Rule 1: one merged calendar per provider
- Every expirable, revalidation and recredentialing date, across every authority and payer
- One record, with its source and proof document attached
Home / White papers / Credentialing
White paper · Credentialing operations
Credentialing revalidation in 2027: one operating model for every cycle you run
Short answer: Medicare revalidation every five years, CAQH re-attestation, payer recredentialing, state licence, DEA and board dates are each a clock that stops billing when it runs out, and CMS now proposes to make every revocation retroactive. The model we run in CredPro: one calendar per provider, a named owner for every date, and a revenue-at-risk view finance can read.
42 CFR 424.515 · revalidate every 5 yrs
42 CFR 424.541 · stay, 60 days
42 CFR 424.516 · report in 30 or 90 days
CMS-1844-P · proposed, not final
Edition
White paper · 2027
Focus
Revalidation operations
Audience
Credentialing · CFO
Metric
Revenue at risk
Framework
One calendar per provider
Length
14 min read
5years
Medicare revalidation cycle for most providers and suppliers; 3 years for DMEPOS [4]
60days
Maximum stay of enrollment; claims with dates of service in the stay are rejected [7]
Allgrounds
CMS proposes to make every revocation ground retroactive in CMS-1844-P (proposed) [2]
$1.04Mheld
Insurance AR in one return-for-credentialing queue at a multi-site behavioral health organization, first 60 days
A missed date does not slow the claim. It stops it.
A late revalidation can mean a hold or deactivation, and Medicare will not reimburse services furnished while deactivated [3]. The backlog is invisible because each item lives in a different inbox.
One 89-provider, 91-payer book at takeover, June 2026
Diagnostic, before our team touched the queue. The $1.04M queue was about one dollar in five of insurance AR, and 52.9 percent of insurance AR was older than 90 days: behavioral health credentialing AR baseline.
Open items older than 90 days643 of 694
64392.7% of open items
Open items under 90 days51 of 694
517.3%
Recredentialing items overduealready past the date
32647% of open items
Recredentialings due inside 90 daysnext wave
11316%
Median turnaround, open enrollment itemsdays from start
62.5 daysmean 150, P90 400
0175350525694 items
Aged open itemsRecredentialing exposureFresh itemsTurnaround
Six clocks, six authorities, one calendar
90 providers with 25 payers each is 2,000-plus provider-payer pairs; with licences, DEA, boards and privileges the calendar runs into five figures.
| Clock | Who sets it | Cycle | What stops when it lapses |
|---|---|---|---|
| Medicare enrollment revalidation | CMS, 42 CFR 424.515 [4] | Every 5 years; DMEPOS every 3; off-cycle at CMS discretion | Medicare payment: hold, stay or deactivation [3] |
| Enrollment change reporting | CMS, 42 CFR 424.516 [5] | 30 days for ownership, adverse legal action, practice location; 90 days for everything else | Grounds for deactivation or revocation; retroactive under the CY 2027 proposal [1] |
| Payer recredentialing | Each commercial and Medicaid plan | Plan-specific, commonly multi-year | Network participation and in-network payment |
| CAQH re-attestation | CAQH ProView | Recurring attestation payers pull from | Payers see a stale profile and pause recredentialing |
| State licence, DEA, board certification | State boards, DEA, specialty boards | Set per credential | Legal ability to practice and prescribe; a Medicare revocation ground [1] |
| Hospital privileges | Each medical staff office | Facility reappointment cycle | Facility-based billing |
From posting to payment risk, six stations
The Medicare clock has the most published mechanics, so it anchors the model. Unsolicited revalidations more than seven months early are returned; CMS grants no extensions and no exemptions [3].
- 1T minus 7 monthsDue date appears on the Medicare Revalidation List [3]
- 2T minus 3 to 4 monthsContractor notice by email or mail; revalidate now even without it [3]
- 3Notice plus 60 daysRegulatory window to submit a complete application after CMS asks [4]
- 4Due dateHold on reimbursement or deactivation if nothing complete is on file
- 5Stay, up to 60 daysClaims with dates of service in the stay rejected unless compliance is restored [7]
- 6DeactivationNo payment for services furnished while deactivated [6]
CMS and the MAC
Posts the date, mails the notice
Your filing
PECOS or CMS-855, complete, inside 3 months
Stay clock
15 days to rebut; CMS-855, CMS-20134 or CMS-588 fixes it
Deactivated
Receipt date, no retro
CMS actionYour filingStay windowDeactivated
Payer clocks are less documented but just as hard: a late recredentialing packet often ends participation, and reinstatement runs through the new-enrollment queue. Our recredentialing PSV checklist shows the NCQA, Medicare and CAQH cycles on one calendar.
Three enrollment states and what they do to the claim
None is a denial you can appeal line by line. Retrospective billing under 42 CFR 424.521 (30 days before a new effective date, 90 in a declared disaster) is for new enrollments and does not rescue a missed revalidation [8].
| State | Trigger | Claims with dates of service in the gap | How it ends |
|---|---|---|---|
| Stay of enrollment, 424.541 [7] | Non-compliance that a CMS-855, CMS-20134 or CMS-588 filing can fix, including a rejected revalidation; 15 calendar days to rebut | Rejected; payable only if compliance resumes and the stay ends on or before its designated end | Compliance confirmed, or the assigned period (maximum 60 days) expires |
| Deactivation, 424.540 [6] | No complete response within 90 calendar days of a request, non-compliance, no claims for 6 months, invalid location | Not payable; payment prohibition in 424.540(e) | Reactivation, effective the date the contractor received the approved submission |
| Revocation, 424.535 [1] | Any ground in 424.535(a); today most grounds are retroactive and the rest take effect 30 days after notice | Not payable from the effective date; reenrollment bar of 1 to 10 years | Bar expires and a new enrollment is approved |
Every revocation retroactive
Today a revocation takes effect 30 days after notice unless it is on the 424.535(g)(2) list. CMS proposes to make every remaining ground retroactive to the date non-compliance began [1]; the fact sheet says it in one line [2].
- 1Dec 2, 2025CY 2026 HH PPS final rule made many revocation grounds retroactive (90 FR 55342)
- 2Jul 1, 2026CMS fact sheet released [2]
- 3Jul 6, 2026Proposed rule published at 91 FR 41216; section V.C applies to all Medicare provider and supplier types unless stated otherwise [1]
- 4Aug 31, 2026Comment period closed
- 5PendingFinal rule; everything in this section is proposed, not final
Reporting deadlines
Unchanged: 30 days for ownership, adverse legal action, practice location; 90 days for everything else [5]
Late report, today
Retroactive only for ownership, adverse actions, locations
Late report, proposed
Retroactive to the day after the report was due, every type of change [1]
Deadlines in forceCurrent treatmentProposed treatment
Seven provisions, and what each would mean for your calendar
| Proposal (all proposed) [1] [2] | Section | What it would mean for your calendar |
|---|---|---|
| All revocation grounds retroactive | 424.535(g) rewritten | A lapse discovered in month four is unpaid from month one, not from the notice |
| Late change reports revoked retroactively | New 424.535(g)(1)(ix) | Every 30-day and 90-day reporting deadline becomes a payment date |
| Suspensions and revocations involving owners or managing employees | Fact sheet | Owner and manager licence and Medicaid actions need the same monitoring as provider licences |
| Reapplication bar for any denial reason | 424.530(f) | Up to 10 years, at CMS discretion, after any denial, not only false information |
| Denial for sharing a suite with a revoked or denied provider | New 424.530(a)(19) | Practice-location data on the CMS-855 needs a compliance check before filing |
| Change in majority ownership within 36 months | New 424.530(a)(22), 424.535(a)(25) | HHAs, hospices and DMEPOS suppliers re-enroll as new providers after a covered sale |
| Rebuttal of reactivation effective dates | 424.540(d)(3), 424.546 | A wrongly assigned reactivation date gets a 15-day rebuttal path |
If the rule finalizes as written, the gap between a missed date and its discovery becomes unpaid revenue in full. Section references: CY 2027 provider enrollment proposals; what to change first: November Credentialing Brief.
One calendar, one owner, one view of risk
Most failures trace to one flaw: dates live in the systems that generate them, PECOS, ProView, a board site, a payer email. Four rules fix that.
Rule 2: a named owner and a lead-time ladder
- Alerts at 90, 60, 30 and 7 days to the owner
- Escalation to a supervisor when a step is missed
Rule 3: continuous primary-source verification
- Licence, DEA, NPDB, OIG, SAM and board status re-checked on a schedule
- Any change opens a task; not only at re-cred time
Rule 4: revenue at risk is computed, not estimated
- Each expiring item carries the monthly billing that depends on it
- Finance sees the dollar exposure of the next 60 days
Weekly, monthly, quarterly, annually: who does what
CMS says providers are responsible for tracking their own due dates [3]. The model removes the only delay you control: the time between a date being set and a person acting on it.
WhenWhatOwner and weekly question
Mondayweekly
Work the windowEvery item inside 60 days, by owner; packets complete, PSV current, applications filed
Credentialing coordinatorWhat is due in 60 days and is the packet complete?
Mondayweekly
Chase the payersFollow up every submission with no payer response in 30 days
Payer enrollment specialistWhich submissions have no payer response in 30 days?
Monthlyreport
Revenue-at-risk reportMonthly billing tied to each item expiring in the next 60 days, by provider and payer
Revenue cycle directorWhat billing depends on the next 60 days of dates?
Quarterlyreconcile
Reconcile the rosterAgainst the Medicare Revalidation List and every payer roster; close anyone who left
Credentialing leadWhich dates slipped a step and why?
Annuallyre-verify
Re-verify every date sourceConfirm each authority, cycle and proof document still matches
ProviderAttestations, signatures, documents: what do I owe the team this week?
Model rule to CredPro module
CredPro, the ASP-RCM Credential OS platform, is a 17-module workspace included with our engagements; it runs the model as configured workflow, not spreadsheet discipline. See credentialing and payer enrollment.
| Model rule | CredPro module | What the user sees |
|---|---|---|
| One merged calendar | Provider profile, 15 sections | Every date and document on one screen, with source and expiry |
| Named owner, lead-time ladder | Revalidation calendar and work queue | Alerts at 90, 60, 30 and 7 days; escalation on a missed step |
| Continuous PSV | Verification network | Status changes open a task; packets stay NCQA audit-ready |
| Revenue at risk | Revenue-at-risk dashboard | Monthly billing tied to each expiring item |
| Clean submission | Pre-flight validator, payer enrollment center | 20 deterministic checks; portal registry and auto-filled forms |
What CredPro holds, each number against its own total
Payer enrollment center, pre-flight and platform tests
Platform facts and internal tests on a synthetic roster of 10,027 providers, not client outcomes; the July 2026 auto-fill test used one demonstration record.
Medicaid portals in the registryof 85 portals
5160% of the registry
State-mandated portalsof 85
1619%
Other payer portalsof 85, plus fillable payer forms
1821%
Fields auto-filled from one provider recordone state form, July 2026
182 of 23178.8%
Cross-tenant access probeafter six isolation defects found in testing were closed
14 of 14100% passed
Penetration test and user acceptance checksinternal
25 of 25 and 127 of 127100% passed
Executive summary load timebefore caching, then after
35 s to 2 s-94% with caching; 5 to 7 ms at P95
Portal registry, share of 85Auto-fill coverageTests passedLoad time, before caching
90 / 60 / 30 / 7
Calendar
- Revalidation calendar with payer-specific lead-time alerts to the named owner
Continuous PSV
Verification
- Licence, DEA, NPDB, OIG, SAM and board certification re-verified on schedule
- 84,001 OIG exclusion records loaded for screening
20 rules
Clean submission
- Pre-flight validator scores every provider file before a submission goes out
3 surfaces
Platform
- Admin, coordinator and provider portal, included with the engagement
- Designed to support HIPAA-aligned controls: PHI access log, encrypted identifiers, role-based surfaces
PECOS is changing in the same direction: a national profile, pre-populated applications, one consolidated application across MACs, status and letters in one place [9]. That makes the Medicare leg easier to file; it does not watch your dates for you.
Find the dates, own them, measure them
- 1Days 1 to 30: findLoad the roster; pull Medicare due dates from the Revalidation List; collect licence, DEA, board and payer dates; attach proof documents
- 2Days 31 to 60: ownAssign owners; switch on the 90/60/30/7 ladder; clear every item already inside 60 days; start continuous PSV
- 3Days 61 to 90: measureReconcile rosters with every payer; publish the first revenue-at-risk report; set the quarterly reconciliation calendar
Data
Roster, dates, documents
People
Owners, ladder, PSV
Reporting
Revenue at risk, reconciliation
Month oneMonth twoMonth three
Measure the lead time, not the completion
| KPI | Definition | Target |
|---|---|---|
| Dates past due | Expirables and revalidations past their date with no complete submission | Zero |
| Items inside 60 days without an owner | Calendar entries with no named person | Zero |
| Submission lead time | Days between the 90-day alert and the submission | Submitted on or before the 60-day mark |
| Open items older than 90 days | Payer submissions with no decision after 90 days | Falling month over month |
| Revenue at risk, 60 days | Monthly billing tied to items expiring in the next 60 days | Reported to finance every month |
| Reporting compliance | Enrollment changes reported inside the 30-day or 90-day window [5] | 100 percent |
Takeaway
A revalidation filed on the due date is a success that nearly failed. Measure the lead time, name the owner, and show finance the dollars behind the next 60 days.
Six checks before 2027
Pull the Medicare Revalidation List for the whole rosterEvery NPI and PTAN; load any date inside seven months as a task with an owner [3].
Audit 12 months of enrollment changesAgainst the 30-day and 90-day deadlines in 424.516; file anything late now [5].
Merge every date into one record per providerMedicare, CAQH, payer, licence, DEA, board, privileges, with proof documents attached.
Name an owner and switch on the 90/60/30/7 ladderEscalate a missed step to a supervisor the same week.
Add owners and managing employees to monitoringThe proposal ties their suspensions and revocations to yours [2].
Publish the first revenue-at-risk reportMonthly billing behind every item expiring in 60 days; the Medicare leg is in our revalidation calendar.
We run credentialing as a product with written service levels; in-house, the model works on any system that holds a date and an owner. See medical credentialing services and the guide to evaluating credentialing vendors, with the questions to ask any provider, including us. CMS's March 2026 conference deck lists the MAC self-service tools the calendar depends on [10].
Frequently asked questions
How often must a provider revalidate Medicare enrollment?
Every five years for most providers and suppliers, and every three years for DMEPOS suppliers, under 42 CFR 424.515. CMS can also call an off-cycle revalidation at any time. CMS posts due dates about seven months ahead on the Medicare Revalidation List and the contractor sends a notice about three to four months before the date.
What happens if a Medicare revalidation is late?
CMS says a late revalidation can lead to a hold on Medicare reimbursement or deactivation of billing privileges, and that Medicare will not pay for services furnished while a provider is deactivated. CMS may also impose a stay of enrollment of up to 60 days under 42 CFR 424.541, during which claims with dates of service inside the stay are rejected.
What does the CY 2027 proposed rule change about revocations?
CMS-1844-P proposes to make every revocation ground under 42 CFR 424.535(a) retroactive, so the effective date reaches back to when the non-compliance began rather than 30 days after the notice is mailed. It also proposes new denial grounds and a reapplication bar of up to 10 years for any denial reason. It is a proposal; the comment period closed August 31, 2026 and the final rule has not been published.
Which enrollment changes have a 30-day reporting deadline?
Under 42 CFR 424.516, a change of ownership, any adverse legal action, and a change, addition or deletion of a practice location must be reported within 30 days. All other enrollment changes must be reported within 90 days. The proposed rule would make revocation for any late report retroactive to the day after the report was due.
How does CredPro fit into a revalidation operating model?
CredPro, the ASP-RCM Credential OS platform, holds each provider's revalidation, re-attestation, license and recredentialing dates as structured data, fires lead-time alerts at 90, 60, 30 and 7 days, runs continuous primary-source checks, and shows the monthly billing that depends on each expiring item on a revenue-at-risk dashboard.
- Federal Register, 91 FR 41216 (July 6, 2026): CY 2027 Home Health PPS proposed rule, CMS-1844-P, section V.C Provider Enrollment (proposed, comments closed August 31, 2026)
- CMS fact sheet: Calendar Year (CY) 2027 Home Health Prospective Payment System Proposed Rule (CMS-1844-P), July 1, 2026
- CMS, Medicare Enrollment: Revalidations (cycle, due-date posting, notices, consequences)
- 42 CFR 424.515, Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information (eCFR, current as of October 22, 2026)
- 42 CFR 424.516, Additional provider and supplier requirements for enrolling and maintaining active enrollment status (reporting deadlines)
- 42 CFR 424.540, Deactivation of Medicare billing privileges
- 42 CFR 424.541, Stay of enrollment
- 42 CFR 424.521, Request for payment by certain provider and supplier types (retrospective billing)
- CMS, PECOS 2.0 FAQs (redesigned PECOS: national profile, consolidated applications, real-time status)
- CMS, Medicare Provider Enrollment Compliance Conference, March 18 to 19, 2026: provider resources (revalidation list, stay of enrollment education, EUS)
Checked October 25, 2026. Rules change; confirm against the source before relying on them. CMS-1844-P is a proposed rule and nothing in it is final until CMS publishes the final rule.
ServiceCredentialing and payer enrollment, run on CredPro
ServiceMedical credentialing services
GuideEvaluating credentialing vendors
BlogMedicare revalidation: how to avoid a stay of enrollment
InsightCY2027 provider enrollment proposals
NewsletterThe Credentialing Brief, November 2026
Case studyRecredentialing PSV checklist
Case studyBehavioral health credentialing AR baseline
Want your roster checked against every clock before 2027?
We load your providers into CredPro, pull the Medicare due dates, find the expirables inside 60 days and show you the billing that depends on each one.