A pediatric group with offices in two states hires a nurse practitioner who will see patients in both. The credentialing coordinator opens the first state's portal and finds a familiar application: NPI, license, ownership disclosure, submit, wait. She opens the second state's portal and finds that the state wants a separate account with multi-factor authentication, a signed access agreement uploaded before the application can even start, and a note that unfinished applications are deleted after 90 days. Then the third surprise: in one of the two states the approval letter means she can bill; in the other it means she is now allowed to apply to each of the five managed care plans that actually pay the claims.
This is Medicaid enrollment. The federal rules are the same everywhere, and the experience is different everywhere. We keep a state file for every program we enroll providers in, and no coordinator works one state from memory of another.
Medicaid provider enrollment is governed by one set of federal screening rules, in 42 CFR Part 455, that every state must apply: screening by risk level, disclosure of ownership and control, exclusion checks, enrollment of ordering and referring providers, and revalidation at least every five years. What differs by state is the portal, the fiscal agent or vendor that operates it, the documents and signatures demanded, the processing time, and above all whether state enrollment alone makes a provider payable or merely eligible to contract with the managed care plans that pay most claims. The table below covers twelve representative states, verified against the state sites, grouped by how they enroll; the sections after it list what every application needs and how to track it all.
How do states differ in the way they enroll providers?
States sort into three patterns, and most belong to more than one. The first pattern is enrollment directly through the state agency's own system: the Medicaid agency (a Department of Health Care Services, a Health Care Authority, a Department of Human Services) runs the provider portal itself, and the portal name is usually an acronym for the state's Medicaid management information system. California's PAVE, Illinois's IMPACT, Washington's ProviderOne, Utah's PRISM, Indiana's Provider Healthcare Portal, Oregon's MMIS Provider Portal and Pennsylvania's PROMISe are examples. The second pattern is enrollment through a fiscal agent or vendor portal operated on the state's behalf: Texas enrolls through the Texas Medicaid and Healthcare Partnership's PEMS system under contract to the Health and Human Services Commission; Florida's Medicaid Web Portal is operated by the fiscal agent for the Agency for Health Care Administration; New York's eMedNY hosts the Provider Services Portal for the Department of Health; North Carolina uses NCTracks. The practical difference is where the help desk sits and whose rules the portal follows, not the legal requirements.
The third pattern is the one that catches practices: managed-care-first states, where most members are in a managed care plan and the state enrollment is a screening and registration step that makes a provider eligible to contract with each plan. Since Section 5005 of the 21st Century Cures Act took effect on January 1, 2018, every state must screen and enroll the providers in its managed care networks, so the state step is universal now; the question is whether it also makes you payable. In Tennessee, where TennCare is entirely managed care, the state registration produces a TennCare Medicaid ID that is required before a plan contract can be signed, and the plan contracts are where payment comes from. Oregon reports that more than 90 percent of Oregon Health Plan members are in coordinated care organizations, each of which does its own credentialing. Texas, Florida, Pennsylvania, Illinois and North Carolina all run large managed care programs alongside the state enrollment. A practice that enrolls with the state and stops there will be able to bill the small fee-for-service remainder and nothing else.
The reference table: twelve states
| State | Program and agency | Enrollment portal | Operated by | Requirements and features noted on the state site | Managed care |
|---|---|---|---|---|---|
| California | Medi-Cal; Department of Health Care Services | PAVE (Provider Application and Validation for Enrollment) | State agency portal | Separate paths for individual providers, groups and other health care businesses; profile created before the application; help desk on Pacific time | Medi-Cal managed care plans contract separately after state enrollment |
| Texas | Texas Medicaid; Health and Human Services Commission | PEMS (Provider Enrollment and Management System) | Texas Medicaid and Healthcare Partnership (fiscal agent) | Enrollment, re-enrollment and revalidation all in PEMS; Texas Medicaid enrollment is a prerequisite for other state programs; step-by-step guides and training in TMHP's learning system | STAR and STAR+PLUS plans credential and contract separately; PEMS enrollment required for each NPI and taxonomy combination |
| Florida | Florida Medicaid; Agency for Health Care Administration | Florida Medicaid Web Portal | Gainwell Technologies (fiscal agent) | Enrollment forms and background screening; options for new, renewal and out-of-state enrollment; portal notifications come from the fiscal agent's email domain | Managed care plans under the state's managed care program contract separately |
| New York | NYS Medicaid; Department of Health | eMedNY Provider Services Portal (PSP) | eMedNY (fiscal agent system) | New enrollment, reinstatement and maintenance for all provider types through the PSP; application fee for listed provider types; compliance program requirements under 18 NYCRR Part 521; revalidate only when notified | Medicaid managed care network providers must be enrolled with the state |
| Illinois | Medical Assistance; Department of Healthcare and Family Services | IMPACT (Illinois Medicaid Program Advanced Cloud Technology) | State agency portal | Preparing-to-enroll resources, provider revalidation FAQs and toolkits, a provider directory, and a separate high-risk provider track | Managed care plans contract separately after IMPACT enrollment |
| Pennsylvania | Medical Assistance; Department of Human Services | PROMISe | State agency portal | Enrollment, claims and eligibility in one system; dedicated provider enrollment phone line; provider handbooks and billing guides | Managed care plans contract separately after PROMISe enrollment |
| North Carolina | NC Medicaid; Department of Health and Human Services | NCTracks Provider Portal | Vendor-operated portal for the state | Online application with electronic signature and document upload; published average turnaround for clean applications (recently in the range of two to three weeks); credentialing committee and recredentialing processes | Managed care plans; the state publishes a managed care provider playbook |
| Washington | Apple Health; Health Care Authority | ProviderOne | State agency portal | "Enroll as a provider" pathway through ProviderOne, with login for enrolled providers | Apple Health managed care organizations contract separately |
| Indiana | Indiana Health Coverage Programs; Family and Social Services Administration | IHCP Provider Healthcare Portal | State agency portal | NPI and provider classification, type and specialty required; enrollment application fee for applicable types; risk-level screening; revalidation as a maintenance action | Separate step to enroll as a managed care program provider |
| Tennessee | TennCare; Division of TennCare | TennCare provider registration (web based) | State agency portal | A TennCare Medicaid ID is required to participate, including to contract with managed care organizations; instructions for the ownership section of the application | Entirely managed care; plans pay claims after state registration |
| Oregon | Oregon Health Plan; Oregon Health Authority | MMIS Provider Portal | State agency portal | Fillable PDF forms uploaded through the portal (10 MB limit) or faxed with a coversheet; prescribers must be enrolled for prescriptions to be covered; revalidation at least every five years | Coordinated care organizations serve more than 90 percent of members and run their own credentialing |
| Utah | Utah Medicaid; Department of Health and Human Services | PRISM | State agency portal | Utah-ID account with multi-factor authentication; PRISM Access Agreement and Health Care Provider Access Agreement; unfinished online applications purged after 90 days | Managed care plans contract separately after PRISM enrollment |
Notes on the rows
- California. PAVE asks you to choose the enrollment path before anything else, and choosing "individual" when the entity should enroll as a group is the most common restart we see. The help desk keeps Pacific hours, which matters for East Coast coordinators.
- Texas. PEMS is strict about the NPI and taxonomy combination: a provider enrolled under one taxonomy who bills a managed care plan under another will be told to enroll the second combination. TMHP posts revalidation due date notices, and the state treats Texas Medicaid enrollment as the gate to its other programs.
- Florida. Background screening is part of enrollment, and the portal's automated emails come from the fiscal agent's domain, so whitelist it or the practice will miss the request for more information.
- New York. The PSP replaced paper for all provider types. Check the published list of provider types that owe an application fee, and do not attempt revalidation until eMedNY tells you to; the site says so explicitly.
- Illinois. IMPACT separates "preparing to enroll" material from the application itself; read it, because the system expects the documents in a particular order. High-risk provider types have their own track.
- Pennsylvania. PROMISe is one system for enrollment, claims and eligibility; the dedicated provider enrollment phone line is the right first call.
- North Carolina. NC Medicaid publishes average turnaround times for clean applications on the enrollment page, which is the most transparent reporting we know of; the figure moves month to month, so read it rather than quoting it.
- Washington. ProviderOne is both the enrollment and the billing system; start from the Health Care Authority's "become an Apple Health provider" pages.
- Indiana. Indiana is explicit that provider classification, type and specialty must be chosen correctly and that risk-level screening applies; managed care enrollment is a separate step after IHCP enrollment.
- Tennessee. Registration with TennCare is a prerequisite, not a payer relationship; the plans pay and each plan credentials.
- Oregon. Oregon still accepts fax with a coversheet and runs free enrollment webinars; prescribers who are not enrolled will see their patients' prescriptions rejected at the pharmacy.
- Utah. The 90-day purge of unfinished applications is the trap: gather every document before starting, because a half-finished application does not wait for the missing malpractice certificate.
What does every Medicaid application need?
Whatever the portal looks like, the federal rules make the core packet predictable. Every application needs the provider's NPI with a taxonomy code that matches the NPPES record and the enrollment type, an active state license (and the state's own license if the provider is enrolling across state lines), a DEA registration where the provider prescribes, and the entity's tax identification with a W-9. Every application requires disclosure of ownership and control under 42 CFR 455.104: the names, addresses, dates of birth and Social Security numbers of every person with a five percent or greater direct or indirect ownership interest, of managing employees, and of any related entities, plus disclosure of criminal convictions related to federal health care programs. States check applicants, owners and managing employees against the HHS Office of Inspector General's List of Excluded Individuals and Entities and the federal exclusion databases, and most ask the practice to attest that it does the same for its staff.
Screening follows the risk level in 42 CFR 455.450: physicians, non-physician practitioners and physician groups are generally "limited" risk, which means license verification, database checks and exclusion screening; "moderate" risk adds an unannounced site visit; "high" risk (newly enrolling home health agencies and durable medical equipment suppliers, and providers the state elevates) adds fingerprint-based criminal background checks of five percent or greater owners. States may rely on screening already completed by Medicare or another state's Medicaid program, so a current Medicare enrollment speeds things up and most portals ask for the PTAN or the Medicare enrollment status. Institutional providers owe the application fee, which tracks the Medicare fee and changes every year; physicians and groups do not. Ordering, referring and prescribing providers must be enrolled even if they never bill Medicaid, because claims that carry an unenrolled ordering provider are denied. And since the Cures Act, every provider in a managed care network must be enrolled with the state, so the plan contract does not substitute for the state application.
Beyond the federal floor, the state-specific items are the ones to look up each time: a portal account with its own identity verification and a signed access agreement (Utah), state-run background screening (Florida), a compliance program certification (New York), a published application fee list (New York, Indiana), and separate enrollment per NPI and taxonomy combination (Texas). Our rule is that the coordinator reads the state's enrollment page on the day the application starts, because the portals change.
How to find any state's program
Every state Medicaid agency has a provider enrollment page, and finding it is a three-step search. Start with the state agency: Medicaid lives in a department with a name like Health Care Services, Health and Human Services or Health Care Authority, and the program often has a brand name (Medi-Cal, Apple Health, TennCare, SoonerCare, Oregon Health Plan) that is a better search term than the word Medicaid. Second, find the provider section of that site and look for "enroll", "become a provider" or the portal acronym; the enrollment page names the system, says who operates it, and links the provider manual and forms. Third, find the managed care page and the list of contracted plans, because that list is your second set of applications. Medicaid.gov keeps a state-by-state overview and state agency contacts. The credentialing timeline tool gives planning ranges for state and plan enrollment, and the enrollment team keeps current state files for the programs we work in.
How to build the tracking system
The tracker that works for Medicaid has one row per provider per program per plan, not one row per provider. A nurse practitioner enrolled in two states with four managed care plans in each is nine rows: two state enrollments and eight plan contracts, each with its own dates. The columns we keep are: state; program and agency; portal name and URL; the portal login owner inside the practice (portal credentials die when a coordinator leaves, so this column has a name and a backup); provider name, NPI and taxonomy used; enrollment type (individual, group, reassignment); application date; tracking or application number; status with the date of the last check; state Medicaid provider ID; effective date; revalidation due date; application fee paid and date where it applies; the plan (for managed care rows) with its contract application date, credentialing decision date, effective date and recredentialing date; and the date each ownership and control disclosure was last updated. Add a document expiration block for the license, DEA, malpractice certificate and board certification, because a lapse in any of them is a maintenance action the state expects within its reporting window.
Three dates drive the follow-up rhythm. The status check date: every open application is touched on a fixed schedule, weekly for state enrollments and every two weeks for plan contracts, and the note says what the portal or the representative said. The revalidation date: states must revalidate at least every five years and most send notices, but the notice goes to whatever address and email are on file, so the tracker, not the inbox, is the source of truth, with a reminder six months out. The maintenance date: changes of address, ownership, managing employees, banking and license status have reporting deadlines (often 30 or 35 days by state rule), and the tracker should carry a "last change reported" column that is updated the same day the change happens. Printable versions of this tracker and the disclosure checklist are in the downloads library.
Questions we hear
Do we need to enroll with the state if we only want to join the managed care plans?
Yes. Since January 1, 2018, under Section 5005 of the 21st Century Cures Act, states must screen and enroll every provider in their Medicaid managed care networks, so the plans require the state enrollment (or a state Medicaid ID) before they will complete credentialing or contracting. In managed-care-first states such as Tennessee the state step is explicitly a registration that produces the ID the plans ask for. Plan the two steps in sequence: state application first, plan applications as soon as the state ID arrives, and in some states the plan will accept the application while the state enrollment is pending.
How long does Medicaid enrollment take?
It depends on the state and on whether the application is clean, and the range is wide. North Carolina publishes average turnaround for clean applications and the recent figures have been in the range of two to three weeks; other states commonly run from several weeks to a few months, and applications returned for missing items restart part of the clock. Managed care plan credentialing adds its own weeks or months after the state ID. The variables you control are completeness, the NPPES taxonomy match and the speed of your responses to requests for information; the variable you do not control is the state's queue, which is why we start Medicaid on the same day as Medicare rather than after it.
Is there an application fee?
For physicians, non-physician practitioners and physician group practices, generally no. The federal application fee applies to institutional providers and suppliers, it mirrors the Medicare fee, and it changes every year; states publish which provider types owe it (New York and Indiana both maintain lists) and credit a fee already paid to Medicare or another state in the same year. Check the state's list for the provider type you are enrolling rather than assuming either way.
Can a provider enrolled in one state bill a neighboring state's Medicaid program?
Only after enrolling in that state. Each state's program is separate, and most have an out-of-state or border provider enrollment path for practices that see the neighboring state's members regularly; Florida and North Carolina both show out-of-state options on their enrollment pages. The neighboring state may rely on the screening your home state or Medicare already performed, which shortens the process, but it still issues its own provider ID and expects its own disclosures. Emergency services for a member who happens to be out of state are handled differently, and the state's provider manual explains how.
What happens if we miss revalidation?
The state deactivates or terminates the enrollment, claims deny from the termination date, and in most states the fix is a new application rather than a reinstatement, which means a gap with no payment for Medicaid dates of service. Managed care plans typically terminate their contracts when the state enrollment ends, so one missed notice can take down every Medicaid payer at once. The federal rule requires revalidation at least every five years; some states run shorter cycles for some provider types, and New York tells providers to wait for an individual notice. Carry the date in the tracker with a six-month reminder and confirm the agency has a current address and email for every enrolled provider.
Sources and references
- Resources for State Medicaid Agencies, CMS: program integrity resources for state agencies, including best practices for provider enrollment disclosures, exclusion searches and managed care compliance that explain what states ask applicants for.
- Exclusions Program, HHS Office of Inspector General: the List of Excluded Individuals/Entities that states screen applicants, owners and managing employees against, and the penalties for employing excluded persons.
- Provider Enrollment, Texas Medicaid and Healthcare Partnership: the PEMS enrollment, re-enrollment and revalidation hub for Texas Medicaid, with guides, training and revalidation notices.
- Provider Enrollment, eMedNY (New York State Medicaid): the Provider Services Portal entry point, enrollment guides by provider type, application fee list, revalidation and managed care network enrollment information.
- Enroll as a provider, Washington State Health Care Authority: the Apple Health enrollment pathway through ProviderOne.
- Provider Enrollment, NC Medicaid: the NCTracks enrollment process, published application turnaround times, credentialing and recredentialing, and out-of-state enrollment.
- Oregon Health Plan (OHP) Provider Enrollment, Oregon Health Authority: enrollment through the MMIS Provider Portal, prescriber enrollment, the five-year revalidation cycle and how coordinated care organizations credential separately.
