Revalidation and recredentialing
Revalidation and recredentialing are the periodic re-verification processes that keep a provider participating after initial credentialing and enrollment are complete. In common usage, revalidation refers to a government program re-confirming an existing enrollment record — most notably Medicare through PECOS — while recredentialing refers to a commercial health plan re-verifying a provider it has already credentialed. Both run on recurring cycles — set in federal regulation for government enrollment, and largely by each plan for commercial networks — both repeat much of the original verification, and both can interrupt participation if a deadline is missed.
Updated 9 min read
Reviewed by Anwaar Tayyab
Director of Billing Operations ·
On this page
Key takeaways
- Revalidation and recredentialing are recurring maintenance activities, not one-time steps completed at onboarding.
- Revalidation generally describes government enrollment (Medicare through PECOS and state Medicaid programs); recredentialing describes commercial health plans re-verifying a provider.
- Federal regulation sets the government revalidation cycle — every five years for most Medicare enrollments, and at least every five years for Medicaid — while commercial recredentialing cycles are set by each plan within any minimum its federal program rules impose.
- Both processes repeat primary source verification of the provider's current licensure, credentials, and eligibility.
- Missing a deadline can deactivate an enrollment or drop network participation, interrupting how claims are paid.
What revalidation and recredentialing are
Credentialing and enrollment are not permanent. Once a provider is approved, both government programs and commercial payers require the underlying information to be re-checked on a recurring schedule to confirm the provider still meets participation requirements. Licenses expire, board certifications lapse, practice locations move, ownership changes, and sanctions or exclusions can appear after the initial review. Revalidation and recredentialing exist to catch those changes and keep the record trustworthy.
The two terms are often used loosely, but they point to different systems. Revalidation is the language of provider enrollment with government payers, where an existing enrollment record is periodically re-confirmed. Recredentialing is the language of credentialing with commercial health plans, where a plan re-verifies a provider it previously admitted to its network. This educational reference keeps the distinction clear, because the forms, cycles, and consequences differ.
- Revalidation
- A government payer's periodic re-verification of an existing enrollment record, such as Medicare revalidation processed through PECOS or a state Medicaid program's periodic revalidation.
- Recredentialing
- A commercial health plan's periodic re-verification of a provider it has already credentialed, confirming that credentials remain current before continued network participation.
- Primary source verification
- The underlying method both processes rely on: confirming a credential directly with the issuing source rather than trusting a copy supplied by the provider.
Different word, similar purpose
Revalidation: keeping government enrollment current
For Medicare, revalidation is handled through PECOS using the CMS-855 application family, the same forms used at initial Medicare enrollment. Federal regulation sets the cycle: to maintain billing privileges, a provider or supplier other than a DMEPOS supplier must resubmit and recertify the accuracy of its enrollment information every five years, and CMS contacts each provider or supplier directly when it is time to revalidate. DMEPOS suppliers and ambulance service providers renew under separate rules, and CMS also reserves the right to run off-cycle revalidations and to adjust the routine five-year schedule for specific provider or supplier types — notifying affected providers and suppliers at least 90 days in advance of a change — so the notice CMS sends for a specific enrollment record, not the routine cycle alone, governs when that record is actually due.
State Medicaid programs run their own revalidation on their own systems. Federal rules require a state Medicaid agency to revalidate the enrollment of all providers, regardless of provider type, at least every five years, and to screen the applications submitted in response to a revalidation request under the same risk-based framework — limited, moderate, or high — that applies at initial enrollment. A state may revalidate more often than that floor, and the portals, forms, and supporting documentation differ by state. A provider enrolled in Medicaid in more than one state may face separate revalidation dates in each. Because a lapse in government enrollment directly affects how claims are processed, revalidation is a core part of ongoing enrollment maintenance.
Deactivation is a real risk
Recredentialing: periodic review by health plans
Commercial payers re-verify their participating providers on a recurring cycle. Where a federal program is involved, the interval is written into the rules: a Medicare Advantage organization must recredential contracted physicians and other health care professionals at least every three years, updating the information obtained at initial credentialing and taking an attestation that the new information is correct and complete. The National Committee for Quality Assurance separately accredits and certifies organizations that perform credentialing, evaluating how they credential and recredential practitioners. Outside those requirements the cycle length and documentation are set by each plan, so a specific interval should be confirmed with the individual payer rather than assumed to be universal.
Recredentialing leans heavily on a current, complete CAQH profile. Plans that use the CAQH profile pull the provider's data when a recredentialing cycle comes due, which is why maintaining CAQH and re-attestation on schedule matters — a stale or unattested profile can stall the review. The plan then repeats primary source verification of licensure, education, board status, and sanctions before a credentialing committee decides on continued participation.
Recredentialing is separate from the contract itself. The commercial payer contract governs rates and terms, while recredentialing governs whether the provider remains eligible to be in the network at all. A provider can hold an active contract yet still be dropped from participation if recredentialing is not completed.
How the two compare
The processes rhyme, but the details differ. The table below contrasts them across the dimensions that matter most in day-to-day operations.
| Dimension | Revalidation | Recredentialing |
|---|---|---|
| Who requires it | Government payers — Medicare (CMS) and state Medicaid programs | Commercial health plans and networks |
| Primary system and forms | PECOS and the CMS-855 family, or a state Medicaid system | Payer portals plus the CAQH profile |
| Typical cycle | Set in federal regulation — every five years for most Medicare enrollments, and at least every five years for Medicaid | Set by each plan; Medicare Advantage organizations must recredential at least every three years |
| What is re-verified | Enrollment data, ownership, practice locations, licensure, and eligibility | Licensure, education, board status, sanctions, and other credentials |
| Consequence of a lapse | Deactivation of the Medicare or Medicaid billing privilege | Loss of in-network participation with the plan |
The Medicaid cycle is a regulatory maximum — at least every five years — while the Medicare five-year cycle is the routine schedule CMS reserves the right to adjust for specific provider or supplier types; either way, confirm requirements against the governing rule or the plan's own policy.
What the process involves
Although the systems differ, revalidation and recredentialing follow a similar arc. The steps below describe the common pattern; the specific documents and reviewers vary by payer.
Track the due date
Programs and plans issue notices, but responsibility for knowing when a record is due sits with the practice. Building due dates into a broader credentialing timeline and planning process prevents surprises.Refresh the underlying record
Update and re-attest the CAQH profile for commercial plans, or confirm and update the enrollment record in PECOS or the state Medicaid system for government revalidation, so the data the reviewer pulls is current.Re-verify at the source
The payer or program repeats primary source verification of licensure, certification, and sanctions history, rather than relying on documents the provider submitted years earlier.Review and decision
CMS processes the submitted CMS-855 for revalidation; a health plan routes a recredentialing file to its credentialing committee for a continuation decision.Maintain continuity
When completed on time, participation continues without interruption. A missed deadline can create a gap, which is why the effective date of any reactivation or reinstatement matters for how claims in the interim are handled.
Why timing matters
The financial stakes of revalidation and recredentialing come from timing, not complexity. The tasks themselves are routine, but a lapse can quietly change a provider's participation status and, with it, how a payer adjudicates claims. Because government deactivation and commercial network removal are handled separately, a single provider can be current with one payer and out of compliance with another at the same time.
- Missing a Medicare revalidation can lead CMS to deactivate the billing privilege until the enrollment is reactivated.
- Missing a commercial recredentialing cycle can move a provider out of network, changing how claims are processed.
- Each program and payer tracks its own dates, so multi-payer providers manage multiple, unrelated deadlines.
- An out-of-date CAQH profile or an unattested record can stall a review even when nothing about the provider has changed.
Treat it as ongoing maintenance
Common questions
Is revalidation the same as recredentialing?
Not exactly. Both are periodic re-verifications, but revalidation usually refers to government enrollment being re-confirmed (Medicare through PECOS or a state Medicaid program), while recredentialing refers to a commercial health plan re-verifying a provider it has already credentialed. They run through different systems and have different consequences when a deadline is missed.
How often do revalidation and recredentialing happen?
Federal regulation sets the government intervals: most Medicare enrollments are resubmitted and recertified every five years, and a state Medicaid agency must revalidate every enrolled provider at least every five years. On the health plan side, a Medicare Advantage organization must recredential contracted physicians and other health care professionals at least every three years, while other plans set their own cycles. Because CMS reserves the right to adjust the routine Medicare schedule for specific provider or supplier types, and a state or a plan may review more often than its own floor, confirm the specific date with the program or payer rather than assuming one universal interval.
What happens if a revalidation deadline is missed?
For Medicare, CMS can deactivate the provider's billing privilege when the provider does not furnish complete and accurate information after being notified to resubmit and certify its enrollment record, and no payment may be made for services or items furnished while the enrollment is deactivated. Reactivation is generally possible, but it takes effect on the date the Medicare contractor receives the reactivation submission it processes to approval, so tracking the due date in advance is important.
Does recredentialing require starting a new application from scratch?
Typically no. Recredentialing re-verifies an existing credentialing file rather than building a new one. The provider is usually asked to update and re-attest to a current CAQH profile, after which the plan repeats primary source verification and its committee decides on continued participation.
Who is responsible for tracking these dates?
The provider organization is. Programs and payers may send notices, but the responsibility for knowing when revalidation or recredentialing is due, and for responding in time, rests with the practice or its credentialing team.
Key terms in this article
Defined once, on their own pages.
Continue learning
Related credentialing and enrollment topics that build on this one.
Credentialing timelines and planning
How to schedule credentialing, enrollment, and re-verification work so due dates do not lapse.
Maintaining CAQH and attestation
Keeping the CAQH profile current and attested so recredentialing pulls accurate data.
Medicare enrollment with PECOS
How Medicare enrollment records are established and maintained in PECOS.
Primary source verification explained
The verification method that both revalidation and recredentialing rely on.
Enrollment maintenance
Ongoing upkeep of enrollment records between formal re-verification cycles.
Authoritative sources
- 42 CFR 424.515 — Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information (opens in a new tab)
eCFR. Conditions the maintenance of Medicare billing privileges on resubmitting and recertifying the accuracy of enrollment information every 5 years for a provider or supplier other than a DMEPOS supplier, and notes that ambulance service providers and DMEPOS suppliers continue to renew under separate rules. Provides that CMS contacts each provider or supplier directly when it is time to revalidate, applies the submission, content, signature, verification, operational, and inspection requirements of 424.510 to that resubmission, and reserves CMS's right to perform off-cycle revalidations with accompanying site visits and to adjust the routine 5-year revalidation schedule to a more or less frequent basis for specific provider or supplier types, with notice to all affected providers and suppliers at least 90 days in advance of the change.
- 42 CFR 424.540 — Deactivation of Medicare billing privileges (opens in a new tab)
eCFR. Lists the reasons CMS may deactivate billing privileges, including a provider's or supplier's failure to furnish complete and accurate information and supporting documentation after CMS notifies it to submit an enrollment application or to resubmit and certify to the accuracy of its enrollment information. Sets out reactivation, provides that a reactivation is effective on the date the Medicare contractor received the reactivation submission it processed to approval, and prohibits payment for services or items furnished while a provider or supplier is deactivated.
- 42 CFR 455.414 — Revalidation of enrollment (opens in a new tab)
eCFR. Requires the State Medicaid agency to revalidate the enrollment of all providers, regardless of provider type, at least every 5 years.
- 42 CFR 455.450 — Screening levels for Medicaid providers (opens in a new tab)
eCFR. Requires a State Medicaid agency to screen the applications it receives in response to a re-enrollment or revalidation request, as well as initial applications, against a categorical risk level of limited, moderate, or high, and sets what each level requires — verification of federal and state requirements, licensure verification, and database checks at the limited level; an on-site visit added at the moderate level; and a criminal background check and fingerprints added at the high level.
- 42 CFR 422.204 — Provider selection and credentialing (opens in a new tab)
eCFR. Requires a Medicare Advantage organization to follow a documented credentialing process for contracted providers and, for physicians and other health care professionals, to recredential at least every 3 years — updating the information obtained at initial credentialing, considering performance indicators such as those collected through quality improvement and utilization management, and including an attestation to the correctness and completeness of the new information. Requires redetermination at specified intervals for other contracted providers.
- Credentialing Accreditation and Certification programs (opens in a new tab)
NCQA. Describes the two program tracks NCQA offers, stating that its credentialing programs provide a framework for implementing industry best practices that help organizations credential and recredential health care professionals, that Credentialing Accreditation evaluates organizations providing full-scope credentialing services including credentialing and recredentialing committee review of practitioners, and that Credentialing Certification assesses organizations that verify practitioner credentials, with verification accomplished through the primary source, a recognized source, or a contracted agent of the primary source.
- Clinicians — the CAQH Provider Data Portal (opens in a new tab)
DataSpring (formerly CAQH). States that clinicians and group administrators enter their information into the CAQH Provider Data Portal and share it with the plans they authorize, that the platform is a neutral repository where a practice maintains its information once instead of managing separate credentialing applications and portals for each payer, and that authorized health plans access it for administrative workflows such as credentialing, enrollment, and directory management.