Recredentialing and revalidation deadlines: the dates that stop a provider billing

A credentialing file gives no warning before it stops working. The dates that end a provider's ability to bill are set by CMS, by a health plan, by a state licensing board and by the DEA, and each provider carries a different set. Recredentialing and revalidation deadlines do not arrive as a batch. The failure surfaces on a remittance advice, weeks after the date that caused it.

A medical services team carries that work without much visibility into it. What the CFO sees is a set of claims for care delivered by a qualified provider that Medicare will not pay and that cannot be resubmitted later.

Deactivation reaches back to the day compliance lapsed

CMS can switch off Medicare billing privileges with an effective date in the past. Under 42 CFR 424.540 it may deactivate where a provider fails to furnish complete revalidation information within 90 calendar days of a request. It may also deactivate where an enrollment change is reported late, and on that ground the effective date is the date the provider became non-compliant. Paragraph (e) is the sentence for the CFO: no payment may be made for services or items furnished while deactivated.

Reactivation does not close the gap. CMS may, for any reason, require a complete Form CMS-855 first, and the reactivation date is the date the contractor received the submission it processed to approval. CMS puts it plainly: "Medicare won't reimburse you for any services during the period that you were deactivated".

Those reporting deadlines are short. A change of ownership, an adverse legal action or a change, addition or deletion of a practice location must be reported within 30 days, and every other enrollment change within 90.

A group opens a second office on March 3 and files on April 20, past the April 2 deadline. If CMS deactivates on that ground the effective date is April 3, and reactivation runs from the day in May the contractor receives the application it approves. Every Medicare claim in between is unpayable, and no later filing reaches back to collect it.

Medicare revalidation: the due date is published before CMS writes to you

Most providers and suppliers revalidate their enrollment information every five years under 42 CFR 424.515. Suppliers of durable medical equipment, prosthetics, orthotics and supplies revalidate every three, under 42 CFR 424.57(g).

CMS posts revalidation due dates seven months ahead on the Medicare Revalidation List at data.cms.gov, and contractors send notice three to four months out. Once notified, there are 60 calendar days to file a complete application. CMS grants no exemptions and no extensions, and puts the tracking obligation on the provider. Deactivation becomes available at 90 calendar days of non-response.

CMS also holds its contractors to a weaker standard on revalidations: 80 percent processed within 15 calendar days where no site visit, development or fingerprinting is needed, against 95 percent for initial applications. Every revalidation sits in that slower queue regardless of when it is filed. A file submitted on day 59 of the 60 has no processing margin left.

Miss NCQA recredentialing by 31 days and the practitioner starts over

NCQA requires recredentialing within 36 months and publishes no grace period. Missing the date means the file is scored down at survey.

NCQA's published FAQ, dated March 15, 2020, states that an organization that misses the deadline may still recredential if it makes the decision within 30 days of the original due date. Beyond that, the practitioner goes through initial credentialing from the start.

That means a fresh application and fresh primary source verifications for a practitioner who never left the network, triggered by a delay of 31 days.

Which three-year cycle applies, and who set it

The Joint Commission, NCQA and CMS each attach an interval of about three years to something, and the three do not describe the same obligation. The Joint Commission grants privileges for a period not to exceed three years, at MS.18.02.03 under the standards effective January 1, 2026. Every Medical Staff standard was renumbered then, so a policy citing a pre-2026 number points at a reference that no longer exists. NCQA's 36 months, covered above, applies to recredentialing rather than to privileges.

CMS appears twice in that list and means different things each time. For Medicare Advantage networks, recredentialing at least every three years sits in federal regulation at 42 CFR 422.204(b)(2)(ii), where "at least" makes it a floor. For medical staff appraisal under the Conditions of Participation, 42 CFR 482.22(a)(1) requires appraisals "periodically" and sets no number at all. A compliance calendar has to hold those four obligations separately, with the body that enforces each one recorded against it.

NPDB Continuous Query becomes the only option on December 4, 2026

Hospitals are the only health care entities federal law requires to query the National Practitioner Data Bank, under 45 CFR 60.17(a), at application and every two years thereafter.

Most hospitals calendar the two-year interval. The trigger that goes unnoticed is the application itself, and NPDB's guidance is explicit that a query is mandatory each time a practitioner applies for temporary privileges. It gives the example of four applications in one year: four queries, including every locum tenens application. A hospital that does not query is presumed under 45 CFR 60.17(b) to know whatever the NPDB holds.

Continuous Query enrollment costs $2.50 per practitioner per year and notifies within 24 hours of a report reaching the NPDB. NPDB confirms it satisfies the two-year mandate. That changes on December 4, 2026, when NPDB merges One-Time Query and Continuous Query into a single NPDB Query service, which becomes the only one available. Any policy written around choosing between the two needs rewriting before that date.

Monthly exclusion screening, and what OIG says it protects against

OIG states that providers are not required by statute or regulation to check the List of Excluded Individuals/Entities. In the same bulletin it writes: "OIG updates the LEIE monthly, so screening employees and contractors each month best minimizes potential overpayment and CMP liability".

The civil monetary penalty for employing or contracting with an excluded individual runs to a maximum of $25,595 per item or service under the HHS inflation adjustment effective January 28, 2026, plus an assessment of up to three times the amount claimed, or three times the total cost of employing them where the role does not bill.

The prohibition covers services that were never separately billed. OIG's own example is an excluded nurse in a hospital: no payment for that nurse's services to program beneficiaries, even where they are paid inside a diagnosis-related group.

Contracting the screening out to a third party does not move the liability from the provider, and the bulletin says so directly. For Medicaid, monthly screening is mandated on states under 42 CFR 455.436.

License and DEA expirations follow no pattern you can infer

A license expiration date cannot be worked out from a hire date. California ties a physician's license to the last day of the month it was issued, and the Medical Board states there is no grace period and that practicing on an expired license is illegal. Texas assigns licenses to one of four fixed quarterly expiration dates, with even-numbered licenses expiring in even-numbered years.

Florida deserves the earliest alert. Board of Medicine licenses expire on January 31 in two alternating-year groups. Failure to renew puts the license into delinquent status, and failure by a delinquent licensee to renew active before the current cycle expires renders it null and void without further action by the board. Florida nursing licenses follow the same delinquent-then-null-and-void sequence on their own renewal groups, and the Board of Nursing states that once a license is null and void it cannot be reactivated and the nurse must reapply under current requirements.

DEA registrations run 36 months at $888 for the dispensing category, and DEA permits reinstatement for one calendar month after expiration. Federal law separately prohibits handling controlled substances for any period under an expired registration, which means reinstatement restores the registration without making anything prescribed in the gap lawful.

Holding recredentialing and revalidation deadlines across a full roster

None of these recredentialing and revalidation deadlines is hard to meet on its own. The difficulty is volume, because every provider carries a different set, issued by bodies that do not coordinate with each other.

Credentially runs real-time compliance monitoring across the documents and registrations in a provider file, with daily re-checks and expiration alerts. Automated primary source verification sits alongside it, and non-compliant providers are blocked from booking shifts. A lapsed credential therefore cannot reach a patient through the schedule. Audit reporting and a logged activity trail produce the evidence on the day a surveyor asks for it. NPDB and LEIE queries are point-in-time events at credentialing and recredentialing, and what the platform tracks is the date each next falls due.

Health Carousel cut audit time from weeks to one day and doubled its credentialing output without expanding its team.

The credentialing page covers how recredentialing and revalidation deadlines are tracked against a provider record, and the primary source verification page covers the verification. The ROI calculator will size what a month of deactivated billing costs across your provider count.

The revalidation dates for providers who enrolled five years ago are already on the CMS list, and the dates for everyone credentialed in 2023 were fixed the moment the committee signed them off. The question worth answering this week is who in your organization holds that list, and what they are checking it against.