Recredentialing fails quietly. Nothing stops on the day a file goes stale. Claims still go out, appointments stay booked, and the payer’s system stops recognizing the provider months later, usually inside a denial queue that nobody connects to a credentialing date. The fix is one calendar holding every provider, every payer and every last date of action, reviewed on a rhythm that surfaces a gap ninety days before it lands.
What this covers
- Medicare revalidation runs on a five-year cycle, and the application is due within 60 calendar days of the CMS notice
- Commercial and Medicare Advantage recredentialing usually follows the 36-month NCQA cycle, counted from the last credentialing decision
- A CAQH profile expires 120 days after the last attestation, and directory confirmation requests arrive on a 90-day rhythm
- A calendar needs a last date of action, not a due date: the file has to open 120 to 150 days before the deadline
- In ABA the BCBA carries the credential while the technician roster changes constantly, so roster work belongs on the same calendar
There is no grace period for recredentialing.NCQA, on the 36-month recredentialing cycle
Credentialing gets attention when a provider joins a practice. Recredentialing gets attention when a claim denies, and by then the file has usually been out of date for months. The difference is administrative. Initial credentialing has a person driving it toward a start date. Recredentialing sits in the background until a date passes, and the date passes in silence.
Four clocks run at once
A practice does not have one recredentialing cycle. It has four, set by different authorities, counted from different starting points, and they rarely line up. A provider can be current with Medicare, lapsed with a commercial plan, and six weeks past a CAQH attestation at the same time. Each of those states blocks revenue in a different way.
| Clock | Who sets it | Length | Starts from |
|---|---|---|---|
| Medicare Part B revalidation | CMS under 42 CFR 424.515 | 5 years, 3 years for DMEPOS suppliers | The last validated enrollment record |
| State Medicaid revalidation | The state agency under 42 CFR 455.414 | At least every 5 years, more often at state discretion | The state enrollment record |
| Commercial and Medicare Advantage recredentialing | The payer, following NCQA standards | 36 months | The date of the previous credentialing decision |
| CAQH attestation | CAQH Provider Data Portal | 120 days, 180 days for Illinois providers | The date of the last attestation |
Two details explain most of the drift. NCQA counts its 36-month cycle to the month, not the day, and the cycle begins on the date of the prior credentialing decision, which is a committee date rather than a contract anniversary. State Medicaid programs must revalidate at least every five years, but many do it more often, and several tier the frequency by the provider’s risk level. A calendar built on contract dates will be wrong for both.
The notice is not the deadline
CMS posts Medicare revalidation due dates about seven months in advance, and the Medicare Administrative Contractor sends a notice three to four months before the due date. Both exist so the practice can plan. Practices that treat the notice as the starting gun are already behind, because the notice is the last warning rather than the first.
The regulation sets two different numbers, and confusing them is expensive. Under 42 CFR 424.515, a provider must submit the enrollment application within 60 calendar days of CMS notification. Under 42 CFR 424.540, CMS may deactivate billing privileges when complete and accurate information is not furnished within 90 calendar days of that notification.
The ninety day figure is when CMS may act, not a buffer you can plan around. The obligation is sixty days. If the contractor later asks for additional documentation, the response window is often thirty days, and missing it can end in deactivation before the original deadline is even in view.
The CMS revalidation page is blunt about the consequences. A late revalidation can put a hold on Medicare reimbursement or deactivate billing privileges. Once deactivated, the practice must submit a complete enrollment application to reactivate, and Medicare will not pay for services furnished during the deactivated period. There are no exemptions and CMS does not grant extensions.
One counterintuitive rule belongs in the calendar notes. Do not file more than seven months before a due date unless a notice has arrived, because CMS returns unsolicited revalidations. Once the due date is within three months, file whether or not a notice has arrived.
The columns that make the calendar work
Most practices already have a spreadsheet. The problem is usually its unit of analysis. A row per provider hides the payer-specific dates that actually govern billing, and a row per provider per payer still hides the line of business, which matters when a Medicaid MCO and a commercial plan run different cycles for the same clinician.
A BCBA with three commercial plans, two Medicaid MCOs and Medicare needs six rows. Each carries its own cycle, its own decision date and its own status.
Not the contract start date and not the effective date on the fee schedule. The committee decision starts the 36-month clock, so that is the date the next cycle counts from.
Set it 150 days before the due date for commercial and Medicare Advantage files, and 120 days before for Medicare revalidation. The last date of action is the column that triggers work.
Credentialing dates die when responsibility is shared. One person owns the calendar, and a second can run the attestations and submissions when the first is out.
Attestation confirmation, committee approval letter, payer effective date notice. When a claim denies eighteen months later, the evidence answers the question faster than the portal.
Payer portals are not a substitute. Each shows only its own relationship, and none shows the next date across every payer. Export each roster quarterly and reconcile it against the calendar. The portal is the source of truth for status, and the calendar is the source of truth for timing.
A review rhythm that catches gaps ninety days out
A calendar that nobody reads is a record of past failures. The review rhythm is what turns dates into work. The cadence below fits a practice of any size because the monthly and quarterly items are sweeps, not projects.
| Interval | What gets checked |
|---|---|
| Monthly | Every CAQH attestation date, plus any license, certification or malpractice policy expiring within 120 days |
| Every 90 days | Roster reconciliation against each payer’s roster and directory listing, including technicians and new hires |
| 150 days before the due date | File opened, documents requested from the provider, application drafted in the payer portal |
| 90 days before | Owner reviews the file, and anything unresolved escalates to the practice manager with a name attached |
| 60 days before | Submission confirmed and receipt captured in the payer system, with a screenshot or confirmation number |
| 30 days before | Effective date confirmed in writing, or the reason for the delay documented and the payer contacted |
The ninety day review is the one that earns the calendar. At that point there is still time to replace a missing document, re-attest a CAQH profile, or finish a fingerprint appointment without the deadline moving. Past sixty days, the options narrow to escalation and apology.
- Is the credentialing decision date in the row, or only the contract date?
- Is every document in the file current at the committee decision rather than at submission?
- Has the provider attested in CAQH since the file opened?
- Does the payer’s roster list match the practice’s roster, including part-time and new technicians?
The expirables that cause most misses
The cycle date is rarely what breaks. The break is a document inside the file that expires on its own schedule and goes unnoticed because the recredentialing due date is still months away. Each item below needs its own expiry date in the calendar row, not a note in a folder.
- State medical or behavioral health license, including multistate licenses the provider holds but does not use
- DEA registration, which renews on its own multi-year schedule and is easy to forget when prescribing is infrequent
- Board certification, including maintenance of certification dates
- Malpractice face sheet with current coverage limits and retroactive date
- CLIA certificate of waiver for any location running point-of-care testing
- BACB certification for BCBAs, BCaBAs and RBTs, plus any state behavior analyst license
- CAQH attestation date, which expires 120 days after the last attestation
- NPI record in NPPES, including taxonomy codes and practice locations
- Medicare reassignment and group linkage for every practice location
Two of these deserve their own reminder. The malpractice face sheet renews annually and is the most common lapsed document in a file that is otherwise complete. The NPPES record is where taxonomy errors live, and a taxonomy mismatch can pass credentialing while failing at the claim, which sends the denial to the billing team instead of the credentialing team.
NCQA requires credentials to be current at the time of the committee decision, and it shortened several verification aging limits in its 2025 standards. A file assembled too early can go stale before it is reviewed, so the last date of action is a window, not a starting point.
In ABA the credential sits with the BCBA, the roster moves underneath
Behavioral health adds a structural wrinkle. Most payers credential the organization under a Type 2 NPI and credential each BCBA individually, while technicians are not credentialed at all. They are rostered under their supervising analyst. That means the group’s ability to bill depends on two things staying current at once, and one of them changes every few weeks.
The billing linkage is the reason. Hours furnished by a technician under a treatment protocol bill under the supervising BCBA’s credential, commonly with 97153 for adaptive behavior treatment by protocol. A technician who is not on the payer’s roster produces a denial even when the BCBA’s file is perfect, and the denial reads like a coding problem rather than a roster problem.
Taxonomy is the second trap. A BCBA enrolled under a generic behavioral health taxonomy can pass credentialing and still fail at the claim, because the payer’s system matches the rendering provider’s specialty to the service. Verify the taxonomy on the NPPES record and on the payer’s own provider file, since the two can drift apart after an update.
New hires move faster than most practices expect, but only when the group enrollment is structured for it. Adding a credentialed analyst to an existing group contract is a roster change. A provider with no existing relationship needs an application, a committee review and an effective date, and payers generally set that effective date from the submission, not from the hire date. Building the credentialing process around roster additions is what keeps a growing ABA practice from carrying weeks of unbillable supervision.
Put roster reconciliation on the same ninety day sweep as the credential dates. Compare the practice’s technician list to every payer roster, and send updates in one batch per payer rather than one at a time as staff mention them.
When a date slips anyway
Every practice misses one eventually. What separates a bad week from a bad quarter is how quickly someone establishes the provider’s real status and communicates it to the people booking patients.
- Check the payer portal first, not the calendar. The calendar holds the date, the portal holds the status, and they disagree often enough that the portal wins.
- Determine whether the file lapsed or the decision is merely late. A late decision with a current file is recoverable; a lapsed network status usually needs reinstatement or a new application.
- Ask the payer what the effective date will be. It is frequently the submission date rather than the approval date, which tells you how many claims sit in the gap.
- Tell scheduling and intake the same day, and pause new bookings under that provider until the effective date is confirmed.
The commercial consequence is governed by the payer’s own credentialing policy, and NCQA’s standard leaves little room. If the recredentialing decision is not made within 36 months, there is no grace period. A file completed within 30 days of the original due date can still be processed as recredentialing. Past that, the practitioner generally has to go through initial credentialing again, which resets the clock and costs far more than the original file.
Medicare is a separate repair. A deactivated provider must submit a complete enrollment application, and reactivation takes effect from the date the contractor received the submission. Every claim for services furnished while deactivated is unpaid and stays unpaid. That is the reason the Medicare row in the calendar gets a 120-day head start rather than the 150 days used for commercial files.
Then close the loop on the cause. If the miss came from a document nobody owned, the document gets an owner. If it came from a person who left, the backup role gets filled. The medical billing services side of the practice sees the damage first, in denials coded as provider ineligible, so ask the billing team which denials trace to credentialing before declaring the repair finished.
Recredentialing questions practices ask
Most providers and suppliers revalidate every five years under 42 CFR 424.515, while DMEPOS suppliers revalidate every three years. CMS also runs off-cycle revalidations, so a due date can arrive early. Once CMS notifies you, the application is due within 60 calendar days, and CMS does not grant extensions.
No. Revalidation renews an enrollment record with Medicare or a state Medicaid program. Recredentialing is a payer’s periodic review of a provider’s qualifications, usually on a 36-month cycle. The two use different dates, different portals and different consequences, so one calendar has to hold both.
The profile moves to expired status the day after the attestation is due, and payers pulling your data see that status rather than the record. Applications and recredentialing files stall until someone re-attests. Re-attestation itself is quick, so the cost is the weeks the file sat stalled without anyone noticing.
Open commercial and Medicare Advantage files about 150 days before the due date, and Medicare revalidation files about 120 days out. That leaves room to collect documents, replace an expiring malpractice face sheet, and answer a payer request without the deadline moving. Starting at 60 days turns a routine file into an escalation.
It depends on whether the payer already has a relationship with that provider. A clinician credentialed elsewhere can often be added to an existing group contract as a roster change. A provider new to the payer needs a full application and committee review, and the effective date usually runs from submission rather than the hire date.
One named person with a named backup, usually in credentialing or the billing office rather than at the front desk. The owner maintains dates, runs the ninety day review and escalates gaps. Shared ownership across a busy practice reliably produces the failure the calendar exists to prevent.
No. Each portal shows one payer’s relationship and one payer’s status, and none of them shows the next date across every payer and line of business. Portals are the source of truth for status. A calendar is the source of truth for timing, and the practice needs both.
The bottom line
The calendar is small infrastructure, and it only works if the review rhythm survives a busy month. A practice that knows its next five deadlines, and who owns each one, will not discover a lapsed credential inside a denial report. That is the whole return: fewer surprises that arrive as unpaid claims.
Is your recredentialing calendar already behind?
We compare your provider roster against payer effective dates, flag the files inside ninety days of a deadline, and hand back a calendar your team can run. No obligation, and the gap list is yours either way.
Request a credentialing calendar reviewThis article describes federal enrollment rules and general payer practice. It is not legal advice, and each payer contract and state Medicaid program sets its own credentialing requirements.
