Should you pay for a credentialing service?

For OT, PT and SLP practice owners seeing children, adults or both: pay a credentialing service only for defined work it does through its own delegated access, at a price that beats your own staff time. No vendor can open a closed network, set your rate or effective date, or sign your clinicians’ Medicare applications.⁠^1,2,3,4,5

What does a credentialing service do for a therapy practice?

It prepares, submits and follows up your applications to payers, and keeps the records behind them current, but every payer it works with runs a separate process under separate rules. A quote that says "credentialing" can cover any of three jobs, so read it payer by payer:

• Medicare enrollment. Providers submit enrollment information on the applicable application, in PECOS or on paper: the CMS-855I for an individual therapist, which now also carries the reassignment of benefits to a group, and the CMS-855B for a group practice.⁠^4,10
• Medicaid enrollment. The state Medicaid agency screens every provider it enrolls under 42 CFR part 455, subpart E, and the state must also screen and enroll every network provider of its Medicaid managed care plans; each plan then credentials on its own documented process, under a uniform policy the state sets.⁠^6,7,13
• Commercial credentialing and contracting. Each plan runs its own request process. Aetna, for one, first evaluates whether it needs more providers in the area; after contracting, and where credentialing applies, it pulls the application from CAQH ProView, and it finalizes the contract when credentialing is complete.⁠¹

Many vendors also sell TRICARE certification and upkeep: re-attestations, revalidations, change reports and recredentialing. Each line below is a separate deliverable with its own decision-maker.

How is Medicare enrollment different from commercial credentialing?

Medicare enrollment follows a federal regulation that applies to every applicant, while commercial credentialing is a plan’s own review that starts with whether the plan needs you. CMS enrolls a provider once it completes the enrollment process, and the regulation sets what the application must contain, who signs it and when billing may start.⁠^3,4 A plan, by contrast, can decline a provider it does not need; a Medicaid managed care plan that declines one must give written notice of the reason.⁠^1,2

TRICARE adds a layer of its own: a provider must be TRICARE-certified to file claims and be paid, and joining the network is a separate request to the regional contractor.⁠¹⁵ The TRICARE participation guide covers certification and the network decision for each discipline.

Where does the CAQH Provider Data Portal fit for therapists?

It is the shared profile many commercial plans read credentialing data from, and it belongs to the clinician, not to whoever fills it in. DataSpring, as CAQH is now called, describes the CAQH Provider Data Portal as a platform where practitioners enter, update and verify professional and practice information and share it with the organizations they authorize; using it is voluntary and free for providers, though more than 1,000 health plans and other organizations have asked their network providers to use it.⁠^8,16 Plans differ in how they use it: UnitedHealthcare asks for a DataSpring registration only in some states and specialties, while Aetna retrieves its credentialing application from CAQH ProView once the clinician authorizes Aetna to see it.⁠^1,17

The profile runs on a clock. Providers must attest to their profiles every 120 days, or every 180 days in Illinois, and a profile not attested in time changes to Expired status.⁠⁸ UnitedHealthcare tells applicants to make sure attestations and documentation are current where DataSpring is required, so re-attestation dates belong in any upkeep contract.⁠¹⁷

What can a credentialing service not do for your practice?

It cannot make the payer’s decisions or sign the clinician’s statements. Four things stay outside any vendor’s reach, whatever its marketing says:

• Open a closed network. The plan decides whether it needs another provider: Aetna evaluates its need to serve members in the area before contracting, a Medicaid managed care plan need not contract beyond the number of providers its enrollees need, and Humana Military’s page for TRICARE East says it is not currently accepting requests to join its medical, surgical or ancillary networks.⁠^1,2,15
• Set the rate. What a plan pays is in the contract the practice signs, and a Medicaid managed care plan may pay different amounts for different specialties, or for different practitioners in the same specialty.⁠² The rate negotiation guide covers which rates are open to negotiation.
• Set the effective date. For PTs, OTs and SLPs, Medicare’s effective date is the later of the filing date of an application a contractor approves or the date services began at a new practice location; a commercial plan’s date comes with its contract, which Aetna, for one, finalizes when credentialing is complete.⁠^1,3
• Sign for a clinician. An individual practitioner signs their own Medicare application and cannot delegate that authority, and a surrogate in CMS’s systems is not authorized to sign an enrollment application; on the CAQH side, DataSpring lists attesting that all information is truthful and complete among the steps a provider takes to use the portal.⁠^4,5,8

A vendor that promises approval, a network opening or a start date is promising something only the payer controls. Ask instead what the vendor does when a payer says no, and put the answer in the contract.

Who signs a Medicare application that a vendor prepares?

The therapist, for an individual enrollment, and the practice’s authorized official, for a group’s; never the vendor. Under 42 CFR 424.510 the individual practitioner signs, an organization’s initial enrollment and its revalidations are signed by an authorized official, and individual practitioners and sole proprietors cannot delegate signature authority for any reason.⁠⁴ An authorized official is someone the organization has given legal authority to enroll it, such as a chief executive officer, general partner or direct owner, and a delegated official who may sign later changes must hold an ownership or control interest in the practice or be its W-2 managing employee.⁠¹⁸

The CMS-855I tells the individual practitioner that they are the only person who can sign it, and the signer certifies, under penalty of perjury, having read the application and that its contents are true, correct and complete. Signing in PECOS electronically does not change who has to sign.⁠^9,19

The responsibility follows the signature. Providers are legally responsible for the accuracy, completeness and truthfulness of everything on or with their applications, regardless of whether another party completed the application, and CMS can revoke an enrollment when the provider certified misleading or false information as true.⁠^4,20 CMS may also reject an application that carries a copied or stamped signature, was signed more than 120 days before the contractor received it, or was signed by someone not authorized to sign.⁠²¹ So never sign blank certification pages for a vendor to hold, and read each application before it goes.

Who attests to a clinician’s CAQH profile when a vendor maintains it?

The clinician should, because the profile and its permissions are the clinician’s. DataSpring says the provider profile belongs to the provider, that the provider controls its information and gives the permissions that let plans use it, and that health plans do not own or control profiles.⁠¹⁶ Its portal lets a provider delegate staff to manage non-sensitive information, and it lists attesting that all information is truthful and complete as one of the provider’s own steps.⁠^8,22 A vendor can keep documents current and send reminders; the clinician reads the profile and attests each cycle.

When is paying for a credentialing service worth the money?

When the volume or the deadline is more than trained staff can carry, and the contract buys work you can check; not when it buys a promise of speed. Count the work before deciding: each payer, times each clinician, times each location, plus the upkeep that never stops.

Upkeep runs on fixed clocks, and missing one can undo an approval:

• A CAQH profile re-attested every 120 days, or 180 days in Illinois.⁠⁸
• Medicare revalidation every 5 years, with the application due within 60 calendar days of CMS’s notice.⁠²³
• Medicare changes reported within 30 days for a change in ownership, an adverse legal action or a change in practice location, and within 90 days for all others.⁠¹⁴
• Medicaid revalidation at least every 5 years, on the state’s schedule.⁠²⁴
• Each Medicaid plan’s recredentialing on its documented process, and each commercial plan’s on its own cycle; the recredentialing and revalidation calendar lays these dates out.⁠⁷

There are three ways to divide the work, and the right one depends on the volume coming and who in the practice can own it.

Does the choice differ for OT, PT and SLP practices?

Medicare screening differs by discipline, and the payer mix differs between pediatric and adult caseloads. CMS screens occupational therapists and speech-language pathologists at the limited risk level, and physical therapists enrolling as individuals or as group practices at the moderate level, which adds an on-site visit; any provider must be operational before billing privileges are granted.⁠^4,25 A PT practice therefore needs its address staffed and ready for an inspector whoever filed the paperwork, and no vendor can stand in for that.

A practice that treats Medicare patients has to enroll: occupational therapists, physical therapists and qualified speech-language pathologists are on CMS’s list of providers not eligible to opt out, though a therapist who sees no Medicare patients does not have to enroll or opt out.⁠²⁶ A pediatric practice that serves children on Medicaid works with the state and each of its plans, each a separate application; the EPSDT guide covers what Medicaid owes those children.⁠^6,7,13 A practice seeing both ages runs both tracks, which multiplies the rows to track.

How do you give a credentialing vendor access without sharing logins?

Approve the vendor’s organization as a surrogate in CMS’s Identity & Access Management System (I&A), so its staff work under their own accounts, and keep your own user ID and password to yourself. CMS’s Medicare enrollment booklet says an authorized official or access manager may invite a staff end user or surrogate to access PECOS for the organization, and that individual providers can authorize surrogates and staff end users too; once registered, they can view and modify CMS system information but cannot represent the practice, manage staff, sign enrollment applications, or start or accept connections.⁠¹⁰

CMS has addressed vendors directly. Asked in a 2019 webcast what a company that completes applications on behalf of clinicians should do, a CMS speaker said the company should have its own account and that CMS does not encourage sharing of accounts; in a later answer, he described the idea as one account per person.⁠²⁷

1. The vendor registers. An official with the authority to bind the vendor’s organization registers it in I&A.⁠⁵
2. You approve the connection. The provider names the vendor as a surrogate and picks the business functions it may use, such as PECOS, adding NPPES only if the vendor is to update NPI records.⁠⁵
3. The vendor assigns its staff. The vendor’s authorized official or access manager grants its own staff end users access to your record.⁠⁵
4. You review, then remove. A connection does not expire, and either side can disable it at any time, so log it with the contract and disable it the day the contract ends.⁠⁵

Removing access works even on records the vendor built. PECOS’s help page says an organization working on behalf of a provider organization may lose access to that provider’s Medicare information even if it initially created the enrollment record.⁠²⁸ CMS also advises reviewing your Medicare enrollment information several times a year and reporting at once any change you did not submit, a habit worth keeping while anyone else has access.⁠¹⁰

For CAQH, DataSpring lets a provider delegate staff to manage non-sensitive information.⁠²² For each plan’s portal, ask the plan how to add a user for an outside company; where it has no such role, keep the login in the practice and have the vendor send what needs entering.

What personal and practice data does a credentialing vendor see?

Nearly everything in the provider file, including Social Security numbers and bank details, so how a vendor stores data matters as much as how fast it works. The CMS-855I asks for each therapist’s name, date of birth and Social Security number, which must match the Social Security record; Medicare’s documentation can include proof of the legal business name, practice location, Social Security number, tax identification number, NPI and owners; and the electronic funds transfer setup asks for a voided check or bank letter with account and routing numbers.⁠^4,9,10 A CAQH profile holds documents such as licenses, training certificates and liability insurance.⁠⁸

Ask these before the first document changes hands, and keep the answers in writing:

• Where is our data stored, and which of your staff can open it?
• Do you pass any of it to subcontractors, or to staff outside the United States?
• How do we send you documents: a secure upload, or email attachments?
• Which of your staff hold access to our PECOS and NPPES records, and how do you remove someone who leaves?
• How long do you keep our data after the contract ends, and how do you delete it?
• How, and how quickly, do you tell us if our data is exposed?

Is a credentialing company a HIPAA business associate?

That depends on whether its work involves patients’ health information, so ask before it starts and let the practice’s privacy officer or lawyer decide. HHS’s rule defines a business associate as a person who, on behalf of a covered entity and other than as a member of its workforce, creates, receives, maintains or transmits protected health information for a regulated function such as claims processing, or who provides services such as management or administrative services that involve disclosing protected health information to it.⁠²⁹ HHS lists billing and practice management among its examples, and says a covered entity may disclose protected health information to a business associate once it has satisfactory assurances in a contract or other written arrangement.⁠³⁰

Ask in writing whether any part of the work touches patient information: following up claims held until an effective date, for example, or billing alongside credentialing. A company you contract with to prepare and submit Medicare claims is a billing agency in the CMS-855I’s terms, and the form says you remain responsible for the accuracy of the claims it submits.⁠⁹ File the answer, and any agreement that follows, with the contract.

What should a credentialing service contract spell out?

Every deliverable by payer, clinician and location, with the payer’s written confirmation as the only proof of completion, plus who may access what, how fast the vendor answers payer requests, upkeep, exit and what happens when a payer says no. Paste the checklist below into the scope of work and fill every blank before signing; a blank left open is a term the vendor sets later.

What should happen when a credentialing contract ends?

The practice should leave with every record, every access removed and every open application handed over with its next date. Write each of these into the exit clause:

• Files: a copy of every application submitted, every payer letter and email, every PECOS tracking ID and plan reference number, and the current tracker.
• Access: the vendor’s I&A connection disabled, which either side can do at any time; its delegated CAQH access removed; any plan portal users closed.⁠⁵
• Contact person: Section 13 of the CMS-855I names the person a Medicare contractor contacts with questions about the application, so change it to someone in the practice if the vendor’s staff were listed.⁠⁹
• Open drafts: PECOS deletes an unsubmitted application in NEW or EDIT status after 120 days of inactivity, rejects one returned for corrections that are not received within 30 days, and deletes a rejected one not reopened within 60 days, so each open application is handed over with its status and date.⁠¹²
• Data: written confirmation that the vendor has returned or deleted the practice’s and clinicians’ data, on the terms the contract set.

What should you ask a credentialing company before signing?

Ask questions whose answers you can check against the rules above. A vendor that asks for your login, offers to sign for a clinician, or quotes approval odds has answered the important ones already.

Score the answers against the contract checklist, not against the sales call. The right answer to question 2 is the surrogate connection, and to question 3, the clinician or the authorized official, every time, on a completed application.⁠^5,21

How do you compare a credentialing quote with doing it in-house?

Price the same year of work both ways: count the applications and upkeep tasks, estimate your staff hours from your own records, multiply by your loaded hourly cost, and set that against the vendor’s full quote plus the practice time that remains either way. Use your own figures rather than a published average; a vendor’s price page, where one exists, is a quote for that vendor on that day.

Measure the hours before you need them. Time the next application your staff handle from the first form to the payer’s letter, logging each sitting, call and request in minutes. Loaded hourly cost is the staff member’s pay plus payroll taxes and benefits, divided by the hours they are paid for. The practice’s time does not drop to zero with a vendor: someone still gathers documents, reads each application, signs and decides on contracts.

Then add the cost of delay to whichever side is slower: the visits a clinician could bill each week once participating, times the expected payment per visit, for each week of difference. Medicare’s retrospective billing reaches back at most 30 days before the effective date, outside a declared disaster, and only when circumstances precluded enrolling in advance, so weeks lost before an application is filed are not recovered beyond that window.⁠¹¹ The startup budget worksheet holds the other cost lines.

How do you track a vendor’s work to the payer’s decision?

With one row per payer, clinician and location, each status tied to a document from the payer, and "done" kept for the payer’s written confirmation of participation and its effective date. A percentage complete is the vendor’s estimate; the payer’s letter is the fact.

Much of it you can see yourself. CMS describes two ways to check a PECOS application’s status, one of them the View Enrollments link in PECOS, and PECOS emails the application’s web tracking ID to each address in its Contact Person section; UnitedHealthcare’s Onboard Pro dashboard shows the status of each enrollment request submitted.⁠^10,17 Ask that the practice receive every tracking ID and reference number the day it is issued.

What happens to visits before your effective date?

For Medicare, they go unpaid unless they fall inside a short retrospective billing window, so the filing date is the number a vendor most needs to protect. For PTs, OTs and SLPs, billing privileges start on the later of the date an application that a contractor approves was filed or the date services began at a new location, and the filing date is when the Medicare contractor gets the application.⁠^3,10 Services before the effective date can be billed retrospectively only when all program requirements, including state licensure, were met and the services were given at the enrolled location: for up to 30 days when circumstances precluded enrolling in advance, or 90 days when a Presidentially declared disaster did.⁠¹¹

Two habits cost days here. A Medicare contractor does not fully process a PECOS application without the provider’s electronic or uploaded signature, and an application whose missing information is not supplied within 30 days of the contractor’s request may be rejected.⁠^10,21 Put both into the contract’s response times, and get each clinician’s signature the day an application is ready.

Medicaid managed care has its own window. A plan may sign a network agreement for up to 120 days while the state’s screening is pending, but must end it when the state says the provider cannot be enrolled or the 120 days run out, and must notify the enrollees affected.⁠¹³ The state may rely on screening already done by Medicare contractors, so a practice enrolled in Medicare can ask the state whether that screening carries over.⁠⁶

Commercial plans set their own dates, in their own documents. Ask each plan in writing whether it ever makes participation effective before its approval date, file the answer, and book that plan’s members as in-network only from the date in the plan’s letter, not from a vendor’s forecast. What staff tell callers while an application is pending is covered in the credentialing guide, and the out-of-network benefits guide covers explaining a patient’s own benefits before the practice is in network.

How does the decision play out for a pediatric and an adult practice?

Differently, because the volume and the payers differ. The two practices below are hypothetical, and their hours, wages and fees are inputs to the worksheet, not figures any vendor charges or any application takes.

The pediatric owner was buying hours during a crunch; the adult owner had the hours and kept control. Both kept the signatures, the attestations and the contracts in-house.

What should your listings say while applications are pending?

Only what a payer has confirmed in writing, changed on the effective date and not before. A website, Google profile or directory listing that names a plan before participation starts sends families to a practice that cannot yet see them in network; the payment guide covers how to describe a pending plan in plain words.

Families search DrSensory free for occupational therapy, physical therapy and speech therapy clinics across all 50 states and Washington, DC; it lists clinics, one listing per practice at one address, every clinic keeps a basic listing at no cost, and claiming it is free.⁠³¹ A paid listing, $29.99 a month or $349.99 a year for the first location and $9.99 a month or $99.99 a year for each additional one, adds a description in the clinic’s own words; the insurance a clinic takes appears in a paid profile’s Clinic details box as the boxes the clinic ticks, and plan names belong in the description.⁠^32,33 Tick a box or name a plan only once the payer’s letter has arrived, and change both the day participation begins or ends. DrSensory does not verify clinical quality, and a listing is not a recommendation.⁠³² The profile guide covers each field.

Sources

1. Aetna. Request to join the Aetna network (Health Care Professionals: Join the Aetna Network). Checked October 25, 2026.
   Show the passageHide the passage

   Step 2: “Next, we’ll evaluate the current need to service our membership in your area and determine if contracting and/or credentialing are required.”; Step 3: “After contracting, and if Credentialing applies, we’ll get your credentialing application from the Council for Affordable Quality Healthcare (CAQH) ProView to begin the credentialing process. Make sure you designate Aetna as an authorized health plan so we can access your application.”; Step 4: “When you complete credentialing, your contract will be finalized and you’ll receive welcome materials to get up and running.”.
2. 42 CFR. §438.12, Provider discrimination prohibited (eCFR; Title 42 up to date as of October 22, 2026; Medicaid managed care). Checked October 25, 2026.
   Show the passageHide the passage

   “If an MCO, PIHP, or PAHP declines to include individual or groups of providers in its provider network, it must give the affected providers written notice of the reason for its decision.” The section may not be construed to “Require the MCO, PIHP, or PAHP to contract with providers beyond the number necessary to meet the needs of its enrollees” or to “Preclude the MCO, PIHP, or PAHP from using different reimbursement amounts for different specialties or for different practitioners in the same specialty”.
3. 42 CFR. §424.520, Effective date of Medicare billing privileges (eCFR; Title 42 up to date as of October 22, 2026; paragraph (d)). Checked October 25, 2026.
   Show the passageHide the passage

   For the types in (d)(2), which include “Physical therapists.”, “Occupational therapists.” and “Speech language pathologists.”, the effective date of billing privileges “is the later of” “The date of filing of a Medicare enrollment application that was subsequently approved by a Medicare contractor” or “The date that the provider or supplier first began furnishing services at a new practice location.”.
4. 42 CFR. §424.510, Requirements for enrolling in the Medicare program (eCFR; Title 42 up to date as of October 22, 2026; paragraphs (a) and (d)). Checked October 25, 2026.
   Show the passageHide the passage

   “Providers and suppliers must submit enrollment information on the applicable enrollment application.” “Once the provider or supplier successfully completes the enrollment process, including, if applicable, a State survey and certification or accreditation process, CMS enrolls the provider or supplier into the Medicare program.”; (d)(2)(ii): documentation to identify the provider “may include, but is not limited to, proof of the legal business name, practice location, social security number (SSN), tax identification number (TIN), National Provider Identifier (NPI), if issued, and owners of the business.”; (d)(3): “The signature attests that the information submitted is accurate and that the provider or supplier is aware of, and abides by, all applicable statutes, regulations, and program instructions.”; who signs, (d)(3)(i)(A): “An individual practitioner, the applying practitioner.”; (d)(3)(i)(C), for an organization: “an authorized official, as defined in § 424.502”; (d)(3)(ii): “Individual practitioners and sole proprietors cannot delegate signature authority when submitting an enrollment application for any reason.”; each delegated official must “Be an individual that has an ownership or control interest in the organization or is a W-2 managing employee as defined in section 1126(b) of the Act”; (d)(6): “The provider or supplier must be operational to furnish Medicare covered items or services before being granted Medicare billing privileges.”; (d)(10), Legal responsibility: “All providers and suppliers are legally responsible for the accuracy, completeness, and truthfulness of all information they provide on or with their applications, regardless of whether another party completed the application.”.
5. Centers for Medicare & Medicaid Services. Identity & Access Frequently Asked Questions (FAQs) (the I&A System FAQ, dated January 20, 2026). Checked October 25, 2026.
   Show the passageHide the passage

   “A surrogate is a user who has been permitted by a Provider (Individual or Organization) to work on that Provider’s behalf in the business function(s), PECOS, NPPES, PEPPER, or CBR designated by the Provider.”; to add one, the provider must “indicate the business function(s) that you want that Surrogate to access”; “Staff End Users must be granted access to the provider by one of the surrogate organization’s Authorized Officials or Access Managers via the My Staff tab.”; “The CMS-855 signor is responsible/liable for the information on the enrollment application. A surrogate is not authorized to sign the enrollment application.”; “Once approved, a connection will not expire. Either party may login and remove the surrogate’s access by disabling the Connection at any time.”; to register a third-party organization, “An appointed official with the authority to legally bind that organization must register in I&A”.
6. 42 CFR. §455.410, Enrollment and screening of providers (eCFR; Title 42 up to date as of October 22, 2026; Medicaid, part 455, subpart E). Checked October 25, 2026.
   Show the passageHide the passage

   “The State Medicaid agency must require all enrolled providers to be screened under to this subpart.”; “The State Medicaid agency may rely on the results of the provider screening performed by any of the following:” “Medicare contractors.”.
7. 42 CFR. §438.214, Provider selection (eCFR; Title 42 up to date as of October 22, 2026; Medicaid managed care, paragraph (b)). “Each State must establish a uniform credentialing and recredentialing policy”; “Each MCO, PIHP, and PAHP must follow a documented process for credentialing and recredentialing of network providers.”. Checked October 25, 2026.
8. DataSpring, powered by CAQH. Resources: Provider Data and Credentialing and Directory Management questions (the company’s frequently asked questions). Checked October 25, 2026.
   Show the passageHide the passage

   “The CAQH Provider Data Portal is an automated platform where physicians, dentists and other healthcare practitioners enter, update and verify professional and practice information and securely share it with the organizations that they authorize.”; “The Provider Data Portal allows you to store all your professional information including documents such as your license, training certificates, liability insurance and more.”; “No, participation in the CAQH Provider Data Portal is voluntary. However, more than 1,000 health plans and other healthcare organizations have requested that their network providers use the Provider Data Portal for credentialing.”; “No, health care providers may use the Provider Data Portal to enter, maintain and share their professional and practice information free of charge.”; the steps to start: “Complete your profile and upload your documents.” “Attest that all information is truthful and complete.” “Authorize plans or other organizations to access your profile.”; providers “are still required to attest to their data profiles every 120 days (every 180 days for IL providers) to comply with credentialing requirements. If providers do not attest within the required timeframe, their CAQH Provider Data Portal status will be changed to Expired.”.
9. Centers for Medicare & Medicaid Services. Medicare Enrollment Application: Physicians and Non-Physician Practitioners, CMS-855I (the paper application, version 05/23). Checked October 25, 2026.
   Show the passageHide the passage

   Section 2A: “The provider’s Name, Date of Birth, and Social Security Number must match his/her social security record.”; Section 8: “A billing agency/agent is a company or individual that you contract with to prepare and submit your claims.” and “If you use a billing agency/agent you must complete this section.” “Even if you use a billing agency/agent, you remain responsible for the accuracy of the claims submitted on your behalf.”; Section 13, Contact Person Information (Optional): “If questions arise during the processing of this application, your designated MAC will contact the individual reported below.”; Section 15: “As an individual practitioner, you are the only person who can sign this application. The authority to sign the application on your behalf may not be delegated to any other person.”; “Under the penalty of perjury, I, the undersigned, certify to the following:” “I have read the contents of this application, and the information contained herein is true, correct, and complete.”.
10. Centers for Medicare & Medicaid Services, Medicare Learning Network. Medicare Provider Enrollment (MLN9658742, December 2025). Checked October 25, 2026.
    Show the passageHide the passage

    “We’ve merged the CMS-855R into the CMS-855I paper enrollment application.”; the CMS-855B: “Group practices and other organizational suppliers, except DMEPOS suppliers, use this form to start the Medicare enrollment or revalidation process, or to change enrollment information.”; “AOs or Access Managers may invite a Staff End User (SEU) or Surrogate to access PECOS for their organization. Once registered, an SEU or Surrogate may log in to access, view, and modify CMS system information, but they can’t represent the practice, manage staff, sign enrollment applications, or initiate or accept connections.”; “Individual providers and suppliers don’t require an AO but can authorize Surrogates and SEUs to work in PECOS.”; “Respond to MAC information requests within 30 days. If you don’t, the MAC may reject your application.”; “Your MAC won’t fully process your PECOS enrollment application without your electronic or uploaded signature, application fee (if applicable), and necessary supporting documentation. The enrollment application filing date is when the MAC gets your enrollment application.”; “You can check your PECOS enrollment application status 2 ways:” “Log in to PECOS and select the View Enrollments link.”; “PECOS emails the web tracking ID for the submitted application to each address in the Contact Person section of the application.”; for electronic funds transfer, “Include a copy of a voided check or bank letter that has your individual or business legal name and applicable account and routing numbers”; “Review your Medicare enrollment information several times a year to make sure no one changed information without your knowledge. Immediately report changes you didn’t submit.”.
11. 42 CFR. §424.521, Request for payment by certain provider and supplier types (eCFR; Title 42 up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    The listed types, which include physical therapists, occupational therapists and speech language pathologists, “may retrospectively bill for services when the provider or supplier has met all program requirements (including State licensure requirements), and services were provided at the enrolled practice location for up to” “Thirty days prior to their effective date if circumstances precluded enrollment in advance of providing services to Medicare beneficiaries”, or “Ninety days prior to their effective date if a Presidentially-declared disaster”.
12. Centers for Medicare & Medicaid Services. Protect Your PECOS Application (PECOS Inactivity Deletion Policy, linked from CMS’s PECOS page). Checked October 25, 2026.
    Show the passageHide the passage

    “Enrollment applications started in the Provider Enrollment, Chain, and Ownership System (PECOS) but left unsubmitted will be automatically deleted after a certain period of inactivity determined by the application’s status.” Its table: “NEW or EDIT Automatically deleted after 120 days of inactivity”; “RETURNED FOR CORRECTIONS Rejected if corrections are not received within 30 days of being returned”; “REJECTED Automatically deleted if not re-opened within 60 days of rejection”.
13. 42 CFR. §438.602, State responsibilities (eCFR; Title 42 up to date as of October 22, 2026; Medicaid managed care, paragraph (b)). Checked October 25, 2026.
    Show the passageHide the passage

    “The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs”; “MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees.”.
14. Centers for Medicare & Medicaid Services. Become a Medicare Provider or Supplier (page last modified June 2, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “Your Medicare Administrative Contractor (MAC) is specific to the region where you practice and may have additional requests for information while they process your application.”; “To avoid having your Medicare billing privileges revoked, be sure to report the following changes within 30 days:” “a change in ownership”, “an adverse legal action”, “a change in practice location”; “You must report all other changes within 90 days.”.
15. Humana Military, TRICARE East Region contractor. Become a TRICARE-certified provider (provider page). “Providers must be TRICARE-certified in order to file claims and receive payment for TRICARE services.”; under Looking to join the TRICARE East network: “Humana Military is not currently accepting requests to join the medical, surgical or ancillary networks.”. Checked October 25, 2026.
16. DataSpring, powered by CAQH. DataSpring Clinician Q&A (June 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “CAQH has rebranded as DataSpring, powered by CAQH.”; “Your provider profile is yours.”; “You control the information in your provider profile and provide the permissions that allow DataSpring to make it available to authorized parties for approved workflows, such as credentialing, directory management, and related administrative processes.”; “Health plans do not own or control clinician or provider profiles.”.
17. UnitedHealthcare. Join our network (UnitedHealthcare provider resource library). Checked October 25, 2026.
    Show the passageHide the passage

    What you need to get started includes “DataSpring, powered by CAQH registration (only required for some states and specialties)”; “If DataSpring is required, make sure attestations and documentation are current”; of its Onboard Pro tool: “Your personal dashboard will show the real-time status of every enrollment request you’ve submitted”.
18. 42 CFR. §424.502, Definitions (eCFR; Title 42 up to date as of October 22, 2026; Medicare enrollment). Checked October 25, 2026.
    Show the passageHide the passage

    An authorized official is “an appointed official (for example, chief executive officer, chief financial officer, general partner, chairman of the board, or direct owner) to whom the organization has granted the legal authority to enroll it in the Medicare program”; of the delegated official: “The delegated official must be an individual with ownership or control interest in, or be a W-2 managing employee of the provider or supplier.”.
19. Centers for Medicare & Medicaid Services. Electronic Signature How To Guide (PECOS, linked from CMS’s Become a Medicare Provider or Supplier page). “This feature does not change who is required to sign the application. In PECOS, all individual practitioners are required to e-sign the Certification and Authorization Statements as part of the submission process.”. Checked October 25, 2026.
20. 42 CFR. §424.535, Revocation of enrollment in the Medicare program (eCFR; Title 42 up to date as of October 22, 2026; paragraph (a)(4), False or misleading information). “The provider or supplier certified as ‘true’ misleading or false information on the enrollment application to be enrolled or maintain enrollment in the Medicare program.”. Checked October 25, 2026.
21. 42 CFR. §424.525, Rejection of a provider’s or supplier’s application for Medicare enrollment (eCFR; Title 42 up to date as of October 22, 2026; paragraph (a)). Checked October 25, 2026.
    Show the passageHide the passage

    CMS may reject an application when “The provider or supplier fails to furnish complete information on the provider/supplier enrollment application within 30 calendar days from the date of the Medicare contractor’s request for the missing information.” That includes “The application contains a copied or stamped signature.”; “The application is signed more than 120 days prior to the date on which the Medicare contractor received the application.”; and “The application is signed by a person unauthorized to do so under this subpart.”.
22. DataSpring, powered by CAQH. DataSpring Provider Data Portal (fact sheet, May 2026). “Authorize health plans to access your information for credentialing, directories, and more.”; “Delegate staff to manage non-sensitive information on your behalf”; “Access the DataSpring Provider Data Portal at no charge to providers or office staff.”. Checked October 25, 2026.
23. 42 CFR. §424.515, Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information (eCFR; Title 42 up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “To maintain Medicare billing privileges, a provider or supplier (other than a DMEPOS supplier) must resubmit and recertify the accuracy of its enrollment information every 5 years.”; “CMS contacts each provider or supplier directly when it is time to revalidate their enrollment information.”; the application is due “within 60 calendar days of our notification to resubmit and certify to the accuracy of its enrollment information.”.
24. 42 CFR. §455.414, Revalidation of enrollment (eCFR; Title 42 up to date as of October 22, 2026; Medicaid, part 455, subpart E). “The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years.”. Checked October 25, 2026.
25. 42 CFR. §424.518, Screening levels for Medicare providers and suppliers (eCFR; Title 42 up to date as of October 22, 2026; paragraphs (a) and (b)). Checked October 25, 2026.
    Show the passageHide the passage

    Limited categorical risk: “Physician or nonphysician practitioners (including nurse practitioners, CRNAs, occupational therapists, speech/language pathologists, and audiologists) and medical groups or clinics.”; moderate categorical risk: “Physical therapists enrolling as individuals or as group practices.”; at the moderate level the contractor also “Conducts an on-site visit.”.
26. Centers for Medicare & Medicaid Services. Manage Your Enrollment (page last modified March 4, 2026). Under “Providers NOT Eligible to Opt Out”: “Occupational therapists”, “Physical therapists” and “Qualified speech language pathologists”; “If you don’t see Medicare patients, you don’t have to enroll in or opt-out of Medicare.”. Checked October 25, 2026.
27. Centers for Medicare & Medicaid Services, Medicare Learning Network. Enrollment: Multi-Factor Authentication for I&A System, webcast transcript (July 30, 2019, listed among the downloads on CMS’s Become a Medicare Provider or Supplier page). Checked October 25, 2026.
    Show the passageHide the passage

    Asked “What happens if you are a company that completes applications on behalf of field clinicians?”, a CMS speaker answered that “you should have your own account” and “We definitely do not encourage sharing of accounts.” Later: “the idea is that it’s supposed to be one account per one person and you’re not supposed to be able to access other people’s accounts using their private login information.”.
28. Centers for Medicare & Medicaid Services. PECOS Frequently Asked Questions (the help page of the Medicare enrollment system). “If you belong to an employer organization who works on behalf of a provider organization, your access to the provider’s Medicare information may have been removed even if you initially created the enrollment record.”. Checked October 25, 2026.
29. 45 CFR. §160.103, Definitions (eCFR; Title 45 up to date as of October 22, 2026; Business associate). Checked October 25, 2026.
    Show the passageHide the passage

    A business associate is a person who, “On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration”, or who “Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity” where the service “involves the disclosure of protected health information”.
30. U.S. Department of Health and Human Services, Office for Civil Rights. Business Associates (HIPAA for Professionals, content last reviewed October 21, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “Generally, business associates are persons, other than a workforce member of a covered entity, that are engaged by a covered entity to carry out certain health care activities and functions or to provide certain services that involve the use or disclosure of PHI.”; “The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement”; “Some examples of activities performed on behalf of a covered entity by a business associate include claims processing or administration, data analysis, billing, and practice management.”.
31. DrSensory. DrSensory for therapists (the For Therapists hub). Checked October 25, 2026.
    Show the passageHide the passage

    “DrSensory is a directory families use free to find occupational therapy, physical therapy and speech therapy clinics”; “across all 50 states and Washington, DC”; “Every clinic keeps a basic listing at no cost.”; “The directory lists clinics rather than individual therapists, so one listing covers a whole practice at one address.”; “Claiming is free and has three steps: find your listing, confirm your email with a six-digit code, choose a password.”; “There is no contract, and nothing is charged while you claim.”.
32. DrSensory. Therapy Clinic Directory Pricing (the pricing page and its frequently asked questions). Checked October 25, 2026.
    Show the passageHide the passage

    “$29.99 a month or $349.99 a year for your first location, and $9.99 a month or $99.99 a year for each additional location”; “A description in your own words”; “We do not verify clinical quality”; “A listing means a practice appears in the directory. It is not a recommendation”.
33. DrSensory. How to claim and optimize your DrSensory profile (For Therapists guide). Checked October 25, 2026.
    Show the passageHide the passage

    “The languages you speak and the insurance you take appear in a paid profile’s Clinic details box once you fill them in”; “How families pay: the insurance you take, Medicaid, or self-pay. The Clinic details box shows the boxes you tick; the description is where you name the plans.”.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice, not legal, compliance, billing or financial advice. Contract and privacy questions belong with a lawyer, and its figures are hypothetical, not DrSensory data or any vendor’s prices.