A pediatric practice we work with found out about a Medicare revalidation the hard way in February. Claims for one of their nurse practitioners started rejecting with a message that the provider was not enrolled. She had been enrolled for eight years. What had happened was ordinary: the revalidation notice went to the correspondence address on file, which was the office they closed in 2023, and nobody had checked the revalidation list online. Medicare deactivated her billing privileges. The claims for six weeks of visits were not payable, and the reactivation application went to the back of the contractor's queue.
Spring is when this shows up most, for no reason other than arithmetic. Medicare revalidation cycles are five years, and a lot of providers enrolled or last revalidated in the spring. CAQH re-attestations fall every 120 days regardless of season, and commercial recredentialing runs on three-year cycles that many payers batch into the first half of the year. If you have more than a handful of providers, something is due this month.
Key takeaways
- The Medicare Revalidation List at data.cms.gov, searched by NPI, is the reliable source for due dates. The mailed notice is not.
- Deactivation is not revocation, but there is no retroactive billing for the gap, and reactivation takes as long as a new enrollment.
- CAQH attestations expire after 120 days. Attest every 90 so a missed reminder never becomes an expiry, and upload the new malpractice certificate every January.
- One spreadsheet, one owner, reviewed every Monday, prevents nearly all of this.
Medicare revalidation: how the due date works
Every enrolled physician and non-physician practitioner must revalidate Medicare enrollment every five years. DMEPOS suppliers revalidate every three. CMS publishes a revalidation due date for each enrollment record, and the Medicare Administrative Contractor mails a notice roughly two to three months before it. The due date is the last day of a month.
The reliable way to find it is not the mail. It is the Medicare Revalidation List at data.cms.gov, which you can search by NPI. A due date shows as a specific month, or as TBD if the provider is not yet within the six-month window. Check every NPI in the practice at the start of each quarter and write down the result. It takes fifteen minutes.
If you miss the due date, the contractor can place a hold on payments and then deactivate the enrollment. Deactivation is not revocation; you can reactivate by submitting a full application. But there is no retroactive billing for the gap between deactivation and the new effective date, and in our experience reactivation applications take as long as a brand new enrollment. That is the six weeks of unpaid nurse practitioner visits.
What a lapse actually costs
Practices tend to think of a missed revalidation as paperwork. It is a revenue event, and the arithmetic is worth doing once so everyone understands why the spreadsheet matters.
| Item | Nurse practitioner example | How it was calculated |
|---|---|---|
| Medicare visits per week | 38 | From the schedule for the six weeks before deactivation |
| Average Medicare allowed per visit | $98 | Mostly 99213 and 99214 at the 85 percent NPP rate |
| Weeks without billing privileges | 6 | Deactivation date to the new effective date |
| Unbillable Medicare charges | About $22,000 | 38 visits times $98 times 6 weeks |
| Staff hours on reactivation | About 20 | Application, development responses, calls to the contractor |
| Commercial plans affected | 2 | Plans that require active Medicare enrollment as a network condition |
The commercial row is the one that surprises people. Some payer contracts, and most Medicare Advantage plans, require active Medicare enrollment. A deactivation can cascade into MA denials for the same provider, and those claims are not automatically fixed when Medicare reactivates. The practice in our example is still working the MA claims.
What the revalidation actually asks for
Revalidation is a complete review of the enrollment record, submitted through PECOS or on paper with the CMS-855I for individuals, the CMS-855B for the group, and the CMS-855R for reassignment of benefits. In practice the items that cause the most rework are:
- Practice locations that have changed since the last submission. Every location where the provider sees Medicare patients must be listed, and closed locations must be removed.
- Managing employees and owners. If the practice manager changed, the record is wrong.
- Reassignments. A provider who left the group and still shows a reassignment to your TIN creates confusion; a provider who joined and does not show one creates rejections.
- Correspondence and pay-to addresses. The pediatric practice above would have received the notice if this had been updated.
- Electronic funds transfer. Bank changes must be reported with the CMS-588 and a voided check or bank letter.
Changes of ownership and practice location have to be reported within 30 days; most other changes within 90 days. Revalidation is the point where unreported changes surface, and the contractor will develop the application (send a request for more information) for every one of them. Each development cycle adds weeks, and the contractor gives you a fixed window, typically 30 days, to respond before the application is rejected and you start over.
Our advice is to do the revalidation in PECOS rather than on paper, and to do it with the current record open in one window and a list of every change since the last submission in another. Most of the record will be correct. The point is to find the two or three fields that are not before the contractor does.
CAQH ProView: the 120-day rhythm
Most commercial payers and many Medicaid managed care plans pull credentialing data from CAQH ProView instead of asking for it directly. The data is only useful to them if the provider has attested that it is current, and attestation expires after 120 days. An expired attestation does not deactivate anything by itself, but it stalls every credentialing and recredentialing application that depends on it, and payers do not tell you that is why the file is stuck.
Our rule is to attest every 90 days, not 120, so a missed reminder does not become an expiry. While in the profile, check that the malpractice certificate, the DEA registration and the state license have current expiration dates and that a copy of each is uploaded. The malpractice certificate is the one that expires most often, because many policies renew on a calendar year and nobody uploads the new certificate in January. Also confirm that each payer you work with is authorized to view the profile; a payer that is not on the authorization list will ask for the whole packet by email instead.
Commercial recredentialing
Commercial payers recredential every three years under NCQA credentialing standards. They usually send a notice, usually to whatever contact they have on file, and they usually give 60 to 90 days. The failure mode is the same as Medicare: wrong contact, notice unseen, provider termed from the network for non-response, claims denied as out of network with CO-B7 or a plan-specific code, and a new credentialing application that takes 90 to 180 days depending on the payer.
The one difference worth knowing is that many commercial payers will reinstate a provider termed for non-response without a full new application if you catch it within a short window, often 30 to 60 days. Call provider relations the day you see the first out-of-network denial, not after the appeal fails.
A tracking sheet that works
You do not need software. One spreadsheet with one row per provider per payer:
| Column | Why it matters |
|---|---|
| Provider, NPI, payer, provider ID | Identity of the record |
| Initial effective date | Start of the cycle |
| Next revalidation or recredentialing due date | The date you are managing |
| Source of the date (PECOS list, payer letter, contract) | So the next person can verify it |
| Date checked | Quarterly check against the source |
| CAQH last attested and next due | Rolling 120-day clock |
| License, DEA, malpractice expirations | The documents payers ask for |
| Owner | The person who is accountable |
Sort by due date. Review the top of the list every Monday. The whole review takes ten minutes once the sheet exists, and building it for a ten-provider practice with fifteen payers takes about two days the first time.
Questions we hear
Can we revalidate early to get it out of the way?
Medicare asks that you wait until you are within the window and have received the notice or see the due date on the list. Unsolicited revalidations submitted more than six months early are generally returned. Early is fine for CAQH and for most commercial payers.
Our provider is deactivated. Can we bill under another provider while we wait?
Not for services the deactivated provider rendered. Billing under a different provider's NPI for services they did not perform is a false claim. The options are to hold the claims, submit the reactivation as fast as possible, and ask the contractor whether the new effective date can be set to the date the application was received.
Who should own this in a small practice?
One person, with a backup who knows where the sheet is. Practices that split it across the office manager, the billing lead and each provider's assistant are the ones that miss dates. If nobody has time, credentialing and provider enrollment is one of the easier functions to hand to an outside team because the work is all deadlines and documents.
What to do this week
- Search every NPI in the practice on the Medicare Revalidation List and record the due date or TBD.
- Log into PECOS and confirm the correspondence address and the managing employee on every enrollment record are current.
- Check the CAQH attestation date for each provider and attest for anyone past 90 days; upload the 2026 malpractice certificate if it is missing.
- Build or update the tracking sheet and name an owner and a backup.
- Pull any CO-B7 or out-of-network denials from the last 60 days and call the payer about each one now.
