How do you revalidate a Medicare enrollment before it lapses?
Look up the due date, wait for the notice from your Medicare administrative contractor and submit the application in PECOS within 60 calendar days. Providers other than DMEPOS suppliers revalidate every 5 years under 42 CFR 424.515.
Written by Salman Saeed, CEO and Co-Founder · Reviewed by a Certified Medical Coder · 
In short: watch the Medicare Revalidation List, then file in PECOS within 60 calendar days of the notice. CMS grants no extensions, and a miss can bring a payment hold or deactivation, with no payment for services while deactivated.
How do you revalidate a Medicare enrollment?
Look up the due date, wait for the revalidation notice from your Medicare administrative contractor, and submit the application in PECOS within 60 calendar days of that notice. Under 42 CFR 424.515, providers and suppliers other than DMEPOS suppliers must resubmit and recertify their enrollment information every 5 years to keep billing privileges.
CMS says a late revalidation can lead to a hold on your Medicare reimbursement or to deactivation of billing privileges, and that it grants no extensions. This post covers the order of work and the dates to watch. For the wider rules see the credentialing and enrollment service page and the Medicare payer page.
How do you find the due date?
Search the Medicare Revalidation List on CMS.gov, which shows the due date for an individual or organizational provider. CMS posts due dates seven months in advance, and it tells providers they remain responsible for tracking their own due date even though notices are sent.
| Where you are | What CMS says to do |
|---|---|
| Due date more than seven months away, no notice received | Do not revalidate. CMS returns unsolicited revalidations. |
| Notice received, about three to four months before the due date | Revalidate. The notice arrives by email or U.S. mail from your enrollment contractor. |
| Within three months of the due date and no notice received | Revalidate anyway. CMS says to do so even if you have not been notified. |
| Past the due date | A payment hold or deactivation can follow, covered below. |
The Program Integrity Manual explains that PECOS tracks due dates, sends the notice and prevents a PECOS revalidation from being submitted outside the window. The notice goes to the contact email on file in PECOS, so a notice sent to a former employee's inbox is one way this process fails. Make sure the address belongs to someone who still works there.
What are the steps once the notice arrives?
A change report sent after the notice is processed on its own and is not merged with the revalidation. If you file a form marked as a revalidation that contains only changes, the manual says the contractor will ask for a complete application and treat it as a revalidation.
What changes for a group with many providers?
Every individual practitioner and the group itself have their own enrollment and their own due date, so a group needs a list of all of them. Look each one up in the Medicare Revalidation List and track them in one place with the notice date, the 60-day date and the submission date.
The stakes for reassignment are real. The Program Integrity Manual says that if a supplier fails to respond to the revalidation request, all of that supplier's reassignments are end-dated. A physician who misses the date can stop the group from being paid for that physician's services. The PECOS enrollment post explains how reassignment is set up, and the credentialing new locations guide covers the change reports.
What happens if you miss the date?
CMS says failing to revalidate on time could result in a hold on Medicare reimbursement or deactivation of billing privileges. Once deactivated, you must resubmit a complete enrollment application, and Medicare does not pay for services during the deactivation period. 42 CFR 424.540(e) states that a provider may not receive payment for services furnished while deactivated.
Deactivation can be retroactive. Under 42 CFR 424.540(a)(3), CMS may deactivate if complete and accurate information is not furnished within 90 calendar days of the notification, and 42 CFR 424.540(d)(1)(ii) allows the effective date to reach back to the date the provider became non-compliant. Reactivation is not retroactive: the effective date is the date the contractor received the reactivation submission that was processed to approval.
An internal medicine practice gets a revalidation notice dated February 14, 2028, for a due date of May 31, 2028. It does not act, and the physician's billing privileges are deactivated effective June 1, 2028. A complete application is received on July 13, 2028 and later approved. The physician sees about 20 Medicare patients a week at an average allowed amount of $90.
The services in that gap were still delivered, and the money for them is the practice's loss, not a delay. Filing the revalidation before April 14, 2028 would have avoided all of it. The Medicare one-year filing limit in 42 CFR 424.44 keeps running on any claims you hold, and the timely filing limits rule lists it with other payers.
What other enrollments renew on their own clock?
Medicare revalidation does not renew anything else. State Medicaid agencies must revalidate every provider at least every 5 years under 42 CFR 455.414, CAQH profiles need re-attestation, and each commercial plan recredentials on its own cycle. The post on why credentialing takes so long gives the Medicare Advantage and UnitedHealthcare cycles, and the CAQH profile post covers re-attestation.
How Nucleus Align handles revalidation
We diary the revalidation and change-report dates for every provider and group, file in PECOS or on paper and follow up with the MAC. See the internal medicine billing page for how this fits a practice, book a call, or read more in the blog.
- Revalidations (renewing your enrollment) · CMS
- 42 CFR 424.515 Requirements for reporting changes and updates to, and the periodic revalidation of, Medicare enrollment information · eCFR
- 42 CFR 424.516 Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program · eCFR
- 42 CFR 424.540 Deactivation of Medicare billing privileges · eCFR
- 42 CFR 424.525 Rejection of a provider's or supplier's application for Medicare enrollment · eCFR
- Medicare Program Integrity Manual, Chapter 10: Medicare Enrollment · CMS
- CMS-855I Medicare enrollment application, physicians and non-physician practitioners · CMS
- 42 CFR 424.44 Time limits for filing claims · eCFR
- 42 CFR 455.414 Revalidation of enrollment · eCFR
We check every rule, code and deadline against the official source. See our editorial policy.
Common questions
Straight answers from the team that does the work.
Ask a billing lead directly. A 20-minute call, Monday to Friday, 9am to 5pm Eastern.
01How often must Medicare enrollment be revalidated?
Every 5 years for providers and suppliers other than DMEPOS suppliers, under 42 CFR 424.515, and every 3 years for DMEPOS suppliers. CMS can also ask for an off-cycle revalidation. CMS contacts each provider directly when it is time and you must respond within 60 calendar days.
02How do you find your Medicare revalidation due date?
Search the Medicare Revalidation List on CMS.gov, which shows the due date for an individual or an organization. CMS posts due dates seven months in advance. The enrollment contractor sends a notice about three to four months before the due date.
03Can you revalidate early?
Not more than seven months before the due date unless you have received a revalidation notice. CMS returns those unsolicited revalidations. If you are within three months of the due date and have not received a notice, CMS says to revalidate anyway.
04What happens if you do not revalidate on time?
CMS may place a hold on your Medicare reimbursement or deactivate your billing privileges. After deactivation you must submit a complete enrollment application, and Medicare does not pay for services furnished while you are deactivated. CMS does not grant extensions.
Talk to a billing lead.
A 20-minute call about your payers, volume and setup. Monday to Friday, 9am to 5pm Eastern.