Medicare Revalidation for Independent Practices: Due Dates, Notices, and What a Missed Deadline Costs
Medicare requires every enrolled provider and supplier to revalidate its enrollment every 5 years (every 3 years for DMEPOS suppliers), and a practice that misses its posted due date can see Medicare payments put on hold or its billing privileges deactivated, with no reimbursement for services furnished during the deactivation period (CMS, Medicare Revalidations page, accessed October 2026). CMS states plainly that there are no exemptions and no extensions, so the deadline on the public Revalidation List is the deadline.
Credentialing and enrollment requirements vary by payer and change frequently. Verify current requirements directly with each payer.
The Short Answer
Look up every Medicare enrollment the practice holds on the CMS Medicare Revalidation List at data.cms.gov/revalidation, including the group enrollment and each individual clinician, and put each due date on a calendar with a 90-day warning. Revalidate through PECOS once you have a notice or are within 3 months of a listed due date. If the list shows To Be Determined instead of a date, do nothing yet; CMS says not to submit a revalidation when no due date is listed.
Practices without in-house enrollment staff can compare credentialing services on GetPracticeHelp that track these dates as part of ongoing maintenance.
How the Revalidation Clock Works
Revalidation is Medicare's periodic re-check of the information in an enrollment record: ownership, practice locations, reassignments, licensure, and the people with managing control. The 5-year cycle is set in federal regulation (42 CFR 424.515), and CMS can also request an off-cycle revalidation at any time. For a small practice, the operational problem is that the clock runs separately for each enrollment. A three-physician group has at least four records to track: the group's own enrollment and one for each physician who reassigns benefits to it. Each one can carry a different due date.
Where the due date comes from
CMS posts revalidation due dates 7 months in advance on the Revalidation List, and the list is refreshed periodically as new dates are assigned (CMS Revalidation Cycle 2 FAQs). The date shown there is the controlling deadline. The MAC that handles the practice's enrollment then sends a revalidation notice by email or U.S. mail roughly 3 to 4 months before that date. The notice goes to the contact information in the enrollment record, which is why a stale correspondence address or a departed office manager's email address is a common reason a practice never sees the warning.
What a To Be Determined entry means
A To Be Determined entry means CMS has not set a revalidation due date for that enrollment within the current period. It does not mean the enrollment is inactive, and it does not mean the practice is exempt. CMS returns unsolicited revalidations submitted more than 7 months ahead of a due date when no notice was issued, so filing early to get it over with wastes staff time. Recheck those entries every 60 to 90 days.
The table below lays out the milestones in order, with the role that usually owns each step in a practice of 1 to 5 providers.
| Milestone | Timing (CMS) | Practice Action | Who Usually Owns It |
|---|---|---|---|
| Due date appears on Revalidation List | Posted 7 months before the due date | Record the date for the group and each clinician | Practice administrator or credentialing service |
| MAC revalidation notice | Sent about 3 to 4 months before the due date | Confirm receipt; start the PECOS application | Credentialing service |
| No notice received, due date within 3 months | CMS says revalidate anyway | Submit in PECOS without waiting for the letter | Credentialing service |
| Due date passes without a submission | Payment hold or deactivation possible | Escalate the same day; contact the MAC enrollment unit | Practice administrator and billing vendor |
| Deactivated | Complete new enrollment application required | Resubmit in full; hold or track affected claims | Credentialing service and billing vendor |
The Complication: Deactivation Is Not a Paperwork Delay
Many practices treat a late revalidation like a late CAQH attestation: annoying, fixable, and mostly harmless. Medicare does not work that way. Once billing privileges are deactivated, reactivation requires a complete new enrollment application, and CMS states that Medicare will not reimburse services furnished during the deactivation period. Those visits are not delayed revenue sitting in a queue. They are gone.
A worked example shows the scale. Assume, for illustration only, a physician whose Medicare collections run $20,000 per month. If that physician's enrollment is deactivated for 45 days while a new application is prepared and processed, roughly $30,000 of Medicare work is unbillable. In a practice where Medicare is a large share of collections, that one missed date can erase a month of margin. The figures are illustrative assumptions, not benchmarks; plug in the practice's own monthly Medicare collections per clinician to size the exposure.
Two further wrinkles catch small groups. First, revalidating the individual clinicians does not revalidate the group, and the reverse is also true; each enrollment record has its own due date and its own application. Second, a clinician who left the practice may still show a reassignment to the group. Revalidation is the right moment to end stale reassignments, because the application asks the group to account for everyone billing under it.
Implementation: What Practices Actually Do
The practices that never miss a revalidation run it as a calendar task, not a mailbox task. For a small group the setup is a few hours of administrative time, and the quarterly upkeep is a short lookup.
- Inventory every enrollment: list the group NPI and each individual NPI that bills Medicare, along with the PTAN for each. If the practice runs more than one location under separate enrollments, list each one.
- Pull every due date: search each NPI on the Revalidation List at data.cms.gov/revalidation and record the date, or note that none is assigned yet. Repeat the lookup every quarter.
- Set a 120-day warning: put a reminder 120 days before each due date. That puts the work ahead of the MAC notice, so a lost letter changes nothing.
- Verify the contact record: confirm the correspondence address, the special payments address, and the contact email in PECOS. If any of them points to a former employee, update it before the notice window opens.
- Submit in PECOS, not on paper: PECOS shows the application status and creates a record of the submission date. Keep the confirmation with the enrollment file.
- Answer development requests fast: if the MAC asks for missing information, treat the response deadline in that letter as a hard date. An application rejected for missing information sends the practice back to the start.
Practices that already pay a credentialing vendor should confirm in writing that Medicare revalidation is in scope, with the vendor named as the owner of the calendar. Many contracts cover new payer enrollments and CAQH maintenance but not revalidation monitoring. The CAQH ProView vs PECOS comparison explains which system feeds which payer, and the guide to credentialing a provider with Medicare and Medicaid covers the initial enrollment steps that revalidation repeats.
What Goes Wrong
- Waiting for the letter: the notice goes to whatever contact data sits in the enrollment record. If that address is stale, the first sign of trouble is a payment hold.
- Tracking only the physicians: the group enrollment has its own due date. A lapsed group record stops payment on every clinician who reassigns to it.
- Filing too early: an unsolicited application more than 7 months ahead of the due date, without a notice, is returned and has to be filed again.
- Treating To Be Determined as done: it means no date is assigned yet. A quarterly recheck catches the date when it appears.
- Billing through a deactivation: claims for dates of service in the deactivation period will not be paid, and timely filing keeps running on everything else. The guide to timely filing denials covers how those windows interact with held claims.
What Should You Do This Quarter?
Run the Revalidation List lookup for every NPI the practice bills under, today, and calendar each date with a 120-day warning. If any date falls within the next 3 months, start the PECOS application now without waiting for a notice. If the list shows no date yet, recheck in 60 to 90 days. The cost of the whole routine is a few hours a year; the cost of one missed date is every Medicare visit in the deactivation period. Practices that would rather hand the calendar to a specialist can compare credentialing services that include Medicare revalidation monitoring in scope.
Get the full practice management guide at GetPracticeHelp, with billing benchmarks, credentialing checklists, and revenue cycle playbooks for independent practices.
Frequently Asked Questions
- How often does a physician practice have to revalidate Medicare enrollment?
- Every 5 years for physicians, non-physician practitioners, and groups, and every 3 years for DMEPOS suppliers, under 42 CFR 424.515. CMS can also request an off-cycle revalidation at any time.
- Can a practice get an extension on a Medicare revalidation due date?
- No. CMS states that it does not grant exemptions or extensions. The due date on the Revalidation List is the deadline.
- What happens if a practice misses the revalidation deadline?
- Medicare can place a hold on payments or deactivate billing privileges. Reactivation requires a complete new enrollment application, and services furnished during the deactivation period are not reimbursed.
- Does revalidating the group also revalidate the physicians who reassign to it?
- No. The group enrollment and each individual enrollment have their own due dates on the Revalidation List, and each needs its own submission when its date comes up.
More practice operations guides for independent practices are available on GetPracticeHelp.