A practice called us in late January because a payer had stopped paying one of its physicians. The claims were denying as provider not eligible on the date of service. The physician had been credentialed with that payer for eleven years. What had happened was ordinary: the payer's recredentialing cycle came due in October, the notice went to an email address of a manager who had left, and the payer terminated the participation in December. The practice was rebilling three months of claims and hoping the payer would reinstate retroactively. It depends on the payer, and often the answer is no.
Credentialing does not fail loudly. It fails quietly, months before the denial. The defense is a calendar with every recurring obligation for every provider, owned by one person, reviewed monthly. This is the one we keep. Frequencies are the typical ones; individual payers and states vary, and the calendar should record the actual date for each provider rather than the general rule.
Key takeaways
- Credentialing fails quietly; the denial that reveals it arrives months after the missed deadline, and retroactive reinstatement depends on the payer.
- Re-attest in CAQH every 120 days and check the Medicare revalidation lookup tool every January and July; those two habits prevent most terminations.
- Any change to an NPI record, including address and taxonomy, must reach NPPES within 30 days, and payers match claims against it.
- Events (a new provider, a departure, a move, a change of ownership) each start their own clock and belong on a second list next to the calendar.
- Point every correspondence address in PECOS, CAQH and the payer portals at a role-based mailbox the practice controls, not at a person.
The recurring obligations, by frequency
| Obligation | Typical frequency | Who sets it | What happens if missed |
|---|---|---|---|
| CAQH ProView re-attestation | Every 120 days | CAQH; used by most commercial payers | Profile shows expired; payers pause recredentialing and may suspend |
| NPPES record update | Within 30 days of any change | CMS | Address or taxonomy mismatches cause claim rejections and enrollment problems |
| Medicare revalidation (PECOS) | Every 5 years (every 3 for DMEPOS suppliers) | CMS; due date published in the revalidation lookup tool | Billing privileges deactivated; gap in payment that is usually not retroactive |
| Medicaid revalidation | Every 3 to 5 years, by state | State Medicaid agency | Termination; managed care plans follow |
| Commercial payer recredentialing | Every 3 years (36 months) | Payer, following NCQA standards | Participation terminated; claims deny as non-participating |
| State medical license renewal | Every 1 to 3 years, by state | State licensing board | Practicing on a lapsed license; payers terminate immediately |
| DEA registration | Every 3 years | DEA | Cannot prescribe controlled substances |
| CLIA certificate | Every 2 years | CMS | Lab claims deny; CO-B7 or similar |
| Hospital privileges reappointment | Every 2 years | Medical staff office | Loss of privileges; some payers require active privileges |
| Malpractice policy renewal | Annually | Carrier | Payers require a current certificate on file |
| Board certification maintenance | Varies by board | Specialty board | Some payers and hospitals require current certification |
The two that cause the most damage
Medicare revalidation. CMS publishes a due date for every enrolled provider and organization in its revalidation lookup tool, and the MAC sends a notice two to three months before. The notice goes to the correspondence address in PECOS, which is often the address of a billing company the practice no longer uses or a location the practice closed. Check the lookup tool for every provider and the group in January and July. If a due date shows, start the revalidation at least 90 days out. Deactivation for a missed revalidation creates a gap in billing privileges, and the reactivation is generally effective from the date the new application is received, not from the deactivation date. The claims in between are usually lost.
Two details about the lookup tool trip people up. A provider whose due date shows as "TBD" is not due yet and should not revalidate early; unsolicited revalidations are returned. And the group and each individual reassigning to it have separate due dates, so a group revalidation (CMS-855B) does not satisfy a physician's individual revalidation (CMS-855I), or the reverse. Put both kinds of records in the calendar. When a due date appears, gather what PECOS will ask for before starting: the current license, the practice locations with the exact suite numbers on file, the managing employees and owners with their dates of birth and Social Security numbers, the bank account for the electronic funds transfer, and the CLIA number if you bill lab services. A revalidation that stalls for a missing document sits in a development queue and the due date does not move.
Commercial recredentialing. Payers recredential on a three-year cycle, and the request goes to whoever the payer has on file. If your CAQH profile is current and the payer has authorization to access it, many payers complete recredentialing without contacting you at all. If the profile is expired, they cannot, and the next step is a letter you may not receive. Re-attesting every 120 days is the single cheapest thing on this list.
Events that trigger work outside the calendar
The calendar handles recurring obligations. A second list handles events, and every one of them has a clock.
- New provider joins: enrollment applications to every payer, ideally 90 to 120 days before the start date; reassignment of benefits in PECOS (form CMS-855R or the online equivalent); CAQH profile creation or update; hospital privileges.
- Provider leaves: termination with every payer and in PECOS; removal of reassignment; notify the state Medicaid agency; update NPPES if they were the group's authorized official.
- Practice moves or opens a location: NPPES within 30 days; PECOS practice location update; every commercial payer's location update, which for some payers is a new credentialing application.
- Change of ownership, tax ID or legal name: PECOS change of information within 30 days for ownership (some changes require a new enrollment); every payer contract; W-9 to every payer.
- Name change or new license for a provider: state board first, then NPPES, then every payer.
The 30-day NPPES rule surprises people. Any change to the information in a provider's NPI record, including practice address and taxonomy, must be reported within 30 days. Payers match claims against NPPES data more than they used to, and an address that differs from the claim is a common cause of front-end rejections that look like nothing else.
How to run the calendar
Put every obligation for every provider in one place with the actual due date, the payer or agency, the contact and the status. A spreadsheet is fine for a practice with fewer than ten providers; above that, a credentialing tool earns its cost. Review it on the first business day of each month and work anything due in the next 120 days. Keep the evidence: the confirmation page from CAQH, the PECOS submission receipt, the payer's approval letter with the effective date. When a payer says a provider was never recredentialed, the approval letter with a date is the argument.
Two habits round it out. Keep the correspondence addresses and email addresses in PECOS, CAQH and each payer portal pointed at a role-based mailbox that the practice controls, not at an individual. And when a provider's claims start denying for eligibility or participation, treat it as a credentialing incident on day one rather than a billing problem on day thirty.
Our credentialing and provider enrollment service maintains this calendar for every provider in a practice, including the CAQH re-attestations and the PECOS revalidation checks, and reports status monthly. The earlier piece on common credentialing delays covers what slows down a new enrollment; this calendar is about not losing the ones you already have.
Questions we hear
A payer says our physician's recredentialing lapsed and terminated her, but we never received a notice. Can it be reinstated retroactively?
It depends on the payer. Some will reinstate with the original effective date if you recredential quickly and can show the notice went to an outdated address. Many will not, and the claims in the gap are non-participating or denied. Ask in writing, escalate through provider relations, and fix the contact information while you wait.
Does re-attesting in CAQH every 120 days actually matter if nothing changed?
Yes. The attestation is the payer's evidence that the data is current. An expired attestation reads to the payer as unknown data, and several large payers will not process recredentialing against an expired profile. It takes ten minutes.
How much lead time does a new physician need before the start date?
Ninety days is the minimum we would plan around and 120 is comfortable. Medicare enrollment through PECOS generally takes 30 to 60 days when the application is clean, and Medicare allows billing for services back to the effective date, which can be up to 30 days before the application was received. Commercial payers are slower and mostly do not pay retroactively, so a physician who starts before the commercial contracts are effective is generating claims that will deny or pay out of network. If the start date cannot move, the practice can bill those visits under a supervising physician only where incident-to rules genuinely apply, which for a new physician seeing their own patients is rarely the case. Delaying the start or limiting the early schedule to Medicare and self-pay patients is the honest workaround.
What to do this month
- Build the calendar: every provider, every obligation in the table, the actual due date, the agency or payer, the contact and the status.
- Check the Medicare revalidation lookup tool for the group and every reassigned individual and record the due dates, including any that show TBD.
- Re-attest every CAQH profile now and set the 120-day reminders.
- Log into PECOS, CAQH and each payer portal and repoint the correspondence email and address to a role-based mailbox.
- Pull the last quarter's denials for provider not eligible or non-participating and match each to the calendar to find what was missed.
- Write the events list with the clock for each: new provider, departure, new location, ownership or name change.
