The call usually comes on a Tuesday. A biller notices that every Medicare claim for Dr. Patel has denied since the first of the month. Nobody changed anything. The MAC, when someone finally reaches them, explains that the revalidation notice went to the address on file in 2018, the due date passed, and the enrollment was deactivated. Reactivation takes weeks. The claims in between are, at best, delayed; at worst, a portion is lost to the gap.
We see a version of this several times a year, and it is never a competence problem. The coordinator who set up the enrollment knew the revalidation was due in five years. Then she left, or moved to a different role, or the reminder lived in her personal calendar. Revalidation is a memory problem, and the fix is a document, not a person.
Key takeaways
- Revalidation is broader than Medicare: licenses, DEA, CAQH, commercial recredentialing, malpractice and privileges all expire, and any lapse can stop payment.
- Look up the Medicare due date in the CMS revalidation tool rather than calculating it; CMS posts dates seven months ahead and returns applications sent earlier than that.
- One row per provider per item, with a "work must start" date, an owner, a reference number and a confirmation date. The last two are the columns that win arguments with payers.
- The calendar lives in a shared place the practice controls, and the monthly routine is written down so it survives the next resignation.
What has to be on the calendar
Revalidation is broader than Medicare. Every credential and enrollment a provider holds has an expiration, and any of them lapsing can stop payment or, worse, create a compliance issue.
| Item | Typical cycle | What happens if it lapses |
|---|---|---|
| Medicare enrollment (PECOS) | Every 5 years (DMEPOS suppliers every 3); CMS sets the due date | Deactivation; claims deny until reactivated, with a possible gap in billing privileges |
| Medicaid enrollment | Typically every 5 years; varies by state | Termination; Medicaid managed care plans usually follow |
| Commercial payer recredentialing | Usually every 3 years (NCQA standard); some every 2 | Termination from the network; out-of-network processing or denial |
| CAQH ProView attestation | Every 120 days | Payers pulling from CAQH cannot complete recredentialing; applications stall |
| State medical license | Every 1 to 3 years by state | Everything else fails; practicing on a lapsed license is a legal matter |
| DEA registration | Every 3 years | Cannot prescribe controlled substances |
| Board certification | Varies by board; many with annual maintenance requirements | Payers and hospitals may require current certification |
| Malpractice coverage | Annual | Payers and hospitals require current face sheet |
| Hospital privileges | Every 2 years, usually | Cannot admit or perform procedures at the facility |
The Medicare due date is the one you cannot set yourself. CMS assigns it and publishes it in the revalidation lookup tool, where it can be found by NPI. Look it up rather than calculating five years from the original enrollment; the assigned date is what counts. Group enrollments have their own due dates separate from the individual providers who reassign benefits to the group, and both have to be on the calendar.
The fields the calendar needs
A spreadsheet is fine. What matters is the columns. For every row (one provider, one item): provider name and NPI; the item; the payer or agency; the identifier (PTAN, payer provider ID, license number, CAQH ID); the current expiration or due date; the lead time in days; the date work must start (due date minus lead time); the owner; the status; the date submitted; the confirmation or reference number; the date confirmed; and a notes column. The two columns people leave out are the reference number and the confirmation date, and those are the two that matter when a payer says they never received it.
Two more columns earn their place in practices with more than a few providers. A "documents needed" column lists what the application will ask for (current license copy, DEA certificate, malpractice face sheet, board certificate, CV with gaps explained) so the collection can start before the form is opened. And a "correspondence address verified" date records the last time someone confirmed with that payer where its notices go, because the notice that never arrived is the start of almost every lapse story we hear.
Lead times that actually work
CMS posts Medicare revalidation due dates about seven months in advance, and it returns unsolicited applications submitted more than seven months before the due date. The practical window is therefore the six months before the date; we would start gathering documents as soon as the date appears in the lookup tool and submit within the first month of the window. Commercial recredentialing typically begins with a payer request 90 to 120 days before the anniversary; if the request does not arrive, ask for it at 120 days rather than waiting. CAQH attestation is easy to do and easy to forget, so it belongs on a monthly routine rather than a calendar entry: on the first business day of each month, re-attest every profile due within the next 45 days. Licenses and DEA registrations should start 90 days ahead, because state boards can be slow and some require continuing education documentation that takes time to assemble.
| Item | Work starts | Submit by | Chase if no confirmation after |
|---|---|---|---|
| Medicare revalidation | When the date appears in the lookup tool (about 7 months out) | 5 months before the due date | 30 days |
| Medicaid revalidation | 120 days before | 90 days before | 30 days |
| Commercial recredentialing | 120 days before the anniversary | 90 days before | 45 days |
| State license | 90 days before expiration | 60 days before | 21 days |
| DEA registration | 90 days before expiration | 60 days before | 21 days |
| CAQH attestation | Monthly routine | Within 45 days of due | Not applicable |
The monthly routine
- Sort the calendar by "work must start" date. Everything in the next 30 days becomes this month's task list.
- Re-attest CAQH profiles due within 45 days.
- Check the status of every item marked submitted and not yet confirmed. Anything with no movement in 30 days gets a call, with the reference number in hand.
- Check the Medicare revalidation lookup for every provider once a quarter. Due dates occasionally appear or change.
- Confirm the correspondence address on file with every payer once a year. Revalidation notices go to the address in the payer's system, not the one on your letterhead.
The routine takes an hour or two a month for a practice with fewer than ten providers. It is the cheapest hour in the revenue cycle, and it is the one most often skipped because nothing visibly goes wrong when it is.
Make it survive turnover
Three rules. The calendar lives in a shared location the practice controls, not in someone's email or personal drive. At least two people can read it and one of them is the practice administrator. And the coordinator's job description includes handing it over, with a walkthrough, before their last day. If your credentialing is outsourced, the same rules apply to the vendor: the practice should be able to see the calendar at any time, and it should come back to the practice complete if the relationship ends.
Portal logins are the other thing that leaves with the coordinator. PECOS access through the Identity and Access Management System, CAQH logins, payer portal credentials and the state licensing board accounts should all be registered to a practice-controlled email address and recorded in the practice's password manager, with a second authorized user on each. A practice locked out of PECOS in the middle of a revalidation window is a practice with a very long month ahead.
A worked example
A five-provider family practice built its calendar from scratch. Nine payers, five providers, plus licenses, DEA, CAQH and malpractice: 87 rows. Building it took a coordinator two working days, most of it looking up dates and identifiers that were scattered across old emails and a filing cabinet. In the process she found that one physician's Medicare revalidation was due in eleven weeks and no notice had been received, because the correspondence address on file was the practice's previous suite. The application went in that month. Without the exercise it would have been the Tuesday phone call.
The same exercise found two commercial recredentialing cycles that had quietly passed. Both payers had continued paying, which happens; a payer that terminates a provider for missed recredentialing often does so months later, in a batch, and the practice learns about it from the denials. The coordinator contacted both payers, confirmed the providers were still listed as participating, and got the recredentialing applications in before either payer ran its clean-up.
Questions we hear
Can we bill during a Medicare deactivation gap?
Claims for dates of service during a deactivation period are generally not payable, though reactivation can in some cases be made effective back to the date the application was received. The details depend on the circumstances, and the practice should confirm with the MAC. The only reliable protection is not letting it happen.
Do commercial payers notify us before recredentialing is due?
Usually, but not reliably, and the notice goes to whatever contact they have on file. Treat the notice as a courtesy and the calendar as the system.
Who should own the calendar in a small practice without a credentialing coordinator?
The practice administrator, with the monthly routine on their own calendar. Or an outside team; Revelrex credentialing and provider enrollment maintains the revalidation calendar for every provider it enrolls, and the practice can see the dates and status in its dashboard.
What to do this month
- Look up every provider's Medicare revalidation due date in the CMS lookup tool and record it, along with the group's own due date.
- Build the spreadsheet with one row per provider per item, using the columns above, and fill in the dates you can find today.
- For every row where the date is unknown, assign someone to find it this month by calling the payer or checking the portal.
- Confirm the correspondence address on file with Medicare and your three largest commercial payers.
- Put the monthly routine on the shared calendar for the first business day of next month, with the administrator as the second reader.
