Medicare revalidation is the periodic re-verification of a provider’s Medicare enrollment record. CMS requires every enrolled provider and supplier to resubmit and confirm their enrollment information on a set cycle, and the deadline is not a suggestion. Most providers and suppliers revalidate every five years. DMEPOS suppliers revalidate every three years. CMS states there are no exemptions and that it does not grant extensions.
The practical stakes are simple. Miss the due date and CMS can place a hold on your Medicare reimbursement or deactivate your billing privileges outright. Medicare does not reimburse for services furnished during a period of deactivation, and getting reinstated means filing a complete new enrollment application rather than a quick correction. A missed Medicare revalidation deadline on a form nobody wanted to own can stop a practice’s largest payer from paying for weeks.
This guide covers where to find your due date, how much notice you actually get, what the submission window is, what deactivation looks like in practice, and the routine that keeps a practice ahead of its next Medicare revalidation.
What is Medicare revalidation?
Medicare revalidation is CMS re-checking that everything in your enrollment record is still true. Practice locations, ownership and managing control, licensure, reassignments of benefits, correspondence addresses, banking details for electronic funds transfer: all of it gets re-attested on the appropriate CMS-855 form through PECOS, the same system used for initial enrollment.
It is not an audit of your claims, and it is not a quality review. It is a records exercise. That is exactly why it gets missed. Nothing about it feels urgent until billing stops.
How often does a practice have to revalidate?
CMS sets the Medicare revalidation cycle by supplier type. Physicians, non-physician practitioners, group practices and most institutional providers revalidate every five years. Suppliers of durable medical equipment, prosthetics, orthotics and supplies revalidate every three years. CMS states plainly that there are no exemptions from revalidation.
Two things follow from that. First, every enrolled provider in your group has a due date, including part-time and per-diem physicians whose paperwork nobody watches. Second, if your practice enrolled providers at different times, their due dates are scattered across the calendar rather than arriving together.
Where do you find your due date?
CMS publishes the Medicare Revalidation List at data.cms.gov/revalidation, where you can look up a due date by individual provider or by organization. Noridian, one of the Medicare Administrative Contractors, notes that the look-up tool refreshes on a 60 day cycle and that CMS assigns the due date as the last day of the assigned month.
Two details on that list matter more than your Medicare revalidation date itself. A provider whose record shows a due date has a live obligation. A provider whose record shows no date yet is not exempt; CMS simply has not assigned one, and it can appear at the next refresh. So the list is something to check on a schedule, not once.
Here is the first-hand piece behind this article. We pulled Search Console data for this site covering 2026-06-23 through 2026-09-19 and looked at every enrollment query that brought a practice to our Medicare provider enrollment guide. Ten distinct enrollment queries drew impressions in that window, and the phrasing was consistently about timing: how long enrollment takes, what the PECOS timeline looks like, where an application sits. Not one of those queries contained the word revalidation. That gap is the pattern worth naming. Practices research the front door carefully and then stop watching the renewal, and the Medicare revalidation deadline is the one that interrupts payment for a provider who is already working.
How much notice do you actually get?
CMS posts Medicare revalidation due dates about seven months in advance and sends a notice roughly three to four months before the due date. Noridian describes its own version of that: two mailed letters, to the special payments address and the correspondence address on file, plus reminder emails at about four months and again about six weeks out.
Notice that every one of those channels depends on the addresses inside your enrollment record. If the practice moved, if the billing manager who set up the record has left, if the correspondence address still points at an old suite number, the notice goes to a place nobody reads. Providers who get deactivated rarely ignored a letter. They usually never saw one.
There is also a window on the front end. The Medicare revalidation submission window opens seven months before the due date, and Noridian returns applications filed earlier than that as unsolicited. Filing a routine change of information during the window does not count either; revalidation needs its own application.
What happens if the deadline passes?
CMS describes two consequences: a hold on Medicare reimbursement, or deactivation of billing privileges. Noridian puts a timeline on the second one, stating that Medicare will typically deactivate the enrollment within 60 to 75 days after the due date when no Medicare revalidation application has been submitted.
Deactivation is the expensive outcome, for a reason that catches practices off guard. Medicare does not reimburse for services furnished during the deactivated period. The physician keeps seeing Medicare patients, the practice keeps submitting claims, and the claims keep rejecting. By the time someone traces the rejections back to an enrollment status rather than a coding problem, the practice can be weeks into unpaid work.
There is no grace period to appeal to, either. CMS states that it does not grant extensions.
How does a deactivated provider get reinstated?
Reactivation means submitting a complete enrollment application again, not a correction to the old one. CMS states that a deactivated provider must re-submit a complete Medicare enrollment application to reactivate billing privileges. Noridian adds a helpful detail: supporting documentation already on file does not have to be resubmitted, and the application must be fully completed and approved before the enrollment goes active again.
Reactivation is a far heavier lift than the Medicare revalidation it replaces, because the practical cost is the processing time on a brand new application, running while nobody is paying you for that provider. That is the whole argument for treating the due date as a hard operational deadline rather than administrative housekeeping.
A seven step routine that keeps you off the deactivation list
A Medicare revalidation routine that actually holds up looks like this.
- Build a provider roster with an owner. Every enrolled individual and every enrolled organization, with its PTAN, NPI and Medicare contractor. One named person owns the roster, not a department.
- Check the CMS list on a 60 day rhythm. The look-up tool refreshes on roughly that cycle, so a quarterly check can miss a newly assigned date by weeks. Put it on the calendar with a date, not as a reminder in someone’s inbox.
- Fix the addresses in PECOS first. Correspondence address, special payments address, contact person, email. Every notice CMS sends runs through those fields, and correcting them costs nothing today.
- Open the file at the six month mark. Pull licensure, ownership and managing control, and all active reassignments, and confirm they match reality before the form is touched. Ownership changes that were never reported are the slowest part of any Medicare revalidation.
- Submit inside the window, early in it. The window opens seven months out and the application cannot be filed before it. Filing in month six or five leaves room for a contractor development request without pushing anyone past the due date.
- Answer development requests the day they arrive. A Medicare revalidation that stalls almost always stalls on a request for one missing document. Route it to whoever watches the roster, not to the physician’s inbox.
- Confirm the approval in writing and record the next date. Do not treat silence as approval. Get the contractor’s confirmation, file it, and set the next cycle immediately.
The mistakes that cost practices the most
The same handful of Medicare revalidation errors show up repeatedly, and none of them are complicated.
- Treating it as one deadline. A group has as many due dates as it has enrolled providers and entities, and they do not align.
- Relying on the notice to trigger the work. The notice is a courtesy that depends on contact fields that may be years stale. The published list is the source of truth.
- Confusing a change of information with a revalidation. Updating an address during the window does not satisfy the requirement.
- Letting a departing manager take the knowledge. Enrollment credentials and PECOS access routinely leave with the person who set them up.
- Discovering the problem through claim rejections. By then the unpaid period has already started.
Questions practices ask
Does every provider in the group revalidate separately?
Yes. Each enrolled individual has their own Medicare revalidation record and their own due date, and the group entity has its own as well. One approval does not cover the others.
What if my provider is not on the published list?
That means CMS has not assigned a date yet, not that the provider is excused. CMS states there are no exemptions from revalidation, so the record should be re-checked when the list refreshes.
Can I ask for more time?
No. CMS states it does not grant extensions, which is why the seven month submission window exists.
Will Medicare pay for services during a deactivation?
No. CMS states Medicare will not reimburse for services furnished during the period the provider was deactivated.
How is this different from commercial payer credentialing?
It is a separate obligation on a separate clock. Commercial plans run their own re-credentialing cycles, and our insurance credentialing guide and CAQH guide cover those. Keeping the Medicare record current does not keep a commercial panel current.
Where this fits in the rest of your compliance calendar
Enrollment maintenance belongs on the same calendar as your other recurring obligations, not in a folder of its own. If you are building that calendar from scratch, our physician credentialing checklist covers the provider-level documents that feed every one of these processes, and the medical practice compliance program guide covers the structure that holds the dates.
Enrollment records also shape what you get paid. The reassignments and practice locations inside the record determine where claims can be billed from, which is the same ground covered in our payer contract negotiation guide.
Getting help with it
Practice Management Consultancy advises independent practices on credentialing, enrollment and payer contracting. We do not run your billing. What we do is build the roster, set the calendar, work the applications alongside your team, and make sure the record CMS holds matches the practice that exists today.
If you want a second set of eyes on your enrollment records before your next Medicare revalidation comes due, get in touch or call (706) 909-3271. You can also read more about our practice consulting services.
