Medicare enrollment is not a one-time event. Once enrolled, a provider or supplier must have the enrollment record confirmed and updated on a cycle — a process called revalidation. Miss the cycle, and Medicare can deactivate billing privileges, leaving services in the gap unpaid.
This guide explains who revalidates every five years and who does not, how to find your due date, what to check before you submit, and what happens if the deadline passes. For the enrollment walkthrough itself, see Fastora’s credentialing and enrollment service page.
What revalidation is — and what it is not
Revalidation is Medicare’s periodic check that the enrollment information on file is still accurate. You resubmit and recertify the applicable CMS-855 application for your enrollment type, confirming or updating ownership, practice locations, managing employees, and contact information, with the supporting documentation Medicare requires.
It is not initial enrollment, which gets you into Medicare in the first place; revalidation confirms an existing enrollment is still correct. Nor is it re-enrollment after a deactivation, a different and harder path back, with the gap in between unpaid. Each has a different form, timeline, and consequence.
Revalidation is also not the same as commercial-payer upkeep. CAQH reattestation and payer recredentialing run on their own cycles and systems. A practice can be current with CAQH and still miss a Medicare deadline. Treat each cycle as its own calendar item.
The cycle: five years for most, three for DMEPOS, sometimes off-cycle
The rule, under 42 CFR 424.515, is straightforward once the exception is stated plainly:
- Most providers and suppliers revalidate every five years.
- DMEPOS suppliers — durable medical equipment, prosthetics, orthotics, and supplies — revalidate every three years.
- CMS or the applicable Medicare Administrative Contractor (MAC) may also require revalidation at other times, outside the regular cycle, to confirm that current enrollment information is accurate.
That last point is the one practices most often miss. The five-year cycle is the normal rhythm, not a guarantee, and an off-cycle request carries the same obligation to respond. Planning around “we have five years” without checking the actual due date is how a deadline gets missed.
How to find your due date — do not wait for the letter
The MAC typically sends a revalidation notice by email or postal mail a few months before the due date — commonly three to four months out. That notice is a courtesy, not the deadline trigger: CMS states the provider remains responsible for its own deadline, and the notice goes to the addresses on file. An outdated address is one of the most common reasons a notice is never seen.
Check the due date directly, instead of building the process around the letter:
- Search the CMS Medicare Revalidation List. Searchable by NPI or organization, it shows upcoming due dates — check every enrolled provider and location, not just the main one.
- Check PECOS. Medicare’s online enrollment system shows the record behind the due date; if the record is wrong, the due date built on it may be wrong too.
- Confirm the contact details on file. If the practice moved or changed who receives Medicare mail, update the record before the notice window opens, not after it closes.
- Put the date on a calendar someone owns. Assign one owner and one backup, and set the first reminder well before the notice window.
Once the MAC issues its notice, the regulation gives 60 calendar days from notification to submit a complete application with supporting documentation — a response window, not extra time to start gathering documents. Practices that file smoothly already have the information assembled before the notice arrives.
What to confirm before you submit
Revalidation fails most often on stale or incomplete information, not on the form itself. Before submitting, confirm each of these:
- Ownership and control. Has ownership or controlling interest changed since the last filing? Report it accurately; an unreported change is itself a compliance problem.
- Practice locations. Every service location and billing address must be current. A closed location never removed, or a new location never added, will surface at the worst time.
- Managing employees and authorized officials. The people listed must still hold those roles, with current contact information — a departed administrator listed as contact is how notices go unanswered.
- Reassignment and group enrollment. If providers reassign benefits to a group, both the group enrollment and each individual’s enrollment must be current.
- Licenses and supporting documentation. Confirm that what Medicare holds matches what is currently in force, and that submitted documents match the application exactly.
- Contact details. Email and mailing addresses on file drive where notices go. This is the cheapest item on the list and the one that causes the most missed deadlines.
Submit through PECOS where possible: the online system lets you upload supporting documents, sign electronically, and leaves a record of what was submitted and when. Paper filing remains an option, with no immediate confirmation. Whichever route you take, keep a complete copy of the application, every supporting document, and the submission confirmation.
If the MAC asks for additional information — a development request — answer it completely and on time; an incomplete response can lead to the same deactivation outcome as no response. If a submission stalls, the escalation playbook for stalled credentialing applications covers how to work it. Do not treat a follow-up request as routine correspondence.
What happens if you miss the deadline
Missing revalidation can deactivate Medicare billing privileges. During deactivation, the provider is not paid for services rendered to Medicare beneficiaries — a billing gap that is permanent, since services in the gap are not paid retroactively once privileges are restored. MACs may even impose retroactive deactivation to the date of non-compliance, widening the gap further.
Restoring privileges after a deactivation requires submitting an updated enrollment application and recertifying the enrollment information. Reactivation is not retroactive to the deactivation date, so every week spent sorting out a missed deadline is a week of Medicare services that will never be paid for.
Deactivation is not revocation: deactivation halts payment while the record is brought current, while revocation is a separate, more serious enrollment action. This article does not claim a missed revalidation automatically revokes enrollment — deactivation alone is costly enough.
A revalidation routine that holds up
Revalidation needs a routine, run once a year at minimum and checked again whenever the practice changes:
- Once a year, check every due date on the Revalidation List for every NPI and organization, and record each one with its source.
- Whenever anything changes, update the record — ownership, locations, managing employees, contact details — when it happens, not at the next cycle.
- Six months before a due date, assemble the file: ownership documents, location list, license information, and contact details, reviewed against the PECOS record.
- When the notice arrives, file within the window. File early, keep the confirmation, and confirm the record shows the submission.
- After filing, verify the outcome. Confirm the revalidation is shown as received and complete, and record the next cycle date.
Labeled illustrative example: three practices, three timelines
The following table is an illustrative example only. It uses no real provider data and no payment figures.
| Practice | Situation | Cycle | What to watch |
|---|---|---|---|
| Solo physician practice | Enrolled five years ago, no changes | 5 years | Due date on the Revalidation List; contact details current before the notice window |
| DMEPOS supplier | Supplies durable medical equipment | 3 years | Shorter cycle — a five-year assumption misses the deadline by two years |
| Multi-location group | Three locations, one recent move | 5 years, plus off-cycle risk | Every location current in PECOS; the moved location updated before filing |
Frequently asked questions
How often does Medicare require revalidation?
Every five years for most providers and suppliers. DMEPOS suppliers revalidate every three years. CMS or the MAC may also require off-cycle revalidation at other times.
How do I find my Medicare revalidation due date?
Search the CMS Medicare Revalidation List by NPI or organization, and check the PECOS record. Do not rely only on the MAC notice, a courtesy sent to the addresses on file.
What if the MAC notice never arrives?
The provider remains responsible for the deadline. An outdated address on file is a common reason notices are missed — confirm contact details before the notice window.
What happens if I miss the revalidation deadline?
Medicare can deactivate billing privileges, and services in the gap are not paid. Reactivation requires a new updated application and is not retroactive.
Is revalidation the same as re-enrollment?
No. Revalidation confirms an existing enrollment; re-enrollment after deactivation is a separate path back, with the gap unpaid.
Does revalidation cost a fee?
It depends on enrollment type: institutional providers and DMEPOS suppliers are the fee-paying categories, while physicians and non-physician practitioners are generally exempt. Check current CMS fee guidance before filing.
How is Medicare revalidation different from CAQH reattestation?
CAQH reattestation is commercial-payer upkeep run through CAQH; Medicare revalidation is a Medicare enrollment requirement run through CMS and the MACs via PECOS. Separate cycles, systems, and deadlines.
Conclusion
Medicare revalidation is a calendar discipline, not a paperwork emergency — until the deadline passes, when it becomes both. Know your cycle, find the due date in Medicare’s own records instead of waiting for a letter, confirm the information before you file, and file inside the window with the confirmation kept.
If your practice is unsure where its revalidation dates stand, a free billing assessment can review the credentialing picture — enrollment dates, location and contact accuracy, and easy-to-miss upkeep cycles — before a deadline turns into a billing gap.
