Medicare Revalidation: Deadlines, PECOS Steps and Avoiding Deactivation (2026) 

Key Takeaways 

• Medicare providers usually revalidate every five years. DMEPOS suppliers revalidate every three years, and CMS can ask for revalidation outside of these times at any time. 

• On the Medicare Revalidation List at data.cms.gov, you can find your due date. You can search by NPI, name, or organization, and you should also look at the group and reassignment files. 

• PECOS is where revalidation takes place. Sign in, look over your registration record, make any necessary changes, and send it in before the due date. 

• If you miss the deadline, your payment will be held. Under 42 CFR 424.540, if billing privileges are taken away, Medicare will not pay for services provided during that time. 

Medicare revalidation is when CMS regularly checks the information they have on file about you to make sure it’s still correct and that you still meet the requirements to be a Medicare participant. If you miss the due date, Medicare may stop paying you right away through a payment hold that can lead to removal. It’s not when you get a warning that you need to find your due date if you’re running your own business or giving credentials to a group. Now is the time. This should be taken care of by your credentialing maintenance services partner, but if it isn’t, you can start by looking at the Medicare Revalidation List. 

What Is Medicare Revalidation? 

Medicare revalidation is the process of verifying your registration information with CMS every so often, as required by 42 CFR 424.515. It applies to all Medicare-enrolled providers and suppliers, including solo practitioners, physician groups, institutional providers, DMEPOS suppliers, and people who submitted a CMS-855R form to change their billing status to a group. 

Revalidation is not the same as signing up for the first time. It’s a different process than setting up Medicare bills for the first time. CMS makes you check your record every so often, update anything that’s changed, and sign off that the information is still correct once you’re registered. The goal is simple: CMS is making sure that enrolled providers are still eligible and that the information about their practices matches what is already on file. Check out our guide on how to enroll in PECOS for a full rundown of the first steps. 

How Often Do You Need to Revalidate? 

It takes most providers five years to revalidate. Suppliers of DMEPOS work in cycles of three years. Off-cycle revalidation can also be asked for at any time by CMS, for example, if a provider’s risk profile changes or if CMS finds mistakes in the enrollment record. 

The five-year clock starts from the date of your most recent approved revalidation, not the date you first signed up. “CMS revalidation” and “Medicare revalidation” mean the same thing. If CMS approved your most recent revalidation in March 2022, your next due date will be in or around March 2027. 

However, CMS usually posts due dates at the end of each month, six to seven months in advance. Some providers mix it up with commercial payer recredentialing, which happens at a different time and uses a different set of tools. 

How to Find Your Due Date with the Medicare Revalidation Lookup 

If you’ve never used the tool before, this is the most important part. The Medicare Revalidation List can be found at data.cms.gov and can be searched by anyone. How to use it. 

Go to data.cms.gov and open the Medicare Revalidation List. The registration files for both individuals and organizations are regularly updated. In the search field, type in your NPI, last name, or the name of your organization. It will either show a specific due date or “TBD.” 

A specific date means CMS has told your MAC when your revalidation is due, and they will send you a notice about three to four months before then. “TBD” means that CMS hasn’t given you a due date yet, usually because it’s more than six to seven months away. You can’t skip TBD. It means your date is coming up but hasn’t been posted yet. 

The Medicare Revalidation List also includes separate files for group enrollments and reassignments, which many offices overlook. For those who bill under a group NPI, both your personal record and the group enrollment need to be checked again. It’s important to check the reassignment files carefully because a provider’s personal due date and their reassignment due date may be different. Submissions for revalidation that were complete but were held up by the missing reassignment piece have been delayed. 

About 90 to 120 days before the due date, your MAC also sends you a letter by mail or email. That notice is not enough on its own. PECOS address changes that were never made mean that the notice goes to a place where you’re not, and the deadline is still there. 

 

When Should You Submit Your Revalidation? 

The CMS revalidation page gives an exact submission window, so it’s better to quote the rule from there than from a competitor’s page. CMS currently tells you when you can submit, and if you submit too early, it may be returned as premature. On the day you’re going to file, check the CMS Medicare provider registration page directly. This is one of the things third-party blogs report differently. 

One thing is clear: CMS does not give extensions. There is no grace period that gives you an extra 30 or 60 days to meet your deadline. If your due date is November 30, you need to make sure your entry is complete and sent to PECOS before that date. 

When the due date comes around, CMS posts it about six to seven months ahead of time. Your MAC sends a revalidation notice about three to four months before the date, the due date. If nothing has been submitted, CMS holds the payment, and the account could be deactivated. 

How to Revalidate in PECOS: Step by Step 

Revalidation is handled in PECOS, currently PECOS 2.0. Confirm the current login page and interface at pecos.cms.hhs.gov before you begin, since CMS has updated the platform. 

• Use your I&A details to log in. 

• Go to your dashboard and open the enrollment record that you need to confirm again. There is no new application for you to fill out. You’re reviewing your old record and only updating what has changed since you last approved it: practice locations, mailing addresses, ownership information, reassignments, and direct deposit banking information. 

• Get the documents you need before you start. Depending on what changed, you might need new forms for licensing, medical insurance, or a company declaration. You can directly upload the needed documents into PECOS. 

• Note the application fee. The CMS enrollment application fee is paid by institutional providers. Practitioners do not have to pay a fee to revalidate. The fee amount for institutional providers for the current year is shown in the notice in the Federal Register from CMS for that year. Before you use a particular dollar amount, get the 2026 number from CMS. 

• Use your computer to sign and send the application. 

• Answer any requests for MAC development by the due date in the letter. 

Paper options include CMS-855A for school providers, CMS-855R for reassigning benefits, CMS-855B for groups, and CMS-855I for individual practitioners. Even though PECOS is faster and makes fewer mistakes, you can still use the paper forms. 

What Happens If You Miss Medicare Revalidation? 

CMS first stops your Medicare bills from being paid. Under 42 CFR 424.540, CMS revokes billing privileges if you don’t fix the problem. Medicare won’t pay for the services you provide while you’re deactivated, and they usually don’t pay for those services again once you’re activated. 

To reactivate after being deactivated, you need to complete a new registration form, wait for processing, and then receive a new effective date. The billing gap between the date you were deactivated and the date your new account started is real, and you usually can’t get it back. This isn’t an administrative hassle for practices that depend on Medicare payments. The money isn’t coming in. 

The fix is preventative, not reactive. If you’re already deactivated, contact Credex Healthcare about reactivation and how they can close the billing gap as quickly as possible through medical billing services. 

Common Medicare Revalidation Mistakes 

These are the mistakes that cause most revalidation issues, and you can avoid all of them. 

• Outdated correspondence address in PECOS. The MAC notice is sent to the address that is on file. If that address is wrong, you won’t get the warning. Time goes by, and the hold starts. Every time your address changes, you need to change it in PECOS. 

• Forgetting group reassignments. When a provider changes how they bill a group, they need to check both their own registration record and the group’s record on the Medicare Revalidation List. 

• NPPES mismatches. CMS will notify you during processing if your name, address, or specialty in NPPES doesn’t match PECOS. Check how your NPI works in credentialing before you submit. 

• Ignoring MAC development letters. A letter with a due date comes in, and missing it starts the problem all over again. 

• Submitting too early. CMS sets an application deadline, and applications submitted after that time may be returned. See why PECOS applications get turned down for more information on other common filing mistakes.  

Medicaid Revalidation: How It Differs 

CMS and PECOS handle Medicare revalidation. As per 42 CFR 455.414, each state is responsible for its own Medicaid revalidation process. This process must be done at least every five years for all Medicaid providers. 

The government baseline is five years, but states can make rounds shorter if they want to. Each state has its own portal, notices, and paperwork. Some states require providers in higher-risk enrollment groups to get fingerprinted, which adds time and steps that Medicare revalidation doesn’t require. 

Our Louisiana Medicaid provider enrollment guide shows how state-level rules are different from the federal Medicare process and how to follow them. Every other state’s Medicaid revalidation gets the same level of attention, tailored to that state. 

Revalidation vs. Recredentialing 

People use these words to talk about the same thing, but they mean different things. Medicare revalidation is run by CMS and happens every five years for most providers. It is all handled in PECOS. 

Commercial payer recredentialing happens separately, and each payer uses its own process. This usually happens every two to three years. A third layer is added by CAQH profile management. You must re-attest your CAQH attestation every 120 days, separate from Medicare’s five-year period. 

A provider who treats Medicare revalidation as their only credentialing obligation is letting commercial payer and CAQH timelines slip. They’re not on the same calendar. 

How Credex Healthcare Helps with Revalidation 

Credex Healthcare tracks due dates for each provider and group enrollment, revalidation files, MAC development requests, and the follow-up that keeps submissions moving. Medicaid revalidation across states and commercial payer recredentialing are also part of the service. This way, nothing gets lost between the three rounds. 

If you’re in charge of a group practice or a health system with multiple providers, you’ll miss deadlines because you must keep track of overlapping individual and group revalidation dates by hand. Let Credex Healthcare track and file your revalidations so your billing doesn’t stop because of a calendar oversight. 

Our medical credentialing services team works with solo practitioners, physician groups, institutional providers, and multi-site practices across all specialties. 

FAQs 

How often do you have to revalidate with Medicare?

Most providers do it every five years. Every three years, DMEPOS providers have to revalidate. CMS can also request revalidation at any time, regardless of where you are in the cycle.

How do I find my Medicare revalidation due date?

Go to data.cms.gov and look for your NPI or name on the Medicare Revalidation List. Once you set a date, you have to meet it. “TBD” means that CMS hasn’t given it to anyone yet, usually because it’s more than six to seven months away.

What does “TBD” mean on the Medicare revalidation list?

It means that CMS hasn’t yet told you when your work is due. This isn’t a permanent state. You are still in the middle of your revalidation cycle, and the date will be posted as the six- to seven-month window approaches.

Can I get an extension on Medicare revalidation?

No. CMS doesn’t give extensions. Before the due date, send in your revalidation. There’s no extra time.

Is there a fee for Medicare revalidation?

Practitioners working alone don’t have to pay a fee. The CMS enrollment application fee is paid by institutional providers. Check the CMS Federal Register notice for the current amount for 2026 before sending it in.

What happens if my Medicare billing privileges are deactivated?

During the deactivation period, Medicare will not pay for any services that are provided. To reactivate, you must complete a new application and choose a new start date. Usually, Medicare does not pay the billing gap retroactively.

Do I need to revalidate my group’s reassignments too?

Yes. It is important to look at both the individual registration records and the group participation on the Medicare Revalidation List. Assignment files differ from provider listings and can have different due dates.

Is Medicaid revalidation the same as Medicare revalidation?

No, 42 CFR 455.414 says that each state must revalidate Medicaid through its own portal at least every five years. Each state has its own set of deadlines, paperwork requirements, and ways to submit.

Conclusion 

Renewing your Medicare isn’t hard, but it’s easy to forget. The due date is on the Medicare Revalidation List, and the submission happens in PECOS. If you miss the deadline, you will lose your ability to bill Medicare, and there is no way to get it back once it has been taken away.