The most expensive credentialing failure is not a slow new-provider enrollment. It is an established provider whose claims stop paying in the middle of February because a license renewal lapsed in December, a CAQH attestation expired in January and a payer's recredentialing request sat in a spam folder. Nothing announces itself. The first sign is a denial with CO-B7 or a remittance message about provider eligibility, three to four weeks after the fact, by which time a month of that provider's claims are in question.
December is the right month for the review because so many items cluster around the year-end: state license cycles, malpractice renewals, hospital reappointment paperwork and the natural moment when practices look at next year's roster. Here is the checklist we use, the intervals behind it, and the roster that has to exist before any of it works.
Key takeaways
- Ten separate items expire on ten separate calendars for every provider; the practice, not the provider, has to track them in one place.
- CAQH re-attestation is due every 120 days (180 for Illinois providers), and the reminders go to the provider's email, which is why it is the item most often missed.
- Medicare revalidation is every five years, cannot be done more than six months early, and the group's own enrollment has a separate date.
- Payer recredentialing notices go to the address on file from the original application; if the practice moved, they are going to the wrong place.
- A 60-day remittance scan for CO-B7 and CO-185 by provider and payer finds the credentialing problems nobody has told you about yet.
The intervals, in one table
| Item | Typical interval | Who notifies you | What happens if missed |
|---|---|---|---|
| CAQH ProView attestation | Every 120 days (180 for Illinois providers) | CAQH emails the provider; practices often are not copied | Profile expires; payers pulling data see a stale profile and pause recredentialing |
| Medicare revalidation | Every 5 years (every 3 for DMEPOS suppliers) | MAC letter and the PECOS revalidation lookup tool | Billing privileges deactivated; claims deny; gap in payment |
| Medicaid revalidation | Every 5 years under federal rule; states vary in process | State Medicaid agency or managed care plan | Termination from the program; MCO claims deny |
| Commercial recredentialing | Every 36 months at most under NCQA standards | Payer letter or portal task, often to the address on file years ago | Termination from network; claims paid as out of network or denied |
| State medical license | Varies: annual or biennial, birthday or fixed date | State board | Practicing without a license; every payer terminates |
| DEA registration | Every 3 years | DEA renewal notice | Cannot prescribe controlled substances |
| Board certification | Board-specific maintenance cycles | Specialty board | Some payers and hospitals require it for participation |
| Hospital reappointment | Typically every 2 years | Medical staff office | Loss of privileges; affects payer applications that list them |
| Malpractice policy | Annual | Carrier | Coverage gap; CAQH document expires |
| NPPES record | Update within 30 days of any change | Nobody | Address and taxonomy mismatches; claim edits and directory errors |
The roster that makes the review possible
Every step below assumes a roster: one table, one row per provider per location per payer, with the dates. If this list does not exist in one place, it is the first deliverable, and the rest of the review waits for it. Most practices have the information scattered across the credentialing coordinator's inbox, the original enrollment applications and the provider's own memory. Pulling it together takes a day for a six-provider group and is the single most useful thing the review produces.
| Column | Source | Why it matters |
|---|---|---|
| Provider, NPI, location, taxonomy | NPPES | Mismatches here cause claim edits before any payer looks at credentialing |
| Payer, product line, effective date, provider ID | Welcome letters, payer portals | Tells you which claims are at risk when something lapses |
| Recredentialing due date | Ask the payer; most will tell you | The date nobody knows until the letter goes to the wrong address |
| Medicare revalidation due date and PTAN | PECOS revalidation lookup tool | Individual and group have separate dates |
| CAQH ID, last attestation date, authorized payers | CAQH ProView | Every payer pulls from here |
| License, DEA, board, malpractice, privileges expiration dates | Provider file | The documents behind every application |
| Correspondence address on file with each payer | Payer portal or a phone call | Where the recredentialing packet will actually be sent |
The December review, step by step
- Build or refresh the roster with the columns above, every provider, every location, every payer.
- Pull every expiration date. License, DEA, board, malpractice, hospital privileges, CAQH last attestation date, Medicare revalidation due date from the PECOS lookup tool, and the recredentialing date for each commercial payer.
- Flag anything due before June 30, 2025. Six months of runway covers payer processing time plus a round of missing-information requests.
- Re-attest CAQH for anyone past 90 days. Don't wait for day 120. Upload any document expiring in the next six months at the same time, and confirm that each payer the practice bills is authorized to view the profile.
- Check the mailing and email addresses on file with each payer and with PECOS. Recredentialing notices go to the address the payer has, which is often the practice's address from the original application.
- Run a claims check per provider per payer. Pull the last 60 days of remittances and look for CO-B7, CO-185 and any provider-eligibility remark codes. A pattern at one payer is a credentialing problem you have not been told about yet.
- Update NPPES for any provider who changed location, taxonomy, name or practice affiliation this year.
- Calendar the 2025 dates. One shared calendar, with reminders at 180, 90 and 30 days, owned by a role rather than a person.
Where CAQH goes wrong
The 120-day attestation is the item most practices know about and still miss, because the reminder goes to the provider's personal email and the provider deletes it. CAQH sends three reminders, at 15, 10 and 5 days before expiration, and all three go to the same inbox. The fix is administrative: the practice holds the CAQH login credentials with the provider's permission, or the provider forwards the reminders to a credentialing mailbox, and the credentialing coordinator attests on a fixed schedule (we use every 100 days) regardless of reminders. When the coordinator attests, they also review the documents tab, because an expired malpractice face sheet or license copy makes the attestation useless to the payer even though the status shows current. A payer that pulls a profile with an expired document does not call; it pauses the recredentialing file and waits.
Medicare revalidation deserves its own paragraph
CMS posts revalidation due dates in the PECOS revalidation lookup tool several months in advance, and the MAC sends a letter a few months before the date. Providers cannot revalidate more than six months early, and unsolicited early submissions are returned. The dangerous case is a group with a dozen providers whose due dates fall in the same quarter because they enrolled together; each needs its own submission, and the group's own enrollment (the organization PTAN) has a separate revalidation date that is easy to forget. Missed revalidation results in deactivation, and while reactivation restores billing, there is typically a gap during which claims for dates of service in the deactivated period are not payable. A group that bills $60,000 a month to Medicare for one provider and loses six weeks has a real number to explain to the owners.
A worked example
Consider a six-provider pediatric group with a nurse practitioner whose state license renews on her birthday in January, whose CAQH was last attested in August, and who received a recredentialing packet from a Blue plan in October at the address of a location the group closed in 2022. The license renews on time because she handles it herself. The CAQH profile expires in mid-December, four months after the August attestation. The Blue plan, unable to reach her and seeing an expired profile, terminates her from the network effective February 1. The group notices in March when three weeks of her claims come back denied with CO-B7. Reinstatement takes eleven weeks. The revenue in question is about $27,000, and roughly half of it falls outside the plan's filing window by the time she is reinstated, because the plan treats the reinstated provider as newly effective rather than continuously enrolled.
Every item in that chain is on the checklist above. The roster would have shown the closed location as the correspondence address. The 100-day attestation schedule would have caught the August date in November. The 60-day remittance scan in December would have shown nothing, because the termination had not happened yet, but the one in February would have shown it three weeks earlier than the AR report did.
Mistakes we see
Assuming the provider is handling it. Providers renew licenses because they must. They do not track payer recredentialing, because they have never seen the letter.
Treating CAQH as a one-time task. The profile is a living document that payers pull from continuously.
Not knowing the recredentialing dates. Payers will tell you if you ask. Most practices never ask.
Keeping the file in one person's head. When the credentialing coordinator leaves, so do the dates. The roster and the shared calendar are the practice's, not the coordinator's.
Forgetting the group enrollment. Individual providers get letters. The organization's own Medicare and payer enrollments have dates too, and a lapsed group enrollment stops every provider at once.
Questions we hear
A payer terminated a provider for non-response. Can we get the effective date restored?
Sometimes, and it depends on the payer. Ask in writing for reinstatement with the original effective date and explain the correspondence address problem, with proof that the address was updated elsewhere. Some plans will reinstate continuously; many treat the provider as newly credentialed, which is why the claims in the gap are at risk. Start the request the day you find the termination, not after the appeal on the first denied claim.
Should the practice hold the providers' CAQH logins?
With the provider's written permission, yes, or at minimum a delegated user. The alternative is depending on a provider to forward emails, and that fails. Record who holds access in the roster, and remove it when the provider leaves.
How far ahead should we start a Medicare revalidation?
As soon as the lookup tool shows the date and you are inside the six-month window. Gather the documents before that: the current license, the organizational documents, the bank letter for EFT if anything changed, and the managing employee list. The submission itself takes an hour once the documents exist and weeks when they don't.
What to do this month
- Build or refresh the roster with the columns in the table above, for every provider, location and payer.
- Re-attest every CAQH profile before the holidays and refresh any document expiring before June 30, 2025.
- Look up every provider's and the group's Medicare revalidation date in the PECOS tool and record them.
- Call the top five payers and ask for each provider's recredentialing date and the correspondence address on file; correct the address where it is wrong.
- Run the 60-day remittance scan for CO-B7 and CO-185 by provider and payer.
- Put every 2025 date on one shared calendar with reminders at 180, 90 and 30 days.
- If the practice would rather hand the tracking to someone else, the Revelrex credentialing and provider enrollment service maintains the roster, attests CAQH on schedule and works revalidations and recredentialing with the dates visible to the practice; rates are on the pricing page.
