A single list of every enrollment record, group, each individual, each location, each payer, with its last action date and its next expected cycle.
- The correspondence address and email in PECOS verified twice a year, on a date that is not “when we remember”.
- A named owner for the PECOS I&A account, with a second person who can get in if the first is unreachable.
- Treat any change of ownership, address, structure or licence status as a trigger for an enrolment review, not only for the legal paperwork.
- CAQH attestation every 120 days and commercial recredentialing on its own three-year track, tracked in the same place so nothing lives in two systems.
If that sounds like a job rather than a task, that is because it is one. It is the reason we run credentialing and enrollment as a standing process for practices rather than a one-off project, see our credentialing and payer enrollment services for how the calendar is maintained, including the retroactive billing window and effective dates.
If you are staring at a deactivation right now
The sequence is: confirm what was deactivated (group, individual, or both), pull the last accepted enrollment application and the notice, fix the data mismatch that caused the non-response, file the reactivation through PECOS, and then reconcile every claim that was denied or held during the gap, that reconciliation is a denial-management exercise, and it has its own timely-filing deadlines. Our medical billing team and denial management process work the same records, so enrollment dates get verified against the claim history rather than kept in a separate spreadsheet.
Questions practice managers ask
At least every five years for most providers and suppliers, but CMS may require it more frequently, high-risk categories can be revalidated sooner, and CMS can pull any record out of sequence if its data checks flag an inconsistency. Treat five years as the maximum interval, not a schedule you can rely on.
The notice states the deadline, which is typically 60 days from the date of the notice. If you need more time, request an extension from your MAC before the date passes, extensions are discretionary and far easier to obtain in advance. Exact windows vary, so confirm the terms in your own notice.
CMS deactivates the enrollment. Claims for services furnished while it is deactivated are not payable, eligibility checks begin failing, and reactivation means filing again as a fresh application. You generally regain the ability to bill retroactively for services in the 30 days before the reactivation application was filed, so filing quickly matters more than analysing the situation.
No. The group enrollment and each individual enrollment are separate records with their own revalidation dates and their own notices. Revalidating the group does not revalidate the individuals, and a single provider’s lapsed record can affect the claims of the practice that received their orders or referrals.
Online through PECOS in almost every case. It is faster, it validates data at entry rather than rejecting the application weeks later, and it avoids the paper application’s common failure modes, missing signatures, wrong form version, incomplete attachments. PECOS now requires a CMS Identity & Access account with multi-factor authentication, so confirm someone in the practice can actually log in before the deadline.
Yes: revalidation, reactivation and the ongoing enrollment calendar are part of our credentialing and payer enrollment services. We track each enrollment record with its cycle and correspondence details, file ahead of the deadline, and confirm effective dates in writing so billing knows exactly when a provider is billable.
The bottom line
Put every enrolment record on one calendar with its cycle, its correspondence address and a named owner. Practices rarely lose revenue to revalidation because the work is difficult. They lose it because nobody was holding the date.
Is your revalidation date on anyone’s calendar?
Send us your payer list and provider roster. We will check what is active, what is due, and what has been quietly deactivated, and tell you plainly what needs filing and by when.
Request a free enrollment reviewMedicare enrollment rules, revalidation cycles and reactivation windows vary by provider type, supplier category and MAC. Confirm the specifics for your enrolment record with your Medicare Administrative Contractor. This article describes the process, not legal advice.
